India's nationwide ID system has a severe cryptography vulnerability

India’s nationwide identification system, also known as Aadhaar, has come under plenty of criticism in the years since it was first announced and introduced.

The verifiable 12-digit identification number issued by the government was lambasted for trying to lock citizens into a system that allowed the government to track their every move and purchase, which some saw as a worrying mission creep. At the same time, it also was plagued with issues that meant many people did not want to use it.

Despite the problems, the system ended up being widely adopted. But a recent academic paper highlights further issues with the system that have been there since the beginning – and could spell disaster for anyone using it.

The paper is the first comprehensive description of the Aadhaar infrastructure, collating information across thousands of pages of public documents and releases, as well as direct discussions with Aadhaar developers. Researchers from Johns Hopkins University studied the computer code that makes the Aadhaar system work and probed it for vulnerabilities.

A key issue

That’s where they found the problem. In the paper, the authors describe the first known cryptographic issue within the system. It could be carried out by reverse engineering the string of numbers that Aadhaar uses to instantiate the AES GCM, which can sometimes be duplicated and spoofed, enabling people to potentially open a bank account, fly internationally or get a mobile phone SIM card in someone else’s name.

Luckily, a workaround prevents it from being exploitable at scale. However, they go further, categorizing and rating various security and privacy limitations and the corresponding threat actors, examining the legitimacy of alleged security breaches, and discussing improvements and mitigation strategies.

The vulnerability with the cryptographic issue dates back to the early development of the app. According to the researchers, Aadhaar architects made the design choice that enabled the vulnerability to occur. They claimed they were aware of this potential issue but could not think of a better solution to the problem.

Fixing things

The researchers suggest a better solution in fact is quite simple: using the entire timestamp instead of a few bits. The academics admit the workaround is still not perfect but is definitely better than the current implementation, assuming the implementation has not been updated.

The vulnerability is one that is not, by the researchers’ own admission, currently exploitable. While the payload might be vulnerable, it is encrypted whenever it is communicated, they say. This makes it almost impossible for anyone to mount an attack off the back of the issue.

Ultimately though, they are worried that if a targeted attack on one communication channel – perhaps through social engineering or other attack methods – would allow eavesdropping, then the attack surface is huge. If an attacker were successful, the researchers claim, they could potentially authenticate as someone else to any Aadhaar-based authentication system, such as banks or telecom providers.

It’s a significant issue – and one to be considered for anyone trying to implement a nationwide identification system such as Aadhaar. “Almost all the issues we found were due to a set of challenges unique to a system at Aadhaar’s scale,” the authors conclude.

More from Cybernews:

Extortion gangs no longer avoid hitting Russian firms

Companies spending billions to have AI answer calls

Russian hackers hit Japan’s government websites

Nemesis Kitten: opportunistic Iran-linked gang with modest ransom demands

Crypto influencer runs Ponzi scheme in "awareness campaign"

Subscribe to our newsletter