Scholarlink

MEGA is a cloud storage platform that supports end-to-end encryption and aims to be designed to guarantee data confidentiality and integrity even against hostile servers. However, Backendal et al. (IEEE S&P 2023) and Heninger and Ryan (PKC2023) showed that a server can exploit the session ID exchange to recover the user’s RSA private key with 512 and 6 login attempts, respectively. Furthermore, Albrecht et al. (Eurocrypt2023) constructed an ECB encryption oracle from MEGAdrop and reduced the number of required login attempts to two. The current version of MEGA is patched for these attacks. We analyze the security of the session ID exchange in unpatched MEGA in more detail. To achieve this purpose, we evaluate the minimum number of login attempts required to recover the user’s RSA private key without the ECB encryption oracle. Based on Heninger and Ryan’s attack, we propose an attack that can recover the user’s RSA private key with four login attempts without the ECB encryption oracle. To reduce the number of required login attempts, we introduce a problem of recovering an unknown divisor of a composite number given its approximation and an approximate of its square and propose an algorithm that solves this problem by refining its approximation.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Key Recovery Attacks on Unpatched MEGA from Four Queries: Solving Approximate Divisor Problem with Help of Approximation of Squared Divisor

  • 会议论文

  • 发表日期：

    2025年

查看全文
  • Naoki Shimoe,
  • Noboru Kunihiro

摘要

MEGA is a cloud storage platform that supports end-to-end encryption and aims to be designed to guarantee data confidentiality and integrity even against hostile servers. However, Backendal et al. (IEEE S&P 2023) and Heninger and Ryan (PKC2023) showed that a server can exploit the session ID exchange to recover the user’s RSA private key with 512 and 6 login attempts, respectively. Furthermore, Albrecht et al. (Eurocrypt2023) constructed an ECB encryption oracle from MEGAdrop and reduced the number of required login attempts to two. The current version of MEGA is patched for these attacks. We analyze the security of the session ID exchange in unpatched MEGA in more detail. To achieve this purpose, we evaluate the minimum number of login attempts required to recover the user’s RSA private key without the ECB encryption oracle. Based on Heninger and Ryan’s attack, we propose an attack that can recover the user’s RSA private key with four login attempts without the ECB encryption oracle. To reduce the number of required login attempts, we introduce a problem of recovering an unknown divisor of a composite number given its approximation and an approximate of its square and propose an algorithm that solves this problem by refining its approximation.