ROBOT

cryptographysecurity

A 2017 return of a classic RSA padding oracle affecting many TLS stacks.

Return Of Bleichenbacher's Oracle Threat showed that a 1998 RSA PKCS#1 v1.5 padding attack still worked against numerous modern implementations. It underscored how hard it is to fully retire a flawed cryptographic construction.

ROBOT is the return of an attack first published in 1998. Bleichenbacher showed that a server which reveals whether an RSA-encrypted message had valid padding can be used as an oracle to decrypt traffic, one query at a time. Nearly twenty years later, researchers found that many major implementations were still vulnerable.

The recurrence is the finding. The original fix required servers to behave identically for valid and invalid padding, which is difficult to implement correctly and impossible to verify by testing the happy path. Implementations diverged in small ways over the years, and the differences were enough. Some products were vulnerable through a distinguishable error message, others through timing.

That is a strong argument for removing dangerous constructions rather than defending them. TLS 1.3 dropped RSA key exchange entirely, which eliminates the class rather than requiring every implementation to keep getting a subtle behaviour right forever. When a mitigation depends on every implementer avoiding a specific mistake in perpetuity, some of them will not, and the failure will be quiet.

Also known as: ROBOT, Return Of Bleichenbacher's Oracle Threat

← All glossary entries