Join GitHub today
Inconsistencies in answers to RSA errors (possiby Bleichenbacher/ROBOT attack) #285
Last year we published research that several TLS implementations were still vulnerable to the classic "Bleichenbacher" attack from 1998 and named it the ROBOT attack .
While analyzing several implementations we also figured out inconsistencies with haskell-tls, but as we couldn't really make sense of them we haven't analyzed them in more detail.
We observe that in some situations as a response to faulty RSA encryption packages a haskell tls server will answer with an internal server error instead of a bad_record_mac error. The behavior is inconsistent, so we're not sure this can be turned into a practical attack. Yet it's still definitely a bug and potentially a vulnerability.
This only happens with ciphers with AES256 and CBC mode. (Which is also why our detection script and many other detection tools that are based on it will not see it, as they often will just test with AES128.)
It was originally pointed out to us by Hubert Kario (he's the developer of tls-fuzzer, which will show errors if you run its bleichenbacher check  against a haskell tls server). Another tool that's capable of detecting the error is TLS-Attacker, which is by one of ROBOT's co-authors .
A test run would be something like this: