Penetration Test Report (TrailOfBits): nucypher

9/26/2018 Public Report - Google Docs
NuCypher
Security Assessment
August 27th, 2018
Prepared For:
MacLane Wilkison | N uCypher
maclane@nucypher.com
Prepared By:
JP Smith | T rail of Bits
jp@trailofbits.com
Ben Perez | T rail of Bits
benjamin.perez@trailofbits.com
Changelog:
June 15, 2018: Initial report delivered
August 27, 2018: Updated for public release
https://docs.google.com/document/d/18dtRtBIVTmpuoiHpl1HO_bPYZivLW0PhBLRDmyJZKDI/edit 1/35
9/26/2018 Public Report - Google Docs
Executive Summary
Engagement Goals & Coverage
Project Dashboard
Recommendations Summary
Short Term
Long Term
Findings Summary
1. Unsalted HKDF in utils.py
2. Multiple issues related to curve specification
3. Multiple issues related to parametrization over arbitrary curves
4. Insufficient validation of signatures
5. Network cannot detect malicious nodes
6. NuCypherKMSToken may be vulnerable to transaction reordering attacks
7. Server implements no rate-limiting functionality
8. Database has no snapshot and rollback functionality
9. Lack of anonymity allows collusion-based attacks
10. Database has no access controls
11. ProxyRESTServer.set_policy can be used to invalidate policy arrangements
12. Several issues related to policy issuance
13. Work orders have no protection from replay attacks
14. Ursula’s responses are unauthenticated
Appendix A. Vulnerability Classifications
Appendix B: Serialization testing code
Appendix C. Code Quality Recommendations
Appendix D. Slither static analysis
1
https://docs.google.com/document/d/18dtRtBIVTmpuoiHpl1HO_bPYZivLW0PhBLRDmyJZKDI/edit 2/35
9/26/2018 Public Report - Google Docs
Executive Summary
From May 10 to June 29, NuCypher engaged with Trail of Bits to review the security of
NuCypher’s blockchain platform and the PyUmbral proxy re-encryption library. Trail of Bits
conducted this assessment over the course of twelve person-weeks with two engineers.
The first two weeks were spent examining the PyUmbral library for cryptographic flaws.
The third week was spent reviewing the smart contracts in NuCypher KMS. The final two
weeks comprised of looking at collusion and DoS-based attacks on the NuCypher network.
The PyUmbral library is high quality, overall. The discovered issues are primarily due to the
fact that the library is curve-agnostic, allowing users to choose their own curves instead of
forcing the use of curves known to be secure. Defining PyUmbral exclusively over one
curve, such as secp256k1, would be a substantial improvement.
NuCypher KMS contained a variety of high-severity issues. As of June 29th, malicious
miners in the NuCypher network can mint free money by outputting random numbers
instead of valid re-encryption keys. Furthermore, the network’s lack of an anonymization
mechanism could lead to collusion-based attacks that would result in the compromise of
users’ private keys. Finally, NuCypher KMS contained several medium-severity issues
stemming from unimplemented functionality and lack of input validation.
To protect users of their network from impersonation, NuCypher must fix the variety of
data-validation and signature issues outlined in this report. Furthermore, as it currently
stands, users are not anonymous, which can lead to their private keys being leaked by
malicious nodes. This issue must be fixed before users have a financial stake in the
network. Finally, the overall robustness of the network is weakened by the fact that
malicious miners cannot be challenged or detected, allowing them to flood the network
with fake re-encryption keys and getting paid for their malicious behavior. Creating a
scheme to prevent this is non-trivial, but is absolutely essential to a functional NuCypher
product.
2
https://docs.google.com/document/d/18dtRtBIVTmpuoiHpl1HO_bPYZivLW0PhBLRDmyJZKDI/edit 3/35
9/26/2018 Public Report - Google Docs
Engagement Goals & Coverage
NuCypher sought to assess the safety of their proxy re-encryption library, PyUmbral,
against cryptanalytic attacks. They also wanted to ensure that their key management
system on the Ethereum blockchain was free of Solidity bugs, network vulnerabilities, and
collusion-based attacks.
During the engagement, we conducted a thorough audit of the PyUmbral library,
examining its openSSL use and writing tests to ensure its serialization routines were
correctly implemented. Also, we manually reviewed the cryptography in NuCypher KMS, as
well as the server code, policy management system, and Solidity contracts. We began
writing automated tests with Echidna for the blockchain component but were unable to
complete this activity due to time constraints.
PyUmbral
✓
Manually review all cryptographic code
✓
Read and review specifications for design flaws
✓
Check all serialization and deserialization code for possible risks
✓
Automate serialization testing with random inputs
❏
Check all call sites of the API for dangerous usage
Blockchain
✓
Perform static analysis on all Solidity code using Slither
✓
Manually review all Solidity code
✓
Manually review all Python code
✓
Run automated tests for ERC20 vulnerabilities
❏
Write property tests and fuzz UserEscrow, MinerEscrow, Issuer, and PolicyManager
contracts
✓
Explore collusion-based attacks
Crypto
✓
Manually review all cryptographic code
✓
Check all call sites of the crypto API for dangerous usage
✓
Check all signature usage
✓
Check all serialization and deserialization code for possible risks
✓
Check all X.509 certificate code for standards compliance and safety
✓
Ensure that the only randomness available via API is cryptographically secure, even
in pathological operating conditions
✓
Analyze the consequences of collusion attacks as they specifically pertain to
cryptographic code
3
https://docs.google.com/document/d/18dtRtBIVTmpuoiHpl1HO_bPYZivLW0PhBLRDmyJZKDI/edit 4/35
9/26/2018 Public Report - Google Docs
Keystore
✓
Manually review all Keystore code for logic errors
✓
Check call sites of the crypto API for dangerous usage
Network
✓
Review server code for code execution or resource exhaustion bugs
✓
Review server code for logic bugs
✓
Consider denial-of-service scenarios
Policy
✓
Review model code for logic bugs with security implications
Misc
✓
Review Bytestring splitter code for possible functionality issues
✓
Review Constant Sorrow for vulnerabilities
4
https://docs.google.com/document/d/18dtRtBIVTmpuoiHpl1HO_bPYZivLW0PhBLRDmyJZKDI/edit 5/35
9/26/2018 Public Report - Google Docs
Project Dashboard
Application Summary
Name NuCypher, PyUmbral
Type Proxy re-encryption system
Platform Python, EVM
Engagement Summary
Dates May 10 - June 29, 2018
Method Whitebox
Consultants Engaged 2
Level of Effort 12 person-weeks
Vulnerability Summary
◼◼◼◼◼◼
Total High Severity Issues 6
◼◼◼◼
Total Medium Severity Issues 4
◼◼◼◼
Total Low Severity Issues 4
Total Informational Severity Issues 0
Total 14
Category Breakdown
◼
Access Controls 1
◼
Configuration 1
◼◼
Cryptography 2
◼
Data Exposure 1
◼
Data Validation 1
◼◼◼◼◼◼◼
Denial of Service 7
◼
Timing 1
Total 14
5
https://docs.google.com/document/d/18dtRtBIVTmpuoiHpl1HO_bPYZivLW0PhBLRDmyJZKDI/edit 6/35
9/26/2018 Public Report - Google Docs
Recommendations Summary
This section aggregates all the recommendations made during the engagement. Short-term
recommendations address the immediate causes of issues. Long-term recommendations
pertain to the development process and long-term design goals.
Short Term
❑
Add a salt parameter to the KDF. The utils.py library provides a KDF but sets salt to
none. All KDF applications must be salted to ensure independence across different uses of
the hash function.
❑
Define which curve the system is using in a single location. M any functions in
PyUmbral take a curve parameter but default to a global configuration if the curve is not
specified. This allows users to generate private keys over one curve but generate public
keys over another, leading to an inconsistent state.
❑
Only allow users a small whitelist of curves to select from. P yUmbral lets users
choose arbitrary–-eve