Penetration Test Report (NCCGroup): NCC Group Keybase KB2018 Public Report 2019 02 27 v1.3

Protocol Security Review
Keybase
February 27, 2019 – Version 1.3
Preparedfor
MaxKrohn
Preparedby
KeeganRyan
ThomasPornin
ShawnFitzgerald
©2019–NCCGroup
PreparedbyNCCGroupSecurityServices,Inc. forKeybase. Portionsofthisdocumentandthetemplates
usedinitsproductionarethepropertyofNCCGroupandcannotbecopied(infullorinpart)without
NCCGroup’spermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,NCCGroupthepublisher,and
theauthor(s)assumenoresponsibilityforerrors,omissions,orfordamagesresultingfromtheuseof
the information contained herein. Use of NCC Group’s services does not guarantee the security of a
system,orthatcomputerintrusionswillnotoccur.
DocumentChangeLog
Version Date Change
1.0 2018-10-14 Initialreport
1.1 2018-10-18 Updatedforinitialtechnicalreview
1.2 2018-12-13 Updatedforadditionaltechnicalreview
1.2 2019-02-11 Updatedforfinaltechnicalandmarketingreview
1.3 2019-02-23 PublicReportReadyforKeybase
2 | KeybaseProtocolSecurityReview
Executive Summary
In September 2018, NCC Group performed a review werequicklyfixed.
oftheKeybaseprotocoldesignsandimplementations.
One of Keybase’s design features is hosting public
Keybase offers several features that are designed to
information in a way that allows third parties to verify
provide cryptographic guarantees of security while
that the data has not been tampered with. For this
maintaining a high level of usability. These features
tosucceed,independentimplementationsareneeded,
include key management, identity proofs, secure chat,
whichinturnrequirethoroughdocumentationonhow
ephemeral messaging, encrypted file storage, and key
to consume and verify the data. While newer features
exchange,amongothers. Keybasesupportsclientsfor
aredocumented,somefeatures,especiallylegacyones,
Android, iOS, desktop (Windows, macOS, and Linux),
are lacking in documented implementation details. In
andweb,althoughthecorelibraryiscross-platformand
addition, some of the documents do not perfectly
writteninGo.
represent the current state of Keybase’s code. This
ScopeandLimitations increasesthedifficultyofauditingthecode,asitmaynot
be clear that some features even exist. This increases
This review aimed to identify any shortcomings in
the difficulty of verifying both the data and the client
these components that fail to deliver on the security
code. Somedocumentationshortcomingsarerecorded
promises of the product. To maximize the benefit
inAppendixBonpage36.
of this engagement, NCC Group focused on analyzing
the designs to either confirm the claims of security
Another common theme was the presence of legacy
or identify weaknesses. This approach both justifies
code. Inorderforclientstoverifythepublicrecord,they
positivedesigndecisionsandstrengthensweakerones.
must understand data generated by the earliest itera-
A secondary focus of the review was analyzing the
tions of the protocols, which have evolved significantly
shared core library for exploitable flaws, as the scope
since their creation. Verifiability requires backwards
of the vulnerabilities would affect multiple platforms
compatibility, and so the client increases in complexity
and have a greater impact. Most of NCC Group’s
overtime,makingitdifficulttoremovelegacycode.
effort focused on reviewing sigchain verification, local
keystorage, theKeybasefilesystem, keyexchangeand Thisdoesnotnecessarilyimplythatlegacycodeisinse-
encrypted chat. The substantial complexity of the cure,butcomplexityandsecurityareintertwined–every
Keybase codebase also meant NCC Group could not new piece of code may contain a security vulnerability,
performanexhaustivereviewofallcomponentsinthe andmorecodecorrelateswithmorerisk. Newcodealso
allottedtime. means more ways different components may interact:
legacy payloads and legacy signatures may be secure,
NCC Group devoted nine person-weeks during this
but security may not extend to modern payloads with
security assessment taking place between September
a legacy signature. The need to support legacy data
10andSeptember28,2018andfocusedthereviewon
contributedinparttobothfindingNCC-KB2018-001on
a specific Github commit.1 At Keybase’s request, NCC
page22andfindingNCC-KB2018-004onpage28.
Group retested certain findings that were fixed during
the course of the review period and also during the StrategicRecommendations
weekofFebruary25th2019;theresultsoftheretestare NCC Group recommends a long-term approach of
reflectedinthisreportandthefindingsmarkedasfixed addressing the themes identified above. This re-
whereappropriate. port suggests design principles that would further
strengthen the overall security posture of the Keybase
KeyFindings
ecosystem. Improvingdocumentationrequireswriting
Keybaseaimstoofferservicestoitsusersthatareboth
upnotonlytheconcepts,butalsothefinedetailsofthe
easytouseandcryptographicallysecure, reducingthe
Keybase protocol, so that independent but compatible
reliance on a central authority. Keybase’s architecture
implementationsmaybewritten. Suchdocumentation
protects user data, limits the need to trust servers,
wouldgreatlyimprovetheauditabilityofthesystemand
and links identities via cryptographic signatures. In its
increaseusertrust.
investigation, NCC Group found that while Keybase’s
design protects against many types of attacks, there NCC Group also recommends taking steps to address
wereweaknessesintheKeybaseimplementation;these the current complexity of the protocols. While an
1https://github.com/keybase/client/commit/049d28bddb3c71cdd986f52d0f9fd9344d17a713
3 | KeybaseProtocolSecurityReview
effort to phase out legacy data would be considerable
and may pose security risks, clients could convert old
data into newer formats in the background, and then
eventually only support the new formats. Moving
forward, the security risks of a complex code base
should be weighed when introducing new features.
Keybasehasconsideredtheriskandrewardofphasing
outlegacymechanismsmultipletimesbuthasdecided
thatthebenefitsarenotworththecostatthistime.
Simplicityshouldbeadoptedasadesigngoal,andfea-
turesshouldbeintroducedwithsomenotionoffuture-
proofing: changes should be possible without having
to redesign security-critical components. Addressing
these two points would go a long way in improving
Keybase’s overall security posture while achieving the
goalofuser-friendlycryptographicguarantees.
4 | KeybaseProtocolSecurityReview
Dashboard
TargetMetadata EngagementData
Name KeybaseProtocol Type DesignandImplementationReview
Type MultiplatformClient Method Code-assisted,DesignReview
Platforms Golang Dates September10,2018toSeptember
28,2018
Environment v2.7.0
Consultants 3
Levelofeffort 9person-weeks
Targets
Documentation https://keybase.io/docs
ClientCode https://github.com/keybase/client/commit/049d28bddb3c71cdd986f52d0f9fd9344d17a713
Encodingand https://github.com/keybase/go-codec/tree/1cf5262595f30a38e4c594385d275b83653a6a89
DecodingLibrary
FindingBreakdown
CriticalRiskissues 0
HighRiskissues 1
MediumRiskissues 3
LowRiskissues 1
Informationalissues 0
Totalissues 5
CategoryBreakdown
Cryptography 2
DataValidation 2
DenialofService 1
Key
Critical High Medium Low Informational
5 | KeybaseProtocolSecurityReview
Sigchain Verification
NCCGroupreviewedtheverificationprocessofauser’ssigchain,2whichisaper-userlistofstatementsregardingthe
user’sidentity. AsaKeybaseuserperformscertainactions,suchasprovisioninganewdevice,followinganotheruser,
orconnectinganidentitytoathird-partywebsite,anewentryisappendedtothesigchain. Thesigchainforeveryuser
ispublicanddesignedtobeimmutable,sincetheabilitytoretroactivelymodifyauser’ssigchaincouldunderminethe
confidenceinearlierstatementsabouttheiridentity. Keybaseperiodicallyaddsahashderivedfromallusers’sigchains
totheBitcoinblockchain3toallowuserstoverifythesigchainofferedupbytheserver.
Therearetwoprimaryadversariestheusersigchainverificationprocessmustprotectagainst. Thefirstisamalicious
serverthatiscapableofreturningarbitrarydatainresponsetosigchainAPIqueries. Assigchaincontentsareobtained
bytheclientfromtheserv