Authored by Victor Grousset/tuxayo

TLS vulnerability ROBOT

Exploits typically require an attacker to make tens of thousands of connections to a vulnerable site. The requirement puts ROBOT well below the severity of Heartbleed, the critical 2014 vulnerability in OpenSSL that could be exploited in a matter of seconds. Still, ROBOT is serious enough that it deserves immediate attention.

Can you actually prove that Facebook was vulnerable?

We were able to sign a test message with Facebook's private key.

RSA encryption based key exchange modes should be deprecated from use.

see if they're still providing the affected RSA cyphers and disable those for any service where cryptographic security is desired.

We can remove the cyphersuites based on RSA (TLS_DHE_RSA_* I think)

But we should check if that excludes browsers/OSes.

It seems that we can:


Affected users and system administrators are encouraged to disable TLS RSA cyphers if possible.

Disable RSA encryption!

ROBOT only affects TLS cipher modes that use RSA encryption. Most modern TLS connections use an Elliptic Curve Diffie Hellman key exchange and need RSA only for signatures. We believe RSA encryption modes are so risky that the only safe course of action is to disable them. Apart from being risky these modes also lack forward secrecy.

By disabling RSA encryption we mean all ciphers that start with TLS_RSA. It does not include the ciphers that use RSA signatures and include DHE or ECDHE in their name. These ciphers are not affected by our attack.

Based on some preliminary data we also believe the compatibility costs of disabling RSA encryption modes are relatively low. Cloudflare shared with us that around one percent of their connections use the RSA encryption modes.

List of read links

6 Bytes
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment