Penetration Test Report (NCCGroup): NCC Group WhatsAppLLC OPAQUE Report 2021 12 10 v1.3

Security Assessment - opaque-ke
WhatsApp LLC
December 10, 2021 – Version 1.3
Preparedfor
KevinLewi
LindsayHegy
Preparedby
AvaHowell
KevinHenry
©2021–NCCGroup
Prepared by NCC Group Security Services, Inc. for WhatsApp LLC. Portions of this document and the
templatesusedinitsproductionarethepropertyofNCCGroupandcannotbecopied(infullorinpart)
withoutNCCGroup’spermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,NCCGroupthepublisher,and
theauthor(s)assumenoresponsibilityforerrors,omissions,orfordamagesresultingfromtheuseof
the information contained herein. Use of NCC Group’s services does not guarantee the security of a
system,orthatcomputerintrusionswillnotoccur.
Executive Summary
Synopsis
In June 2021, WhatsApp engaged NCC Group to conduct a security assessment of the opaque-ke library, an open
sourceRustimplementationoftheOPAQUEpasswordauthenticatedkeyexchangeprotocol. Theprotocolisdesigned
to allow password-based authentication in such a way that a server does not actually learn the plaintext value of
the client’s password, only a blinded version of the password computed using a verifiable oblivious pseudorandom
function.
Two consultants spent a total of 15 days over 2 weeks focused on a detailed review of the opaque-ke source code
andtheassociatedversionoftheOPAQUEspecification. Thelibraryisopensource,withcodeavailableinGitHub,and
thespecificationisavailableasanIETFdraftRFC.TheWhatsAppteamprovidedsupportthroughouttheengagement,
andtheNCCGroupprojectteamachievedgoodcoverageoftheprovidedsourcecodeandtheassociateddraftofthe
OPAQUEspecification.
Scope
Theprimarytargetisopaque-ke,anopensourceRustlibraryintendedtobeareferenceimplementationofOPAQUE.
The review focused on the tagged release v0.5.0 located at: github.com/novifinancial/opaque-ke/tree/v0.5.0. The
reviewed library implements Draft 03 of the OPAQUE RFC: www.ietf.org/archive/id/draft-irtf-cfrg-opaque-03.html. A
formalreviewoftheOPAQUEspecificationwasnotinscope, butcompliancetothespecificationwasassessed, and
somecommentsontheRFCitselfareincludedwhererelevant.
Followingtheinitialreview,are-testwasconductedacrosstwoupdatedreleases:.
• Releasev1.2.0,locatedatgithub.com/novifinancial/opaque-ke/tree/v1.2.0,isadirectupdatetov0.5.0andtargets
the same version of the OPAQUE RFC. This release contains several patches that directly address findings in this
report,andwastheprimarytargetofthere-test.
• Releasev0.6.0,locatedatgithub.com/novifinancial/opaque-ke/tree/v0.6.0,targetsanewerversionoftheOPAQUE
RFC(Draft05),andwasstillunderdevelopmentatthetimeoftheinitialreview. Fixesforsomefindingsidentifiedin
thisreportwerealreadypresentinthisrelease,andaresummarizedalongsidetherelevantfindings.
Limitations
Duringthereview,theWhatsAppteamwasactivelyworkingonthev0.6.0releaseofopaque-ke,targetinganewer
version of OPAQUE. Some of the findings identified in this report had been identified previously, and have been
correctedineithertheRFCitselfand/orinpatchestotheopaque-kelibrary. Whilethesepatcheswerereviewedin
isolationwhereapplicable,anin-depthreviewofopaque-ke v0.6.0ornewerversionsoftheRFCwasnotinscope.
KeyFindings
Theassessmentuncoveredseveralissues,whichwerepromptlyaddressedbytheWhatsAppteam:
• Insufficient Input Validation During OPRF Group Element Deserialization: Incoming messages containing a
group element were not checked for the identity element. Deserializing an identity point could have caused all
subsequentpointoperationsto‘zeroout’whichmayhaveforcedtheexport_keytoaknownvalue.
• ServerCanReflectOPRFValueAndForceNon-Randomized[CREDENTIAL_REDACTED]
client’s randomized password to a non-randomized password value, potentially leading to additional unexpected
exposureoftheclient’spasswordsuchasthroughusageoftheexportkey.
• MissingErrorConditioninI2OSPImplementation: Amissinglengthcheckwhenserializingvariable-lengthdata
mayhavecausedthelengthprefixtobesetincorrectly,preventingcorrectdeserializationoftheresultingdataat
theendpoint.
• Non-Constant-Time Verification of 3DH Transcript MAC: An attacker that can precisely measure the timing of
theOPAQUEimplementation’sverificationofthetranscripthashofthe3DHkeyexchangemayhavebeenableto
authenticateafalse3DHtranscript.
2 | WhatsAppLLCSecurityAssessment-opaque-ke NCCGroup
StrategicRecommendations
• Thelibrarycouldbenefitfrommorecomprehensivetestingingeneral. Severaltestsareimplementedwithknown
testvectorsandtovalidatebasicbehavior,butmorerobustteststhatexplicitlyvalidaterequirementsandnegative
test cases would be beneficial. Fuzz testing or randomized input testing may help identify potential serialization
errors,andcouldpotentiallydetectmissingerrorconditionsandedgecases.
• Additional guidance to a user of the library may be beneficial, particularly in instances where the client or server
mayneedtoimplementOPAQUE-specificrequirementsnotincludedinthelibraryitself. Forexample,aservermay
mitigateclientenumerationduringtheregistrationphasebylimitingtherateatwhichaclientcaninitiatetheprocess.
• Whilethisreportwasunderpreparation,opaque-ke v0.6.0wasreleased,whichupdatesthelibrarytoimplement
Draft05oftheOPAQUERFC,includingseveralsecurity-relatedpatches,someofwhichaddressissuesidentifiedin
thisreport. Aformalreviewofthisrecentreleasemayrevealadditionalfindingsnotpresentinv0.5.0.
AdditionalContent
Inadditiontoasetofformalfindings,thisreportincludesseveralappendices:
• arequirementssummaryandreview;
• anoverviewofclientenumerationattackmitigations;
• asummaryofsecurity-relatedpatchesinopaque-ke v0.6.0;
• asummaryofsecurity-relatedpatchesinopaque-ke v1.2.0;
• commentsontheOPAQUERFC.
3 | WhatsAppLLCSecurityAssessment-opaque-ke NCCGroup
Table of Findings
Foreachfinding,NCCGroupusesacompositeriskscorethattakesintoaccounttheseverityoftherisk,application’s
exposureanduserpopulation,technicaldifficultyofexploitation,andotherfactors. ForanexplanationofNCCGroup’s
riskratingandfindingcategorization,seeAppendixAonpage21.
Title Status ID Risk
InsufficientInputValidationDuringOPRFGroupElementDeserialization Fixed 004 High
ServerCanReflectOPRFValueAndForceNon-RandomizedPassword Fixed 010 High
PotentialConstraintViolationinPublic-PrivateKeyPairs Fixed 002 Low
Non-Constant-TimeVerificationof3DHTranscriptMAC Fixed 006 Low
PotentiallyUnsafeTypeConversionofusize Fixed 007 Low
MissingErrorConditioninI2OSPImplementation Fixed 008 Low
OutdatedandUnmaintainedDependencies Fixed 001 Informational
OPRF Blinding Scalar Can Be Chosen At Random To Be The Zero Element In Fixed 005 Informational
GF(p)
4 | WhatsAppLLCSecurityAssessment-opaque-ke NCCGroup
Finding Details
Finding InsufficientInputValidationDuringOPRFGroupElementDeserialization
Risk High Impact: High,Exploitability: Medium
Identifier NCC-E001000K-004
Status Fixed
Category Cryptography
Component opaque-ke
Location novifinancial/opaque-ke/blob/master/src/messages.rs
Impact Deserializinganidentitypointcouldhavecausedallsubsequentpointoperationsto‘zeroout’
whichmayhaveforcedtheexport_keytoaknownvalue.
Description TheVOPRF1specificationdefinestheRandomScalar()functionasreturningarandomlycho-
sennon-zeroelementinGF(p). Ifazeroweretobechosen,thensubsequentscalar-by-point
multiplicationsinBlind(),Evaluate()andUnblind()(whichisessentiallytheentireVOPRF
flow)wouldresultinthepredictableneutralelement. Asthespecificationdoesnotconsider
trustboundaries,theeffectsofachosenzeroscalararenotarticulatedaspartoftheOPRF
groupelementdeserializationprocess.
GiventhatOPAQUEmessagescrosstrustboundaries,itisimperativetovalidatereceivedinput
andrejecttheneutralpoint. Forexample,theOPAQUE2specificationdescribesthefollowing
registrationmessagetypescontainingserializedgroupelementsthatcrosstrustboundaries.
struct {
SerializedElement data;
} RegistrationRequest;
data A serialized OPRF group element.
struct {
SerializedElement data;
opaque server_public_key[Npk];
} RegistrationResponse;
data A serialized OPRF group element.
Thecodeinmessages.rscontainsanumberofmessagesandassociateddeserializationfunc-
tions that do not test for the ne