Penetration Test Report (Kudelski Security): report ing tss 1.0

Audit of ECDSA-MPC
ING
26 March 2021
Version: 1.0
Presented by:
Kudelski Security Research Team
Kudelski Security – Nagravision SA
Corporate Headquarters
Kudelski Security – Nagravision SA
Route de Genève, 22-24
1033 Cheseaux sur Lausanne
Switzerland
For public release
ING | Audit of ECDSA-MPC
26 March 2021
DOCUMENT PROPERTIES
Version: 1.0
File Name: Audit_ING_TECDSA
Publication Date: 26 March 2021
Confidentiality Level: For public release
Document Owner: Tommaso Gagliardoni
Document Recipient: Shariff Lutfi
Document Status: Approved
© 2021 Nagravision SA / All Rights Reserved Page 2 of 32
For public release
ING | Audit of ECDSA-MPC
26 March 2021
TABLE OF CONTENTS
EXECUTIVE SUMMARY ...................................................................................................... 6
1.1 Engagement Scope ............................................................................................. 6
1.2 Engagement Analysis .......................................................................................... 6
1.3 Observations ....................................................................................................... 7
1.4 Issue Summary List ............................................................................................. 8
2. METHODOLOGY ............................................................................................................ 9
2.1 Kickoff .................................................................................................................. 9
2.2 Ramp-up .............................................................................................................. 9
2.3 Review ................................................................................................................. 9
2.4 Reporting ........................................................................................................... 10
2.5 Verify ................................................................................................................. 11
2.6 Additional Note .................................................................................................. 11
3. TECHNICAL DETAILS OF SECURITY FINDINGS ....................................................... 12
3.1 Security parameter check not enforced .............................................................. 12
3.2 Paillier secret key not zeroized after use ............................................................ 14
3.3 Secret share not zeroized upon error ................................................................. 15
3.4 Variable shadowing prevents zeroization ........................................................... 16
3.5 Paillier secret key not zeroized upon errors ....................................................... 17
3.6 Dlog signature nonce not zeroized ..................................................................... 18
3.7 Intermediate signing values not zeroized ........................................................... 19
3.8 Incorrect upper bound in range sampling ........................................................... 20
3.9 Use of powm() .................................................................................................. 21
4. OTHER OBSERVATIONS............................................................................................. 22
4.1 Extra checks in get_rho_vec() ...................................................................... 22
4.2 Proof of Knowledge is not a Signature ............................................................... 23
4.3 Commented out code ........................................................................................ 24
4.4 Lack of code coverage on error handling ........................................................... 25
4.5 Copy-paste error ................................................................................................ 26
4.6 Use of an unmaintained dependency ................................................................. 27
4.7 Single party attack on key resharing .................................................................. 28
APPENDIX A: ABOUT KUDELSKI SECURITY ................................................................... 30
© 2021 Nagravision SA / All Rights Reserved Page 3 of 32
For public release
ING | Audit of ECDSA-MPC
26 March 2021
APPENDIX B: DOCUMENT HISTORY ............................................................................... 31
APPENDIX C: SEVERITY RATING DEFINITIONS ............................................................. 32
© 2021 Nagravision SA / All Rights Reserved Page 4 of 32
For public release
ING | Audit of ECDSA-MPC
26 March 2021
TABLE OF FIGURES
Figure 1 Issue Severity Distribution ....................................................................................... 7
Figure 2 Methodology Flow ................................................................................................... 9
© 2021 Nagravision SA / All Rights Reserved Page 5 of 32
For public release
ING | Audit of ECDSA-MPC
26 March 2021
EXECUTIVE SUMMARY
Kudelski Security (“Kudelski”, “we”), the cybersecurity division of the Kudelski Group, was
engaged by ING (“the Client”) to conduct an external security assessment in the form of a
code audit of the cryptographic library ecdsa-mpc (“the Product”).
The assessment was conducted remotely by the Kudelski Security Team and coordinated by
Dr. Tommaso Gagliardoni, Senior Cryptography Expert, Yolan Romailler Cryptography Expert
and Nathan Hamiel, Head of Cybersecurity Research. The audit focused on the following
objectives:
• To provide a professional opinion on the maturity, adequacy, and efficiency of the
software solution in exam.
• To check compliance with existing standards.
• To identify potential security or interoperability issues and include improvement
recommendations based on the result of our analysis.
This report summarizes the analysis performed and findings. It also contains detailed
descriptions of the discovered vulnerabilities and recommendations for remediation.
1.1 Engagement Scope
The scope of the audit was a code audit of the Product written in Rust, with a particular
attention to safe implementation of hashing, randomness generation, protocol verification, and
potential for misuse and leakage of secrets.
The target of the audit was the cryptographic code located in the sub-branches
/src/algorithms and /src/ecdsa at https://github.com/ing-bank/threshold-signatures.
We audited the commit number: cc86590a2fbc8ee41b6cede2bfbc48c03a0f4da5.
Particular attention was given to side-channel attacks, in particular constant timeness and
secure erasure of secret data from memory.
1.2 Engagement Analysis
The engagement consisted of a ramp-up phase where the necessary documentation about
the technological standards and design of the solution in exam was acquired, followed by a
manual inspection of the code provided by the Client and the drafting of this report.
As a result of our work, we identified 6 Medium, 3 Low, and 7 Informational findings.
© 2021 Nagravision SA / All Rights Reserved Page 6 of 32
For public release
ING | Audit of ECDSA-MPC
26 March 2021
Issue Severity Distribution
7
6
5
4
3
2
1
0
Medium Low Informational
Medium Low Informational
Figure 1 Issue Severity Distribution
1.3 Observations
The Product is one of the most advanced libraries we are aware of implementing ECDSA
threshold signing and offers interesting features in terms of flexibility. Comments in the code
help pointing out to the scientific literature where specific algorithms are taken from.
Most of the issues we identified concern the way secret values are erased from memory after
use (“zeroization”). Zeroization is a tricky subject even in Rust, which is one of the few modern
programming languages offering such feature (thorough the zeroize() crate). Some
examples of misuse and correct implementation can be found for example at
https://benma.github.io/2020/10/16/rust-z