Authentication tokens can be broken in under 15 minutes !!

The news that tokens can be broken in less than 15 minutes raises questions again following last years security breaches! One clients comments related to the need that the traditional token vendors sell the tokens with a life span but generates little revenues in between. Following RSA’s breach they had a reported revenue spike in additional sales! This questions; is this compromise a method to force customers to upgrade because of a security flaw and in turn generating additional charges?

As the inventors of tokenless we don’t have these associated issues and in addition don’t sell time limited hardware. We brought to market a comprehensive model that encompasses the license, updates and support. This is reflected by the user count not by how many servers, agents or tokens the client has!

From the beginning SecurEnvoy have always preached that having disparate databases on a network isn’t best practice; with this current issue flagging Oracle at the centre of the problem, as they are the repository these vendors have chosen. Utilising the existing infrastructure has been our policy since the late nineties and remains the way forward in our opinion.

The SC Magazine article wrote:

“The fragility of authentication tokens against established attack vectors have been detailed.

According to a research paper authored by Romain Bardou, Riccardo Focardi, Yusuke Kawamoto, Lorenzo Simionato, Graham Steel and Joe-Kai Tsay, who call themselves ‘Team Prosecco’, RSA authentication tokens can be cracked in 13 minutes.

The group are to present a paper on the subject at the Crypto 2012 conference in August in Santa Barbara, California. They also confirmed that the SecurID 800 and other tokens can be broken.

The paper details a demonstration on how to exploit the encrypted key import functions of a variety of different cryptographic devices to reveal the imported key. These attacks were padding oracle attacks, a side channel allowing the user to see whether a decryption has succeeded or not”

The group also looked at SafeNet’s Aladdin eTokenPro and iKey 2032, the CyberFlex from Gemalto and Siemens’ CardOS. The Siemens device took 22 minutes to crack, while the Gemalto device took 89 minutes.

These companies were notified of the research. SafeNet said it was planning to release a security bulletin confirming the vulnerability on eToken Pro, eToken Pro Smartcard, eToken NG-OTP, eToken NG-FLASH, iKey 2032 using Aladdin eToken PKI Client or SafeNet Authentication Client software. They suggested using SafeNet Authentication Client 8.0 or later to enable PKCS#1 v2.1 padding for RSA and to avoid wrapping symmetric keys using other symmetric keys as a workaround.

RSA recognised that an attacker can obtain the corresponding plaintext through a padding Oracle attack against RSA SecureID faster than would be possible with a standard Bleichenbacher attack.

Siemens has also recognised the flaws and it said that it has fixed the verification of the padding and added a check of the obtained plaintext with respect to the given key template in the most recent version.

The group also found that the attacks were effective against the Estonian electronic identification cards and that it plans to test Hardware Security Modules (HSMs) soon.

<more> http://www.scmagazineuk.com/research-finds-that-rsa-tokens-can-be-broken-in-under-15-minutes/article/247390/?DCMP=EMC-SCUK_Newswire

Category: Industry News

MFA