Penetration Test Report (NCCGroup): NCC Group MobileCoin RustCrypto AESGCM ChaCha20Poly1305 Implementation Review 2020 02 12 v1.0

RustCrypto AES/GCM and ChaCha20+Poly1305
Implementation Review
MobileCoin
February 13, 2020 – Version 1.0
Preparedfor
MobileCoin
Preparedby
GéraldDoussot
ThomasPornin
©2020–NCCGroup
Prepared by NCC Group Security Services, Inc. for MobileCoin. Portions of this document and the
templates used in its production are the property of NCC Group and cannot be copied (in full or in
part)withoutNCCGroup’spermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,NCCGroupthepublisher,and
theauthor(s)assumenoresponsibilityforerrors,omissions,orfordamagesresultingfromtheuseof
the information contained herein. Use of NCC Group’s services does not guarantee the security of a
system,orthatcomputerintrusionswillnotoccur.
Executive Summary
Synopsis
InDecember2019, MobileCoinengagedNCCGrouptoconductareviewoftheAES/GCMandChaCha20+Poly1305
implementations provided by the RustCrypto/AEADs crates. The intended usage context of these crates includes
SGXenclaves,makingtiming-relatedsidechannelattacksrelevanttothisassessment. Twoconsultantsprovidedfive
person-daysofefforts.
Scope
Themaintargetofevaluationconsistedoftheaes-gcmandchacha20poly1305cratesthatarepartoftheRustCrypto/
AEADsrepositoryonGitHub. ThesecratesuseothercratesfromotherRustCryptorepositories. Inallcases,thesource
codereviewedwasthelatestversionavailableatthetimeoftheengagement:
• aes-gcmandchacha20poly1305fromRustCrypto/AEADs:
https://github.com/RustCrypto/AEADs/tree/a15698fdba23ffb17b84d9ecaa2c9c80706ecf03
• aesfromRustCrypto/block-ciphers:
https://github.com/RustCrypto/block-ciphers/tree/e385f1ebb2ec48547194e51c5193309ee328d93b
• chacha20andsalsa20-corefromRustCrypto/stream-ciphers:
https://github.com/RustCrypto/stream-ciphers/tree/[PII_REDACTED]c21dee4e76af4cc932cf1cd815e8f9
• aead,stream-cipheranduniversal-hashfromRustCrypto/traits:
https://github.com/RustCrypto/traits/tree/4569d256f02ac0ecefa393baf225fb4a6df35875
• ghash,poly1305andpolyvalfromRustCrypto/universal-hashes:
https://github.com/RustCrypto/universal-hashes/tree/1ab06bd79542e75490468b227dd3c2cbe42d3d92
KeyFindings
NCCGroupdid notfind anyvulnerabilityin theaudited crates. The RustCryptoimplementationsuse allthe recom-
mendedtechniquestoachieveconstant-timeimplementations;inparticular,thefallbackAESimplementation(tobe
usedwhentherearenousablehardwareAESopcodes)usesbitslicingtoavoidanytablelookupsatsecret-dependent
addresses. Similarly,receivedauthenticationtagsarecomparedwithconstant-timecomparisonfunctions.
Afewcosmeticremarks,mostlyrelatedtopotentialperformanceimprovements,havebeenassembledintoRustCrypto
AuditNotesonthefollowingpage.
2 | MobileCoinRustCryptoAES/GCMandChaCha20+Poly1305ImplementationReview
RustCrypto Audit Notes
In this section, NCC Group provides a description of the audit process on RustCrypto, and a few remarks. None of
theseobservationsconstituteavulnerability,evenintheoreticalcontexts.
CrateStructure
The scope of the audit was the AES/GCM and ChaCha20+Poly1305 implementations from the RustCrypto AEADs
repository:
• AES/GCM:https://github.com/RustCrypto/AEADs/tree/master/aes-gcm
• ChaCha20+Poly1305: https://github.com/RustCrypto/AEADs/tree/master/chacha20poly1305
ThesetwocratesthemselvesrelyonfeaturesprovidedbyotherRustCryptocrates:
• aes,aes-softandaesnifromblock-ciphers: https://github.com/RustCrypto/block-ciphers/tree/master/aes
• chacha20andsalsa20-corefromstream-ciphers: https://github.com/RustCrypto/stream-ciphers
• ghash,poly1305andpolyvalfromuniversal-hashes: https://github.com/RustCrypto/universal-hashes
• aead,block-cipher-trait,crypto-mac,stream-cipheranduniversal-hashfromtraits: https://github.com
/RustCrypto/traits
Ingeneral,implementationsarestructuredinlayersthatallowsharingofcommonparts(e.g. salsa20-coreprovides
thesupportfordatabufferingthatisusedinallChaCha20andSalsa20variants).
AESImplementations
Theaescrateisawrapperforanunderlyingimplementation,whichwillbeaesni(ifthetargetplatformis32-bitor
64-bitx86withtheAES-NIopcodes),oraes-soft(forallotherplatforms).
aesni
Theaesniimplementationusesthededicatedhardwareopcodes(throughthespecialfunctionsfromarch,suchas
_mm_aesenc_si128()). Itisratherstraightforward,butevaluatesuptoeightinstancesinparallel(withthesamekey)
byinterleavingtheopcodes: thisismeanttoprovidebetterperformance,sincetheCPUopcodestypicallyhavehigh
throughputbutnonnegligiblelatency(1aesencpercycleonaSkylakecore,butwithalatencyof4cycles).
NoteworthyisthepresenceofaCTRimplementation(inaesni/src/ctr.rs). Thisimplementationappearstofollow
the“64-bit”variant;indeed,CTRcanbedefinedinseveralways,dependingonhowmanybitsintheAESblockareused
fortheblockcounter. AES/GCMuses32-bitcounters;otherstandardAEADmodes(e.g. CCMandEAX)usefull-width
128-bit counters. What this CTR implementation with 64-bit counters is meant to be used for is unclear. The GCM
implementationhasitsownCTRcode(with32-bitcounters)anddoesnotusethecodedefinedinaesni/src/ctr.rs.
Also,thenon-AES-NIimplementationdoesnotfeatureanycounterparttothiscode.
aes-soft
Theaes-softimplementationprovidesaconstant-timesoftwareAESimplementation. Theimplementationtechnique
isbitslicing:individualstatebitsarespreadontomanyregisters,alloperationsbeingperformedwithbitwiseoperators.
Fullbitslicingwouldinvolveusing128registersforthe128bitsofanAESblock;thiswouldnaturallyleadtonparallel
evaluationsofAES,ifregistershavesizenbits. SincemostCPUsdonothave128distinctregisters,thiswouldresultin
highpressureontheregisterallocatorandwasteofCPUresourcesforexchangesofdatabetweenCPUregistersand
stackslots. Instead,theusualimplementationstructureforbitslicedAESistokeep16bitsofstateinasingleregister:
the16S-BoxesofeachAESroundarestillevaluatedinparallelwiththesamesequenceofcode, buttheotherAES
operations(MixColumns,ShiftRows…)requireslightlymoredatamovementoperations. ThefamousKäsper-Schwabe
AESimplementation1 usesthisstructure. Sinceeachregistercanstore16bitsfromagivenAESinstance,onlyeight
registersareneeded,andn/16AESinstancesareevaluatedinparallel.
Interestingly,theaes-softimplementationworksover32-bitvalues(u32)butdefinesacustom128-bittype:
1https://eprint.iacr.org/2009/129
3 | MobileCoinRustCryptoAES/GCMandChaCha20+Poly1305ImplementationReview
pub struct u32x4(pub u32, pub u32, pub u32, pub u32);
Itisunclearwhyitisdonethatway. Iftheactualregistersare32-bitvalues,thereshouldbenoadditionalbenefitto
increasingparallelevaluationbeyondwhatcanfitinaregister: anXORoftwo32-bitregistersisoneoperation,butthe
XORoftwo128-bitcustomtypeswillinvolvefourindividual32-bitXORoperations. Theuseofu32x4isthenequivalent
tousinga32-bitbitslicedAESimplementation(withtwoinstancesinparallel),butrunningfoursuchimplementations
with their code interleaved. The number of required registers then rises to 32, which will increase pressure on the
registerallocator.
Therefore,whilethecurrentaes-softimplementationiscorrectandsecure,asimilarimplementationwithonly32-
bitvaluesandlimitedparallelism(twoAESinstancesinparallel)wouldyieldsimplersourcecode,smallerbinaries,and
probablybetterperformance.
GHASH
GHASHistheuniversalhashfunctionusedformessageauthenticationinGCM.TheimplementationusesPOLYVAL
(from RFC 8452, section 32), which is identical to GHASH except for encoding endianness. The core operation is a
multiplicationinthebinaryfieldGF(2128). WhentheAES-NIopcodesareavailable,thepclmulqdqopcodeisused,
leading to reasonably good performance, though not completely on par with AES-CTR. GHASH (POLYVAL) could be
madefasterbyprocessingblocksinparallel;indeed,foraninputconsistingofnblocksm
1
tom n,andsecretkeyh,
thecomputationis:
POLYVAL(m)=m 1 hn+m 2 hn(cid:0)1+m 3 hn(cid:0)2+(cid:1)(cid:1)(cid:1)+m n(cid:0)1 h2+m n h
Thus,ifh2,h3andh4arepre-computed,thenitbecomespossibletoprocessfourblocksinparallel,i.e. suchthatthe
outputofonemultiplicationisnotusedasinputforthenextthreeblocks. Thispromotesperformanceintwoways:
• LikeAES-NIopcodes,pclmulqdqhashighthroughput(1instructionpercycleonSkylake)buthighlatency(7cycles
onSkylake). Parallelismreducestheeffectofthatlatency.
• pclmulqdq computes the multiplication on b