Penetration Test Report (iSEC): NCC Group Olm Cryptogrpahic Review 2016 11 01

Olm Cryptographic Review
Matrix
November 1, 2016 – Version 2.0
Preparedfor
MatthewHodgson
RichardvanderHoff
Preparedby
AlexBalducci
JakeMeredith
©2016–NCCGroup
PreparedbyNCCGroupSecurityServices,Inc. forMatrix. Portionsofthisdocumentandthetemplatesusedinits
productionarethepropertyofNCCGroupandcannotbecopied(infullorinpart)withoutNCCGroup’spermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,NCCGroupthepublisher,andtheauthor(s)
assumenoresponsibilityforerrors,omissions,orfordamagesresultingfromtheuseoftheinformationcontained
herein. UseofNCCGroup’sservicesdoesnotguaranteethesecurityofasystem,orthatcomputerintrusionswill
notoccur.
DocumentChangeLog
Version Date Change
1.0 2016-10-04 InitialreportreleasedtoOlm
1.1 2016-10-13 Updatedreportwithadditionalfindings
1.5 2016-10-22 Updatedreportwithremediationdetails
2.0 2016-11-01 Publicrelease
2|MatrixOlmCryptographicReview
Executive Summary
Synopsis chatmessages,canreplaymessagesfromanyuserin
InSeptember2016,Matrix,alongwithfinancialsupport achat.Thismayleadtoundesiredbusiness,personal,
from the Open Technology Fund,1 engaged NCC or ethical implications for the user whose messages
Group’s Cryptography Services Practice to perform a arebeingreplayed.
targeted review of their cryptographic library Olm. • FutureandBackwardSecrecyConcerns. Whilegroup
The review covered two major components of the chats are effectively protected by ephemeral keys,
Olm library: the double ratchet used for peer-to-peer thesechatsmaybelonglived. Compromiseofthese
communications, and Megolm, the group ratcheting keys can lead to the decryption of past and future
mechanism. Matrix has produced several reference messages.
implementations that make use of the Olm library
Caveats
including the client-server SDK for JavaScript, matrix-
js-sdk.2 Matrix-js-sdk was not reviewed during the Theoriginalscopeoftheengagementwassolelybased
onreviewingthe Olm cryptographicratchet. Afterthe
engagement; however, certain remediations to issues
first week of the assessment (five person-days), Matrix
wereappliedtothisimplementationandnotOlm.
informedNCCGroupthatMegolmshouldtakeprece-
Thereviewcoveredthe1.3.0releaseoftheOlmlibrary. dence over Olm as it is the primary mechanism to be
Two consultants performed the engagement over a definedintheMatrixspecification.Theremainderofthe
span of two weeks (September 19 to September 30, engagement was spent reviewing Megolm with some
2016) and consisted of 15 person-days of effort. A additionaltimedevotedtoOlm.Whiletheengagement
follow-upreviewoffixeswasperformedoverthelatter focused less on Olm than originally expected, NCC
halfofOctober. Group does not believe that Olm’s coverage in the
allottedtimewasadverselyaffected.
Scope
NCC Group’s evaluation focused on issues specific to TestDetails&StrategicRecommendations
doubleratchetsusedinsecuremessagingapplications, NCC Group has detailed main portions of the testing
generalcryptographicconcerns,andpotentialvulnera- planandobservationsinTestDetailsonpage6.
bilitiesintroducedbytheCprogrammingenvironment.
During the course of the engagement, NCC Group
Specifictargetsincluded:
observedthatthefollowingmeasuresmayenhancethe
• OlmDoubleRatchet:themainconstructionproviding Olmlibrary’slong-termsecurityposture:
asecure,deniablemethodforexchangingkeys.
• Perform an Additional Review of Megolm. Several
• Olm API: the API used by applications who wish to
issues were found in Megolm after a short review
harnessthedoubleratchet.
period. These issues need to be addressed in
• MegolmRachet:themaincryptographicconstruction
order for group messengers utilizing Megolm to
usedforgroupmessaging.
havesimilarguaranteesasone-on-onemessageswith
• Input Entry Points: fuzzing of entry points into the
Olm. OncethesechangesaremadetotheMegolm
libraryaswellaspicklingandunpicklingfunctions.
protocol, thereshouldbeadditionalreviewtoverify
KeyFindings thatthefixeshavebeenimplementedsecurely.
NCC Group identified several issues that could under- • Add Additional Identity Information into Pre-Key
mine the integrity of Olm and Megolm. Noteworthy MessagesinOlmandMegolm. Providingadditional
attacksinclude: information in the initial message between users
prevents unknown key-share attacks. The additional
• UnknownKey-ShareAttacks. BothOlmandMegolm informationcanhelpusersandapplicationsknowthat
suffer from variations of unknown key-share attacks. theyarecommunicatingwiththeintendeduser. This
This attack can allow a user or group of users to information can be any item that uniquely identifies
conspire to confuse other users about who they are a user, such as user ID, phone number, or address.
actuallyspeakingwith. Privacyissuesshouldbeaccountedforinthissolution
• MessagesinGroupChatsCanbeReplayed. Agroup astonotgiveouttoomuchpersonalinformation.
chatmember,oranattackerwithaccesstoencrypted
1https://www.opentech.fund/
2https://github.com/matrix-org/matrix-js-sdk
3|MatrixOlmCryptographicReview
See Strategic Recommendations on page 9 for more
details.
RemediationReview
Matrixbeganremediatingissuesaftertheinitialreport
wasdeliveredtothem. Remediationresultshavebeen
identified and included in each individual finding and
thedashboardupdatedtoreflecttheoneissuethathas
beenfullyaddressed.
Matrixhasaddressedthemajorityofthefindingsintheir
higher-layerprotocolmatrix-js-sdkandnotinOlm. For
a majority of these issues addressing them within Olm
wouldaddunduecomplexitytothelibraryandhigher
layerprotectionsweremoreaptforthefixes. Because
ofthis,Matrixhasclearlydocumentedtheshortcomings
in their end-to-end encryption guide3 and the Olm
specification4 as well as stating what developers must
todoprotectagainstthesevariousissues.
3https://matrix.org/docs/guides/e2e_implementation.html
4https://matrix.org/docs/spec/olm.html
4|MatrixOlmCryptographicReview
Dashboard
TargetMetadata EngagementData
Name Olm Type CryptographicReview
Type CryptographicLibrary Method SourceReview
Platforms C/C++ Dates 2016-09-19to2016-09-30
Environment Tag1.3.0 Consultants 2
Levelofeffort 15person-days
Targets
Olm1.3.0 https://matrix.org/git/olm/tag/?h=1.3.0
Release
FindingBreakdown
OriginalAssessment Remaining
CriticalRiskissues 0 CriticalRiskissues 0
HighRiskissues 1 HighRiskissues 1
MediumRiskissues 1 MediumRiskissues 1
LowRiskissues 6 LowRiskissues 5
Informationalissues 1 Informationalissues 1
Totalissues 9 Totalissues 8
CategoryBreakdown
Cryptography 8
ComponentBreakdown
Megolm 5
Olm 3
Key
Critical High Medium Low Informational
5|MatrixOlmCryptographicReview
Test Details
InthissectionwediscussvariouscryptographicdetailsoftheOlmlibraryandNCCGroup’sassessmentofit. TheOlm
ratchetisbasedoffoftheworkofTrevorPerrinandMoxieMarlinspikeasdetailedinhttps://github.com/trevp/doubl
e_ratchet/wiki. TheMegolmratchetispartiallydetailedinhttps://matrix.org/docs/spec/megolm.html.
CryptographicKeysandAuthentication
Cryptographickeysareusedfortwomajorreasonsinacryptographicchatprotocol: toprovideauthenticationofa
peerandtoprovideconfidentialityandintegrityofmessages.BothOlmandMegolmsharethefollowingsetsofkeys:
• Along-termsigningandidentityfingerprintingEd25519key.
• Along-termidentityCurve25519key.
Whilenotinscopeinthisengagement,userssubmittheirEd25519keyandCurve25519key,signedbytheirEd25519
key, to a central server. When a user wishes to engage a peer, they first download a bundle containing the peer’s
Ed25519key,Curve25519key,andsignature.Usersmustthenout-of-bandverifytheEd25519keyfingerprintoftheir
peer,whichhappensintheapplicationlayer(Matrix). Thisout-of-bandverificationprovidesauthenticationofpeers.
ConfidentialityisprovidedbyAES256inCBCmode. AuthenticityisprovidedbyHMAC-SHA256.
Olm
Inadditiontotheabove,theOlmratchetmakesuseofephemeral,one-timeCurve25519keys. Thesekeysarepub-
lishedonacentralserverandusedtofacilitateasynchronousmessaging. Forexample,AlicecangraboneofBob’s
publishedkeysandperformaTripleDiffie-Hellman(TripleDH)handshake,allwithoutBob’sinput. WhenBobeven-
tually logs in and receives a message from Alice, he can complet