Penetration Test Report (X41 D-Sec): X41 RandomX Audit 2019 Final Report Public

RandomXAudit
forMoneroLabs
FinalReportandManagementSummary
2019-07-05
PUBLIC
X41D-SECGmbH
Dennewartstr.25-27
D-52068Aachen
AmtsgerichtAachen:HRB19989
https://x41-dsec.de/
info@x41-dsec.de
RandomXAudit MoneroLabs
Revision Date Change Editor
1 2019-06-12 InitialReport E.Sesterhenn
2 2019-06-27 Findings G.Kopf,L.Merino,S.Bazanski
3 2019-06-27 Summaries E.Sesterhenn,G.Kopf
4 2019-06-30 Finalization M. Vervier, E. Sesterhenn, S.
Bazanski
5 2019-07-05 Corrections M.Vervier,S.Bazanski
X41D-SecGmbH PUBLIC Page1of50
RandomXAudit MoneroLabs
Contents
1 ExecutiveSummary 4
2 Introduction 6
2.1 FindingsOverview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.2 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.3 RecommendedFurtherTests. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3 RatingMethodology 8
4 Results 9
4.1 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
4.2 FeasibilityofImplementingRandomXinHardware . . . . . . . . . . . . . . . . . . . 18
4.3 WeaknessesintheCryptographicImplementationsandAlgorithms . . . . . . . . . 27
4.4 SideFindingsandGeneralObservations . . . . . . . . . . . . . . . . . . . . . . . . . . 31
5 About 38
5.1 X41D-SecGmbH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
5.2 SergeBazanski . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
5.3 SecfaultSecurityGmbH. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
A Parallelizer 42
X41D-SecGmbH PUBLIC Page2of50
RandomXAudit MoneroLabs
Dashboard
Target
Customer MoneroLabs
Name RandomX
Type Sourcecode
Version Commite4b[PII_REDACTED]71b0c4e3209d714bbcfeb943a61
Engagement
Type SourceCodeAuditandDesignReview
Consultants 3:GregorKopf(SFS),LuisMerino(X41),SergeBazanski
EngagementEffort 30days,2019-06-10to2019-06-28
Totalissuesfound 4
Figure1:IssueOverview(l:Severity,r:CWEDistribution)
X41D-SecGmbH PUBLIC Page3of50
RandomXAudit MoneroLabs
1 Executive Summary
X41wastaskedbytheMoneroprojectwithareviewofthenewly-developedRandomXPoW
scheme.TheprojectwascoordinatedbytheOpenSourceTechnologyImprovementFund.
ThisdocumentdescribestheresultsofthesecurityreviewofRandomX.
AtotaloffourvulnerabilitieswerediscoveredduringthetestbyX41.Nonewereratedascritical,
nonewereclassifiedashighseverity,fourasmedium,andnoneaslow.Additionally,elevenissues
withoutadirectsecurityimpactwereidentified.
Figure1.1:IssuesandSeverity
ThedesignreviewwasperformedbasedonthedocumentationavailableintheRandomXGitHub
repository. Thecodereviewhasbeenperformedbasedonthepubliclyavailablesourcecode.
Alltaskshavebeenperformedinamanualfashion,withoutleveragingtoolssuchasautomated
vulnerabilityscanners.Inadditiontothecodereview,limiteddynamictestshavebeenperformed-
mainlyinordertoverifyassumptionsandtobetterunderstandthetargetimplementation.The
analyseswereperformedoncommitIDe4b[PII_REDACTED]71b0c4e3209d714bbcfeb943a61inthe
RandomXGitHubrepository.
Theoverallaimofthereviewwastoidentifypotentialsecurityvulnerabilitiesinboth,designand
X41D-SecGmbH PUBLIC Page4of50
RandomXAudit MoneroLabs
implementationofthenewscheme. Furthermore,ananalysisofthefeasibilityofahardware
implementationofRandomXwasperformed.
Thereviewwasconductedinthetimeframefrom2019-06-03to2019-06-28bythreeexperienced
securityexperts.
Themostseverefindingsincludeanumberofout-of-boundsmemoryaccessesinnon-standard
configurations.ThecurrentMoneroparametersarenotaffected.Whenchangingcompiletime
configurationsuchastheprogramsize,thedescribedvulnerabilitiescomeintoeffect.X41found
thatitislikelypossibletoimplementRandomXasarelativelysimple,albeitlarge,VLIWCPU
withoutanybranchpredictionorinstructionschedulinglogic,whichyetallowsforIPCratessimilar
tospeculative,outoforderandsuperscalarexecutionofaConventionalCPU.
Furthermore,alargenumberofside-findingshavebeenidentified,whicharedescribedinsec-
tion4.4ofthisdocument.Thesedonotrepresentactualvulnerabilitiesintheanalyzedversion
ofRandomX,butmightbecomeproblematicincaseofcodere-useorfutureextensionsofthe
implementation.
Atthetimeofwriting,thedevelopersofRandomXhavealreadydevelopedfixesforthevulnerabili-
tiesdescribedinthisreport.
Inthetimegiven,X41wasabletoidentifyseveralflaws,butnothingthatisconsideredcritical.
X41D-SecGmbH PUBLIC Page5of50
RandomXAudit MoneroLabs
2 Introduction
X41reviewedthedesignandimplementationofRandomXwhichisaPoW1 algorithm,thatis
optimizedforgeneral-purposeCPUs.Toachievethis,randomcodeexecutionwithmemory-hard
techniquesareused.
SincetheRandomXalgorithmwillbeusedinthecryptocoincontextofMonero,anyflawsand
insecuritiescanhaveafinancialimpact.Thegoalofthistestwastouncoversuchflawsbeforethey
areexploitedbyrealadversaries.
2.1 FindingsOverview
DESCRIPTION SEVERITY ID REF
Hard-CodedCodeSize MEDIUM RNDX-PT-19-01 4.1.1
IntegerHandlinginJumpTargetCalculation MEDIUM RNDX-PT-19-02 4.1.2
IntegerTruncationonDatasetAllocationSize MEDIUM RNDX-PT-19-03 4.1.3
IncorrectCodeGeneratedinEmulationMode MEDIUM RNDX-PT-19-04 4.1.4
LowrelianceonBranchPredictionUnit NONE RNDX-PT-19-100 4.2.1
LowrelianceonFront-EndSchedulingLogic(dynamicsuperscalar NONE RNDX-PT-19-101 4.2.2
andout-of-orderexecution)
LackofrelianceonothermodernCPUelements NONE RNDX-PT-19-102 4.2.3
InsecureAesHash1R NONE RNDX-PT-19-103 4.3.1
ReversibleAesGenerator NONE RNDX-PT-19-104 4.3.2
InsufficientDiffusioninAesGenerator4R NONE RNDX-PT-19-105 4.3.3
PoorCodeCoverage NONE RNDX-PT-19-106 4.4.1
JITMemoryPagesforGeneratedCodeareWritableandExe- NONE RNDX-PT-19-107 4.4.2
cutable
SandboxingRandomXExecution NONE RNDX-PT-19-108 4.4.3
IncorrectSuperScalarHashLatencywhenProgramSizeistooSmall NONE RNDX-PT-19-109 4.4.4
LackofMachineReadableSpecification NONE RNDX-PT-19-110 4.4.5
Table2.1:SecurityRelevantFindings
1Proof-of-Work
X41D-SecGmbH PUBLIC Page6of50
RandomXAudit MoneroLabs
2.2 Scope
The audit was based on commit ID e4b[PII_REDACTED]71b0c4e3209d714bbcfeb943a61 in the
RandomXGitHubrepository2.
ThedesignreviewwasperformedbasedonthedocumentationavailableintheRandomXGitHub
repository. Thecodereviewhasbeenperformedbasedonthepubliclyavailablesourcecode.
Alltaskshavebeenperformedinamanualfashion,withoutleveragingtoolssuchasautomated
vulnerabilityscanners.Inadditiontothecodereview,limiteddynamictestshavebeenperformed-
mainlyinordertoverifyassumptionsandtobetterunderstandthetargetimplementation.
2.3 RecommendedFurtherTests
WhileeconomicallyviableFPGA3implementationsofthealgorithmhavebeenruledout,further
researchintopracticalASIC4implementationsofaRandomXprocessorisneeded. Tothatend,
onecouldbeginthemicroarchitecturaldesignoftheaVLIW5architectureasdescribedearlier,
orlookintofurtheravailableoptimizationsandapproaches.Onceamicroarchitecturedesignis
achieved,moreprecisegate/cellcountscanbeestablishedandthusapricetagcanbesetonthe
costofimplementingRandomXinVLSI6CMOS7.Withthisnumber,andtheattainedFmax/MIPSof
thedesignatagivenprocess/nodesize,onecanestablishtheminimumscaletoachieveeconomic
viabilityofrunningRandomXonASICs.
2https://github.com/tevador/RandomX
3FieldProgrammableGateArray
4Application-SpecificIntegratedCircuit
5VeryLongInstructionWord
6VeryLargeScaleIntegration
7Complementarymetal-oxide-semiconductor
X41D-SecGmbH PUBLIC Page7of50
RandomXAudit MoneroLabs
3 Rating Methodology
Securityvulnerabilitiesaregivenapurelytechnicalratingbythetestersastheyarediscovered
duringthetest.BusinessfactorsandfinancialrisksforMoneroLabsarebeyondthescopeofapen-
etrationtestwhichfocusesentirelyontechnicalfactors.Yettechnicalresultsfromapenetration
testmaybeanintegralpartofageneralriskassessment.Apenetrationtestisbasedonalimited
timeframeandonlycoversvulnerabilitiesandsecurityissueswhichhavebeenfoundinthegiven
time,thereisnoclaimforfullcoverage.
Intotalfivedifferentratingsexist,whicharethefollowing:
SeverityRating
None
Low
Medium
High
Critical
FindingswithsecurityimpactareclassifiedusingCWE1.TheCWEisasetofsoftwareweaknesses
thatallowsthecategorizationofvulnerabilitiesandweaknesses