The One&Done attack, which is described in a paper to appear in the USENIX Security'18 conference, uses EM emanations to recover the values of the bits that are obtained using BN_is_bit_set while constructing the value of the window in BN_mod_exp_consttime. The EM signal changes slightly depending on the value of the bit, and since the lookup of a bit is surrounded by highly regular execution (constant-time Montgomery multiplications) the attack is able to isolate the (very brief) part of the signal that changes depending on the bit. Although the change is slight, the attack recovers it successfully >90% of the time on several phones and IoT devices (all with ARM processors with clock rates around 1GHz), so after only one RSA decryption more than 90% of the bits in d_p and d_q are recovered correctly, which enables rapid recovery of the full RSA key using an algorithm (also described in the paper) that modifies the branch-and-prune approach for a situation in which the exponents' bits are recovered with errors, i.e. where we do not know a priori which bits are correctly recovered. Upstream Pull Request: https://github.com/openssl/openssl/pull/6276 Reference: https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-alam.pdf
Looks like this will be released upstream in OpenSSL 1.1.1. (i.e. fix is currently in the OpenSSL_1_1_1-pre9 release tag).
While the older versions of OpenSSL shipped in RHEL5/6 do not appear to have the exact same code in BN_mod_exp_mont_consttime, the BN_is_bit_set is looped over which seems to be the core issue leading to the side-channel vector. That code block is almost exactly similar to the impacted changeset with a few differences in variable naming. I was unable to find any other information on if older versions were impacted. My assumption is yes.
(In reply to Scott Gayou from comment #1) > Looks like this will be released upstream in OpenSSL 1.1.1. (i.e. fix is > currently in the OpenSSL_1_1_1-pre9 release tag). Is the fix also part of 1.1.0i (or will it be part of 1.1.0j)? Thanks.
In reply to comment 3: > (In reply to Scott Gayou from comment #1) > > Looks like this will be released upstream in OpenSSL 1.1.1. (i.e. fix is > > currently in the OpenSSL_1_1_1-pre9 release tag). > > Is the fix also part of 1.1.0i (or will it be part of 1.1.0j)? > > Thanks. Unclear, I'm just looking at releases from github. https://github.com/openssl/openssl/releases/tag/OpenSSL_1_1_0i does not appear to have the fix, and 1.1.0j hasn't been tagged yet. You'd need to contact upstream for an official answer.
Created mingw-openssl tracking bugs for this issue: Affects: fedora-all [bug 1620147] Created openssl tracking bugs for this issue: Affects: fedora-all [bug 1620146]
Statement: Red Hat Product Security has rated this issue as having a security impact of Moderate, and a future update may address this flaw.
Doesn't look like this was fixed in OpenSSL_1_1_0i or OpenSSL_1_1_0j, but it is at least fixed in OpenSSL_1_1_1. Unclear why at the moment. Also, I don't believe One&Done was ever assigned a CVE.
This vulnerability is out of security support scope for the following products: * Red Hat Enterprise Application Platform 5 * Red Hat Enterprise Application Platform 6 Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.