Allele Security Alert
ASA-2019-00118
Identifier(s)
ASA-2019-00118, CVE-2019-1543
Title
ChaCha20-Poly1305 with long nonces
Vendor(s)
The OpenSSL Project
Product(s)
OpenSSL
Affected version(s)
OpenSSL versions 1.1.1 and 1.1.0
Fixed version(s)
OpenSSL versions with the following commit applied:
Prevent over long nonces in ChaCha20-Poly1305
https://github.com/openssl/openssl/commit/f426625b6a
Proof of concept
Unknown
Description
ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored.
It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce.
Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected.
Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable.
Technical details
Unknown
Credits
Joran Dirk Greef (Ronomon)
Reference(s)
ChaCha20-Poly1305 with long nonces (CVE-2019-1543)
https://www.openssl.org/news/secadv/20190306.txt
Prevent over long nonces in ChaCha20-Poly1305
https://github.com/openssl/openssl/commit/f426625b6a
chacha20-poly1305: fails to detect tampering, where IV > 12 and IV <= 16 (CHACHA_CTR_SIZE) #8345
https://github.com/openssl/openssl/issues/8345
CVE-2019-1543
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1543
CVE-2019-1543
https://nvd.nist.gov/vuln/detail/CVE-2019-1543
If there is any error in this alert or you wish a comprehensive analysis, let us know.
Last modified: March 6, 2019