Penetration Test Report (Leviathan): OmniFileStore Encryption Review   FINAL   06102016

OmniFileStore Encryption
Design Review
Prepared for: Ken Case
Chief Executive Officer
Omni Development Inc 1000
Dexter Ave N,
Seattle, WA 98109
June 7th, 2016
© 2016 Leviathan Security Group Incorporated.
All Rights Reserved.
This document contains information, which is protected by copyright and pre-existing non-disclosure
agreement between Leviathan Security Group and The Omni Group.
Disclaimer
No trademark, copyright, or patent licenses are expressly or implicitly granted (herein) with this
analysis, report, or white paper. All brand names and product names used in this document are
trademarks, registered trademarks, or trade names of their respective holders. Leviathan Security
Group is not associated with any other vendors or products mentioned in this document.
Confidentiality Notice
This document contains information confidential and proprietary to Leviathan Security Group. The
information may not be used, disclosed, or reproduced without the prior written authorization of
Leviathan and those so authorized may only use the information for the purpose of evaluation
consistent with authorization. Reproduction of any section of this document must include this legend.
Table of Contents
Engagement Summary 4
The Product 5
Design Review 6
Threat Model 6
Entropy Sources 7
Choice of Algorithms 8
CTR Mode 9
Crypto Agility 10
Compression-Related Attacks 11
File Length Disclosure 11
Unauthorized File Overwrite 12
Key Rollover and Forward Secrecy 12
Key Encryption Key Protection 13
Summary 14
1 Engagement Summary
The Omni Group publishes a cloud document storage system for the Mac OS X and iOS platforms.
Recognizing that it is beneficial to provide encryption for stored client documents, they have
designed a cryptosystem tailored to their particular application. Among other constraints, the system
is designed such that the client controls the encryption key and that key is unknown to The Omni
Group.
On May 17th, The Omni Group engaged Leviathan Security Group to conduct a design-level review of
the proposed cryptosystem (OmniFileStore) to be used in the OmniFocus product. Omni provided
documentation of the proposed design for the OmniFileStore in the form of diagrams, narrative
descriptions with justification and future development plans, and example Python source code,
current as of May 18th, 2016. Using this information, Leviathan has documented a number of
requirements and considerations related to the use of this design in the target platform.
2 The Product
The OmniFileStore encryption system is intended to be used in a variety of products, including
OmniFocus, OmniPresence, MailDrop, and Quick Entry. These products use a document storage
system involving a collection of a compacted database containing many files, and individual files not
yet added to the database. Associated with these are several metadata files describing key
information and synchronization state. The file database is synchronized en bloc to each of a user’s
devices via The Omni Group’s application software, which authenticates to and communicates with a
hosted web service using TLS.
The role of the encryption system in The Omni Group’s product offering is to supplement extant
authentication in the protection of a user’s files. The current implementation solely relies on transport
encryption to protect information during transmission. Once uploaded, a user’s files are stored
unencrypted and are susceptible to compromise. The Omni Group proposes to introduce a user
derived and controlled encryption key to protect the user’s files during transport and storage.
Users must have access to their files from multiple devices that can be added and removed
dynamically. Multiple device support requires that encryption and decryption keys are available to
the user when they use any device to access the service, even if they do not have access to any
other device they have previously used. Further, The Omni Group finds it desirable from a
performance perspective to have paged random access into files and compressed databases.
As with the vast majority of cryptographically secured document storage systems, the fundamental
goal of the system presently under consideration is to prevent disclosure of sensitive information to
anyone who does not possess the decryption key. In this case, the contents of any and all documents
stored in the system, as well as the titles and other similar metadata of those files, is classified as
sensitive. The length of files and other data entities are also considered sensitive if and only if the
length would disclose non-trivial information about the data entity.
The Omni Group’s products are developed for Mac OS X and Apple iOS platforms. Because of the
design goal that the user retains control over the encryption keys they use, cryptographic operations
including encryption, decryption, and key generation will be handled on such devices. Where
possible, The Omni Group has made use of platform APIs and libraries to handle cryptography in
order to minimize opportunities for implementation error.
3 Design Review
Our analysis of the design documents provided is organized by topical area. For each area, we
consider how the proposed system supports the security of the proposed system with respect to the
design goals. We follow our standard methodology that first considers the Threat Model the design
faces and then evaluates Entropy Sources, Algorithm Choice, and Cypher Modality.
3.1.1 Threat Model
The threat model used to guide the design of the cryptosystem correctly assumes compromise of
the synchronization service. This is vital, since the primary purpose of the cryptosystem is to protect
user data even in the event of a compromise.
A compromise that results in disclosure of cleartext user data would have strongly negative external
consequences to The Omni Group, including reputational damage and a decrease in users’
perceived value of The Omni Group’s products and services. Further, storing cleartext user data
increases the risk of compromise of that data during the company’s day-to-day operations, which
creates a need for specific policies and processes to mitigate internal threats.
The impact of cleartext user-data disclosure is further compounded by the fact that the nature of the
data is entirely undefined. It is possible and even likely that many different types of sensitive
information will be stored on The Omni Group’s systems, including inter alia personally identifiable
information, personal health information, financial and payment industry information, privileged legal
information, and intellectual property owned by users. There is no effective technical measure by
which The Omni Group could prevent such use, and so it should be taken into account in the threat
model.
In their threat model, The Omni Group specifically identifies a number of aspects of their service’s
attack surface, under the assumption that a user’s account is compromised and a hypothetical
attacker is able to disclose arbitrary data associated with at least that user’s account from The Omni
Group:
• Disclosure of the frequency of changes to documents, the size of those changes, and the
rough time of the changes
• The ability of an attacker to introduce additional data into a user’s working set for later
coalescing into their main document database, and the attendant plaintext-guessing attack
resultant from compression use
• Possession of one of the devices used to access files, whether a current or old device, and
full control over that device
• Potential abuse of certain privileged user accounts (e.g. administrative accounts) to roll back
files to previous versions
• The potential for users with write-only access to a user’s working set of documents to abuse
this privilege to make changes to existing documents by overwriting them
• Disclosure of metadata related to the surrogate filename established when a file is added to
a user’s repository (e.g. to their database)
While not specifical