Microsoft Security Advisory 4338110

Microsoft guidance for CBC Symmetric Encryption Security Feature Bypass

Published: June 12, 2018

Version: 1.0

General Information

Executive Summary

Microsoft is announcing improved guidance on the use of Cipher-Block-Chaining (CBC) mode with symmetric encryption. A "padding oracle" Security Feature Bypass vulnerability may exist in certain circumstances if padded CBC block ciphers are used without additional data integrity checks. This could allow an attacker to decrypt and tamper with encrypted data without knowing the encryption key. This vulnerability can be used both locally, and in network-based attacks.

The vulnerability stems from the way in which the encryption is coded and cannot be programmatically identified without a high rate of false positives due to the unpredictable nature of the data. The vulnerability relies on a having a "padding oracle" who freely responds to queries about whether a message is correctly padded or not. An attack relies on the ability to change the encrypted data and test the result with the oracle. The only way to fully mitigate the attack is to detect changes to the encrypted data and refuse to perform any actions on it. The standard way to do this is to create a verifiable signature for the data and validate that signature before any operations are performed.

The potential issue can apply to either data at rest or data in transit, and Microsoft recommends that any data which has confidentiality in transit needs be transmitted over Transport Layer Security (TLS, the successor to Secure Sockets Layer (SSL)). Applications which are unable to change their messaging format but perform unauthenticated CBC decryption are encouraged to try to incorporate mitigations. Based on the current research it is generally believed that when the authentication and encryption steps are performed independently (for non-AE modes of encryption) that authenticating the ciphertext (encrypt-then-sign) is the best general option. However, there is no one-size-fits-all correct answer to cryptography and this generalization is not as good as directed advice from a professional cryptographer.

In summary, to use padded CBC block ciphers safely, you must combine them with a keyed-hash message authentication code (HMAC) (or another data integrity check) that you validate using a constant time comparison before attempting to decrypt the data. Since all altered messages will take the same amount of time to produce a response the attack is prevented. To help find instances of this vulnerability, Microsoft has released guidance indicating how to conduct code reviews as discussed in the updated document: Timing Vulnerabilities with CBC-Mode Symmetric Decryption Using Padding. Microsoft products and services were reviewed and are not affected.

Recommended Actions:

1. Keep Microsoft applications updated.
2. Determine if you have custom applications performing their own encryption and decryption.
3. Read the referenced document to determine how to identify vulnerable code.

Additional Suggested Actions

• Protect your PC
  We continue to encourage customers to follow our Protect Your Computer guidance of enabling a firewall, getting software updates and installing antivirus software. For more information, see Microsoft Safety & Security Center.

• Keep Microsoft Software Updated
  Users running Microsoft software should apply the latest Microsoft security updates to help make sure that their computers are as protected as possible. If you are not sure whether your software is up to date, visit Microsoft Update, scan your computer for available updates, and install any high-priority updates that are offered to you. If you have automatic updating enabled and configured to provide updates for Microsoft products, the updates are delivered to you when they are released, but you should verify that they are installed.

Other Information

Microsoft Active Protections Program (MAPP)

To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release. Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. To determine whether active protections are available from security software providers, please visit the active protections websites provided by program partners, listed in Microsoft Active Protections Program (MAPP) Partners.

Feedback

• You can provide feedback by completing the Microsoft Help and Support form, Customer Service Contact Us.

Support

• Customers in the United States and Canada can receive technical support from Security Support. For more information, see Microsoft Help and Support.
• International customers can receive support from their local Microsoft subsidiaries. For more information, see International Support.
• Microsoft TechNet Security provides additional information about security in Microsoft products.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

• V1.0 (June 12, 2018): Advisory published.