Penetration Test Report (TrailOfBits): StandardNotes

Standard Notes
Security Assessment
September 8 , 2 020
Prepared For:
Mo Bitar | S tandard Notes
mo@standardnotes.org
Prepared By:
James Miller | T rail of Bits
james.miller@trailofbits.com
Claudia Richoux | T rail of Bits
claudia.richoux@trailofbits.com
Changelog:
March 9, 2020: Initial report delivered
September 8, 2020: Updated report with fix review results
Executive Summary
Project Dashboard
Engagement Goals
Coverage
Recommendations Summary
Short Term
Long Term
Findings Summary
1. Small, insecure passwords are allowed when users change passwords
2. Secrets remain in memory for undetermined amount of time
3. Timing information on root key comparison could leak part of root key
4. Keys.offline.pw value not cleared in migrateStorageStructureForMobile
A. Vulnerability Classifications
B. Non–Security-Related Findings
C. CodeQL Analysis
D. Recommendation for Refactoring Code with TypeScript
E. Recommendations for Enforcing Secure Passwords
F. Recommendation for Guaranteeing Backward Secrecy
G. Fix Log
Detailed Fix Log
© 2020 Trail of Bits Standard Notes Assessment | 1
Executive Summary
From March 2 through March 6, 2020, Standard Notes engaged Trail of Bits to review the
security of SNJS and SNCrypto. Trail of Bits conducted this assessment for one person-week
with two engineers working from commit b 9d7b79 on branch 004 from the
standardnotes/snjs repository, along with commit 0 059a66 on branch 004 of the
standardnotes/sncrypto repository.
At the beginning of this one-week assessment, we reviewed the relevant documentation for
SNJS and SNCrypto, and gained an overall understanding of the system. We manually
reviewed the SNJS and SNCrypto components and actively engaged with the Standard
Notes team to discuss our findings. We also integrated CodeQL, a static analyzer, into both
codebases to help understand them and identify common security issues (see A ppendix C
for more details).
Our manual review of the codebase revealed four findings. We report one medium-severity
issue, T OB-SNOTES-001, related to insecure passwords. The remaining three,
TOB-SNOTES-002– T OB-SNOTES-004, are informational findings related to values leaked to
timing side-channels, and values not being cleared after they are no longer needed.
Trail of Bits assessed protocol version 004. Standard Notes provided thorough
documentation for this protocol. We recommend adjusting this protocol to guarantee
backward secrecy, which can be found in A ppendix F.
Besides that, we found this protocol to be robust, and we report no findings related to the
design of this protocol. Further, we found that Standard Notes uses strong and modern
cryptographic primitives in their design; the strength of these primitives limited the
feasibility of exploitation for some of our findings. In addition, we found that Standard
Notes employs well-accepted coding practices. We have included recommendations for
improving the code quality and architecture in A ppendix B and A ppendix D (respectfully),
but these represent improvements to an already robust codebase. Lastly, due to time
limitations, our assessment consisted mainly of manual review. Given more time, we would
like to integrate fuzzing into the codebases and perform a more in-depth manual review of
SNJS.
Standard Notes should fuzz their codebases. Fuzzing finds bugs from unexpected behavior
not encapsulated in the unit tests. We also encourage Standard Notes to protect secrets
stored in memory and, when possible, ensure these values are cleared once they are no
longer needed. Further, we encourage Standard Notes to consider our recommendations
detailed in our appendices: A ppendix D details a proposal for refactoring the codebase
using TypeScript to help achieve more secure, maintainable code; A ppendix E details
© 2020 Trail of Bits Standard Notes Assessment | 2
recommendations for enforcing secure passwords; and A ppendix F details a
recommendation for guaranteeing backward secrecy.
Update: On September 8, 2020, Trail of Bits reviewed fixes implemented for the issues presented
in this report. For more details on the review of these changes, see A ppendix G.
© 2020 Trail of Bits Standard Notes Assessment | 3
Project Dashboard
Application Summary
Name SNJS, SNCrypto
Version 004
Type JavaScript
Platforms Desktop, web, mobile
Engagement Summary
Dates March 2–6, 2020
Method Whitebox
Consultants Engaged 2
Level of Effort 1 person-week
Vulnerability Summary
Total High-Severity Issues 0
◼
Total Medium-Severity Issues 1
Total Low-Severity Issues 0
◼◼◼
Total Informational-Severity Issues 3
Total 4
Category Breakdown
◼
Configuration 1
◼◼
Data Exposure 2
◼
Data Validation 1
Total 4
© 2020 Trail of Bits Standard Notes Assessment | 4
Engagement Goals
The engagement was scoped to provide a security assessment of the 004 branches of both
the SNJS and SNCrypto code repositories. The 004 branch represents the fourth version of
the Standard Notes protocol. We assessed the cryptography and overall security of this
protocol version.
Specifically, we sought to answer the following questions:
● Does the provided specification of version 004 achieve its design goals?
● Does the provided specification have any flaws?
● Does the protocol use safe cryptographic primitives, and use them correctly?
● Do the SNJS and SNCrypto implementations comply with the claims of the provided
specification?
● Are secret values cleared from memory after they are no longer needed?
● Is any secret information leaked to timing side-channels?
● Client root keys and server passwords are generated with a rgon2id and then split.
Should each key also be input into a HKDF?
● Item’s u uid and protocol version are included as part of the additional
authentication parameters for authenticated encryption. Should i tems_key_id also
be included in the additional authentication parameters?
Coverage
The assessment of SNJS and SNCrypto was primarily performed through manual review.
First, we manually reviewed the protocol described in the provided specification. We
manually reviewed both codebases for their compliance with the specification and
conducted general security and cryptographic reviews.
In addition to the manual review, we also integrated CodeQL, a static analysis tool, into
both codebases (see A ppendix C for more details). This integration allowed us to
understand better how portions of the codebases interacted with each other. CodeQL also
helps identify common security and code quality issues, and fuzzing targets. Due to the
assessment’s brevity, we were unable to fuzz these codebases.
© 2020 Trail of Bits Standard Notes Assessment | 5
Recommendations Summary
This section aggregates all the recommendations made during the engagement. Short-term
recommendations address the immediate causes of issues. Long-term recommendations
pertain to the development process and long-term design goals.
Short Term
❑
A djust the code responsible for handling password changes to enforce a minimum
length. This will help prevent users from using very insecure passwords.
(T OB-SNOTES-001)
❑
W henever possible, use Javascript array buffers to store long-lived cryptographic
keys instead of strings. These are mutable and do not live on the heap, which allows you
to control the storage and expiration of sensitive data. Be sure to add routines zeroing the
buffers as soon as they are no longer necessary. (T OB-SNOTES-002)
❑
F urther, ensure all references to the password or passcode strings are out of scope
after the application has finished using them. This will help ensure secret values are not
leaked. (T OB-SNOTES-002)
❑ R efactor the c ompare function to include a secure, constant-time comparison
function. This will prevent timing information from leaking information about the root key.
(T OB-SNOTES-003)
❑ A djust the mobile migration code to clear the keychain of the k eys.offline.pw
values once migration has occurred. This value is no longer needed and should be
cleared from memory to comply with the protocol specifi