CVE-2017-15361 PoC — Infineon Trusted Platform Module Infineon RSA库安全漏洞

Source

Associated Vulnerability

Title: Infineon Trusted Platform Module Infineon RSA库安全漏洞 (CVE-2017-15361)
Description:The Infineon RSA library 1.02.013 in Infineon Trusted Platform Module (TPM) firmware, such as versions before 0000000000000422 - 4.34, before 000000000000062b - 6.43, and before 0000000000008521 - 133.33, mishandles RSA key generation, which makes it easier for attackers to defeat various cryptographic protection mechanisms via targeted attacks, aka ROCA. Examples of affected technologies include BitLocker with TPM 1.2, YubiKey 4 (before 4.3.5) PGP key generation, and the Cached User Data encryption feature in Chrome OS.

Description

Go package that checks if RSA keys are vulnerable to ROCA / CVE-2017-15361

Readme

# rocacheck [![GoDoc](https://godoc.org/github.com/titanous/rocacheck?status.svg)](https://godoc.org/github.com/titanous/rocacheck)

Package rocacheck is a Go implementation of the [key fingerprint
algorithm](https://github.com/crocs-muni/roca) that checks if an RSA key was
generated by broken Infineon code and is vulnerable to factorization via the
[Return of Coppersmith's Attack
(ROCA)](https://crocs.fi.muni.cz/public/papers/rsa_ccs17) / CVE-2017-15361.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →