Penetration Test Report (iSEC): TrueCrypt Phase II NCC OCAP final

Open Crypto Audit Project
TrueCrypt
Cryptographic Review
Prepared for:
Prepared by:
Alex Balducci
Sean Devlin
Tom Ritter
CryptographyServicesFinalReport—OpenCryptoAuditProjectTrueCrypt Page2of21
©2015,NCCGroup,Inc.
PreparedbyNCCGroup,Inc.forOpenCryptoAuditProject. Portionsofthisdocumentandthetemplatesused
initsproductionarethepropertyofNCCGroup,Inc.andcannotbecopiedwithoutpermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,NCCGroup,Inc,thepublisher,andthe
author(s)assumenoresponsibilityforerrors,omissions,orfordamagesresultingfromtheuseoftheinformation
contained herein. Use of NCC Group services does not guarantee the security of a system, or that computer
intrusionswillnotoccur.
March13,2015 OpenCryptoAuditProject Version1.0
CryptographyServicesFinalReport—OpenCryptoAuditProjectTrueCrypt Page3of21
Table of Contents
1 ExecutiveSummary ........................................................ 4
1.1 CSRiskSummary............................................................. 5
1.2 ProjectSummary ............................................................. 6
1.3 FindingsSummary............................................................ 7
1.4 RecommendationsSummary................................................... 7
2 EngagementStructure ..................................................... 8
2.1 InternalandExternalTeams ................................................... 8
2.2 ProjectGoalsandScope ....................................................... 9
3 DetailedFindings .......................................................... 10
3.1 Classifications................................................................ 10
3.2 Vulnerabilities ............................................................... 12
3.3 DetailedVulnerabilityList ..................................................... 13
Appendices .................................................................... 17
A RandomNumberGenerator ............................................... 17
B Follow-upReview .......................................................... 18
B.1 XTSPointerArithmetic........................................................ 18
B.2 HeaderVolumeParameters .................................................... 18
B.3 ProgramFlow ................................................................ 18
C XTSModeofDiskEncryption.............................................. 19
D DefensiveCoding .......................................................... 20
March13,2015 OpenCryptoAuditProject Version1.0
CryptographyServicesFinalReport—OpenCryptoAuditProjectTrueCrypt Page4of21
1 Executive Summary
ApplicationSummary
ApplicationName TrueCrypt
ApplicationVersion 7.1a
ApplicationType Diskencryptionsoftware
Platform Windows,C/C++
EngagementSummary
EngineersEngaged Three(3)
EngagementType CryptographicReview
TestingMethodology SourceCodeReview
VulnerabilitySummary
TotalHighseverityissues 2
TotalMediumseverityissues 0
TotalLowseverityissues 1
TotalUndeterminedseverityissues 1
Totalvulnerabilitiesidentified: 4
Seesection3.1onpage10fordescriptionsoftheseclassifications.
CategoryBreakdown:
AccessControls 0
AuditingandLogging 0
Authentication 0
Configuration 0
Cryptography 4 (cid:4)(cid:4)(cid:4)(cid:4)
DataExposure 0
DataValidation 0
DenialofService 0
ErrorReporting 0
Patching 0
SessionManagement 0
Timing 0
March13,2015 OpenCryptoAuditProject Version1.0
CryptographyServicesFinalReport—OpenCryptoAuditProjectTrueCrypt Page5of21
1.1 CS Risk Summary
The CryptographyServicesRisk Summary chart evaluatesvulnerabilitiesaccordingtobusiness risk.
Theimpactofthevulnerabilityincreasestowardsthebottomofthechart. Thesophisticationrequired
for an attacker to find and exploit the flaw decreases towards the left of the chart. The closer a
vulnerabilityistothechartorigin,thegreaterthebusinessrisk.
• Keyfile mixing is not cryptographically sound
w
o • Unauthenticated ciphertext in volume headers
L
k
s
i
R
s
s
e
n
i
s
u
B
• CryptAcquireContext may silently fail in unusual scenarios
h
g
iH • AES Implementation susceptible to cache timing attacks
Simple Attack Sophistication Difficult
©2008 iSEC Partners, Inc.
March13,2015 OpenCryptoAuditProject Version1.0
CryptographyServicesFinalReport—OpenCryptoAuditProjectTrueCrypt Page6of21
1.2 Project Summary
TheOpenCryptoAuditProjectengagedCryptographyServices(CS)toperformascopedengagement
onportionsofTrueCrypt'scryptographicimplementationsanduse. Thisreviewwasnarrowlyscoped
tospecificaspectsoftheapplication,andwastime-boxedtoanengagementlengththatwasdeemed
sufficienttogiveadequatecoverageofthecomponentsinplace.
CS reviewed TrueCrypt 7.1a using source code review as well as sample applications and targeted
debugging on the Windows platform to verify assumptions about API behavior. Reverse engineer-
ing to perform assembly code analysis or comparison to provided sources was not conducted. The
specificscopeoutliningwhichcomponentswereincludedandexcludedfromthereviewcanbefound
insection2.2onpage9.
Whilethetime-boxednatureoftheengagementpreventedauditorsfromreviewingthesourcecodein
itsentirety,themostrelevantareaswereinvestigatedthoroughly. TheassortedAESimplementations
inbothparallelandnonparallelXTSconfigurationswereaparticularpointoffocus. Testerslooked
forimplementationerrorsthatcouldleakplaintextorsecretkeymaterialorallowanattackertouse
malformed inputs to subvert the TrueCrypt software. Additionally, the random number generator
implementation and usage were reviewed for errors that could lead to predictable outputs used in
secret keys. The SHA-512 hash function, concomitant key derivation functions, and integration of
keyfileswerecheckedforsimilarproblems.
The header volume format and protection schemes were evaluated for design and implementation
flawsthatcouldallowanattackertorecoverdata,executemaliciouscode,orotherwisecompromise
thesecurityofthesystem. Theciphercascadeswerereviewed,andnotedtobehaveinthemostcon-
servativemannerpossible(thatis,applyingtheentireblockciphermodesuccessively). Theunusual
legacymodethatcascadestwocipherswithdifferentblocksizeswasnoted,butdidnotappeartohave
flaws.
Becauseofthedifficultyinprotectingagainstsuchathreatandthelimitedtime,CSdidnotattempt
toenumeratelocationswherememorywasinsecurelywiped. Theeffectofdifferentdisksectorsizes
was also outside the scope of the review, but should be carefully examined to ensure the program
behavescorrectlyinunusualsectorsizes.AreasofconcernthatCSfeelsareworthparticularadditional
attentionarelistedinAppendixBonpage18.
Inaddition,aspartoftheengagement,CSreviewedtheexistingeffortsinCipherShedandVeracryptat
auditingandimprovingtheTrueCryptcodebase. Theseeffortsweredesignedtoaugmentthereview
ofTrueCryptandwerenotanauditoftheseapplications. Issuesidentifiedandremediatedinthese
projects1arenotnotedhere.
1Suchashttps://stackoverflow.com/questions/22122509/truecrypt-bug-in-serpent
March13,2015 OpenCryptoAuditProject Version1.0
CryptographyServicesFinalReport—OpenCryptoAuditProjectTrueCrypt Page7of21
1.3 Findings Summary
Duringtheengagement,CSidentifiedfour(4)issues,andnoneledtoacompletebypassofconfiden-
tialityincommonusagescenarios. Thestandardworkflowofcreatingavolumeandmakinguseofit
wasreviewed,andnosignificantflawswerefoundthatwouldimpactit.
ThemostseverefindingrelatestotheuseoftheWindowsAPItogeneraterandomnumbersformaster
encryptionkeymaterialamongotherthings. WhileCSbelievesthesecallswillsucceedinallnormal
scenarios,atleastoneunusualscenariowouldcausethecallstofailandrelyonpoorsourcesofentropy;
itisunclearinwhatadditionalsituationstheymayfail.
Additionally,CSidentifiedthatvolumeheaderdecryptionreliesonimproperintegritycheckstodetect
tampering, and that the method of mixing the entropy of keyfiles was not cryptographically sound.
Finally,CSidentifiedseveralincludedAESimplementationsthatmaybevulnerabletocache-timing
attacks. Themoststraightforwardwaytoexploitthiswouldbeusingnativecode,potentiallydelivered
throughNaClinChrome;however,thesimplestmethodofexploitationthroughthatattackvectorwas
recen