Penetration Test Report (NCCGroup): NCC Group ProtocolLabs PRLB007 Report 2020 10 20 v1.0

Filecoin Bellman/BLS Signatures Cryptography
Review
Protocol Labs
October 20, 2020 – Version 1.0
Preparedfor
FriedelZiegelmayer
JonathanVictor
Preparedby
EricSchorn
PaulBottinelli
JavedSamuel
©2020–NCCGroup
Prepared by NCC Group Security Services, Inc. for Protocol Labs. Portions of this document and the
templatesusedinitsproductionarethepropertyofNCCGroupandcannotbecopied(infullorinpart)
withoutNCCGroup’spermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,NCCGroupthepublisher,and
theauthor(s)assumenoresponsibilityforerrors,omissions,orfordamagesresultingfromtheuseof
the information contained herein. Use of NCC Group’s services does not guarantee the security of a
system,orthatcomputerintrusionswillnotoccur.
Executive Summary
Synopsis
InMay2020,ProtocolLabsengagedNCCGroup’sCryptographyServicesteamtoconductacryptographyreviewof
multiple Filecoin code repositories. Filecoin is a decentralized storage and content distribution network developed
by Protocol Labs. These repositories implement finite field and group arithmetic, cryptographic pairings, SHA2 via
intrinsics,BLSsignaturesandzk-SNARKoperations. Takentogether,theseoperationsdeliverthecutting-edgecrypto-
graphicprimitiveswhicharecentraltothesecurityoftheFilecoinnetwork. Thisnetworkreliesuponprovablesecurity
andauthenticitytoensureuserdataisstoredcorrectlyandsecurelyovertime. Theassessmentwasopen-endedbut
wastime-boxedtoelevenperson-daysofeffort. Goodcommunicationwasestablishedthroughakick-offcall,astatus
updatecallandoverSlack. TheassessmentwasfollowedbyabriefretestofseveralfindingsinJune2020.
Scope
NCCGroup’sevaluationincludedthefollowingGitHubsourcecoderepositoriescomprisingapproximately26klinesof
Rust. Thelatestcommitswerereviewedasnotedandparticularareasoffocusarehighlightedbelow.
• filecoin-project/ffcommit998ddb0 – Fullaudit,specificfocusonnewcode
– BasedonZcashcode,focusonassemblyadditions • filecoin-project/bls-signaturescommit0ecd251
• filecoin-project/groupcommit57aa2e7 – Full audit, specific focus on new code and compli-
– Interfacedefinitions ancetodraftspecification
• filecoin-project/pairedcommit7cc51a4 • filecoin-project/bellmancommit300b52d
– Focusonimplementationofhash-to-curve. – Comprehensive audit including a number of addi-
• filecoin-project/rust-sha2nicommit29532da tionsincludingtheOpenCLGPUcode.
– Dynamicfeaturedetection,SHAintrinsics
Limitations
Included test cases relating to SHA2-intrinsics and (some) GPU functions were not run due to advanced hardware
requirements. Whilethisisgenerallyanout-of-scopetask,itdidmarginallyimpacttestingconvenienceandproduc-
tivity, thoughitdidnotmateriallyimpacttheresultingin-scopecoverage. Additionalinspectionofthevariousbuild
flows/optionsisneverthelessrecommended.
KeyFindings
Thetargetcoderepositoriesdemonstratedanumberofexcellentdesignandimplementationchoices. Theseincluded
theuseofRusttoavoidthemanysafety-relatedchallengesofCandC++,aseparationofconcernsthatkeepsrelated
levelsofcryptographicabstractionstightlycoupledandmodular,asolidsetoftestcasesthatenableddynamicinspec-
tionduringtesting,andveryadvancedalgorithms(particularlyinhash-to-curve). Theassessmentdiduncoverseveral
issues,themostnotableincluding:
• Alackofdistinctmessagesenforcementinbls-signatureverificationthatcouldallowa“roguekey”toforgean
aggregatesignature.
• Twomissedlengthchecksrelatedtoinputdatavalidation. Onemayleadtoapanicandtheothercouldresultinan
unanticipatedpublickey.
• AmissedopportunitytocheckforerrorswithinrandomnessgenerationwhichmaypresentanissueiftheOSentropy
isexhaustedorotherwiseproblematic.
• Slightlyoutdatedandinconsistentdependencyspecificationsthatmayincreasethedifficultyofdebug.
• Missing and inconsistent compiler specification across repositories; Note that the compiler’s nightly channel is
requiredforcodebuilds.
RetestResults
InJune2020,ProtocolLabsundertookaretestofselectedfindingsuncoveredintheoriginalassessmentonanupdated
filecoin-project/bls-signatures (commit 0ecd251) repository. Findings NCC-PRLB007-004, NCC-PRLB007-005, NCC-
PRLB007-006, NCC-PRLB007-007 and NCC-PRLB007-008 were reviewed to determine whether each was fully fixed,
partiallyfixedornotfixed. Thedetailedentryforeachofthesefindingsnowincludesabriefdescriptionoftheretest
2 | FilecoinBellman/BLSSignaturesCryptographyReview NCCGroup
observationsandresults. Theoverallretestresultscanbesummarizedasfollows:
• FindingsNCC-PRLB007-004,NCC-PRLB007-005,NCC-PRLB007-006,NCC-PRLB007-007andNCC-PRLB007-008have
beenfullyfixed.
ThecurrentstatusofeachfindingisalsolistedintheTableofFindingsonpage5.
StrategicRecommendations
Thein-scopecoderepositoriesfollowsecurecodingpracticesanddemonstratecarefulattentiontoedge-cases. As
thecodemovestowardsproductiondeployment,NCCGrouprecommendsprioritizingthefollowingfocusareas:
• Ensureallapplicationinputisvalidatedastightlyaspossibleasearlyaspossible.
• Periodicallyrevisitandupdateallrepositorydependenciesandcompilerspecifications.
• Consideropportunitiestoadoptconstanttimealgorithmsandsecretclearing.
• Documenttheimplementedalgorithmsmoreclearly(e.g. inhash-to-curve)viacodecomments.
• ConsiderfollowingthedraftspecificationforBLSsignaturesmorecloselywithexplanationsfordivergence.
3 | FilecoinBellman/BLSSignaturesCryptographyReview NCCGroup
Dashboard
TargetMetadata EngagementData
Name FilecoinBLSSignatures Type Cryptographyreview
Type CryptographyLibrary Method Manualsourceinspection
Platforms Rust Dates 2020-05-13to2020-05-22
Environment Sourcecode Consultants 2
LevelofEffort 11person-days
Targets
https://github.com/filecoin-project/ff Traitsandutilitiesforworkingwithfinitefields
https://github.com/filecoin-project/group Ellipticcurvegrouptraitsandutilities
https://github.com/filecoin-project/pairing Pairing-friendlyellipticcurvelibrary
https://github.com/filecoin-project/rust-sha2ni Dynamicfeaturedetection,SHAintrinsics
https://github.com/filecoin-project/bls-signatures BLSsignaturesinRust
https://github.com/filecoin-project/bellman zk-SNARKlibrary
FindingBreakdown
Criticalissues 0
Highissues 0
Mediumissues 1
Lowissues 5
Informationalissues 2
Totalissues 8
CategoryBreakdown
Configuration 1
Cryptography 2
DataExposure 1
DataValidation 3
Patching 1
ComponentBreakdown
Systemic 3
bls-signatures 5
Key
Critical High Medium Low Informational
4 | FilecoinBellman/BLSSignaturesCryptographyReview NCCGroup
Table of Findings
Foreachfinding,NCCGroupusesacompositeriskscorethattakesintoaccounttheseverityoftherisk,application’s
exposureanduserpopulation,technicaldifficultyofexploitation,andotherfactors. ForanexplanationofNCCGroup’s
riskratingandfindingcategorization,seeAppendixAonpage20.
Title Status ID Risk
DistinctMessagesnotEnforcedinAggregateVerify Fixed 006 Medium
OutdatedDependenciesandInconsistentCompilerSpecification Reported 001 Low
SecretsinMemoryNotCleared Reported 003 Low
MissingErrorCheckandNon-CryptoRandomnessGenerator Fixed 004 Low
MissingLengthCheckonPrivateKeyDeserialization Fixed 005 Low
MissingLength==0ValidationCheck Fixed 008 Low
NonConstant-TimeCryptographyImplementation Reported 002 Informational
PrivateKeyGenerationnotCompliant Fixed 007 Informational
5 | FilecoinBellman/BLSSignaturesCryptographyReview NCCGroup
Finding Details
Finding DistinctMessagesnotEnforcedinAggregateVerify
Risk Medium Impact: Low,Exploitability: Medium
Identifier NCC-PRLB007-006
Status Fixed
Category DataValidation
Component bls-signatures
Location bls-signatures/src/signature.rs
Impact Aspeciallycraftedpublickey(commonlyreferredtoasthe“rogue”key)canpotentiallybeused
toforgeanaggregatesignature.
Description TheBLSsignatureschemeallowsuserstoproduceaggregatesignatures,combinationsofa
setofsignatures,whichcanbeverifiedmoreefficientlythantheindividualsignaturessepa-
rately.
ThedraftspecificationdefinesthreesignatureschemesforBLS:basic,messageaugmentation
andproofofpossession. Thedifferencebetweenthesevariantsliesinthewaytheyprotect
against rogue key attacks. In this context, a rogue key is a maliciously crafted public key
that can be used to forge aggregate signat