Penetration Test Report (NCCGroup): NCC Group ProtocolLabs FilecoinGroth16 Report 2021 06 02

Groth16 Proof Aggregation: Cryptography and
Implementation Review
Protocol Labs
June 2, 2021 – Version 1.1 Retest
Preparedfor
FriedelZiegelmayer
NicolasGailly
DeepKapur
Preparedby
EricSchorn
PaulBottinelli
KevinHenry
©2021–NCCGroup
Prepared by NCC Group Security Services, Inc. for Protocol Labs. Portions of this document and the
templatesusedinitsproductionarethepropertyofNCCGroupandcannotbecopied(infullorinpart)
withoutNCCGroup’spermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,NCCGroupthepublisher,and
theauthor(s)assumenoresponsibilityforerrors,omissions,orfordamagesresultingfromtheuseof
the information contained herein. Use of NCC Group’s services does not guarantee the security of a
system,orthatcomputerintrusionswillnotoccur.
Executive Summary
Synopsis KeyFindings
DuringApril2021,ProtocolLabsengagedNCCGroup’s The in-scope code was well organized and supported
CryptographyServicesteamtoconductacryptography by detailed technical documentation. Implementing
andimplementationreviewoftheGroth16proofaggre- thetargetfunctionalityinRustpreventsmanycommon
gation functionality in the bellperson and two other memory-safety related errors, allows for safer use of
related GitHub repositories. This code utilizes inner concurrency and provides for a straightforward build/
product arguments to efficiently aggregate existing testenvironment. Nonetheless,thereviewuncovereda
Groth16 proofs while re-using existing powers of tau totalofelevenfindingswiththemostnotableincluding:
ceremony transcripts. Full source code access was
• Several instances of panic from malformed or mali-
providedwithsupportoverSlack.Theprojectconcluded
ciousinputthatcouldpresentdenialofserviceattack
withabriefretestseveralweeksaftertheinitialreview.
vectorsorpreventagracefulrecoveryfromerrors.
Scope • Aknown-constantvaluepresentintherandomvector
that determines the linear combinations of proof
NCCGroup’sevaluationincluded the followingprimary
elementsfortheinnerproductprocess.
materials:
• The potential for memory churn and/or exhaustion
• The bellperson GitHub repository, commits d4120 duringthedeserializationofcarefullycraftedobjects.
78 and 854f254 on branch feat-ipp2, containing • Input validation checks utilizing debug_assertions
sourcecodeinsrc/groth16/aggregate/* thatthecompilerremovesduringareleasebuild.
• The filecoin-ffi GitHub repository, commit c5
e646e on branch feat-aggregation2, containing After retesting, NCC Group found all findings were
source code in rust/src/proofs/api.rs with the fixed, with one exception of an informational obser-
primary functions fil_aggregate_seal_proofs() vation involving toolchain and dependency versioning.
and fil_verify_aggregate_seal_proof() (along This latter issue is expected to be fixed via a normal
periodic updating process. Additional informational
withdownstreamlogic)
• The rust-fil-proofs GitHub repository, commit a materialisincludedasAppendixBonpage27.
b958b5 on branch feat-aggregation, containing
StrategicRecommendations
sourcecodeinfilecoin-proofs/src/api/seal.rs
Beyond addressing the reported findings, NCC Group
withtheprimaryfunctionsaggregate_seal_commit
recommends prioritizing the following areas during
_proofs()andverify_aggregate_seal_commit_p
futuredevelopment:
roofs()(alongwithdownstreamlogic)
• The technical paper titled “Proofs for Inner Pairing • Continue the focus on data validation for all input
ProductsandApplications”byBünzetal. suppliedat the API level and also wheneverpossible
• The private/preliminary technical paper titled “Pro- within intermediate functions (such as ensuring the
posal: PracticalGroth16Aggregation”1 lists provided to zip are of equal and non-zero
• RetestperformedonbellpersonPullRequest179,2 lengths). Ensure range checks are implemented for
filecoin-ffi Pull Request 1693 and the technical both minimum and maximum expected values/sizes
paper “SNARKpack: Practical SNARK Aggregation” by whenappropriate.
Gailly,MallerandNitulescu • Tobetteravoiddenialofservicescenariosstemming
from unanticipated or illegal operations, prefer a R
Thetestingmethodologyrevolvedarounddocumenta-
esult or Option over an assert which may panic
tionreviewandmanualsourcecodereviewaugmented
at runtime, and over a debug_assert which will be
byfuzzingofselectedcomponents.
removed during a release build. Continue utilizing
Limitations the ensure!() macro, while avoiding unwrap() and
expect()statements.
While the target source code is part of a much larger
• Tighten the externally-visible API by reviewing the
out-of-scope system undergoing rapid development,
visibility of internal functions, perhaps replacing pub
NCC Group was able to achieve robust coverage of all
withpub(crate)whenpossible.
in-scopecomponents.
1FileAggregate_Groth16_via_IPP.pdfdatedMarch11,2021withshasumac40456...
2https://github.com/filecoin-project/bellperson/pull/179
3https://github.com/filecoin-project/filecoin-ffi/pull/169/commits/7f4effb29d1b0bd78125049c99da21839e778da3
2 | Filecoin:Groth16ProofAggregation NCCGroup
Dashboard
TargetMetadata EngagementData
Name Filecoin: Groth16ProofAggregation Type CryptographyandImplementation
Review
Type CryptographicLibrary Method ManualSourceCodeReview,Fuzzing
Platforms RustwithCFFI Dates 2021-04-05to2021-04-16
Environment Development Consultants 3
LevelofEffort 15person-days
Targets
Bellperson https://github.com/filecoin-project/bellperson/
Filecoin-FFI https://github.com/filecoin-project/filecoin-ffi/
Rust-Fil-Proofs https://github.com/filecoin-project/rust-fil-proofs/
FindingBreakdown
Criticalissues 0
Highissues 0
Mediumissues 5
Lowissues 4
Informationalissues 2
Totalissues 11
CategoryBreakdown
Cryptography 5
DataValidation 1
DenialofService 3
ErrorReporting 1
Patching 1
ComponentBreakdown
all 1
bellperson 9
filecoin-ffi 1
Key
Critical High Medium Low Informational
3 | Filecoin:Groth16ProofAggregation NCCGroup
Table of Findings
Foreachfinding,NCCGroupusesacompositeriskscorethattakesintoaccounttheseverityoftherisk,application’s
exposureanduserpopulation,technicaldifficultyofexploitation,andotherfactors. ForanexplanationofNCCGroup’s
riskratingandfindingcategorization,seeAppendixAonpage25.
Title Status ID Risk
ConstantEntryinRandomnessVector(s) Fixed 003 Medium
BrittleInputValidationviaDebugAssertions Fixed 005 Medium
DoSinAggregatedProofVerificationviaMalformedProof Fixed 006 Medium
UncaughtPanicinFFICode Fixed 007 Medium
MemoryExhaustionviaMalformedStructuredReferenceString Fixed 009 Medium
PotentialDoSviaInverseComputationPanic Fixed 002 Low
PanicwhenAggregatingProofsofLengthOne Fixed 004 Low
AggregateProofMalleability Fixed 008 Low
DiscrepancybetweenReferenceandImplementationinKZGChallengePoint Fixed 011 Low
Computation
MarginallyInconsistent/OutdatedToolchainandDependencies NotFixed 001 Informational
MissingDomainSeparationParameterinOracleCalls Fixed 010 Informational
4 | Filecoin:Groth16ProofAggregation NCCGroup
Finding Details
Finding ConstantEntryinRandomnessVector(s)
Risk Medium Impact: Medium,Exploitability: Low
Identifier NCC-E001405-003
Status Fixed
Category Cryptography
Component bellperson
Location • structured_scalar_power()onlines28-34ofbellperson/src/groth16/aggregate/
mod.rs
• Lines49-57ofbellperson/src/groth16/aggregate/prove.rs
• Line109ofbellperson/src/groth16/aggregate/verify.rs
Impact Arandomrvectorwiththefirstelementfixedto1(orr0)willresultinthefirstgroupelements
oftheZ AB andZ C innerproducttermsandthefirstv 1 ′ andv 2 ′ vectorelementshavingno
randomnessapplied. Thisimpactsacentralpillaroftheaggregationschemewhichdepends
uponcheckingarandomlinearcombinationofproofelements.
Description The technical reference paper titled “Proposal: Practical Groth16 Aggregation”4 section 3.3
containsanoverviewoftheaggregationprotocolstating“…itissufficienttoprovethatonly
oneinnerpairingproductofarandomlinearcombinationoftheseinitialequationsdefinedby
averifier’srandomchallenger 2Z pholds”,withsection3.3.2item5definingtherandomness
vector as r = frign . These statements are consistent with t