Key Reuse opens to attacks on IPsec IKE, Cisco, Huawei, ZyXEL products are affected
14.8.18 securityaffairs Hacking

Security expert demonstrated that reusing a key pair across different versions and modes of IPsec IKE open the doors to attacks. Many vendors are affected
Security researchers from the University of Opole in Poland and the Ruhr-University Bochum in Germany have devised a new attack technique that allows cracking encrypted communications.

The products of several vendors, including Cisco, Huawei, ZyXEL, and Clavister, are vulnerable to the attack.

The experts will present their findings this week at the 27th USENIX Security Symposium, meantime they have released a research paper.

“In this paper, we show that reusing a key pair across different versions and modes of IKE can lead to cross-protocol authentication bypasses, enabling the impersonation of a victim host or network by attackers. We exploit a Bleichenbacher oracle in an IKEv1 mode, where RSA encrypted nonces are used for authentication.” reads the paper.

“Using this exploit, we break these RSA encryption based modes, and in addition break RSA signature-based authentication in both IKEv1 and IKEv2.”

The experts focused their analysis on the impact of key reuse on Internet Protocol Security (IPsec). IPsec is used for virtual private networks (VPNs). The cryptographic key for IPsec leverages the Internet Key Exchange (IKE) protocol, which has two versions, IKEv1 and IKEv2.

The experts have also described an offline dictionary attack against the PSK (Pre-Shared Key) based IKE modes, thus covering all available authentication mechanisms of IKE.

The researchers found Bleichenbacher oracles in the IKEv1 implementations of Cisco (CVE-18-0131), Huawei (CVE2017-17305), Clavister (CVE-18-8753), and ZyXEL (CVE-18-9129).

Major vendors, including Cisco, Huawei and ZyXEL have published security advisories for this vulnerability.

The Cisco’s advisory describes the issue as an issue in the implementation of RSA-encrypted nonces in the IOS and IOS XE software. A remote unauthenticated attacker can obtain the encrypted nonces of an IKEv1 session by sending specially crafted ciphertexts to the targeted system.

“A vulnerability in the implementation of RSA-encrypted nonces in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to obtain the encrypted nonces of an Internet Key Exchange Version 1 (IKEv1) session.” reads the advisory published by Cisco.

“The vulnerability exists because the affected software responds incorrectly to decryption failures. An attacker could exploit this vulnerability sending crafted ciphertexts to a device configured with IKEv1 that uses RSA-encrypted nonces. A successful exploit could allow the attacker to obtain the encrypted nonces.”

According to ZyXEL, the Bleichenbacher attack works against the ZyWALL and USG series network security appliances, the vendor already released firmware updates that address the vulnerability.

According to the Huawei’s advisory, its firewall products are affected by the flaw.