I-056
Published: 1998-06-04 00:00:00
Updated: 1998-06-04 00:00:00
INFORMATION BULLETIN
I-056: Cisco PIX Private Link Key Processing
and Cryptography Vulnerability
June 4, 1998 14:00 GMT
PROBLEM: Cisco has identified a vulnerability in the PIX Private Link
that can be installed in Cisco PIX firewalls. An error in
parsing of configuation file commands reduces the effective
key length. There is no workaround available.
PLATFORM: All PIX Private Link software through version 4.1.6.
DAMAGE: Detailed knowledge of the key-parsing error will increase the
attackers ability to crack the encryption by a factor of 256.
SOLUTION: Upgrade to version 4.2.1, scheduled for release in late June
1998.
VULNERABILITY Cisco has had no reports of malicious exploitation of this
ASSESSMENT: vulnerability. Cisco knows of no public announcement of this
vulnerability before the date of this notice.
[ Start Cisco Advisory ]
Field Notice:
PIX Private Link Key Processing and Cryptography Issues
=======================================================
June 3, 1998
Summary
=======
PIX Private Link is an optional feature that can be installed in Cisco PIX
firewalls. PIX Private Link creates IP virtual private networks over
untrusted networks, such as the Internet, using tunnels encrypted with Data
Encryption Standard (DES) in ECB ("electronic codebook") mode.
An error in parsing of configuration file commands reduces the effective key
length for the PIX Private Link DES encryption to 48 bits from the nominal
56 bits.
Who Is Affected
===============
All users of the PIX Private Link encryption product with PIX software
versions earlier than the date of this notice are affected. This includes
all PIX Private Link software through version 4.1.6.
Impact
======
If attackers know the details of the key-parsing error in the PIX Private
Link software, they will know 8 bits of the key ahead of time. This reduces
the effective key length from the attacker's point of view from 56 to 48
bits. This reduction of the effective key length reduces the work involved
in a brute-force attack on the encryption by a factor of 256. That is,
knowledgeable attackers can, on the average, find the right key 256 times
faster than they would be able to find it with a true 56-bit key.
In addition to this key-length issue, some customers have expressed concern
over the use of DES ECB mode for PIX Private Link encryption. Although the
use of ECB mode is intentional, ECB is not generally considered to be the
best mode in which to employ DES, because it tends to simplify certain forms
of cryptanalysis and may permit certain replay attacks. Technical details of
the relative merits of various encryption modes are beyond the scope of this
document. Interested readers should refer to a cryptography text for more
information, such as Bruce Schneier's Applied Cryptography.
Details
=======
This vulnerability has been assigned Cisco bug ID CSCdk11848.
Affected Software Versions
-------------------------
This vulnerability affects all released versions of PIX Private Link
software with version numbers up to and including 4.1.6, and all
beta/interim software released earlier than the date of this notice.
Planned Software Fixes
---------------------
The first regular release containing a fix for this problem will be version
4.2.1, which is tentatively scheduled for release in late June 1998. This
schedule is subject to change. Fixes for the 4.1 software release have not
yet been scheduled.
This fix extends the effective DES key length to a full 56 bits; ECB mode is
still used.
Customers who need to upgrade immediately may contact Cisco's Technical
Assistance Center (TAC) to obtain interim software. Interim software has not
been subjected to full testing; it has a greater chance of containing
serious bugs than would regular released software.
Interim releases are available only by special request from the Cisco TAC,
not via the regular download channels. Cisco advises customers to install
interim releases only if absolutely necessary. Customers who choose to
install interim releases should plan to upgrade to the regular released
software when it becomes available.
When the fix is installed, it will be necessary to upgrade both ends of each
Private Link tunnel at the same time. This is because key the modified key
parsing algorithm will lead old and new versions to derive different
encryption keys from the same configuration file.
Software upgrades to correct this key-length problem will be offered free of
charge to all PIX Private Link customers, regardless of their service
contract status. Customers under contract may obtain upgrades through their
usual procedures. Customers not under contract should call the Cisco TAC.
Contact information for the TAC is in the "Cisco Security Procedures"
section at the end of this message, and is available on Cisco's Worldwide
Web site at http://www.cisco.com/.
The use of ECB mode was a deliberate design decision for the PIX Private
Link product, and will not be changed. However, future IPSEC/IKE products
for the PIX platforms will use other encryption modes.
Workarounds
----------
There is no configuration workaround.
Exploitation and Public Announcements
=====================================
Cisco has had no reports of malicious exploitation of this vulnerability.
Cisco knows of no public announcements of this vulnerability before the date
of this notice. This vulnerability was discovered by an engineering analysis
conducted by a Cisco customer at a security incident response organization.
Status of This Notice
=====================
This is a final field notice. Although Cisco cannot guarantee the accuracy
of all statements in this notice, all the facts have been checked to the
best of our ability. Cisco does not anticipate issuing updated versions of
this notice unless there is some material change in the facts. Should there
be a significant change in the facts, Cisco may update this notice.
Distribution
-----------
This notice will be posted on Cisco's Worldwide Web site at
http://www.cisco.com/warp/public/770/pixkey-pub.shtml. In addition to
Worldwide Web posting, the initial version of this notice is being sent to
the following e-mail and Usenet news recipients:
* cust-security-announce@cisco.com
* firewalls@lists.gnac.net
* comp.security.firewalls
* bugtraq@netspace.org
* first-teams@first.org (includes CERT/CC)
* Various internal Cisco mailing lists
Future updates of this notice, if any, will be placed on Cisco's Worldwide
Web server, but may or may not be actively announced on mailing lists or
newsgroups. Users concerned about this problem are encouraged to check the
URL given above for any updates.
Revision History
---------------
Revision 1.0, Initial released version
08:00 AM
US/Pacific,
03-JUN-1998
Cisco Security Procedures
=========================
Please report security issues with Cisco products, and/or sensitive security
intrusion emergencies involving Cisco products, to security-alert@cisco.com.
Reports may be encrypted using PGP; public RSA and DSS keys for
"security-alert@cisco.com" are on the public PGP keyservers.
The alias "security-alert@cisco.com" is used only for reports incoming to
Cisco. Mail sent to the list goes only to a very small group of users within
Cisco. Neither outside users nor unauthorized Cisco employees may subscribe
to "security-alert@cisco.com".
Please do not use "security-alert@cisco.com" for configuration questions,
for security intrusions that you do not consider to be sensitive
emergencies, or for general, non-security-related support requests. We do
not have the capacity to handle such requests through this channel, and will
refer them to the TAC, delaying response to your questions. We advise
contacting the TAC directly with these requests. TAC contact numbers are as
follows:
* +1 800 553 2447 (toll-free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: mailto:tac@cisco.com
All formal public security notices generated by Cisco are sent to the public
mailing list "cust-security-announce@cisco.com". For information on
subscribing to this mailing list, send a message containing the single line
"info cust-security-announce" to "majordomo@cisco.com". An analogous list,
"cust-security-discuss@cisco.com" is available for public discussion of the
notices and of other Cisco security issues.
This notice is copyright 1998 by Cisco Systems, Inc. This notice may be
redistributed freely after the release date given at the top of the notice,
provided that redistributed copies are complete and unmodified, including
all date and version information.
[ End Cisco Advisory ]
CIAC wishes to acknowledge the contributions of Cisco Systems, Inc. for the information contained in
this bulletin.
For additional information or assistance, please contact CIAC:
Voice: +1 925-422-8193 (8:00 - 18:00 PST, 16:00 - 2:00 GMT)
Emergency (DOE, DOE Contractors, and NIH ONLY):
1-800-759-7243, 8550070 (primary),
8550074 (secondary)
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@llnl.gov
World Wide Web: http://www.ciac.org/
http://ciac.llnl.gov
(same machine -- either one will work)
Anonymous FTP: ftp.ciac.org
ciac.llnl.gov
(same machine -- either one will work)
Modem access: +1 (925) 423-4753 (28.8K baud)
+1 (925) 423-3331 (28.8K baud)
This document was prepared as an account of work sponsored by an agency of the United States
Government. Neither the United States Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the
accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or
represents that its use would not infringe privately owned rights. Reference herein to any specific
commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not
necessarily constitute or imply its endorsement, recommendation or favoring by the United States
Government or the University of California. The views and opinions of authors expressed herein do not
necessarily state or reflect those of the United States Government or the University of California, and
shall not be used for advertising or product endorsement purposes.
UCRL-MI-119788
[Disclaimer]
