Vulnerability Note VU#307015
Infineon RSA library does not properly generate RSA key pairs
Original Release date: 16 Oct 2017 | Last revised: 08 Nov 2017

Overview
The Infineon RSA library version 1.02.013 does not properly generate RSA key pairs, which may allow an attacker to recover the RSA private key corresponding to an RSA public key generated by this library.

This vulnerability is often cited as "ROCAquot; in the media.

Description
CWE-310: Cryptographic Issues – CVE-2017-15361
The Infineon RSA library version 1.02.013 does not properly generate RSA key pairs.

As a result, the keyspace required for a brute force search is lessened such that it is feasible to factorize keys under at least 2048 bits and obtain the RSA private key.

The attacker needs only access to the victim’s RSA public key generated by this library in order to calculate the private key.

Note that only RSA key generation is impacted.

ECC is unaffected. RSA keys generated by other devices/libraries may also be used safely with this library.

Trusted Platform Modules (TPM) or smartcards may use this RSA library in their products.
Infineon has provided a partial list of impacted vendors in a security advisory. Please see our list of impacted vendors below.

A research paper with more detail was presented at the ACM CCS conference in November 2017.

Also in early November 2017, an independent research team produced a more successful attack against this flaw based on summary details from the original paper.

Impact
A remote attacker may be able recover the RSA private key from a victim’s public key, if it was generated by the Infineon RSA library.

Solution
Apply an update

Check with your device manufacturer for information on firmware updates.

A partial list of affected vendors is below.

Alternatively, affected users may use the following workarounds:
Replace the device

Consider replacing the vulnerable device with a non-impacted device.

Generate a new RSA or ECC key pair

ECC keys are not impacted by this vulnerability.

Affected users should consider generating a new ECC key pair to replace the vulnerable RSA key pair.

Alternatively, if RSA keys are required, affected users may generate an RSA key pair using different method (e.g., OpenSSL) and then use the new secure RSA key pair with the old device. Only RSA key generation is impacted, not use of secure keys.

4096-bit RSA keys generated by the Infineon library are not known to be practically factorizable at current publication time, but affected users should not rely on this property for the long-term future.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedAtos SEAffected24 Oct 201724 Oct 2017
DellAffected19 Oct 201724 Oct 2017
FujitsuAffected16 Oct 201716 Oct 2017
Gemalto AVAffected18 Oct 201702 Nov 2017
GoogleAffected16 Oct 201716 Oct 2017
Hewlett Packard EnterpriseAffected16 Oct 201716 Oct 2017
Infineon Technologies AGAffected16 Oct 201724 Oct 2017
LenovoAffected16 Oct 201716 Oct 2017
Microsoft CorporationAffected16 Oct 201716 Oct 2017
RubrikAffected24 Oct 201724 Oct 2017
Taglio LLCAffected-02 Nov 2017
WinMagicAffected16 Oct 201716 Oct 2017
YubicoAffected16 Oct 201716 Oct 2017If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
8.8
AV:N/AC:M/Au:N/C:C/I:C/A:N

Temporal
6.9
E:POC/RL:OF/RC:C

Environmental
6.9
CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

References

https://crocs.fi.muni.cz/public/papers/rsa_ccs17
https://crocs.fi.muni.cz/_media/public/papers/nemec_roca_ccs17_preprint.pdf
https://github.com/crocs-muni/roca
https://www.infineon.com/cms/en/product/promopages/tpm-update/?redirId=59160
https://blog.cr.yp.to/20171105-infineon.html
http://cwe.mitre.org/data/definitions/310.html

Credit

This vulnerability was disclosed by Matus Nemec, Marek Sys, Petr Svenda, Dusan Klinec, and Vashek Matyas.
This document was written by Garret Wassermann.

Other Information

CVE IDs:
CVE-2017-15361

Date Public:
16 Oct 2017

Date First Published:
16 Oct 2017

Date Last Updated:
08 Nov 2017

Document Revision:
59

FeedbackIf you have feedback, comments, or additional information about this vulnerability, please send us email.

Leave a Reply