Cryptographic attack highlights the importance of bug-free software

Feb 29, 2012

A padlocked icon in a web-browser or a URL starting with https provides communication security over the Internet. The icon or URL indicates OpenSSL, a cryptography toolkit implementing the SSL protocol, or a similar system is being used. New research by a collaborative team has developed an attack that can circumvent the security OpenSSL should provide. The attack worked on a very specific version of the OpenSSL software, 0.9.8g, and only when a specific set of options were used.

Dr Dan Page, Senior Lecturer in Computer Science in the Department of Computer Science at the University of Bristol, and one of the collaborative team, will present a paper at the RSA conference in San Francisco today [Wednesday 29 February] about the EPSRC-funded research.

The attack worked by targeting a bug in the software. Carefully constructed messages were sent to the web-server, each of which triggered the bug and allowed part of a to be recovered. Using enough messages, the entire key could be recovered.

Dr Dan Page said: "Our work suggests an underlying problem. With software and hardware playing increasingly significant roles in our day-to-day life, how much can and should we trust them to be correct?

"The answer, in part at least, is a stronger emphasis on and investment in formal verification and correctness of . Our research highlights the important role this topic will play for of the future."

SSL is designed to provide two guarantees. Firstly, that a web-server accessed is the one expected, and, secondly, that subsequent communication between the user and the web-server cannot be read by anyone else.

Both guarantees are important for e-commerce websites that need to manage such as in a secure, dependable way. However, both depend on the web-server keeping various cryptographic keys secret.

OpenSSL is embedded in many platforms, particularly those based on the . Some operating system vendors have started to release advisories that prompt the upgrade of older versions of OpenSSL. This acts to limit any implications of an attack.

Explore further: Researchers jailbreak iOS 7.1.2

More information: 'Practical realisation and elimination of an ECC-related software bug attack?', B B Brumle, Aalto University, Finland; M Barbosa, Universidade do Minho, Portugal; D Page, University of Bristol, and F Vercauteren, Katholieke Universiteit Leuven, Belgium, Cryptology ePrint archive: report 2011/633.

Related Stories

How to Protect Your Web Server from Attacks

Oct 11, 2007

The National Institute of Standards and Technology has released a new publication that provides detailed tips on how to make web servers more resistant to potential attacks. Called “Guidelines on Securing Public Web Servers,” ...

Patch for flaw in key Internet protocol

Jan 15, 2010

(PhysOrg.com) -- A flaw was found in November in a key Internet protocol that encrypts most sensitive online transactions and communications, including credit card and banking transactions. A patch has now ...

Software Helps Developers Get Started with PIV Cards

Jul 10, 2008

The National Institute of Standards and Technology has developed two demonstration software packages that show how Personal Identity Verification (PIV) cards can be used with Windows and Linux systems to perform ...

Automated analysis of security-sensitive protocols

Oct 25, 2005

The sheer number and variety of security protocols for Internet applications under development makes it difficult to be sure that any one protocol is 100 per cent secure from attack. Now an automated tool can systematically ...

Recommended for you

Researchers jailbreak iOS 7.1.2

12 minutes ago

Security researchers at the Georgia Tech Information Security Center (GTISC) have discovered a way to jailbreak current generation Apple iOS devices (e.g., iPhones and iPads) running the latest iOS software.

Smartphones as a health tool for older adults

46 minutes ago

A team of researchers from the Universitat Politècnica de Catalunya · BarcelonaTech (UPC) and the Universitat Autònoma de Barcelona (UAB) is creating a smartphone app that will help older adults to understand ...

Can you trust that app?

56 minutes ago

You're on your smartphone, browsing through Facebook. In a fit of productivity, you search for, say, a project management app to help you use your non-Instagram and cat video time more effectively. You download ...

Facebook's Internet.org expands in Zambia

Jul 31, 2014

(AP)—Facebook's Internet.org project is taking another step toward its goal of bringing the Internet to people who are not yet online with an app launching Thursday in Zambia.

Body by smartphone

Jul 30, 2014

We love our smartphones. Since they marched out of the corporate world and into the hands of consumers about 10 years ago, we've relied more and more on our iPhone and Android devices to organize our schedules, ...

User comments : 1

Adjust slider to filter visible comments by rank

Display comments: newest first

roboferret
not rated yet Feb 29, 2012
The title is misleading; truly bug-free software is not possible because exhaustive testing is impossible in non-trivial programs.
http://en.wikiped...theorems