Penetration Test Report (NCCGroup): NCC Group O1Labs O1LB001 Report 2020 05 11 v1.1

Coda Cryptographic Review
O1 Labs
May 11, 2020 – Version 1.1
Preparedfor
BrandonKase
IzaakMeckler
EmreTekisalp
Preparedby
MasonHemmel
AvaHowell
ThomasPornin
JavedSamuel
EricSchorn
©2020–NCCGroup
PreparedbyNCCGroupSecurityServices,Inc. forO1Labs. Portionsofthisdocumentandthetemplates
usedinitsproductionarethepropertyofNCCGroupandcannotbecopied(infullorinpart)without
NCCGroup’spermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,NCCGroupthepublisher,and
theauthor(s)assumenoresponsibilityforerrors,omissions,orfordamagesresultingfromtheuseof
the information contained herein. Use of NCC Group’s services does not guarantee the security of a
system,orthatcomputerintrusionswillnotoccur.
Executive Summary
Synopsis evaluating these components can be found in Ap-
During the spring of 2020, O(1) Labs engaged NCC pendixBonpage18.
GrouptoconductacryptographicassessmentofCoda
KeyFindings
Protocol. This cryptocurrency leverages state-of-the-
The assessment uncovered a set of common crypto-
art cryptographic constructions to provide traditional
graphicflaws. Twoofthemorenotablewere:
cryptocurrency applications with a more lightweight
blockchain. This assessment focused on the core
• Potential mishandling of point addition edge cases,
cryptographicprimitivesaswellastheoverlaidprotocol.
which could result in provers being forced to create
invalidproofs.
The O(1) Labs team provided source code, and was
• In computers that used a legacy C++ standard
communicative throughout the engagement. NCC
library or could not access cryptographically-secure
Groupperformedthistestonapurpose-builtbranchof
pseudorandom number generators, Schnorr secret
thecodeavailableatthetimeoftesting.
key values are generated such that attackers with
Scope knowledge of the underlying system would likely be
NCCGroup’sevaluationincluded: abletopredictthesecret.
• CompilationofSnarkytoRank-1ConstraintSystem O(1) Labs addressed four of the six findings reported
(R1CS): This covers the process of turning the arith- byNCCGroup,includingbothoftheabove,priortothe
meticcircuitsintoaninstantiationofanNP-complete releaseofthisreport.
problem for which efficient argument systems have
StrategicRecommendations
beendesigned.
O(1) Labs’s code, while largely stable on its own, relies
• Implementations of Snarky Primitives: The primi-
insomepartsonupstreamlibrariesnotcoveredinthis
tives implemented are a verifiable random function
audit. Timepermitting, thesedependenciesshouldbe
(VRF), Schnorr signatures, a random oracle function,
audited and/or reduced to ensure the lowest possible
andellipticcurvearithmeticinsupportoftheabove.
attacksurface.
• Elliptic Curves and Generators: This includes the
choice of elliptic curves, as well as the soundness of
theirinstantiationandimplementation.
• LedgerHardwareWalletApp: Thisisanimplemen-
tation of the Schnorr signature scheme used to sign
Coda Protocol transactions on the Ledger BOLOS
platform.
• BlockchainSNARK:TheCodaProtocolincludesboth
a pairing-based and discrete-log-based implemen-
tation of the MARLIN preprocessing SNARK. These
allow for proofs of correctness of the overall state
of the blockchain at a given moment, as well as the
correctnessoftransitionsbetweenstates(i.e. blocks).
• Overall Protocol Review: The implementation of
the Coda Protocol’s core consensus mechanism
(OuroborosSamasika),ensuringthattheimplementa-
tionaccordswiththewhitepaper’sdesign,andensur-
ingthattheparameterchoicesmadeareappropriate
anddonotintroduceanyissuesinandofthemselves.
Security issues arising from side-channels and issues
in the upstream papers that were implemented in this
project,includingthoseauthoredbyO(1)Labs,werenot
inscopeforthisassessment.
More detailed discussion of NCC Group’s strategy in
2 | O1LabsCodaCryptographicReview NCCGroup
Dashboard
TargetMetadata EngagementData
Name Coda Type CryptographicAssessment
Type Cryptocurrency Method Code-Assisted
Platforms OCaml,Rust Dates 2019-12-23to2020-04-09
Environment LocalInstance Consultants 4
LevelofEffort 45days
Targets
BlockchainSNARKImplementation
CodaProtocolConsensusImplementation
Discrete-Log-BasedMarlinSNARKImplementation
EllipticCurveImplementationinR1CS-GeneratingOCAMLLayer
EllipticCurveImplementationUsedtoInstantiateMarlinSNARK
Pairing-BasedMarlinSNARKImplementation
PoseidonHashImplementationinR1CS-GeneratingOCAMLLayer
RandomOracle
SchnorrSignatureImplementationinR1CS-GeneratingOCAMLLayer
VerifiableRandomOracle
FindingBreakdown
Criticalissues 0
Highissues 0
Mediumissues 1
Lowissues 2
Informationalissues 3
Totalissues 6
CategoryBreakdown
Cryptography 5
Other 1
ComponentBreakdown
LedgerApp 2
Zexe 1
camlsnark_c 1
snarky 2
Key
Critical High Medium Low Informational
3 | O1LabsCodaCryptographicReview NCCGroup
Table of Findings
Foreachfinding,NCCGroupusesacompositeriskscorethattakesintoaccounttheseverityoftherisk,application’s
exposureanduserpopulation,technicaldifficultyofexploitation,andotherfactors. ForanexplanationofNCCGroup’s
riskratingandfindingcategorization,seeAppendixAonpage16.
Title Status ID Risk
SchnorrSecretKeyValuesArePredictablyGeneratedinLegacyArchitectures Fixed 004 Medium
orWithLegacyC++StandardLibraryImplementations
PotentialMishandlingofPointAdditionEdgeCases Fixed 001 Low
Out-of-BoundsMemoryWrite Fixed 006 Low
PoseidonS-BoxisNotaBijectionUnderMNTCurves’Field Fixed 002 Informational
Future Developments May Impact Subgroup Security of Discrete-Log-Based Reported 007 Informational
EllipticCurve
LedgerSigningDoesNotAbortWhenk = 0 Reported 009 Informational
4 | O1LabsCodaCryptographicReview NCCGroup
Finding Details
Finding Schnorr Secret Key Values Are Predictably Generated in Legacy Architectures or
WithLegacyC++StandardLibraryImplementations
Risk Medium Impact: High,Exploitability: Low
Identifier NCC-O1LB001-004
Status Fixed
Category Cryptography
Component camlsnark_c
Location o1-labs/snarky/src/camlsnark_c/libsnark-caml/libsnark/misc/pedersen.cpp:133
Impact Oncertainarchitectures,attackersabletogathersomeknowledgeofatargetsystemwillbe
abletopredictSchnorrsecretkeyvalues.
Description SnarkygeneratesaSchnorrsecretkeyintheOCamllayerasfollows:
scalar schnorr_secret_key() {
return scalar_field::random_element().as_bigint();
}
Therandom_elementfunctionthatiscalledherecomesfromlibff,theunderlyingClibrary
used to perform some curve operations within Snarky. The pedersen.cpp file references
themnt4andmnt6implementationsfoundwithin libff, andbothoftheseimplementthe
random_elementroughlyasbelow:
mnt4_G1 mnt4_G1::random_element()
{
return (scalar_field::random_element().as_bigint()) * G1_one;
}
Theunderlyingscalar_field::random_elementfunctionhasmultipleimplementationpaths
dependingonthetypeofthescalar_fieldthatcallsit;however,allofthesedifferingfield
implementationsusethesamebaseclassimplementationtogetarandomfieldelement. This
isimplementedasfollows:
template<mp_size_t n, const bigint<n>& modulus>
Fp_model<n, modulus> Fp_model<n,modulus>::random_element() /// returns random ele
ment of Fp_model
{
/* note that as Montgomery representation is a bijection then
selecting a random element of {xR} is the same as selecting a
random element of {x} */
Fp_model<n, modulus> r;
do
{
r.mont_repr.randomize();
/* clear all bits higher than MSB of modulus */
size_t bitno = GMP_NUMB_BITS * n - 1;
while (modulus.test_bit(bitno) == false)
5 | O1LabsCodaCryptographicReview NCCGroup
{
const std::size_t part = bitno/GMP_NUMB_BITS;
const std::size_t bit = bitno - (GMP_NUMB_BITS*part);
r.mont_repr.data[part] &= ~(1ul<<bit);
bitno--;
}
}
/* if r.data is still >= modulus -- repeat (rejection sampling) */
while (mpn_cmp(r.mont_repr.data, modulus.data, n) >= 0);
return r;
}
ThisfunctiongeneratesarandompointintheMontgomeryrepresentation,thenpresentsit
to the caller without much alteration. NCC Group confirmed that none of the other callers
includeanyrandomness,soanyentropyinthefinalresponseisderivedfromthecalltothe
mont_repr.randomize()function. Sincemont_reprisatypealiasforanappropriately-sized
bigint,thisfunctionisacalltoth