CVE-2019-1543 : Security Advisory and Response

ChaCha20-Poly1305 is an AEAD cipher vulnerability in OpenSSL versions 1.1.1 and 1.1.0 that allows for nonce reuse, potentially leading to confidentiality and integrity attacks.

Understanding CVE-2019-1543

What is CVE-2019-1543?

The vulnerability in the ChaCha20-Poly1305 cipher in OpenSSL allows for the reuse of nonces, which can compromise the security of encrypted messages.

The Impact of CVE-2019-1543

The vulnerability can result in severe confidentiality and integrity attacks on encrypted messages if nonces are reused, potentially affecting the security of applications using the affected OpenSSL versions.

Technical Details of CVE-2019-1543

Vulnerability Description

ChaCha20-Poly1305 cipher vulnerability in OpenSSL versions 1.1.1 and 1.1.0
Nonce reuse issue allowing for potential confidentiality and integrity attacks

Affected Systems and Versions

OpenSSL 1.1.1 and 1.1.0
Fixed in OpenSSL 1.1.1c (previously affected versions: 1.1.1 to 1.1.1b) and OpenSSL 1.1.0k (previously affected versions: 1.1.0 to 1.1.0j)

Exploitation Mechanism

Nonces can be inadvertently reused if applications modify the default nonce length to be longer than 12 bytes
Ignored bytes in long nonces are not covered by the integrity guarantee of the cipher

Mitigation and Prevention

Immediate Steps to Take

Update OpenSSL to the fixed versions 1.1.1c and 1.1.0k
Avoid setting non-default nonce lengths longer than 12 bytes

Long-Term Security Practices

Ensure unique nonce values for each encryption operation
Regularly monitor for any nonce reuse issues

Patching and Updates

No new releases are planned at this time as the impact is assessed as low severity
Monitor for any future updates or advisories from OpenSSL