Penetration Test Report (TrailOfBits): ToB RandomX Monero

RandomX
Security Assessment
May 28th, 2019
Prepared For:
Sam Williams | A rweave
sam@arweave.org
Howard Chu | M onero
hyc@symas.com
Prepared By:
Paul Kehrer | T rail of Bits
paul.kehrer@trailofbits.com
Will Song | T rail of Bits
will.song@trailofbits.com
Evan Sultanik | T rail of Bits
evan.sultanik@trailofbits.com
Executive Summary
Project Dashboard
Engagement Goals
Cryptography
General Security
Coverage
Cryptographic Architecture
General Security of the Implementation
Recommendations Summary
Short Term
Long Term
Findings Summary
1. Single AES rounds used in AesGenerator
2. Insufficient Testing and Validation of VM Correctness
3. RandomX configurable parameters are brittle
A. Vulnerability Classifications
B. Code Quality
C. Randomness Analysis
D. Bias in SuperscalarHash
E. Parameter Selection
Instruction Frequency
F. Recommended Parameters for Arweave
© 2019 Trail of Bits Arweave RandomX Assessment | 1
Executive Summary
From May 20t h to June 3r d 2019 Arweave engaged Trail of Bits to assess the RandomX
proof-of-work (PoW) algorithm implemented in C++. The c odebase was assessed as of git
commit 3 78d5de, corresponding to r elease 1.0.2. This assessment was conducted using two
engineers over two person-weeks.
During the week of May 20th, 2019, Trail of Bits began its assessment of the RandomX
algorithm, using a single engineer and focusing on the identification of major cryptographic
flaws. During the following week of May 27th, Trail of Bits expanded its assessment to
include non-cryptographic attacks, also using a single engineer.
The RandomX algorithm has several complex and novel constructions that make a single
week of review insufficient for a complete cryptographic analysis of the system. Trail of Bits
focused its efforts on confirming that the use of AES in the algorithm was safe, determining
if initial entropy input to the system was preserved throughout the transformations, and
determining safe alternate configuration values for Arweave’s use.
We found one low-severity issue with the use of single AES rounds in RandomX not
providing full diffusion of input bits across the output. We also documented concerns
around bias in the output of SuperscalarHash when used in conjunction with non-default
parameters in A ppendix D. A survey of configuration parameters and which ones are safe
to change is included in A ppendix E. A ppendix F recommends changes for Arweave.
The RandomX codebase lacks sufficient unit and regression tests to validate virtual
machine (VM) correctness. The security implications of this omission depends on the way
RandomX is adopted, as well as the way RandomX is maintained in the future. If this
implementation of RandomX is used for mining a PoW blockchain, then an error in the VM
implementation (e .g., a deviation from the specification) will be irrelevant as long as the
output of the VM is deterministic. However, if this implementation is ever updated in such a
way that the VM semantics change, o r if a cleanroom implementation of RandomX is ever
used to mine blocks on the same blockchain, then this can lead to consensus errors and
forking. While no deviations between the VM implementation and the specification were
discovered, the scope of this engagement was insufficient to validate that no latent errors
exist.
In addition to the security findings, we discuss code-quality issues not related to any
particular vulnerability in A ppendix B. One such issue was related to undefined behavior in
a test edge case. An analysis of the randomness of RandomX is provided in A ppendix C.
RandomX is an intriguing, novel hash function specifically designed for PoW blockchains. It
should not be used as a general purpose keyed cryptographic hash. Trail of Bits
recommends a more thorough analysis of the cryptographic fundamentals of the system as
well as improved unit and regression testing for VM correctness. This should provide
additional confidence that no single step bias can be propagated across multiple steps to
allow unwanted optimizations.
© 2019 Trail of Bits Arweave RandomX Assessment | 2
Project Dashboard
Application Summary
Name RandomX
Type Proof of work algorithm
Platforms Cross-Platform (C++)
Engagement Summary
Dates May 20t h to June 3r d 2019
Method Whitebox
Consultants Engaged 2
Level of Effort 2 person-weeks
Vulnerability Summary
Total High-Severity Issues
Total Medium-Severity Issues
Total Low-Severity Issues 2 ◼◼
Total Informational-Severity Issues 1 ◼
Total Undetermined-Severity Issues
Total 3
Category Breakdown
Configuration 1 ◼
Cryptography 1 ◼
Data Validation 1 ◼
Total 3
© 2019 Trail of Bits Arweave RandomX Assessment | 3
Engagement Goals
RandomX is a proof-of-work hashing algorithm primarily developed for use by the M onero
blockchain. Its design goal is to be optimized for general purpose CPUs (rather than ASICs
or GPU-based execution) while remaining a secure algorithm. To accomplish this, RandomX
uses a variety of techniques, including aggressive use of native AES instructions for data
transformation, randomized execution on a virtual machine, memory-hard hashing
functions, and more. During our analysis we prioritized the following areas:
Cryptography
● Are there methods by which the algorithm could be significantly accelerated?
● Is the algorithm’s use of AES rounds safe?
● What is a safe set of parameters to use?
General Security
● Are there inputs that can cause the algorithm to crash?
● Is there undefined behavior in the implementation?
● Is the implementation deterministic and guaranteed to terminate?
● Does the implementation adhere to the RandomX specification?
© 2019 Trail of Bits Arweave RandomX Assessment | 4
Coverage
In this section we highlight some of the analysis coverage we achieved during this effort,
relative to the areas specified by Arweave in our engagement goals.
Cryptographic Architecture
● The design and specification documentation was reviewed to fully understand the
design goals of the algorithm.
● The random program generation code was reviewed to confirm that the generated
programs were statistically random.
● The security properties of the AesGenerator and AesHash constructions were
scrutinized to determine whether their unusual use of AES was secure.
● Trail of Bits also ran the complete algorithm on many test inputs and examined the
results for their randomness properties, as well as examining the randomness
within the context of VM execution. A summary of our efforts can be found in
Appendix B.
General Security of the Implementation
● Constants (e .g., related to cryptographic algorithms like AES) were compared against
their associated specifications.
● Third-party components of the system (e .g., Argon2) were diffed against their latest
versions to check for missing upstream bugfixes and security patches.
● The entire codebase was manually inspected for logical errors, undefined behavior,
denial of service, and memory-corruption vulnerabilities.
RandomX neither interacts with the network nor the filesystem, nor does it parse complex
user input. Therefore, its attack surface is relatively small.
© 2019 Trail of Bits Arweave RandomX Assessment | 5
Recommendations Summary
This section aggregates all the recommendations made during the engagement. Short-term
recommendations address the immediate causes of issues. Long-term recommendations
pertain to the development process and long-term design goals.
Short Term
✓ Increase the number of rounds of AES used in AesGenerator. A esGenerator uses
a single round of AES to create a pseudorandom stream. A minimum of two rounds
is needed for diffusion. Insufficient mixing of bits due to single-round operation
could allow an attacker, in combination with other biases, to craft inputs that could
zero bits in the output. This issue has subsequently been resolved in the code base
with a new A esGenerator4R that performs 4 rounds. (T OB-ARW-001)
❏
Increase test coverage of the VM semantics and implement regression tests to
ensure the consistency of