Penetration Test Report (SECConsult): Source Code Review   Proton Crypto Library

Report 1907551
Source Code Review
Proton Crypto Library
for
Proton Technologies AG
conducted by
SEC Consult
Version: 1.2 | Date: 2019-05-14
Responsible: SEC Consult | Author: SEC Consult
Confidentiality class: Public
Report 1907551 for Proton Technologies AG
Source Code Review – Proton Crypto Library
Responsible: SEC Consult
Version/Date: 1.2 / 2019-05-14
Confidentiality class: Public
Table of Contents
Table of Contents ........................................................................................................................ 2
1 Management Summary ......................................................................................................... 3
1.1 Scope and Timetable ............................................................................................................ 3
1.2 Results ................................................................................................................................ 3
1.3 Disclaimer ............................................................................................................................ 4
2 Vulnerability Summary .......................................................................................................... 5
2.1 Total Risk Per System ........................................................................................................... 5
2.2 Risk of Each Vulnerability ...................................................................................................... 5
3 Detailed Analysis .................................................................................................................. 6
3.1 Proton Crypto Library ............................................................................................................ 6
3.1.1 General Information ....................................................................................................... 6
3.1.2 Cleartext message spoofing - FIXED ............................................................................... 6
3.1.3 Small RSA keys are allowed - FIXED .............................................................................. 8
3.1.1 Notes ............................................................................................................................ 9
4 Appendix ............................................................................................................................ 10
4.1 sig_spoof.go ....................................................................................................................... 10
5 Version History ................................................................................................................... 13
SEC Consult office@sec-consult.com | www.sec-consult.com Page 2 of 13
Report 1907551 for Proton Technologies AG
Source Code Review – Proton Crypto Library
Responsible: SEC Consult
Version/Date: 1.2 / 2019-05-14
Confidentiality class: Public
1 Management Summary
The following chapter summarizes the scope and timetable of the code review, the results of the code
review, and outlines the measures recommended by SEC Consult.
1.1 Scope and Timetable
During the initial security assessment for Proton Technologies AG, SEC Consult performed a source code
review of the Proton Crypto Library - a set of supplementary cryptography libraries written in Go, which
allows encrypting, decrypting, signing, and verifying messages using symmetric and asymmetric
cryptography. Objective of the review was to reveal security issues and to offer suggestions for
improvement. The focus of the code review was to identify:
- vulnerabilities in cryptographic algorithms,
- routines that could cause user data compromise,
- routines that could be abused for user monitoring.
The initial review was conducted in March 2019 and a total effort of 7 days was dedicated to identifying and
documenting security issues in the code base of the Proton Crypto Library.
The following subsystems were in the scope of the code review:
- openpgp
- ed25519
- brainpool
The source code of the library was publicly available and could be obtained from the respective online
repository (https://github.com/ProtonMail/crypto/tree/5bcbe4637f9ffa5c89be9a5c1f2bcbdac5b881a9).
In April 2019, Proton Technologies fixed the identified issues and supplied the fixes to SEC Consult for
verification (https://github.com/ProtonMail/crypto/tree/efb430e751f2f00d8d9aedb254fc14ef76954880).
Goal of the fix verification was to confirm remediation provided by the applied fixes. SEC Consult verified
the fixes in May 2019.
1.2 Results
During the initial code review, SEC Consult found a high-risk vulnerability in the reviewed source code.
An attacker can, given that specific preconditions are met, abuse this vulnerability to:
- spoof arbitrary cleartext messages without invalidating the signatures.
In addition, SEC Consult discovered a medium-risk vulnerability in the reviewed source code. An attacker
can, given that specific preconditions are met, abuse these vulnerabilities to:
- force victims to generate small-size private keys.
All security issues that were identified in the initial code review were properly fixed by Proton
Technologies AG.
SEC Consult office@sec-consult.com | www.sec-consult.com Page 3 of 13
Report 1907551 for Proton Technologies AG
Source Code Review – Proton Crypto Library
Responsible: SEC Consult
Version/Date: 1.2 / 2019-05-14
Confidentiality class: Public
1.3 Disclaimer
At the request of Proton Technology AG, this report has been declassified from strictly confidential to public.
While the report was shortened for public release, relevant vulnerability information has been maintained.
In this particular project, a timebox approach was used to define the consulting effort. This means that SEC
Consult allotted a prearranged amount of time to identify and document vulnerabilities. Because of this,
there is no guarantee that the project has discovered all possible vulnerabilities and risks.
Furthermore, the security check is only an immediate evaluation of the situation at the time the check was
performed. An evaluation of future security levels or possible future risks or vulnerabilities may not be
derived from it.
SEC Consult office@sec-consult.com | www.sec-consult.com Page 4 of 13
Report 1907551 for Proton Technologies AG
Source Code Review – Proton Crypto Library
Responsible: SEC Consult
Version/Date: 1.2 / 2019-05-14
Confidentiality class: Public
2 Vulnerability Summary
This chapter contains all identified vulnerabilities in the reviewed source code of the company Proton
Technologies AG.
Initial no. of Current no. of
Risk assessment
vulnerability classes vulnerability classes
Low 0 0
Medium 1 0
High 1 0
Critical 0 0
Total 2 0
2.1 Total Risk Per System
The following table contains a risk assessment for each system which contained security flaws.
System Field of application Initial risk Current risk
Proton Crypto Library Cryptography Library High -
Total - High -
2.2 Risk of Each Vulnerability
The following table contains a risk assessment for the discovered vulnerabilities.
Vulnerability System Initial risk Current risk Page
Cleartext message
Proton Crypto Library High FIXED 6
spoofing
Small RSA keys are
Proton Crypto Library Medium FIXED 8
allowed
Total - High - -
SEC Consult office@sec-consult.com | www.sec-consult.com Page 5 of 13
Report 1907551 for Proton Technologies AG
Source Code Review – Proton Crypto Library
Responsible: SEC Consult
Version/Date: 1.2 / 2019-05-14
Confidentiality class: Public
3 Detailed Analysis
This chapter outlines the attacks and found vulnerabilities in detail.
3.1 Proton Crypto Library
3.1.1 General Information
This section describes vulnerabilities found in the Proton Crypto Library. The parts of the library, which
were reviewed implement the core OpenPGP functionalities as well as key generation, encrypting,
decrypting, signing and signature verification functionalities.
3.1.2 Cleartext message spoofing - FIXED
According