ROCA vulnerability

From Wikipedia, the free encyclopedia
Jump to: navigation, search

The ROCA vulnerability is a cryptographic weakness that allows the private key of a key pair to be recovered from the public key in keys generated by devices with the vulnerability. "ROCA" is an acronym for "Return of the Coppersmith Attack".[1] The vulnerability has been given the CVE identifier CVE-2017-15361.

The vulnerability arises from a problem with a software library used for RSA key generation in Infineon's Trusted Platform Module implementation.[2][3][4] All keys generated using this library are believed to be vulnerable to the ROCA attack.[5] The researchers who discovered the attack believe that it affects around one-quarter of all current TPM devices globally.[6] In particular, many millions of smartcards are believed to be affected.[1]

See also[edit]

References[edit]

  1. ^ Jump up to: a b Goodin, Dan (2017-10-23). "Crippling crypto weakness opens millions of smartcards to cloning". Ars Technica. Retrieved 2017-10-25. 
  2. Jump up ^ "ROCA: Infineon TPM and Secure Element RSA Vulnerability Guidance". www.ncsc.gov.uk. Retrieved 2017-10-25. 
  3. Jump up ^ "ROCA: Vulnerable RSA generation (CVE-2017-15361)". crocs.fi.muni.cz. Retrieved 2017-10-25. 
  4. Jump up ^ Infineon Technologies AG. "Information on software update of RSA key generation function". www.infineon.com. Retrieved 2017-10-25. 
  5. Jump up ^ Khandelwal, Swati. "Serious Crypto-Flaw Lets Hackers Recover Private RSA Keys Used in Billions of Devices". The Hacker News. Retrieved 2017-10-25. 
  6. Jump up ^ Leyden, John (16 Oct 2017). "Never mind the WPA2 drama... Details emerge of TPM key cockup that hits tonnes of devices". Retrieved 2017-10-25. 

External links[edit]