Главная
Study mode:
on
1
Intro
2
Outline
3
Motivation: break crypto, maybe?
4
Introduction to BigNum Arithmetic
5
Widely used implementations
6
Anatomy of CVE-2014-3570
7
OpenSSL's impact assessment (1/2)
8
Counterargument
9
GMP 5 mult bugs
10
The patch
11
Bug pattern: carry mispropagation
12
libgcrypt 1.6.0
13
Symbolic Execution Challenges
14
Galois' SAW
15
Alternative property-based bug hunting
16
Fuzzing
17
Conclusions
18
Bibliography
Description:
Explore the intricacies of BigNum vulnerabilities in cryptography implementations during this 49-minute Black Hat conference talk. Delve into the implications of bugs in multi-precision integer arithmetic and their potential for exploitation in asymmetric cryptographic primitives. Learn about bug patterns, exploitation requirements, and strategies for automated bug hunting. Examine case studies including CVE-2014-3570 in OpenSSL, GMP 5 multiplication bugs, and issues in libgcrypt 1.6.0. Discuss challenges in symbolic execution, alternative property-based bug hunting methods, and fuzzing techniques. Gain insights into assessing and exploiting these vulnerabilities to enhance cryptographic security.

Assessing and Exploiting BigNum Vulnerabilities

Black Hat
Add to list
0:00 / 0:00