SLOTH

cryptography

A 2016 set of attacks abusing obsolete hashes like MD5 in TLS negotiation.

Security Losses from Obsolete and Truncated Transcript Hashes showed that allowing weak hashes such as MD5 in TLS signatures enabled transcript-collision and downgrade attacks. It pushed removal of MD5-based signatures from TLS.

SLOTH attacked protocols still using weak hash functions in their handshake signatures. The name stands for security losses from obsolete and truncated hash constructions, and the finding was that transcript collisions could be used to impersonate a party during TLS, IKE or SSH negotiation.

The important detail is where the weak hash was. Everyone had stopped using MD5 and SHA-1 for certificates, and the deprecation campaigns focused there. But the same functions survived inside handshake signature negotiation, where they attracted no attention because nobody thought of the handshake as a place hashes lived.

That is the generalizable lesson: deprecating a primitive means finding every place it is used, and the ones that get missed are the internal, unglamorous uses that no compliance checklist enumerates. A scanner that reports a certificate's signature algorithm says nothing about what the handshake negotiated. Removing a weak algorithm requires an inventory of uses rather than an inventory of certificates.

Also known as: SLOTH, Security Losses from Obsolete and Truncated Transcript Hashes

← All glossary entries