Penetration Test Report (iSEC): NCC Group Zcash Crypto Report 2016  10 10

Zcash Cryptography and Code Review
Zcash
October 10, 2016
Preparedfor
NathanWilcox
DairaHopwood
ZookoWilcox
Preparedby
AlexBalducci
RobertSeacord
©2016–NCCGroup
PreparedbyNCCGroupSecurityServices,Inc. forZcash. Portionsofthisdocumentandthetemplatesusedinits
productionarethepropertyofNCCGroupandcannotbecopied(infullorinpart)withoutNCCGroup’spermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,NCCGroupthepublisher,andtheauthor(s)
assumenoresponsibilityforerrors,omissions,orfordamagesresultingfromtheuseoftheinformationcontained
herein. UseofNCCGroup’sservicesdoesnotguaranteethesecurityofasystem,orthatcomputerintrusionswill
notoccur.
Executive Summary
Synopsis KeyFindings
InAugust2016,ZcashengagedNCCGrouptoperform NCCGroupdidnotfindanycriticalseverityissuesthat
a targeted review of the Zcash cryptocurrency imple- wouldunderminetheintegrityoftheZcashblockchain
mentation. The review was performed in two parts, or undermine the security of confidential transactions.
conductedsimultaneously.Thefirstpartwasconducted NCCGroupidentified a number of C++ coding errors
by NCC Group’s Cryptography Services Practice, and that could result in stack-based buffer overflows, data
was focused on validating that the implementation of races,memoryuse-after-freeissues,memoryleaks,and
ZcashadheredtothespecificationoftheZcashProtocol other potentially exploitable runtime error conditions.
Specificationversion2016.0-alpha-3.1-58-g8711aswell Additionally, most, if not all, third-party open source
asensuringthatthecryptographicimplementationwas library dependencies were identified as being out of
free from security errors. The second part was a C++ date. Keyfindingsfromtheengagementincluded:
source code review for vulnerabilities that can occur
• A potentially remotely accessible stack-based buffer
in unmanaged languages, focusing on the Zcash and
overflow that could allow an attacker the ability to
libsnark libraries. The review also included a cursory
executearbitrarycodeonarunningzcashdhost.
reviewofdependentlibrariesandrecommendationsfor
• ZcashzkSNARKprovingandverificationkeyscan
improvingsoftwareassurancepracticesatZcash.
be tampered with in transit during initial download
This assessment was atypical for NCC Group because becauseofmissingverificationlogic.
itemphasizedremediationoveranalyzingexploitability, • Out-of-dateversionsofthird-partylibrarieswereiden-
includingissuesreportedbytools. Thismeansthatless tified, including Berkeley DB, OpenSSL, and Boost.
timewasspentdetermininghowspecificsecurityflaws Manyoftheselibrarieshavesignificantlyrevisedthe
mightbeexploitedandmoretimeidentifyingasmany versionsusedbyZcashtoaddressmultipleCVEs.
possiblesecurityissuesandassociatedremediationas
timeallowed. Limitations
Zcash is a complicated cryptographic protocol that
The engagement ran from August 8 to September 1,
builds upon cutting-edge academic research. NCC
2016, with the majority of the work conducted in the
Group reviewed the protocol by comparing the spec-
firstthreeweeks. Twoconsultantswerestaffedoneach
ification to the implementation, but did not give the
partoftheengagement, withoneconsultantactingas
protocol and underlying cryptographic constructions
TechnicalLead.
the scrutiny it might receive in a rigorous academic
review.
Scope
NCCGroup’sevaluationincluded: Because of the quantity of static and dynamic analysis
diagnostics, some findings were not fully analyzed
• Statically analyzing the code using Coverity Prevent,
during the assessment. The raw data, however, was
GCC,andLDRA.
provided to Zcash for further analysis. Some effort
• Instrumenting the code with AddressSanitizer,
was redirected to propose detailed remediations to
ThreadSanitizer, and UndefinedBehaviorSanitizer
the development team in the form of pull requests to
andperformingdynamicanalysisbyrunningthefull
improvethelikelihoodthattherepairswouldbemade
testsuiteandRPCtests.
beforetheinitialreleaseoftheproduct.
• Fuzzing Zcash and the libsnark library using the
AmericanFuzzyLop(AFL)fuzzer.2
• Reviewing the Zcash specification and matching the
implementationagainstit.
• Analyzing the constraints used for proving and ver-
ifying zkSNARKs. Zero-Knowledge Succinct Non-
interactiveArgumentofKnowledge(zkSNARK)isthe
cryptographictoolunderlyingZcash.
1https://github.com/zcash/zips/blob/zips27.reorganisation.0/protocol/protocol.pdf
2http://lcamtuf.coredump.cx/afl/
2|ZcashCryptographyandCodeReview
Dashboard
TargetMetadata EngagementData
Name Zcash Type Cryptographic&CodeReview
Type Bitcoin-forkedcryptocurrency Method SourceReviewandStaticAnalysis
Platforms C++ Dates 2016-08-08to2016-09-02
Environment Branchzc.v0.11.2.z8 Consultants 4
Levelofeffort 45person-days
Targets
Zcashv0.11.2.z8 https://github.com/zcash/zcash/tree/v0.11.2.z8
VulnerabilityBreakdown
CriticalRiskissues 0
HighRiskissues 2
MediumRiskissues 3
LowRiskissues 8
Informationalissues 2
Totalissues 15
CategoryBreakdown
AccessControls 2
Cryptography 1
DataExposure 2
DataValidation 4
DenialofService 1
Patching 1
Timing 2
Other 1
Uncategorized 1
ComponentBreakdown
All 2
zcash 2
bitcoin 9
libsnark 2
leveldb 1
Key
Critical High Medium Low Informational
3|ZcashCryptographyandCodeReview
Test Details
CryptographicReview
SpecificationReview
NCC Group’s Cryptography Services reviewed Zcash’s implementation of the Zcash Protocol Specification version
2016.0-alpha-3.1-58-g873forinconsistenciesandcomparedittoitsprecursor,describedinZerocash: Decentralized
AnonymousPaymentsfromBitcoin.4 TheZcashProtocolSpecificationismostlycomplete;however,severalimportant
topicsareimplementedinthecodebutnotyetfullydocumentedinthespecification5:
1. Coinbase and nonconfidential-to-confidential transactions are not adequately defined. When a transaction only
hasavpub_old—apublicinputvalueandnoconfidentialinputnotes—twodummyinputnotesareattachedtothe
Zcashtransaction. Thesedummyinputnoteshaveavalueequaltozeroandrandomvaluesforthespendingkey
(publicandprivateportions),rhoandr. Whilethesevaluesarerandom,thedummynoteisstillvalid;thatis,the
nullifierandMACarestillwell-formed.
2. Coinbase and nonconfidential-to-confidential transactions both skip the Merkle tree constraints. When a
transaction does not have any previous confidential transactions associated with it, the Merkle tree checks (for
example,doesthisnotecommitmenthaveavalidpathtotherootofthetree?) mustbeskipped(becausethese
arefakenotes, theydonotexistinthetree!). Tosimplifythisprocess, anadditionalparametervalue_enforced
isincluded. Whenthetransactionvalueiszero(thatis,dummyinputnoteshavebeenadded),value_enforced
is allowed to take the value of zero; when a transaction value is non-zero, value_enforced is set to one. The
value_enforcedargumentispassedtotheMerkletreeconstraintsystemandwilldeterminewhetheravalidpath
needstobeprovidedornot.
3. Coinbasetransactionsmustbespentusingaconfidentialtransaction.
4. Afounder’srewardistakenfromeachblockupuntilthefirstsubsidyhalvinginterval.
Issues1,2,and4listedabovehavebeendocumentedintheprotocolspecificationsincetheoriginalreleaseofthis
reporttoZcash.
ImplementationReview
NCCGroupexaminedtheimplementationoftheZcashProtocolSpecification. Alldetails, cryptographicprimitives,
andconstructionsinthespecificationwereinscope;however,anacademicreviewoftheschemewasnotperformed.
NCCGroupdidnotexaminethespecificencodingsandserializationsofaddresses,keys,notes,andotheritemsthat
werebeingchanged.
FairieGoldAttack
AninitialfocusofthereviewwasontheFairieGoldattackdescribedinsection7.4ofthespecificationandanalternative
attackputforward. IntheoriginalZcashdesign,nullifiersofnoteswerederivedfromthespendingkeyandaunique
pernotevaluerho.Becausethevaluerhoforeachnoteisattackercontrolled,thespenderofanotecancreatemultiple
notes(spends)withthesamenullifier;recipientsofthesecraftednoteswillnotbeabletospendthemasthenullifier
alreadyexistsinthenullifierset. Tothwartthis,Zcashforcesthenullifierstobeuniquebyderivingthemfromseveral
otherparameters,includingthenullifiersoftheprevioustransaction,andenfo