Penetration Test Report (QuarksLab): OSTIF QuarksLab Monero Bulletproofs Final2

Evaluation of Bulletproof Implementation
Monero
Ref. 18-06-439-REP
Version 1.2
Date 2018 October 20th
Prepared for Monero Research Lab
With the support of OSTIF
Carried out by Quarkslab
Contents
1 Executive Summary 2
2 Context 4
2.1 Initial request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2.2 Evolution of the request and complementary evaluations . . . . . . . . . . . . . 4
2.3 Quarkslab’s planned work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.4 Role of Bulletproof in Monero . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
3 Code overview 7
3.1 Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3.2 The two main algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
3.2.1 Prove. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
3.2.2 Verify . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
4 Evaluation overview 13
4.1 Hypothesis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
4.2 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
4.3 Topics covered . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
4.3.1 Hash function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
4.3.2 Random generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
4.3.3 Protocol challenges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
4.3.4 Generators of the main subgroup of Ed25519 . . . . . . . . . . . . . . . 15
4.3.5 Arithmetic operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
4.3.6 Multi-exponentiation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
4.3.7 Prove and Verify algorithms . . . . . . . . . . . . . . . . . . . . . . . . . 18
4.3.8 Serialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
5 Vulnerabilities 20
5.1 Zero value challenges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
5.2 Dependent generators in the Java implementation . . . . . . . . . . . . . . . . . 20
5.3 Overflow in the double scalar multiplication . . . . . . . . . . . . . . . . . . . . 21
5.4 Erroneous identity output in Bos-Coster multi-exponentiation . . . . . . . . . . 22
5.5 Silently discarded element in Pippenger multi-exponentiation . . . . . . . . . . . 23
5.6 Invalid Verify input parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
5.7 Key compromise in Schnorr signature . . . . . . . . . . . . . . . . . . . . . . . . 25
5.8 Failures in input size validation during deserialization . . . . . . . . . . . . . . . 26
5.9 Failures in input size validation during containers deserialization . . . . . . . . . 27
5.10 Failures in input type validation during deserialisation . . . . . . . . . . . . . . . 28
6 Weaknesses 30
6.1 Checks and input validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
6.1.1 Function preconditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
6.1.2 Shift bounds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
6.2 Edge cases and failure cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
6.2.1 Empty proof . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
6.2.2 Tests on malformed proofs . . . . . . . . . . . . . . . . . . . . . . . . . . 32
6.2.3 Generators at infinity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
6.3 Fragilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
6.3.1 Random generation initialization . . . . . . . . . . . . . . . . . . . . . . 33
6.3.2 Manual type isolation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
6.3.3 Code duplication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
6.3.4 Hard coded literals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
7 Improvements 37
7.1 Code dependencies: OpenSSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
7.2 Use of near-standards: Keccak vs SHA-3 . . . . . . . . . . . . . . . . . . . . . . 37
7.3 Missing abstraction layers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
7.3.1 Code factoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
7.3.2 Variable and function names . . . . . . . . . . . . . . . . . . . . . . . . . 38
7.4 Lack of specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
7.4.1 Input parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
7.4.2 Computation of challenges . . . . . . . . . . . . . . . . . . . . . . . . . . 39
7.5 Simplifications and performance suggestions . . . . . . . . . . . . . . . . . . . . 40
7.5.1 Ugly sum computation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
7.5.2 Inner-product challenge for the prover . . . . . . . . . . . . . . . . . . . 41
7.5.3 Test of points at infinity . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
8 Conclusion 42
Bibliography 43
Ref.: 18-06-439-REP Quarkslab SAS 3
Evaluation of Bulletproof Implementation
Project information
Document Status Log
Version Date Status Authors
0.9 24/07/2018 Delivered to Monero Research Jean-Baptiste Bédrune
Lab Cédric Tessier
Marion Videau
1.0 27/07/2018 Reviewed Sarang Noether
1.1 07/08/2018 Reviewed Derek Zimmer
1.2 22/10/2018 Published
Quarkslab
Contact Role
Frédéric Raynal CEO and Founder
Marion Videau Chief Scientific Officer
Jean-Baptiste Bédrune R&D Engineer
Cédric Tessier R&D Engineer
Monero Research Lab
Contact Role
Sarang Noether R&D Engineer
Open Source Technology Improvement Fund
Contact Role
Derek Zimmer President and Founder
1
1. Executive Summary
This report describes the results of the security evaluation by Quarkslab of Monero’s im-
plementation of Bulletproof. Three senior engineers reviewed Monero’s Bulletproof be-
tween April 18 and July 17 for a total of 35 man-days of study. The review target is
the C++ code of the https://github.com/moneromooo-monero/bitmonero repository, branch
bp-multi-aggregation, commit 7f964dfc8f15145e364ae4763c49026a3fab985d, directory
src/ringct. The assessment included verifying that the implementation correctly reflected
the algorithms described in the original academic paper and looking for vulnerabilities by code
review, manual testing and fuzzing.
Bulletproofisanewnon-interactivezero-knowledgeproofprotocolwithshortproofsandwithout
trusted setup. It is integrated in the Monero project as a replacement for the previous protocol
based on ring signatures which generates larger proofs. Bulletproof proves that amounts lie in
a given positive interval, which is crucial in validating a transaction. Without this proof, due
to the elaborated cryptographic machinery involved, it is possible to create fraudulent coins.
Three categories of concerns emerged from the evaluation work:
Improvements towards a simpler and more robust code. They revolve around adding abstrac-
tion layers to the current implementation, building specifications and a few other simplification
and performance improvements for a more robust code.
Weaknesses that could turn into vulnerabilities during code evolutions. They coalesce around
three topics: insufficient input and boundary validation, lack of edge case and failure case
testingandfragilitiesintheimplementationchoices. Theycouldinducevulnerabilitiesinfuture
evolutions of Monero.
Vulnerabilities that should be fixed in priority. In the limited time frame of the assessment,
we preferred to focus on a search for weaknesses as wide as possible and did not dig into
exploitability. Hence none of the vulnerabilities found has lead to a practical exploit. However,
it does not mean it is impossible, especially when considering all the vulnerabilities directly
linked to inputs controled by an attacker. We gather in the following t