# Divide-and-conquer session key recovery in SSLv2 (CVE-2016-0703)

OpenSSL SSLv2 server accepted clear-key bytes for non-export ciphers, letting an eavesdropper recover the master key in 16 connections as an oracle.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: dadrian
- Disclosed: 2016-06-01
- CVE: CVE-2016-0703
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/138179
- Library page: https://bugbountylibrary.com/r/h1%3A138179
- Tags: area:oss domain:oss impact:data-leak kind:bounty platform:hackerone sev:high tech:linux technique:source-review vuln:crypto

**Target:** SSLv2 server handshake (s2_srvr.c) in OpenSSL
**Root cause:** s2_srvr.c did not enforce clear-key-length of 0 for non-export ciphers; supplied clear-key bytes displace encrypted-key bytes, so the server acts as an oracle on the master key.
**Steps:**
1. Intercept an SSLv2 handshake between client and server.
2. Craft SSLv2 CLIENT-MASTER-KEY messages with clear-key bytes present for a non-export cipher, so they displace encrypted-key bytes.
3. Use the server's accept/reject response as an oracle to determine master-key bytes divide-and-conquer.
4. Recover the full SSLv2 master key using only 16 connections and negligible computation.
**How found:** Code review of s2_srvr.c revealed clear-key-length was not validated as 0 for non-export ciphers, and that clear-key bytes displace encrypted-key bytes, suggesting an oracle.
**Exploitation:** An eavesdropper with a captured SSLv2 handshake queries the server with crafted CLIENT-MASTER-KEY messages, using accept/reject as an oracle to recover the master key in ~16 connections, then decrypts the session; also enables a computation-free Special DROWN against non-export ciphersuites.
**Escalation:** Chained into the Special DROWN variant, extending DROWN to non-export ciphersuites without significant computation.
**Insight:** When a protocol field is conditionally meaningful, check whether the parser still consumes attacker bytes for it in modes where it should be absent; displaced/ignored bytes often become an oracle.