Penetration Test Report (NCCGroup): NCC Group EthereumFoundation ETHF002 Report 2021 01 20 v1.0

BLST Cryptographic Implementation Review
Ethereum Foundation
January 20, 2021 – Version 1.0
Preparedfor
AndyPolyakov
KellyOlson
SeanGulley
SimonPeffers
Preparedby
EricSchorn
ThomasPornin
©2021–NCCGroup
PreparedbyNCCGroupSecurityServices,Inc. forEthereumFoundation. Portionsofthisdocumentand
thetemplatesusedinitsproductionarethepropertyofNCCGroupandcannotbecopied(infullorin
part)withoutNCCGroup’spermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,NCCGroupthepublisher,and
theauthor(s)assumenoresponsibilityforerrors,omissions,orfordamagesresultingfromtheuseof
the information contained herein. Use of NCC Group’s services does not guarantee the security of a
system,orthatcomputerintrusionswillnotoccur.
Executive Summary
Synopsis • Exporting far more functionality and library internals
In October 2020, Supranational, Protocol Labs and to the calling application than necessary, which
the Ethereum Foundation engaged NCC Group’s Cryp- increasesapplicationcomplexity,riskoflibrarymisuse
tography Services team to conduct a cryptographic andimpactofchanges.
implementation review of the BLST library. This library • Missingand/orunevenlytestedfunctionalityforlesser
implementssupportforthedraftIETFspecificationson usedaspectsofthetargetspecificationsoutsideofthe
Hashing to Elliptic Curves and BLS Signatures. The Ethereum2.0usageprofile.
latterspecificationusesadvancedcryptographic-pairing • Issues involving modular reduction, point multiplica-
operationstofeatureaggregationpropertiesforsecret tionandclearingofsecretsfrommemory.
keys, public keys and signatures. This functionality is
PartialRetestResults
central to the emerging Ethereum 2.0 Proof-of-Stake
The latter portion of the project involved retesting
block-validation mechanism. Full source code and
fixes for selected findings across a variety of commits
support was provided. The project was delivered by 2
culminatingin9b4b16f. Thedetailedentryforeachof
consultantswithin23person-daysofeffort.
theaddressedfindingsnowincludesabriefdescription
Scope of retest observations with results summarized in
NCC Group’s evaluation included the following source theTableofFindingsonpage4. Asummaryofthefinal
coderepositoryandspecifications: positionisasfollows:
• Commit414ac6bofgithub.com/supranational/blst • Therewerenocriticalorhighseverityfindings.
– C source code, Assembly source code for multiple • Initially, there were 3 medium severity findings re-
targetarchitectures. ported. Subsequently,2werefixedand1categorized
– Rust and Golang bindings; Other language bind- as‘riskaccepted’. Thisleaves0open.
ingswereoutofscope. • Initially,therewere14lowseverityfindingsreported.
• IETFCFRGdraftforBLSSignaturesv4 Subsequently, 9 were fixed, 3 categorized as ‘risk
• IETFCFRGdraftforHashingtoEllipticCurvesv10 accepted’and1partiallyfixed. Thisleaves2open.
• Initially, there were 3 informational observations
Limitations reported. Subsequently,2wereaddressed. Theseare
While the BLST library largely contains sufficient func- notconsideredsecurityweaknesses.
tionality to support the target specifications, the API
StrategicRecommendations
does not fully correlate to the specification. In some
casesacallingapplicationisexpectedtocombinelower- The in-scope code is well structured, highly optimized,
level primitives to perform a particular function, such performant and demonstrates careful attention to
asthepublickeysubgroupcheck,whichdemonstrates detail. Beyond addressing the reported findings, NCC
library flexibility but also moves relevant functionality Grouprecommendsprioritizingthefollowingareasfor
outside of the library. As the code is minimally futuredevelopment:
documented,fullymatchingintentwithimplementation
• Revisit the API to present the simplest possible
canbesubjectiveinafewplaces. Nonetheless, robust
interfacethattightlycorrespondstothetargetspeci-
coverageofallin-scopecodewasachieved.
fications. Additionalperformanceenhancementscan
builduponthisfoundation.
KeyFindings
• Moveallpossiblefunctionalityfromthebindingsinto
The BLST library demonstrates leadership in high
the C source to maximize consistency across lan-
performancethroughanoptimizedimplementationinC
guagesandusefulnesstoCusers.Thebindingswould
andAssembly,andleadershipinbroadusabilitythrough
then largely contain language-specific validation and
multiple language, compiler and architecture targets.
threadingsupport.
However,thereviewuncoveredanumberofflawsfalling
• Enforce strict validation upon deserialization to
intoseveralbroadcategories:
externally-opaque data structures to prevent the
• Insufficient validation constraints that need to be libraryfromoperatingoninvalidapplicationdata.
updated to the latest version of the BLS Signatures • Develop robust documentation to maximize devel-
specification,whichrisksinteroperabilityissues. operproductivity, applicationcorrectnessandlibrary
uptake.
2 | SupranationalBLSTCryptographicImplementationReview NCCGroup
Dashboard
TargetMetadata EngagementData
Name BLSTSignatureLibraryforBLS12-381 Type CryptographyImplementationReview
Type Sourcecode Method Manualsourcecodeanalysis
Platforms CwithAssemblyforseveral Dates 2020-10-13to2020-11-06
architectures;RustandGolang
bindings
Environment Productioncommit Consultants 2
LevelofEffort 23person-days
Targets
BLSTCodeRepository https://github.com/supranational/blst/tree/414ac6b185f6b2ef2e6364d5716f915af966c465
FindingBreakdown
Criticalissues 0
Highissues 0
Mediumissues 3
Lowissues 14
Informationalissues 3
Totalissues 20
CategoryBreakdown
Configuration 4
Cryptography 7
DataExposure 2
DataValidation 7
ComponentBreakdown
A:BLSTLibrary 2
B:Assembly 2
C:CSource 3
D:RustBindings 8
E:GolangBindings 5
Key
Critical High Medium Low Informational
3 | SupranationalBLSTCryptographicImplementationReview NCCGroup
Table of Findings
Foreachfinding,NCCGroupusesacompositeriskscorethattakesintoaccounttheseverityoftherisk,application’s
exposureanduserpopulation,technicaldifficultyofexploitation,andotherfactors. ForanexplanationofNCCGroup’s
riskratingandfindingcategorization,seeAppendixConpage50.
A:BLSTLibrary
Title Status ID Risk
MissingPopProve()andPopVerify()Functions Reported 015 Low
UnevenIntegrationTestCoverageofPrimaryFunctionality Reported 023 Informational
B:Assembly
Title Status ID Risk
IncompleteModularReduction(256bits) Fixed 006 Low
MiscomputationofParityintheFieldExtension Fixed 003 Informational
C:CSource
Title Status ID Risk
MissingSecretKeyDeserializationBoundCheck Fixed 005 Low
IncorrectPointMultiplicationResult Fixed 016 Low
NonConstant-TimeInversion Fixed 021 Informational
D:RustBindings
Title Status ID Risk
InsufficientInputValidationDuringDeserialization Fixed 004 Medium
MissingChecksinAggregateVerify Fixed 009 Medium
ExtraneousCExports RiskAccepted 010 Medium
UnspecifiedRustToolchainVersion RiskAccepted 001 Low
SensitiveInformationNotCleared Fixed 002 Low
InsufficientPublicKeyValidation Fixed 007 Low
IncorrectResultforZeroLengthAggregation PartiallyFixed 008 Low
StructFieldsWithExtraneouspubAccessModifiers Fixed 017 Low
E:GolangBindings
4 | SupranationalBLSTCryptographicImplementationReview NCCGroup
Title Status ID Risk
SensitiveInformationNotCleared Fixed 012 Low
MissingPublicKeyValidateFunction Fixed 013 Low
ExtraneousTypeExports RiskAccepted 018 Low
InsufficientPublicKeyValidationonDeserialization RiskAccepted 019 Low
MissingChecksinAggregateVerify Fixed 020 Low
5 | SupranationalBLSTCryptographicImplementationReview NCCGroup
Finding Details – A: BLST Library
Finding MissingPopProve()andPopVerify()Functions
Risk Low Impact: Medium,Exploitability: Undetermined
Identifier NCC-ETHF002-015
Status Reported
Category Cryptography
Component A:BLSTLibrary
Location Missingfunctionalityin(forexample)Rustbindingslib.rs.
Impact An application intending to target a ciphersuite configuration corresponding to the ‘Proof
ofPossessionScheme’isrequiredtoimplementthemissingPopProve()andPopVerify()
functionsfromothercomplex(sub)components,withahighpotentialformistakesbycasual
users