Security fix #103

survived · 2024-07-18T08:20:01Z

Challenge derivation in non-interactive ZK proofs was ambiguous and that could lead to security vulnerability (however, it's unknown if it could be exploited). This PR makes challenge derivation unambiguous.

The fix was developed and reviewed privately. Fixed library version has been already released on crates.io.

Derive challenges unambiguously

Signed-off-by: Denis Varlakov <[email protected]>

github-actions · 2024-07-18T08:22:03Z

The spec was successfully compiled. PDF is available here.

Signed-off-by: Denis Varlakov <[email protected]>

github-actions · 2024-07-18T08:22:51Z

Crate direct deps

Direct deps

cggmp21-keygen v0.3.0 (/home/runner/work/cggmp21/cggmp21/pr_branch/cggmp21-keygen)
digest v0.10.6
futures v0.3.24
generic-ec v0.4.0
generic-ec-zkp v0.4.0
hex v0.4.3
key-share v0.4.0 (/home/runner/work/cggmp21/cggmp21/pr_branch/key-share)
paillier-zk v0.4.0
rand_core v0.6.4
rand_hash v0.1.0
round-based v0.3.0
serde v1.0.193
serde_with v2.3.3
sha2 v0.10.6
thiserror v1.0.48
udigest v0.2.0

Compared to base branch

Diff

--- direct-deps-base	2024-07-18 08:22:50.315061442 +0000
+++ direct-deps-pr	2024-07-18 08:22:50.675061427 +0000
@@ -1 +1 @@
-cggmp21-keygen v0.2.0 (/home/runner/work/cggmp21/cggmp21/base_branch/cggmp21-keygen)
+cggmp21-keygen v0.3.0 (/home/runner/work/cggmp21/cggmp21/pr_branch/cggmp21-keygen)
@@ -4,2 +4,2 @@
-generic-ec v0.3.0
-generic-ec-zkp v0.3.0
+generic-ec v0.4.0
+generic-ec-zkp v0.4.0
@@ -7,3 +7,2 @@
-key-share v0.3.0 (/home/runner/work/cggmp21/cggmp21/base_branch/key-share)
-paillier-zk v0.3.0
-rand_chacha v0.3.1
+key-share v0.4.0 (/home/runner/work/cggmp21/cggmp21/pr_branch/key-share)
+paillier-zk v0.4.0
@@ -10,0 +10 @@
+rand_hash v0.1.0
@@ -16 +16 @@
-udigest v0.1.0
+udigest v0.2.0

All deps

cargo tree

cggmp21 v0.4.0 (/home/runner/work/cggmp21/cggmp21/pr_branch/cggmp21)
├── cggmp21-keygen v0.3.0 (/home/runner/work/cggmp21/cggmp21/pr_branch/cggmp21-keygen)
│   ├── digest v0.10.6
│   │   ├── block-buffer v0.10.3
│   │   │   └── generic-array v0.14.6
│   │   │       ├── serde v1.0.193
│   │   │       │   └── serde_derive v1.0.193 (proc-macro)
│   │   │       │       ├── proc-macro2 v1.0.66
│   │   │       │       │   └── unicode-ident v1.0.4
│   │   │       │       ├── quote v1.0.33
│   │   │       │       │   └── proc-macro2 v1.0.66 (*)
│   │   │       │       └── syn v2.0.32
│   │   │       │           ├── proc-macro2 v1.0.66 (*)
│   │   │       │           ├── quote v1.0.33 (*)
│   │   │       │           └── unicode-ident v1.0.4
│   │   │       └── typenum v1.15.0
│   │   └── crypto-common v0.1.6
│   │       ├── generic-array v0.14.6 (*)
│   │       └── typenum v1.15.0
│   ├── displaydoc v0.2.4 (proc-macro)
│   │   ├── proc-macro2 v1.0.66 (*)
│   │   ├── quote v1.0.33 (*)
│   │   └── syn v2.0.32 (*)
│   ├── generic-ec v0.4.0
│   │   ├── digest v0.10.6 (*)
│   │   ├── generic-ec-core v0.2.0
│   │   │   ├── generic-array v0.14.6 (*)
│   │   │   ├── rand_core v0.6.4
│   │   │   ├── serde v1.0.193 (*)
│   │   │   ├── subtle v2.4.1
│   │   │   └── zeroize v1.6.0
│   │   │       └── zeroize_derive v1.3.2 (proc-macro)
│   │   │           ├── proc-macro2 v1.0.66 (*)
│   │   │           ├── quote v1.0.33 (*)
│   │   │           ├── syn v1.0.101
│   │   │           │   ├── proc-macro2 v1.0.66 (*)
│   │   │           │   ├── quote v1.0.33 (*)
│   │   │           │   └── unicode-ident v1.0.4
│   │   │           └── synstructure v0.12.6
│   │   │               ├── proc-macro2 v1.0.66 (*)
│   │   │               ├── quote v1.0.33 (*)
│   │   │               ├── syn v1.0.101 (*)
│   │   │               └── unicode-xid v0.2.4
│   │   ├── hex v0.4.3
│   │   │   └── serde v1.0.193 (*)
│   │   ├── phantom-type v0.4.2
│   │   │   └── educe v0.4.19 (proc-macro)
│   │   │       ├── enum-ordinalize v3.1.11 (proc-macro)
│   │   │       │   ├── num-bigint v0.4.3
│   │   │       │   │   ├── num-integer v0.1.45
│   │   │       │   │   │   └── num-traits v0.2.15
│   │   │       │   │   └── num-traits v0.2.15
│   │   │       │   ├── num-traits v0.2.15
│   │   │       │   ├── proc-macro2 v1.0.66 (*)
│   │   │       │   ├── quote v1.0.33 (*)
│   │   │       │   └── syn v1.0.101 (*)
│   │   │       ├── proc-macro2 v1.0.66 (*)
│   │   │       ├── quote v1.0.33 (*)
│   │   │       └── syn v1.0.101 (*)
│   │   ├── rand_core v0.6.4
│   │   ├── rand_hash v0.1.0
│   │   │   ├── digest v0.10.6 (*)
│   │   │   ├── rand_core v0.6.4
│   │   │   └── udigest v0.2.0
│   │   │       ├── digest v0.10.6 (*)
│   │   │       └── udigest-derive v0.2.0 (proc-macro)
│   │   │           ├── proc-macro2 v1.0.66 (*)
│   │   │           ├── quote v1.0.33 (*)
│   │   │           └── syn v2.0.32 (*)
│   │   ├── serde v1.0.193 (*)
│   │   ├── serde_with v2.3.3
│   │   │   ├── serde v1.0.193 (*)
│   │   │   └── serde_with_macros v2.3.3 (proc-macro)
│   │   │       ├── darling v0.20.1
│   │   │       │   ├── darling_core v0.20.1
│   │   │       │   │   ├── fnv v1.0.7
│   │   │       │   │   ├── ident_case v1.0.1
│   │   │       │   │   ├── proc-macro2 v1.0.66 (*)
│   │   │       │   │   ├── quote v1.0.33 (*)
│   │   │       │   │   ├── strsim v0.10.0
│   │   │       │   │   └── syn v2.0.32 (*)
│   │   │       │   └── darling_macro v0.20.1 (proc-macro)
│   │   │       │       ├── darling_core v0.20.1 (*)
│   │   │       │       ├── quote v1.0.33 (*)
│   │   │       │       └── syn v2.0.32 (*)
│   │   │       ├── proc-macro2 v1.0.66 (*)
│   │   │       ├── quote v1.0.33 (*)
│   │   │       └── syn v2.0.32 (*)
│   │   ├── subtle v2.4.1
│   │   ├── udigest v0.2.0 (*)
│   │   └── zeroize v1.6.0 (*)
│   ├── generic-ec-zkp v0.4.0
│   │   ├── generic-array v0.14.6 (*)
│   │   ├── generic-ec v0.4.0 (*)
│   │   ├── rand_core v0.6.4
│   │   ├── serde v1.0.193 (*)
│   │   ├── subtle v2.4.1
│   │   └── udigest v0.2.0 (*)
│   ├── hex v0.4.3 (*)
│   ├── key-share v0.4.0 (/home/runner/work/cggmp21/cggmp21/pr_branch/key-share)
│   │   ├── displaydoc v0.2.4 (proc-macro) (*)
│   │   ├── generic-ec v0.4.0 (*)
│   │   ├── generic-ec-zkp v0.4.0 (*)
│   │   ├── hex v0.4.3 (*)
│   │   ├── serde v1.0.193 (*)
│   │   ├── serde_with v2.3.3 (*)
│   │   └── thiserror v1.0.48
│   │       └── thiserror-impl v1.0.48 (proc-macro)
│   │           ├── proc-macro2 v1.0.66 (*)
│   │           ├── quote v1.0.33 (*)
│   │           └── syn v2.0.32 (*)
│   ├── rand_core v0.6.4
│   ├── round-based v0.3.0
│   │   ├── displaydoc v0.2.4 (proc-macro) (*)
│   │   ├── futures-util v0.3.24
│   │   │   ├── futures-channel v0.3.24
│   │   │   │   ├── futures-core v0.3.24
│   │   │   │   └── futures-sink v0.3.24
│   │   │   ├── futures-core v0.3.24
│   │   │   ├── futures-io v0.3.24
│   │   │   ├── futures-macro v0.3.24 (proc-macro)
│   │   │   │   ├── proc-macro2 v1.0.66 (*)
│   │   │   │   ├── quote v1.0.33 (*)
│   │   │   │   └── syn v1.0.101 (*)
│   │   │   ├── futures-sink v0.3.24
│   │   │   ├── futures-task v0.3.24
│   │   │   ├── memchr v2.5.0
│   │   │   ├── pin-project-lite v0.2.9
│   │   │   ├── pin-utils v0.1.0
│   │   │   └── slab v0.4.7
│   │   ├── phantom-type v0.3.1
│   │   │   └── educe v0.4.19 (proc-macro) (*)
│   │   ├── round-based-derive v0.2.1 (proc-macro)
│   │   │   ├── proc-macro2 v1.0.66 (*)
│   │   │   ├── quote v1.0.33 (*)
│   │   │   └── syn v1.0.101 (*)
│   │   ├── thiserror v1.0.48 (*)
│   │   └── tracing v0.1.36
│   │       ├── cfg-if v1.0.0
│   │       ├── pin-project-lite v0.2.9
│   │       └── tracing-core v0.1.29
│   ├── serde v1.0.193 (*)
│   ├── serde_with v2.3.3 (*)
│   ├── sha2 v0.10.6
│   │   ├── cfg-if v1.0.0
│   │   ├── cpufeatures v0.2.12
│   │   └── digest v0.10.6 (*)
│   ├── thiserror v1.0.48 (*)
│   └── udigest v0.2.0 (*)
├── digest v0.10.6 (*)
├── futures v0.3.24
│   ├── futures-channel v0.3.24 (*)
│   ├── futures-core v0.3.24
│   ├── futures-executor v0.3.24
│   │   ├── futures-core v0.3.24
│   │   ├── futures-task v0.3.24
│   │   └── futures-util v0.3.24 (*)
│   ├── futures-io v0.3.24
│   ├── futures-sink v0.3.24
│   ├── futures-task v0.3.24
│   └── futures-util v0.3.24 (*)
├── generic-ec v0.4.0 (*)
├── generic-ec-zkp v0.4.0 (*)
├── hex v0.4.3 (*)
├── key-share v0.4.0 (/home/runner/work/cggmp21/cggmp21/pr_branch/key-share) (*)
├── paillier-zk v0.4.0
│   ├── digest v0.10.6 (*)
│   ├── fast-paillier v0.1.0
│   │   ├── bytemuck v1.13.1
│   │   │   └── bytemuck_derive v1.4.1 (proc-macro)
│   │   │       ├── proc-macro2 v1.0.66 (*)
│   │   │       ├── quote v1.0.33 (*)
│   │   │       └── syn v2.0.32 (*)
│   │   ├── rand_core v0.6.4
│   │   ├── rug v1.21.0
│   │   │   ├── az v1.2.1
│   │   │   ├── gmp-mpfr-sys v1.6.1
│   │   │   │   └── libc v0.2.153
│   │   │   ├── libc v0.2.153
│   │   │   └── serde v1.0.193 (*)
│   │   ├── serde v1.0.193 (*)
│   │   └── thiserror v1.0.48 (*)
│   ├── generic-ec v0.4.0 (*)
│   ├── rand_core v0.6.4
│   ├── rand_hash v0.1.0 (*)
│   ├── rug v1.21.0 (*)
│   ├── serde v1.0.193 (*)
│   ├── serde_with v3.0.0
│   │   ├── serde v1.0.193 (*)
│   │   └── serde_with_macros v3.0.0 (proc-macro)
│   │       ├── darling v0.20.1 (*)
│   │       ├── proc-macro2 v1.0.66 (*)
│   │       ├── quote v1.0.33 (*)
│   │       └── syn v2.0.32 (*)
│   ├── thiserror v1.0.48 (*)
│   └── udigest v0.2.0 (*)
├── rand_core v0.6.4
├── rand_hash v0.1.0 (*)
├── round-based v0.3.0 (*)
├── serde v1.0.193 (*)
├── serde_with v2.3.3 (*)
├── sha2 v0.10.6 (*)
├── thiserror v1.0.48 (*)
└── udigest v0.2.0 (*)

Compared to base branch

Diff

--- all-deps-base	2024-07-18 08:22:50.451061437 +0000
+++ all-deps-pr	2024-07-18 08:22:50.811061422 +0000
@@ -6 +6 @@
-cggmp21-keygen v0.2.0 (/home/runner/work/cggmp21/cggmp21/base_branch/cggmp21-keygen)
+cggmp21-keygen v0.3.0 (/home/runner/work/cggmp21/cggmp21/pr_branch/cggmp21-keygen)
@@ -28 +28 @@
-generic-ec v0.3.0
+generic-ec v0.4.0
@@ -30 +30 @@
-generic-ec-zkp v0.3.0
+generic-ec-zkp v0.4.0
@@ -34 +34 @@
-key-share v0.3.0 (/home/runner/work/cggmp21/cggmp21/base_branch/key-share)
+key-share v0.4.0 (/home/runner/work/cggmp21/cggmp21/pr_branch/key-share)
@@ -40 +40 @@
-paillier-zk v0.3.0
+paillier-zk v0.4.0
@@ -45 +44,0 @@
-ppv-lite86 v0.2.17
@@ -48 +46,0 @@
-rand_chacha v0.3.1
@@ -49,0 +48 @@
+rand_hash v0.1.0
@@ -71,2 +70,2 @@
-udigest v0.1.0
-udigest-derive v0.1.0 (proc-macro)
+udigest v0.2.0
+udigest-derive v0.2.0 (proc-macro)

github-actions · 2024-07-18T08:26:13Z

Benchmark Result

Benchmarks

RUST_TESTS_SEED=72b57b0a8455813d378e1b6c01628caec9c764b87d23d3fc6f7938057f6cc224
n = 3

Non-threshold DKG
Protocol Performance:
  - Protocol took 428.63µs to complete
In particular:
  - Stage: 9.47µs
    - Setup networking: 9.08µs (95.9%)
    - Unstaged: 390.00ns (4.1%)
  - Round 1: 142.51µs
    - Sample x_i, rid_i, chain_code: 62.69µs (44.0%)
    - Sample schnorr commitment: 58.52µs (41.1%)
    - Commit to public data: 20.99µs (14.7%)
    - Unstaged: 311.00ns (0.2%)
  - Round 2: 1.34µs
    - Hash received msgs (reliability check): 1.17µs (87.3%)
    - Unstaged: 171.00ns (12.7%)
  - Round 3: 2.11µs
    - Assert other parties hashed messages (reliability check): 1.98µs (94.2%)
    - Unstaged: 122.00ns (5.8%)
  - Round 4: 37.06µs
    - Validate decommitments: 33.63µs (90.8%)
    - Calculate chain_code: 992.00ns (2.7%)
    - Calculate challege rid: 1.92µs (5.2%)
    - Prove knowledge of `x_i`: 360.00ns (1.0%)
    - Unstaged: 151.00ns (0.4%)
  - Round 5: 236.15µs
    - Validate schnorr proofs: 235.86µs (99.9%)
    - Unstaged: 290.00ns (0.1%)


Threshold DKG
Protocol Performance:
  - Protocol took 1.28ms to complete
In particular:
  - Stage: 1.87µs
    - Setup networking: 1.84µs (98.4%)
    - Unstaged: 30.00ns (1.6%)
  - Round 1: 199.11µs
    - Sample rid_i, schnorr commitment, polynomial, chain_code: 176.08µs (88.4%)
    - Commit to public data: 22.80µs (11.5%)
    - Unstaged: 231.00ns (0.1%)
  - Round 2: 1.35µs
    - Hash received msgs (reliability check): 1.19µs (88.1%)
    - Unstaged: 161.00ns (11.9%)
  - Round 3: 340.00ns
    - Assert other parties hashed messages (reliability check): 210.00ns (61.8%)
    - Unstaged: 130.00ns (38.2%)
  - Round 4: 785.23µs
    - Validate decommitments: 44.54µs (5.7%)
    - Validate data size: 380.00ns (0.0%)
    - Validate Feldmann VSS: 352.40µs (44.9%)
    - Compute rid: 241.00ns (0.0%)
    - Compute chain_code: 931.00ns (0.1%)
    - Compute Ys: 354.17µs (45.1%)
    - Compute sigma: 320.00ns (0.0%)
    - Calculate challenge: 28.81µs (3.7%)
    - Prove knowledge of `sigma_i`: 3.28µs (0.4%)
    - Unstaged: 151.00ns (0.0%)
  - Round 5: 292.35µs
    - Validate schnorr proofs: 291.13µs (99.6%)
    - Derive resulting public key and other data: 1.03µs (0.4%)
    - Unstaged: 181.00ns (0.1%)


Auxiliary data generation protocol
Protocol Performance:
  - Protocol took 9.56s to complete
In particular:
  - Stage: 10.99µs
    - Retrieve auxiliary data: 220.00ns (2.0%)
    - Setup networking: 10.65µs (96.9%)
    - Unstaged: 120.00ns (1.1%)
  - Round 1: 1.16s
    - Retrieve primes (p and q): 101.00ns (0.0%)
    - Compute paillier decryption key (N): 6.32µs (0.0%)
    - Generate auxiliary params r, λ, t, s: 8.96ms (0.8%)
    - Prove Πprm (ψˆ_i): 1.16s (99.2%)
    - Sample random bytes: 2.52µs (0.0%)
    - Compute hash commitment and sample decommitment: 302.05µs (0.0%)
    - Unstaged: 230.00ns (0.0%)
  - Round 2: 1.66µs
    - Hash received msgs (reliability check): 1.36µs (81.9%)
    - Unstaged: 301.00ns (18.1%)
  - Round 3: 621.00ns
    - Assert other parties hashed messages (reliability check): 461.00ns (74.2%)
    - Unstaged: 160.00ns (25.8%)
  - Round 4: 5.89s
    - Validate round 1 decommitments: 600.87µs (0.0%)
    - Validate П_prm (ψ_i): 2.28s (38.8%)
    - Add together shared random bytes: 1.33µs (0.0%)
    - Compute П_mod (ψ_i): 3.43s (58.3%)
    - Assemble security params for П_fac (ф_i): 10.79µs (0.0%)
    - Compute П_fac (ф_i^j): 171.70ms (2.9%)
    - Unstaged: 1.05µs (0.0%)
  - Round 5: 2.51s
    - Validate ψ_j (П_mod): 2.34s (93.1%)
    - Validate ф_j (П_fac): 172.20ms (6.9%)
    - Assemble auxiliary info: 146.23µs (0.0%)
    - Unstaged: 902.00ns (0.0%)


Signing protocol
Protocol Performance:
  - Protocol took 4.16s to complete
In particular:
  - Stage: 137.03µs
    - Map t-out-of-n protocol to t-out-of-t: 65.78µs (48.0%)
    - Retrieve auxiliary data: 66.66µs (48.6%)
    - Precompute execution id and security params: 561.00ns (0.4%)
    - Setup networking: 3.94µs (2.9%)
    - Unstaged: 90.00ns (0.1%)
  - Round 1: 188.52ms
    - Generate local ephemeral secrets (k_i, y_i, p_i, v_i): 49.18µs (0.0%)
    - Encrypt G_i and K_i: 107.35ms (56.9%)
    - Prove ψ0_j: 81.12ms (43.0%)
    - Unstaged: 581.00ns (0.0%)
  - Round 2: 15.09µs
    - Hash received msgs (reliability check): 14.88µs (98.6%)
    - Unstaged: 210.00ns (1.4%)
  - Round 3: 2.23s
    - Assert other parties hashed messages (reliability check): 511.00ns (0.0%)
    - Verify psi0 proofs: 269.22ms (12.1%)
    - Sample random r, hat_r, s, hat_s, beta, hat_beta: 14.16µs (0.0%)
    - Encrypt D_ji: 70.26ms (3.2%)
    - Encrypt F_ji: 35.77ms (1.6%)
    - Encrypt hat_D_ji: 559.08ms (25.1%)
    - Encrypt hat_F_ji: 35.73ms (1.6%)
    - Prove psi_ji: 789.34ms (35.4%)
    - Prove psiˆ_ji: 208.99ms (9.4%)
    - Prove psi_prime_ji : 258.32ms (11.6%)
    - Unstaged: 1.22µs (0.0%)
  - Round 4: 1.56s
    - Retrieve auxiliary data: 4.84µs (0.0%)
    - Validate psi: 164.38ms (10.5%)
    - Validate hat_psi: 164.67ms (10.6%)
    - Validate psi_prime: 934.07ms (59.9%)
    - Compute Gamma, Delta_i, delta_i, chi_i: 215.12ms (13.8%)
    - Prove psi_prime_prime: 81.13ms (5.2%)
    - Unstaged: 481.00ns (0.0%)
  - Presig output: 185.22ms
    - Validate psi_prime_prime: 185.09ms (99.9%)
    - Calculate presignature: 132.74µs (0.1%)
    - Unstaged: 761.00ns (0.0%)
  - Partial signing: 7.02µs
  - Signature reconstruction: 196.16µs

survived added 16 commits June 18, 2024 17:07

Update deps & derive challenges unambiguously

35fa715

Update workflow

db0569d

Update udigest

f446712

Update workflows

f7527e2

Fix tests

3c6d9cb

Update wasm

e5a9f72

Use execution id as sid everywhere

344ccd4

Update the spec

7ba8860

Fix keygen compilation

f5d5df6

Update cargo.toml

00a38ee

Update deps

0fc8d28

Bump lib versions, update changelogs

504f4cd

Add changelog check to CI

03bd6cd

Update bench workflow

ed0894f

Merge pull request #5 from dfnsco/unambiguous-challenge

730e121

Derive challenges unambiguously

Update deps

c9a1a9d

Signed-off-by: Denis Varlakov <[email protected]>

Update CI

d07ddc5

Signed-off-by: Denis Varlakov <[email protected]>

survived requested a review from maurges July 18, 2024 08:25

maurges approved these changes Jul 18, 2024

View reviewed changes

survived merged commit 9b458cd into m Jul 18, 2024
21 checks passed

survived deleted the publish-fix branch July 18, 2024 09:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Security fix #103

Security fix #103

survived commented Jul 18, 2024

github-actions bot commented Jul 18, 2024 •

edited

Loading

github-actions bot commented Jul 18, 2024

github-actions bot commented Jul 18, 2024

Security fix #103

Security fix #103

Conversation

survived commented Jul 18, 2024

github-actions bot commented Jul 18, 2024 • edited Loading

github-actions bot commented Jul 18, 2024

Crate direct deps

Compared to base branch

All deps

Compared to base branch

github-actions bot commented Jul 18, 2024

Benchmark Result

github-actions bot commented Jul 18, 2024 •

edited

Loading