Penetration Test Report (NCCGroup): NCC Group Qredo Apache Milagro MPC Cryptographic Review 2020 07 16 v1.3

Apache Milagro MPC Cryptographic
Assessment
Qredo
July 16, 2020 – Version 1.3
Preparedfor
SamueleAndreoli
KealanMcCusker
BrianSpector
Preparedby
MasonHemmel
AleksandarKircanski
©2020–NCCGroup
PreparedbyNCCGroupSecurityServices,Inc. forQredo. Portionsofthisdocumentandthetemplates
usedinitsproductionarethepropertyofNCCGroupandcannotbecopied(infullorinpart)without
NCCGroup’spermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,NCCGroupthepublisher,and
theauthor(s)assumenoresponsibilityforerrors,omissions,orfordamagesresultingfromtheuseof
the information contained herein. Use of NCC Group’s services does not guarantee the security of a
system,orthatcomputerintrusionswillnotoccur.
Executive Summary
Synopsis malicious participants are involved in a full run of the
Duringthespringof2020,QredoengagedNCCGroup protocol,meaningthatthiscanhaveapracticalimpact.
toconductasecurityassessmentoftheApacheMilagro
Theseissueshavebeenfixedpriortothepublicationof
MPC library. This library implements the primitives
thisreport.
necessary to instantiate the multi-party ECDSA sig-
nature scheme provided in Gennaro and Goldfeder’s StrategicRecommendations
“Fast Multiparty Threshold ECDSA with Fast Trustless
• EncapsulateHigher-LevelPrimitivesintoFunctions
Setup”1(GG).Thisassessmentoccurredoverthecourse
WhileMilagroMPCoffersallthefunctionalityneeded
of two calendar weeks and was delivered by three
to spin up an implementation of the GG scheme,
consultantsovertenperson-days. NCCGroupassessed
many of the larger steps are not implemented as
commitc5f0733ofthepublicincubator-milagro-MPC
single functions. This leaves users of the library to
repository.
implement these larger steps themselves, which has
historically resulted in insecure implementations. To
Scope
avoid this, the library should at least implement all
NCCGroupevaluatedonlythecodeintheincubator-
phases of key and signature generation as single
milagro-MPC repository, and did not stray into the
functions.
original cryptographic libraries used in this project. As
• Consider Vetting Novel Sections of milagro-
a result, the engagement team did not review the
crypto The milagro-crypto library supplies the
implementationofmanyofthelow-levelprimitivesused
low-level cryptographic implementations of the core
inthisproject. Thisincludesthefollowing:
primitives listed in the Scope section. While the
• Hashfunctionimplementations library’s authors note it has largely been imported
• Elliptic curve group and finite field operations (other fromawell-usedandwell-vettedcryptographiclibrary,
thanspecial-casemodularmultiplicationandmodular there is still a certain amount of “glue” code and
reductions) some novel functionality. Implementing low-level
• Bit-and-byte-leveloperations cryptographicprimitives, orevencodeusedtostitch
• Bignumoperations it together, tends to be extremely challenging. To
• Acquisitionandmanipulationofrandomness ensure the highest level of assurance, the Milagro
• Paillierencryptionimplementation teamshouldconsiderhighlightingandfurthervetting
anynovelportionsofthislibrary.
The engagement proceeded with the assumption that • SeparateFunctionsRequiringRandomGeneration
all of the above functionality is implemented correctly ManyoftheMilagroMPCfunctionsincludeapattern
and securely. For example, the team assumed that in which an RNG struct is optionally passed into a
all serialization into the struct for an elliptic curve function that alters its functionality depending on
pointperformsfullvalidationofthatpoint, andthatall whether or not it is passed. This leads to bad
randomnessissourcedfromacryptographicallysecure functionality in cases where the RNG is meant to be
pseudo-randomnumbergenerator. passedinandhassomehowacquiredtheNULLvalue,
or vice versa. As a result, these functions should be
KeyFindings
separatedintotwo.
The assessment uncovered a set of common crypto-
• UseNamingConventionsConsistentlyTheMilagro
graphic flaws. The most notable involved the replaya-
MPC library tends to use GG’s naming conventions
bilityofsomeofthezero-knowledgeproofsgenerated
for its variables. However, this is not applied across
intheprotocol.
the board, leading to potential confusion for users
attemptingtocross-referencefunctionality.
NCC Group found that a lack of liveness guarantors in
• Warn Users About Repeated Schnorr Proofs with
zero-knowledge proofs render them replayable. This
Unchanged Randomness The functions used to
means an attacker could potentially “forge” proofs in a
generatenon-interactivezeroknowledge(NIZK)chal-
given round of multi-party signing by replaying proofs
lengessupportuser-inputrandomness. IfaSchnorr
generated in an earlier round. The implemented
NIZK proof is repeated for the same randomness
protocolcanrevealsensitiveinformationinthecasethat
but different challenge values, an adversary that
1Thepaperinwhichthisschemewaspresentedisavailableathttps://eprint.iacr.org/2019/114.pdf.
2 | QredoApacheMilagroMPCCryptographicAssessment NCCGroup
observesbothprooftranscriptscandirectlycalculate
the prover’s secret key.2 Users are not likely to be
aware of this, and may misuse the API such that
this vulnerability is triggered. Alternatively, the team
may refactor the functions such that randomness is
guaranteed to be generated by a strong RNG every
time.
2AssumeaproverwithsecretausesrandomnessvtocommittoV =gv modptwiceandeithertheverifierreplieswithtwoseparatechallenges
orthehashfunctionintheNIZKvarianthastwodifferentcountervalues.
Thefirstchallengeisrandthesecondisr′
,inresponsetowhichthe
provercomputesc=v(cid:0)a(cid:3)candc′=v(cid:0)a(cid:3)c′ .Anadversaryobservingbothproofscancalculate r c′ (cid:0) (cid:0) r c ′ = v(cid:0)a(cid:3) c c ′ (cid:0) (cid:0) v c +a(cid:3)c′ =a.
3 | QredoApacheMilagroMPCCryptographicAssessment NCCGroup
Dashboard
TargetMetadata EngagementData
Name ApacheMilagroMPC Type CryptographicSecurityAssessment
Type CryptographicLibrary Method Code-assisted
Platforms C Dates 2020-04-21to2020-05-08
Environment LocalInstance Consultants 3
LevelofEffort 10person-days
FindingBreakdown
Criticalissues 0
Highissues 0
Mediumissues 0
Lowissues 2
Informationalissues 1
Totalissues 3
CategoryBreakdown
Cryptography 3
Key
Critical High Medium Low Informational
4 | QredoApacheMilagroMPCCryptographicAssessment NCCGroup
Testing Methodology
When examining the Apache Milagro Multiparty Computation (MPC) project, NCC Group focused on ensuring that
the project faithfully implemented its source protocol, avoided common programming issues, and was formulated
suchthatenduserscouldsafelytakeadvantageofthelibrary. ThislibraryimplementsGennaroandGoldfeder’s“Fast
MultipartyThresholdECDSAwithFastTrustlessSetup”paper3(GG)throughacombinationofadditivelyhomomorphic
encryption,zeroknowledgeproofs(ZKP),Shamir’ssecretsharing,non-malleableequivocablecommitments,Feldman’s
verifiablesecretsharingprotocol,4 andECDSAitself. Forthisproject,zeroknowledgeproofs,commitments,ECDSA,
andtheoverallstructurewereinscope. Eachofthesestructuresandthemethodologyusedtotestitaredescribed
inmoredetailbelow.
HomomorphicEncryption
Homomorphic encryption is a special form of encryption that allows for limited computation over encrypted values
withoutpossessionofthesecretkey. GGuseaninstantiationofhomomorphicencryptionknownasPaillierencryption,
inwhichanentitypossessingciphertextsc 1 = E k (m 1 );c 2 = E k (m 2 ), andthepublickeyk underwhichtheywere
encryptedcancomputec
3
=E
k
(m
1
+m
2
).Inordertocombinesecretshareswithoutrevealingthem,GGusePaillier’s
instantiationofadditivelyhomomorphicencryption. TheimplementationofthePailliercryptosystemwasnotinscope
forthisengagement,soNCCGroupdidnotreviewit.
ZeroKnowledgeProofs
At a high level, zero knowledge proofs are a cryptographic technique allowing one entity (the prover) to prove to
another (the verifier) that they know a particular statement is true without revealing anything else. GG leverages
six variants of this technique: range proofs, a proof of modular polynomial relations, Schnorr’s