What is tlslite?

From the source “TLS Lite is an open source python library that implements SSL and TLS”. I’d seen references to it in the original BEAST post written by Thai Duong and an article on TLS Prober by Yngve Pettersen. This gave me some confidence that tlslite would be a good starting point. Obviously it’s not going to be fast but that doesn’t matter. With a SSL/TLS implementation in a high level language, it would be much easier to make the changes required for the sorts of tests I wanted to run, and I thought POODLE_TLS would be a good one to try first.

TLS Prober is in fact where I wanted to be heading. It works on a modified version of tlslite to test for various SSL/TLS bugs. However, the public source code hasn’t been updated since Yngve left Opera in 2013 and thus wouldn’t cover POODLE_TLS. While I could have added that capability, I decided to ignore TLS Prober (for now) and start afresh with the latest tlslite – mainly as it would be a good learning experience.

How to test for POODLE_TLS

I’m not going to re-hash theory that’s already covered elsewhere. Suffice to say that implementations of TLS that are faithful to the RFC shouldn’t be vulnerable to POODLE because the spec states what the contents of the padding bytes should be. Therefore, the way to test for POODLE_TLS is to ignore that rule and see if the connection is terminated by the server. This isn’t the same as performing a full attack but like all testing you have to compromise between accuracy and aggressiveness. I think this test is a good indication. After some rummaging through the source code and a bit of debugging, I found what I wanted.

Changes to tlslite

It seemed a bit crazy to fork the original project as my changes were tiny. I also thought that working through the changes here may be helpful to anyone else who wants to do the same sort of thing.

So to begin with I needed to signal to tlslite that I wanted to send TLS messages with invalid padding. You get things going with tlslite through the TLSConnection class so I changed how that was instantiated. TLSConnection inherits from TLSRecordLayer, which is where the padding code lives, so that needed changing too. Within the “tlslite” folder I made the following changes (obviously line numbers will be version dependent so I’ve added the original code too; my version was 0.4.8):

tlsconnection.py
Line 52 was:
def __init__(self, sock):
Now:
def __init__(self, sock, check_poodle_tls=False):
# now i can signal whether or not I want to perform the test
# if you already have tlslite, you can change it safely because check_poodle_tls defaults to False so it’s backward-compatible with any existing code that makes use of tlslite

Line 61 was:
TLSRecordLayer.__init__(self, sock)
Now:
TLSRecordLayer.__init__(self, sock, check_poodle_tls)
# I need to pass that signal on to the parent

tlsrecordlayer.py
Line 102 was:
def __init__(self, sock):
Now:
def __init__(self, sock, check_poodle_tls):

After line 103 self.sock = sock added new line:
self.check_poodle_tls = check_poodle_tls

After line 600 paddingBytes = bytearray([paddingLength] * (paddingLength+1)) added new lines:
if self.check_poodle_tls == True:
paddingBytes = bytearray(x ^ 42 for x in paddingBytes[0:-1])
paddingBytes.append(paddingLength)
# change all but the last of the padding bytes to be invalid (just XOR with 42, the answer to everything)
# make the last byte of padding valid = the number of padding bytes

And that’s it! Remember, as it’s Python, that tabs are important and the new code needs to be properly aligned.

POODLE_TLS test script

I then created the test script (available here), which attempts a normal TLS connection first before testing for POODLE using the invalid padding trick. Place the script within the modified tlslite and run it as test_poodle_tls.py <hostname>. Remember, it only tests for POODLE over TLS, not SSLv3.

I’ve noticed that sometimes the normal connection fails and one of the reasons for this is that the server does not support any of the small number of cipher suites offered by tlslite. In this case no conclusion can be drawn – and the script catches that.

SSLv3 support with block ciphers (in CBC mode) supported

All SSL/TLS tools check for SSLv3 support. You can do this manually with:

openssl s_client -ssl3 –connect <host>:443

This confirms SSLv3 support but obviously it only reports 1 cipher suite. This is where the tools come in. However, remember that POODLE only affects block ciphers in cipher block chaining (CBC) mode (which I’ll just abbreviate to “block ciphers” now, as I believe all the block ciphers that can run under SSLv3 operate in CBC mode). So review the list of supported cipher suites: if the server only supports RC4 ciphers then don’t report POODLE as an issue (instead report SSLv3, which is still old and creaky, and RC4!).

Server preference

Even if the server supports block ciphers, it may prefer RC4-based ciphers so the likelihood of exploitation is going to be negligible. I recently wrote up what to do if you find that your tools disagree over which cipher suite is preferered.

TLS_FALLBACK_SCSV

I also recently posted in detail about how the TLS_FALLBACK_SCSV remediation worked. In short it’s a signal to the server from the client that it is connecting with a lower protocol version than it supports. If the server supports something better, then that should have been negotiated during the earlier connection attempts, so the server can abort the connection as being suspicious.

With the release of OpenSSL v1.0.1j it’s easy to test for TLS_FALLBACK_SCSV support:

openssl s_client -ssl3 -fallback_scsv -connect <host>:443

This is telling the server than I’d like to connect using SSLv3 – but grudgingly. I’m using -ssl3 in the context of POODLE but TLS_FALLBACK_SCSV offers wider protection than this (checking support for it will continue to be worthwhile long after we’ve forgotten about POODLE.) Below you can see the fake cipher suite value advertising the fallback (which Wireshark couldn’t decode into something meaningful as it didn’t recognise the new cipher suite value 0×5600 at the time):

If the OpenSSL connection succeeds as usual (as shown below – a cipher suite has been chosen) then the server doesn’t support TLS_FALLBACK_SCSV.

If the connection fails with the new inappropriate_fallback alert then the server does support TLS_FALLBACK_SCSV:

Enabling TLS_FALLBACK_SCSV is all very well but it does depend on client support too – so if the server has SSLv3 enabled with block ciphers supported (and preferred) then it’s not out of the woods. A few browsers do already support it – Chrome 33 (Feb 2014), Firefox 35 (Jan 2015), Opera 25 (Oct 2014) – so it’s better than nothing, and of course support for it among browsers will only improve. Acknowledging TLS_FALLBACK_SCSV support is therefore worthwhile – both today and in the future. A client may even feel aggrieved if they’ve gone to the trouble of enabling TLS_FALLBACK_SCSV but get no credit for it in their pentest report!

How is a cipher suite chosen?

Quick overview: the connection starts with a Client Hello in which the client advertises which cipher suites it supports in order of preference (most preferred first). This list will be tailored according to any local configuration, as well as to the SSL/TLS protocol version the client is hoping to use, which is also advertised in the Client Hello:

The protocol version is the highest the client supports – unless the browser has gone down the fallback route, which is the mechanism abused by POODLE to make the SSLv3 attack more practical. Cipher suites can vary with protocol version simply because older protocols can’t always meet the needs of newer cipher suites. For example, only TLSv1.2 supports cipher suites that use SHA-256 for message integrity.

In receipt of the Client Hello, the server now has two options: it can either (a) opt for the client’s most preferred cipher suite that it too supports, or (b) ignore the client’s preference and opt for the cipher suite nearest the top of its own list that the client supports. For example, say the client has sent up a list of cipher suites which we’ll just call 1,2,3,4,5,6,7 and the server supports 8,3,4,2,6. In the case of (a) the server’s order is unimportant and it chooses 2; in the case of (b) the server chooses 3. The choice the server makes is returned in the Server Hello message:

Something to note in the above example is that, in the case of the server having a preference, you would never find out that cipher suite 8 is in fact the preferred choice because it isn’t supported by the client and thus it’s never offered in the Client Hello. Server preference is thus not only dictated by the server: it depends on what the client knows too.

Conflicting results

On my last test I had a conflict between SSLyze and SSLscan over which cipher suite was preferred over SSLv3. SSLyze thought it was RC4-SHA (I’m using the OpenSSL notation here)…

…whereas SSLscan went for DES-CBC3-SHA:

Manually testing for preference

To resolve this was simple. I ran:

openssl s_client -ssl3 -connect <host>:443

OpenSSL reported that DES-CBC3-SHA had been chosen. Just to be sure – which I explain below – I let the two cipher suites in question compete with one another using the -cipher switch, which allows you to put specific cipher suites in the Client Hello. OpenSSL orders them exactly how you list them according to the scheme set out in man ciphers. So I ran:

openssl s_client -ssl3 -cipher DES-CBC3-SHA:RC4-SHA -connect <host>:443

and then switched the order of the cipher suites:

openssl s_client -ssl3 -cipher RC4-SHA:DES-CBC3-SHA -connect <host>:443.

In both cases DES-CBC3-SHA was chosen so I was confident that SSLscan was right.

Why did SSLyze get it wrong this time?

Up to now I had tried SSLyze versions 0.9 and 1.0dev and both had reported RC4-SHA as the preferred cipher suite. I then tried an earlier 0.6beta version and found it correctly reported DES-CBC3-SHA. Rather than delve into the code I first took the easy option and fired up Wireshark while running one of the later versions of SSLyze. When enumerating the supported cipher suites, I could see that DES-CBC3-SHA was tested individually; however, when it came to checking for preference, DES-CBC3-SHA was left out of the list in the Client Hello. Obviously the server couldn’t choose it in this case, hence the preference was misreported. I reported this as a bug and Alban Diquet explained that:

The reason why DES-CBC3-SHA isn’t sent within the preference test is that specific servers will not reply at all if the client hello is larger than 255 bytes (due to a bug in a specific brand of load balancers). To reduce the size of the hello, I had to disable some stuff including specific cipher suites.

In this case the server only supported 3 cipher suites over SSLv3 so this misidentification could have been avoided. And this got me thinking…

Algorithm for testing preference

For each supported SSL/TLS protocol version, this is my version 0.1 of a method a tool could use to work out cipher suite preference:

1. Determine which cipher suites are supported individually (i.e. repeatedly send a Client Hello with just one cipher suite and see if it’s accepted).
2. Once you know which suites are supported, send them all up in one Client Hello and see which one is picked. If you’re worried about the buggy load balancers mentioned above then use a subset for now.
3. If the chosen cipher suite is the one that was at the top of the list then there are two alternative explanations: either (a) the server picked the client’s preferred suite as it has no preference of its own, or (b) the server really does prefer that cipher suite and it just happened to be at the top. (This is why I ran more than one test above.) So repeat the test in step 2, this time changing the most preferred cipher suite at the top of the order. If the same cipher suite is chosen then it’s a case of (b) and the server definitely has a preference; otherwise, the first cipher suite should be chosen and it’s case of (a) where the server is happy to be guided by the client’s preference¹.
4. If the cipher suite list has been cut short to appease buggy load balancers, repeat step 2 with the next set of cipher suites. If a preference has been expressed so far, that cipher suite should be included with the next set to allow it to compete.
5. If a preference has been found and you really wanted to go the whole hog, you could determine the order in full by starting again at step 2, missing out the cipher suite previously identified as preferred.

I put some of this to Alban Diquet (as part of the bug report) and he replied “yes I thought of adding the exact check you described but that’s pretty much at the bottom of my TODO list”. I think he was referring to step 3 but, anyway, if you ever have conflicting output from your tools over cipher suite preference, hopefully this posting will help you to resolve the issue.

——————–

¹ Actually, there is a possibility of “no preference” being misreported if you consider a server that supports cipher suite “wildcards” in such as way that there is no preference within a set of cipher suites that match a wildcard. I don’t think any popular implementation features this (hence the footnote) but for the sake of completeness imagine a server that prefers AES-* then RC4-*. The test tool sends up AES-SHA, AES-MD5, RC4-SHA, RC4-MD5 and AES-SHA is chosen. As per step 3, the tool then sends up AES-MD5, RC4-SHA, RC4-MD5, AES-SHA. This time AES-MD5 is chosen, giving the illusion of no server preference but in fact the server does have a preference, it’s just by groups. To cover this, if no server preference has been detected after step 3, repeat step 2 rotating the cipher suite at the top of the list each time; if at any point the cipher suite selected is not the first on the list then the server does have a preference. Admittedly this could add a fair bit of overhead!

TLS_FALLBACK_SCSV is a fake cipher suite advertised in the Client Hello, which starts the SSL/TLS handshake. SCSV stands for “Signaling Cipher Suite Value”. The idea of using a cipher suite as a signal is not new: TLS_EMPTY_RENEGOTIATION_INFO_SCSV is a way clients can advertise that they support secure renegotiation (addressing CVE-2009-3555):

The RFC for the TLS_FALLBACK_SCSV mechanism is still a draft but apparently Chrome (and Google from the server-side) has been using it since February 2014. This is no surprise as the RFC was written by two Google heavyweights. (Perhaps this was written with POODLE in mind as the RFC and the attack share an author – but that’s pure speculation!)

The whole business of successively downgrading the protocol version was put in place because browsers wanted to ensure they could connect to servers that were buggy. The TLS_FALLBACK_SCSV mechanism ensures that this downgrade only happens with the client’s blessing.

How does the protection work?

TLS_FALLBACK_SCSV is recommended for a client to indicate that it is knowingly repeating a SSL/TLS connection attempt over a lower protocol version than it supports (because the last one failed for some reason). When the server sees a TLS_FALLBACK_SCSV signal it compares the highest protocol version it supports to the version indicated in the Client Hello. If the client’s version is lower, then the server responds with a new Alert defined by the RFC called inappropriate_fallback. The idea being that the server knows the client supports something better so the connection should have negotiated that. The inappropriate_fallback Alert is a “fatal” error, i.e. the SSL/TLS connection is aborted.

Why does this help against POODLE?

Let’s say both the client and server support TLSv1.2. The client starts off, hoping to make a TLSv1.2 connection but an active man-in-the-middle attacker interferes with the handshake in the hope of forcing a downgrade. By repeatedly doing this, the attacker can force the use of SSLv3 and try some shenanigans like POODLE. Remember, the attacker can’t remove the TLS_FALLBACK_SCSV from the Client Hello because the handshake is cryptographically protected (unlike in SSLv2).

After the first round of interference, the client should try TLSv1.1. With the TLS_FALLBACK_SCSV signal in place, the server will pick up on the fact that the client is only requesting a TLVs.1.1 connection because of some difficulty earlier on. The server now knows that there is no good reason why a connection with a higher procotol version should have failed – and duly aborts the current connection.

The attacker could, of course, drop the TLSv1.1 and the following TLSv1.0 Client Hello. If the lack of response causes the browser to downgrade again then eventually the browser will try a SSLv3 connection, which the attacker will let through. Again, the TLS_FALLBACK_SCSV signal indicates to the server that the client supports something better and will terminate the connection attempt.

Okay, what if the client doesn’t support the server’s best protocol (TLS v1.2 in this example)? Just to be clear, let’s consider that case. The client would begin with, say, a TLSv1.0 connection. The attacker interferes with the handshake and so the client tries a SSLv3 connection with TLS_FALLBACK_SCSV. Again, the server knows that the client is only doing this because an earlier attempt with a higher protocol failed so it returns the Alert and the downgrade is aborted. If the client tries again, unhindered by the attacker, the client’s opening TLSv1.0 request is accepted because it lacks the TLS_FALLBACK_SCSV signal.

It’s more than just a POODLE buster…

The TLS_FALLBACK_SCSV mechanism doesn’t just protect us from attacks to downgrade connections to SSLv3: it protects us from forced downgrades completely. So when we want to connect using TLSv1.2, we can be sure that a meddling attacker can’t drop us down to TLSv1.0, which doesn’t support the best available cipher suites. As ever, we do need the server to play along.

…but it’s not quite a silver bullet

Of course, TLS_FALLBACK_SCSV doesn’t help if the best protocol version is SSLv3 at the client and SSLv3 is supported by the server – or vice versa. In this case SSLv3 will be agreed so no downgrade attack is required but the attacker still needs to make the browser perform multiple requests to the target domain, as the whitepaper explains. Remember that the attack only works with block ciphers operating in CBC mode so if the preferred cipher suite over SSLv3 is RC4 then the attack is likely to fail. Not that I’m advocating SSLv3 with RC4 as a solution though!

If SSLv3 is disabled either on the server or the client, POODLE has lost its bite. The only practical reason to support SSLv3 for servers is to humour IE6 users (because IE6 doesn’t enable TLSv1.0 by default). But if that’s a must then TLS_FALLBACK_SCSV – when supported by both client and server – will protect the vast majority of connections when SSLv3 isn’t necessary.

UPDATE: OpenSSL 1.0.1j supports TLS_FALLBACK_SCSV.

NEW: Assumptions and side effects

While writing up these scenarios I thought of a potential compatibility issue when TLS_FALLBACK_SCSV was in place. The draft RFC states that the connection MUST be refused by the server if the maximum protocol version the server supports is higher than the one advertised in the Client Hello with the TLS_FALLBACK_SCSV signal. This assumes that the server supports all protocol versions in between the client’s stated version and the server’s maximum. What can the server infer about the client? It’s clear the client supports at least a protocol version one higher than that in the Client Hello. But that’s all the server knows. So what if one of those intermediate versions isn’t supported by the server and happens to be the highest version the client supports?

In previous pentests I have seen servers that don’t support TLSv1.1 but do support TLSv1.0 and TLSv1.2. Imagine a client that supports TLSv1.1 at best and so it starts off a TLSv1.1 connection. TLS allows for the server to respond saying effectively “sorry, can’t do that, I can do TLSv1.0″. But supposing it’s one of those buggy servers that the downgrade fallback was intended for…In this case the connection fails in an unexpected way and the browser attempts the connection again, this time using TLSv1.0 with the TLS_FALLBACK_SCSV signal. The server then refuses the connection as its maximum TLS version is 1.2 and it assumes the client can do better. But, in fact, the client doesn’t understand 1.2 and the server doesn’t want to talk 1.1. The two will never talk to each other.

I put this to the RFC authors and I was delighted that Adam Langley replied (on what must have been a particularly busy day!): “I think you’re correct that the server will break in that situation”. He also proposed another, simpler compatibility scenario: “a server believes that it implements TLS 1.2 but is buggy and doesn’t handle, say, the signature_algorithms extension correctly. It works currently because clients downgrade to TLS 1.1. If the server implements TLS_FALLBACK_SCSV then it breaks”.

But is this a problem? I guess it’s unlikely. I don’t know how many of these buggy servers are out there. It’s also a fair assumption that any server that has the awareness to support TLS_FALLBACK_SCSV has also got the TLS version negotiation working. What about from the client viewpoint? In the example above, according to Wikipedia older versions of Chrome and Opera supported TLSv1.1 at best but of course users of these browsers are now very likely to have been auto-updated to later versions. However, we want the TLS_FALLBACK_SCSV mechanism to be future-proof.

At the same, ultimately this is all the fault of buggy servers. Many browsers will look to disable SSLv3 in the light of POODLE, knowing that this will cause issues for a small number of sites but that’s a reasonable price to pay to protect the majority. Enabling TLS_FALLBACK_SCSV for the long-term good could be viewed in the same way. Adam Langley seemed to agree: “TLS_FALLBACK_SCSV is a way for good servers to lift themselves out of the swamp that buggy servers have created. If you have a buggy server and enable TLS_FALLBACK_SCSV then it could certainly break your server. Hopefully that’s noticed in testing and then the real bug can be fixed ”. That’s why, when he acknowledged the potential for compatibility issues, he added “but I’m ok with that”.

Implementing TLS_FALLBACK_SCSV could expose the buggy servers that fallback was designed for – and perhaps that’s just what we need.