AES-GCM IV Collision Vulnerability in fbeta ePA3 VAU Protocol

Vulnerability Overview This vulnerability involves an issue with the Counter in the VAU (Verschlüsselung von Auftragsdaten) protocol. Specifically, fails to perform monotonicity checks when storing the counter provided by the client, allowing the same counter value to be used repeatedly. This leads to collisions in the AES-GCM-IV, which can subsequently result in data leakage and tampering. Impact Scope Data Leakage: Attackers can reconstruct the AES-GCM-IV by observing ciphertexts and authentication tags, thereby obtaining plaintext data. Data Tampering: Attackers can tamper with server-to-client VAU messages, inserting fake patient data or forging authorization responses. Passive Network Monitoring: The aforementioned attacks can be achieved solely through passive network monitoring, without the need for active attacks. Remediation 1. Update Software: Update to version 1.3.0 or higher. 2. Verify Counter: Validate the monotonicity of the counter during the build process. 3. Check Counter: Implement a monotonicity check for the counter in the client to prevent replay attacks. 4. Handle Session Length: Treat the session length as a security parameter until the fix is applied to the entire deployment. POC Code Other Key Information Collision Probability: With a 64-bit counter, the probability of collision increases significantly as the number of messages grows. Attack Method: Using Joux’s Forbidden Attack (2006) method, attackers can reconstruct the AES-GCM-IV. Real-World Case: In one test, two messages out of 57,248 encrypted responses shared the same IV, resulting in a 9/8 digit difference. This reduced the search space from 1,000,000,000 to 16,777,216. References fbeta ePA3-Service-OpenSource-PR #10 (Fix) gemSpec_Krypt_A_24628-01 (Client-Encryption-Counter) NIST SP 800-38D (AES-GCM) Summary This vulnerability severely compromises the security of the VAU protocol, potentially leading to data leakage and tampering. It is recommended to update the software and implement the aforementioned remediation measures as soon as possible.

Goal Reached Thanks to every supporter — we hit 100%!

AES-GCM IV Collision Vulnerability in fbeta ePA3 VAU Protocol