Conference proceeding
Morpheus: Bringing The (PKCS) One To Meet the Oracle
CCS '21: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp.2474-2496
CCS '21: 2021 ACM SIGSAC Conference on Computer and Communications Security (Virtual Event, Republic of Korea, 11/15/2021 - 11/19/2021)
11/13/2021
DOI: 10.1145/3460120.3485382
Appears in UI Libraries Support Open Access
Abstract
This paper focuses on developing an automatic, black-box testing approach called MORPHEUS to check the non-compliance of libraries implementing PKCS#1-v1.5 signature verification with the PKCS#1-v1.5 standard. Non-compliance can not only make implementations vulnerable to Bleichenbacher-style RSA signature forgery attacks but also can induce interoperability issues. For checking non-compliance, MORPHEUS adaptively generates interesting test cases and then takes advantage of an oracle, a formally proven correct implementation of PKCS#1-v1.5 signature standard, to detect non-compliance in an implementation under test. We have used MORPHEUS to test 45 implementations of PKCS#1-v1.5 signature verification and discovered that 6 of them are susceptible to variants of the Bleichenbacher-style low public exponent RSA signature forgery attack, 1 implementation has a buffer overflow, 33 implementations have incompatibility issues, and 8 implementations have minor leniencies. Our findings have been responsibly disclosed and positively acknowledged by the developers.
Details
- Title: Subtitle
- Morpheus: Bringing The (PKCS) One To Meet the Oracle
- Creators
- Moosa Yahyazadeh - University of IowaSze Yiu Chau - Chinese University of Hong KongLi Li - Syracuse UniversityMan Hong Hue - Chinese University of Hong KongJoyanta Debnath - University of Iowa, Computer ScienceSheung Chiu Ip - Chinese University of Hong KongChun Ngai Li - Chinese University of Hong KongEndadul Hoque - Syracuse UniversityOmar Chowdhury - University of Iowa, Computer Science
- Resource Type
- Conference proceeding
- Publication Details
- CCS '21: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp.2474-2496
- Conference
- CCS '21: 2021 ACM SIGSAC Conference on Computer and Communications Security (Virtual Event, Republic of Korea, 11/15/2021 - 11/19/2021)
- Publisher
- Association for Computing Machinery (ACM)
- DOI
- 10.1145/3460120.3485382
- ISSN
- 1543-7221
- Number of pages
- 23
- Grant note
- CNS-2007512; CNS-2006556 / US National Science Foundation (NSF); National Science Foundation (NSF) D19AP00039 / US Department of Defense (DARPA) GRF/20/SYC; 3133292C / Chinese University of Hong Kong (CUHK); Chinese University of Hong Kong
- Language
- English
- Date published
- 11/13/2021
- Academic Unit
- Computer Science
- Record Identifier
- 9984473238202771
Metrics
5 Record Views