In Search of Partitioning Oracle Attacks Against TLS Session Tickets

In 2021, researchers introduced a new type of chosen-ciphertext attack known as the partitioning oracle attack. This attack uses properties of Carter-Wegman MACs in Authenticated Encryption with Associated Data (AEAD) schemes, like AES-GCM or ChaCha20-Poly1305, to recover the key. These algorithms are employed in Transport Layer Security (TLS), a widely used protocol to secure communication on the internet. At first glance, it might seem that these attacks are irrelevant to TLS. However, our focus shifts to the session ticket mechanism used in TLS. This mechanism speeds up the connection process by allowing the reuse of previously negotiated parameters, including key material. Servers encrypt session tickets using the Session Ticket Encryption Key (STEK) to protect the ticket contents. Should the STEK become compromised, it enables attackers to decrypt intercepted connections or impersonate a server. We tested six TLS implementations using AES-GCM or ChaCha20-Poly1305 to protect session tickets to determine whether they are susceptible to partitioning oracle attacks. We identified three libraries that provide an oracle and one that provides a limited oracle. We analyzed the market share and exploitability of the vulnerable libraries using large-scale scans. Our results suggest that the proposed attack does not provide a significant advantage over simple bruteforce decryption due to library-specific formats of session tickets.