SAE side-channel attacks
Published: April 10, 2019
Identifiers:
- VU#871675
- CVE-2019-9494 (cache attack against SAE)
Latest version available from: https://w1.fi/security/2019-1/
Vulnerability
Number of potential side channel attacks were discovered in the SAE
implementations used by both hostapd (AP) and wpa_supplicant
(infrastructure BSS station/mesh station). SAE (Simultaneous
Authentication of Equals) is also known as WPA3-Personal. The discovered
side channel attacks may be able to leak information about the used
password based on observable timing differences and cache access
patterns. This might result in full password recovery when combined with
an offline dictionary attack and if the password is not strong enough to
protect against dictionary attacks.
Cache attack
A novel cache-based attack against SAE handshake was discovered. This
attack targets SAE with ECC groups. ECC group 19 being the mandatory
group to support and the most likely used group for SAE today, so this
attack applies to the most common SAE use case. Even though the PWE
derivation iteration in SAE has protections against timing attacks, this
new cache-based attack enables an attacker to determine which code
branch is taken in the iteration if the attacker is able to run
unprivileged code on the victim machine (e.g., an app installed on a
smart phone or potentially a JavaScript code on a web site loaded by a
web browser). This depends on the used CPU not providing sufficient
protection to prevent unprivileged applications from observing memory
access patterns through the shared cache (which is the most likely case
with today's designs).
The attacker can use information about the selected branch to learn
information about the password and combine this information from number
of handshake instances with an offline dictionary attack. With
sufficient number of handshakes and sufficiently weak password, this
might result in full discovery of the used password.
This attack requires the attacker to be able to run a program on the
target device. This is not commonly the case on access points, so the
most likely target for this would be a client device using SAE in an
infrastructure BSS or mesh BSS.
The commits listed in the end of this advisory change the SAE
implementation shared by hostapd and wpa_supplicant to perform the PWE
derivation loop using operations that use constant time and memory
access pattern to minimize the externally observable differences from
operations that depend on the password even for the case where the
attacker might be able to run unprivileged code on the same device.
Timing attack
The timing attack applies to the MODP groups 22, 23, and 24 where the
PWE generation algorithm defined for SAE can have sufficient timing
differences for an attacker to be able to determine how many rounds were
needed to find the PWE based on the used password and MAC
addresses. When the attack is repeated with multiple times, the attacker
may be able to gather enough information about the password to be able
to recover it fully using an offline dictionary attack if the password
is not strong enough to protect against dictionary attacks. This attack
could be performed by an attacker in radio range of an access point or a
station enabling the specific MODP groups.
This timing attack requires the applicable MODP groups to be enabled
explicitly in hostapd/wpa_supplicant configuration (sae_groups
parameter). All versions of hostapd/wpa_supplicant have disabled these
groups by default.
While this security advisory lists couple of commits introducing
additional protection for MODP groups in SAE, it should be noted that
the groups 22, 23, and 24 are not considered strong enough to meet the
current expectation for a secure system. As such, their use is
discouraged even if the additional protection mechanisms in the
implementation are included.
Vulnerable versions/configurations
All wpa_supplicant and hostapd versions with SAE support (CONFIG_SAE=y
in the build configuration and SAE being enabled in the runtime
configuration).
Acknowledgments
Thanks to Mathy Vanhoef (New York University Abu Dhabi) and Eyal Ronen
(Tel Aviv University) for discovering the issues and for discussions on
how to address them.
Possible mitigation steps
- Merge the following commits to wpa_supplicant/hostapd and rebuild:
OpenSSL: Use constant time operations for private bignums
Add helper functions for constant time operations
OpenSSL: Use constant time selection for crypto_bignum_legendre()
SAE: Minimize timing differences in PWE derivation
SAE: Avoid branches in is_quadratic_residue_blind()
SAE: Mask timing of MODP groups 22, 23, 24
SAE: Use const_time selection for PWE in FFC
SAE: Use constant time operations in sae_test_pwd_seed_ffc()
These patches are available from https://w1.fi/security/2019-1/
- Update to wpa_supplicant/hostapd v2.8 or newer, once available
- In addition to either of the above alternatives, disable MODP groups
1, 2, 5, 22, 23, and 24 by removing them from hostapd/wpa_supplicant
sae_groups runtime configuration parameter, if they were explicitly
enabled since those groups are not considered strong enough to meet
current security expectations. The groups 22, 23, and 24 are related
to the discovered side channel (timing) attack. The other groups in
the list are consider too weak to provide sufficient security. Note
that all these groups have been disabled by default in all
hostapd/wpa_supplicant versions and these would be used only if
explicitly enabled in the configuration.
- Use strong passwords to prevent dictionary attacks
Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
[bump PKG_RELEASE]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
With this change, the file is reduced from 5186 bytes to 4649 bytes that
its approximately 10.5 percent less memory consumption. For small
devices, sometimes every byte counts.
Also, all other protocol handler use tabs instead of spaces.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
This is sold as a dual-band 802.11ac range extender. It has a sliding
switch for Extender mode or Access Point mode, a WPS button, a recessed
Reset button, a hard-power button, and a multitude of LED's, some
multiplexed via an NXP 74AHC164D chip. The internal serial header pinout is
Vcc, Tx, Rx, GND, with GND closest to the corner of the board. You may
connect at 115200 bps, 8 data bits, no parity, 1 stop bit.
Specification:
- System-On-Chip: QCA9558
- CPU/Speed: 720 MHz
- Flash-Chip: Winbond 25Q128FVSG
- Flash size: 16 MiB
- RAM: 128 MiB
- Wireless No1: QCA9558 on-chip 2.4GHz 802.11bgn, 3x3
- Wireless No2: QCA99x0 chip 5GHz 802.11an+ac, 4x4
- PHY: Atheros AR8035-A
Installation:
If you can get to the stock firmware's firmware upgrade option, just feed
it the factory.img and boot as usual. As an alternative, TFTP the
factory.img to the bootloader.
Signed-off-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us>
[whitespace fix in DTS and reorder of make variables]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Remove Netgear-specific image build variables which are set to the same
value.
Signed-off-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us>
[reordering of variables, removed stray newline]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Currently it's not possible to test boot squashfs root images, so this
patch now allows this use case as well.
Cc: Yousong Zhou <yszhou4tech@gmail.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Currently it's not possible to test boot squashfs root images, so this
patch now allows this use case as well.
Cc: Yousong Zhou <yszhou4tech@gmail.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
For basic tests it's not necessary to have the networking setup and this
allows testing as a normal user as well, without root privileges.
So this patch adds `--no-network` long option or `-n` short option,
which allows starting QEMU without network.
Cc: Yousong Zhou <yszhou4tech@gmail.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
This device shares the network config with v4, thus the WAN MAC
also needs to be fixed the same way. However, the partition
where the MAC address resides has been changed.
Based on: https://github.com/openwrt/openwrt/pull/1726
Tested-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
These devices share the network config with C7v4, thus the WAN MAC
also needs to be fixed the same way. However, the partition
where the MAC address resides has been changed.
Based on: https://github.com/openwrt/openwrt/pull/1726
Tested-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The GPIO for the reset button for the Archer C7v5 changed from
ar71xx to ath79. An investigation based on tests revealed
that the A7v5 responds on "11", while the C7v5 responds on
"5" as set for ar71xx.
Thus, we just define this in the DTS files instead of in the
common DTSI.
Tested-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Definition is split here without obvious reason. Just merge it
(and align order to that from C7 v4).
Tested-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The Ubiquiti Network airCube ISP is a cube shaped 2.4 GHz with internal
2x2 MIMO antennas. It can be supplied via a USB connector or via PoE.
There are for 10/100 Mbps ports (1 * WAN + 3 * LAN). There is an
optional PoE passthrough from the first LAN port to the WAN port.
SoC: Qualcomm / Atheros QCA9533-BL3A
RAM: 64 MB DDR2
Flash: 16 MB SPI NOR
Ethernet: 4x 10/100 Mbps (1 WAN + 3 LAN)
LEDS: 1x via a SPI controller (not yet supported)
Buttons: 1x Reset
Serial: 1x (only RX and TX); 115200 baud, 8N1
Missing points:
- LED not yet supported
- Factory upgrade via web IF or TFTP recovery not yet supported
(Needs RSA signed images, for details see PR#1958)
The serial port is on a four pin connextor labeled J1 and located
between Ethernet and USB connector. The pinout is:
1. 3V3 (out)
2. Rx (in)
3. Tx (out)
4. GND
Upgrading via serial port / U-Boot:
- Connect the serial port via a level converter
- Power the system and stop U-Boot with pressing any key when `Hit any
key to stop autoboot` is displayed. Note: Pressing space multiple
times untill U-Boot reaches that location works well.
- Connect a PC with the IP 192.168.1.100 (or some other in that net)
running a TFTP-Server to one of the LAN ports. Copy the sysupgrade
image to the server.
- Set the U-Boot server IP with
setenv serverip 192.168.1.100
- Load the flash image to RAM with
tftpboot 0x81000000 sysupgrade.bin
- Erase the flash with
erase 0x9f050000 0x9ffaffff
- Write the new flash content with
cp 0x81000000 0x9f050000 ${filesize}
- Reset the device with
reset
Signed-off-by: Christian Mauderer <oss@c-mauderer.de>
[removed full stop in subject and added lockdown note to commit message]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
SOC: Qualcomm Atheros QCA9558
RAM: 128MB
FLASH: 16MB (Macronix MX25L12845EMI-10G)
WLAN1: QCA9558 2.4GHz 802.11bgn 3SS
WLAN2: QCA9880 5GHz 802.11ac 3SS
LED: Power, LAN1, LAN2, 2.4GHz, 5GHz
Serial:Next to SPI Flash,
Pinout is 3V3 - GND - TX - RX (Square Pin is 3V3)
The Serial setting is 115200-8-N-1
INSTALLATION:
1. Serve an OpenWrt ramdisk image named "ursus.bin".
Set your IP-address to 192.168.100.8/24.
2. Connect to the serial. Power up the device and interrupt
the boot process.
3. Set the correct bootcmd with
> setenv bootcmd run bootcmd_1
> saveenv
4. Run
> tftpboot 0x81000000 ursus.bin
> bootm 0x81000000
5. Wait for OpenWrt to boot up.
6. Transfer OpenWrt sysupdate image and flash via sysupgrade.
Signed-off-by: Markus Scheck <markus.scheck1@gmail.com>
Tested-by: David Bauer <mail@david-bauer.net>
[whitespace fix, renamed LED labels and SoC type fix]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
In ar71xx we check for stuck DMA on devices which fall in the is_ar724x
SoC group (ar724x, ar933x, ar934x, qca9533, tp9343, qca955x, qca956x).
In ath79 we're currently performing this check only for devices with
ar7240 SoC, so this patch tries to sync the dma stuck checking behavior
with what is being done in ar71xx.
Signed-off-by: Petr Štetiar <ynezz@true.cz>
It was reported, that latest ar71xx builds have broken networking on
TP-Link TL-WPA8630 and Nanostation M5 XW devices and that by reverting
the offending commit, everything is back to normal.
Fixes: d3506d1 ("ar71xx: ag71xx: fix compile error when enabling debug")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
CPU: AR9342 SoC
RAM: 64 MB DDR2
Flash: 8 MB NOR SPI
Ports: 100 MBit (24V PoE in)
WLAN: 2.4/5 GHz
UART: 1 UART on PCB marked as J1 with 115200 8N1 config
LEDs: Power, Ethernet, 4x RSSI LEDs (orange, red, 2x green)
Buttons: Reset
UART connection details
.---------------------------------.
| |
[ETH] J1 [ANT]
| o VCC o RX o TX o GND |
`---------------------------------'
Flashing instructions using recovery method over TFTP
1. Unplug the ethernet cable from the router.
2. Using paper clip press and hold the router's reset button. Make sure
you can feel it depressed by the paper clip. Do not release the button
until step 4.
3. While keeping the reset button pressed in, plug the ethernet cable
back into the AP. Keep the reset button depressed until you see the
device's LEDs flashing in upgrade mode (alternating LED1/LED3 and
LED2/LED4), this may take up to 25 seconds.
4. You may release the reset button, now the device should be in TFTP
transfer mode.
5. Set a static IP on your Computer's NIC. A static IP of 192.168.1.25/24
should work.
6. Plug the PoE injector's LAN cable directly to your computer.
7. Start tftp client and issue following commands:
tftp> binary
tftp> connect 192.168.1.20
tftp> put openwrt-ar71xx-generic-ubnt-bullet-m-xw-squashfs-factory.bin
Tested only on Bullet M2HP.
Signed-off-by: Petr Štetiar <ynezz@true.cz>
This is backport of the same functionality in ath79, from commit
d42a7c469 ("ath79: ubnt-m-xw: Fix factory image flashing using TFTP
recovery method")
Ubiquity allows flashing of unsigned factory images via TFTP recovery
method[1]. They claim in airOS v6.0.7 release changelog[2] following:
All future airOS versions will be signed in this way and not allow
unsigned firmware to be loaded except via TFTP.
U-boot bootloader on M-XW devices expects factory image revision
version in specific format. On airOS v6.1.7 with `U-Boot 1.1.4-s1039
(May 24 2017 - 15:58:18)` bootloader checks if the revision major(?)
number is actually a number, but in currently generated images there's
OpenWrt text and so the check fails:
Hit any key to stop autoboot: 0
Setting default IP 192.168.1.20
Starting TFTP server...
Receiving file from 192.168.1.25:38438
Received 4981148 bytes
Firmware check failed! (1)
By placing arbitrary correct number first in major version, we make the
bootloader happy and we can flash factory images over TFTP again:
Received 3801500 bytes
Firmware Version: XW.ar934x.v6.0.4-42.OpenWrt-r9766+2-be42e44
Setting U-Boot environment variables
Un-Protected 1 sectors
Erasing Flash.... done
Patch provided by AREDN[3] project, tested on Bullet M2 XW.
1. https://help.ubnt.com/hc/en-us/articles/204910124-UniFi-TFTP-Recovery-for-Bricked-Access-Points
2. https://dl.ubnt.com/firmwares/XW-fw/v6.0.7/changelog.txt
3. https://github.com/aredn
Signed-off-by: Petr Štetiar <ynezz@true.cz>
This patch adds support for the following computer on modules (CoM) from
Toradex[A]:
Apalis iMX6 Quad 2GB IT - i.MX 6Quad 800MHz, 2GB DDR3, 4GB eMMC
-40° to +85° C Temp
Apalis iMX6 Quad 1GB - i.MX 6Quad 1GHz, 1GB DDR3, 4GB eMMC
0° to +70° C Temp
Apalis iMX6 Dual 1GB IT - i.MX 6Dual 800MHz, 1GB DDR3, 4GB eMMC
-40° to +85° C Temp
Apalis iMX6 Dual 512MB - i.MX 6Dual 1GHz, 512MB DDR3, 4GB eMMC
0° to +70° C Temp
I've developed and tested it on Quad 2GB IT v1.1A and Dual 512MB v1.1A
CoMs, using Ixora[B] carrier board v1.0A, but it should hopefuly work on
Eval[C] board as well.
A. https://www.toradex.com/computer-on-modules/apalis-arm-family/nxp-freescale-imx-6
B. https://www.toradex.com/products/carrier-board/ixora-carrier-board
C. https://www.toradex.com/products/carrier-board/apalis-evaluation-board
Flashing/recovery instructions:
1. Download and compile imx_loader for OpenWrt from
https://github.com/ynezz/imx_loader
2. Enter recovery mode as desribed in
https://developer.toradex.com/knowledge-base/imx-recovery-mode
3. Connect board via USB to the host computer, check that it's connected
by lsusb:
15a2:0054 Freescale Semiconductor, Inc. i.MX 6Dual/6Quad SystemOnChip
in RecoveryMode
4. Copy following OpenWrt images to imx_loader directory:
SPL
u-boot.img
u-boot-with-spl.imx
openwrt-imx6-apalis-recovery.scr
openwrt-imx6-apalis-squashfs.combined.bin
5. Run imx_usb in imx_loader directory
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Fix dbclient regression in 2019.77. After exiting the terminal would be left
in a bad state. Reported by Ryan Woodsmall
drop patch applied upstream:
010-tty-modes-werent-reset-for-client.patch
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
This patch enable gnu99 mode for the nec-enc utility which
fixes the following build-breaking errors on some older
architectures.
nec-enc.c: In function ‘xor_data’:
nec-enc.c:34:2: error: ‘for’ loop initial declarations are only allowed in C99 or C11 mode
for (int i = 0; i < len; i++) {
^~~
nec-enc.c:34:2: note: use option -std=c99, -std=gnu99, -std=c11 or -std=gnu11 to compile your code
nec-enc.c: In function ‘main’:
nec-enc.c:101:3: error: ‘for’ loop initial declarations are only allowed in C99 or C11 mode
for (int i = 0; i < n; i++) {
^~~
Spotted-By: Buildbot
Fixes: fac27643f0 ("firmware-utils: add nec-enc")
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Add switch definition for the rtl8367b switch to the DTS/DTSi for
the Belkin F9K1109v1 that was mistakenly omitted from the initial
commit.
Fixes: 017ec068e3 (ramips: add support for Belkin F9K1109v1)
Signed-off-by: Kip Porterfield <kip.porterfield@gmail.com>
nec-enc provides firmware encoding/decoding with model specific key
for NEC devices.
known devices:
- Aterm WF1200CR
- Aterm WG1200CR
- Aterm WG2600HS
usage:
nec-enc -i infile -o outfile -k key
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
[checkpatch fixes, marked usage as noreturn, added static function,
moved buf* from stack to the global data segment]
Upstream driver has gone through a series of cleanup and was moved
from drivers/staging into drivers/spi. Backport it to replace our
messy driver.
Tested-by: Jörg Schüler-Maroldt <joerg-linux@arcor.de>
[LinkIt Smart 7688, AcSIP AI7688H Wi-Fi module]
Tested-by: Rosen Penev <rosenp@gmail.com>
Tested-by: Tian Xiao bo <peterwillcn@gmail.com>
[Newifi-D2 MediaTek MT7621 ver:1 eco:3]
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
Otherwise tar will keep the sgid bit when running
from a sgid-set directory, resulting in a different
file being generated.
Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
[reworked commit message, removed DMARC]
We do not need to define an empty Build/Configure since
the default checks for existing ./configure and does nothing
in case nothing is found.
Similar for Build/Compile: we can remove the definition
when we only call the default.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
I made a similar change to this here:
https://github.com/openwrt/packages/pull/8159
However, it turns out this did not fix the problem as the problem has to
do with tools/xz and not the xz package. The error is the same and causes
linking errors as can be seen above.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Currently, tplink-safeloader definition is only used a base for
another common definition.
This patch adjusts tplink-safeloader so it can be actually used
for some targets in generic-tp-link.mk.
This patch is cosmetic except for the order of
"check-size $$$$(IMAGE_SIZE)" and "append-metadata" exchanged
for the tplink_re350k-v1 .
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com> [dealed with
tplink_cpe210-v2 and tplink_cpe210-v3, removed tplink-safeloader-uimage's
extra IMAGE/sysupgrade.bin rule]
After getting rid of cryptsetup's heavy openssl dependency, there is now
the problem of missing RIPEMD160 support. RIPEMD160 is used for True/Vera
crypt volumes as well as old LUKS1 ones.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Enable the USB power for the Netgear R6120. Otherwise, no power is
supplied to an attached USB device.
Signed-off-by: David Bauer <mail@david-bauer.net>
