Bouncy Castle BKS version 1 keystore files use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS-V1 keystore.
Bouncy Castle is a cryptographic library for C# and Java applications, including Android applications. BKS is a keystore format, which is designed to function similarly to a Sun/Oracle JKS keystore. BKS files can contain public keys, including certificates, as well as private keys. BKS files rely on password-based encryption to provide confidentiality and integrity protections to the keystore contents.
The first version of a BKS file contains a design flaw in the determination of the key size used to protect the data inside of the keystore. A SHA-1 hash function, which is 160 bits in length, is used in the BKS HMAC code. In a RFC7292-compliant cryptographic algorithm, the MAC key size is the same size as the hash function being used. This means that the MAC key size should be 160 bits long for BKS files. However, the Bouncy Castle code for version 1 BKS files uses only 16 bits for the MAC key size. This means that regardless of password complexity, a BKS version 1 file can only have 65,536 different encryption keys. A valid password for a keystore can be bruteforced by attempting each of these key values, which can take only seconds.
A BKS file that was created with Bouncy Castle 1.46 or earlier, or 1.49 or later as the "BKS-V1" format will have insufficient protection against bruteforce cracking. This may allow an attacker bypass BKS integrity checking.
Do not rely on version 1 BKS keystore files
This vulnerability was reported by Will Dormann of the CERT/CC.
This document was written by Will Dormann.
|Date First Published:||2018-03-19|
|Date Last Updated:||2018-04-04 15:27 UTC|