Visible to the public In Search of CurveSwap: Measuring Elliptic Curve Implementations in the Wild

TitleIn Search of CurveSwap: Measuring Elliptic Curve Implementations in the Wild
Publication TypeConference Paper
Year of Publication2018
AuthorsValenta, L., Sullivan, N., Sanso, A., Heninger, N.
Conference Name2018 IEEE European Symposium on Security and Privacy (EuroS P)
ISBN Number978-1-5386-4228-3
Keywordscryptographic protocols, curve twist attacks, curve validity checks, CurveSwap attack, Elliptic curve cryptography, elliptic curve parameter downgrade attack, Elliptic curves, HTTPS hosts, Internet, internet scanning, internet-wide scans, invalid curve attacks, IPsec, Libraries, Metrics, Protocols, pubcrawl, Resiliency, Scalability, server vulnerability, Servers, SSH hosts, Standards, TLS handshake, transport layer protocol, transport protocols, twist attacks

We survey elliptic curve implementations from several vantage points. We perform internet-wide scans for TLS on a large number of ports, as well as SSH and IPsec to measure elliptic curve support and implementation behaviors, and collect passive measurements of client curve support for TLS. We also perform active measurements to estimate server vulnerability to known attacks against elliptic curve implementations, including support for weak curves, invalid curve attacks, and curve twist attacks. We estimate that 1.53% of HTTPS hosts, 0.04% of SSH hosts, and 4.04% of IKEv2 hosts that support elliptic curves do not perform curve validity checks as specified in elliptic curve standards. We describe how such vulnerabilities could be used to construct an elliptic curve parameter downgrade attack called CurveSwap for TLS, and observe that there do not appear to be combinations of weak behaviors we examined enabling a feasible CurveSwap attack in the wild. We also analyze source code for elliptic curve implementations, and find that a number of libraries fail to perform point validation for JSON Web Encryption, and find a flaw in the Java and NSS multiplication algorithms.

Citation Keyvalenta_search_2018