From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id B0511D66 for ; Fri, 6 Apr 2018 20:51:33 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-ua0-f176.google.com (mail-ua0-f176.google.com [209.85.217.176]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 00750621 for ; Fri, 6 Apr 2018 20:51:32 +0000 (UTC) Received: by mail-ua0-f176.google.com with SMTP id q12so1510721uae.4 for ; Fri, 06 Apr 2018 13:51:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=IaqJwjWUL8iIWIY3HV025zUtl2iHIw2lNpDUH4yhOmc=; b=fYAt6aqdhNwDS0Id+RgQRXJ4Ox/EIYtpNP4zF7B4hBOVcPbG4+IXNImodjExueyK2C f2xi1RDx6ca+wI/5krZUa5mscq5VmpjVibbEzay9nVHTukeCy0Ls2XBbvf94zxpTwAW+ xE9bld8XaONYE6OT33LPaMqqldnuFGSlamk6/tJ/5dvpKWqCxr0znvLMkEfvYqxkqbqJ /fA0HaVpo5UXhXsqaCageGUYbnrhODFoiuqM7KOs6dn5y+j56BuA9qbIVQSsSB9obOZV Y60KjCbVQWyXVHiKbGTInzwKBc285fbhm/hQZ+Hn6/K+SCYz0ONSyUp+DXBMrcqxBzOI CZqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=IaqJwjWUL8iIWIY3HV025zUtl2iHIw2lNpDUH4yhOmc=; b=Uv50ZKkaryjjwc7t/RqAJhxBb43HPNy0gFVwVqmDUsfBXnlY2bQcwCm6MYU9z4ClJU cCeurWgYoVqj3W3QUixyOJyfuy1CUIwSdiFxEgqw8C0gpon1QxKVBTubElTQnOn2PKzG mgziqBFG+ooBmmuWSM6eCyxd+f3gKWNNcaPKQDH4ZeGgil7Zf4BmxhkKGFCSoTKsqA50 JMWzxYlx28WYjxtOW/3+nFW1poVQeijWUJkRz4I6/TJe7kHSzQKbKecPW5/ZFRs1p5So ncwW/hT074FoY3QCGLpD4a0GiAkSkQaNj2XoLO13q3kGGImBeNFMehVcdTxYxqW82WBn EkXw== X-Gm-Message-State: ALQs6tCCxh04r507ns43m29Mz/mdlY++DHgQbVfwEyblw/ANq7GgFJPL 0sKtDm8t2Pcd9dxI/2z9EwhfSIy+7oW61shCGw0= X-Google-Smtp-Source: AIpwx48xKjpyiE8AFSco0GFaIb6SGxqi7fGkC204YulzQjPl7LXaiIPL6WcixzX0hPRBohjyfXdVx7MWeMqTxTWNnuQ= X-Received: by 10.159.34.241 with SMTP id 104mr17851544uan.182.1523047891999; Fri, 06 Apr 2018 13:51:31 -0700 (PDT) MIME-Version: 1.0 Received: by 10.103.90.28 with HTTP; Fri, 6 Apr 2018 13:51:11 -0700 (PDT) In-Reply-To: <84976adb75bef1dfdb12b98c19811278@national.shitposting.agency> References: <84976adb75bef1dfdb12b98c19811278@national.shitposting.agency> From: Matias Alejo Garcia Date: Fri, 6 Apr 2018 17:51:11 -0300 Message-ID: To: ketamine@national.shitposting.agency, Bitcoin Protocol Discussion Content-Type: multipart/alternative; boundary="94eb2c04c9329420db0569343817" X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, HTML_MESSAGE, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org X-Mailman-Approved-At: Fri, 06 Apr 2018 20:55:56 +0000 Subject: Re: [bitcoin-dev] KETAMINE: Multiple vulnerabilities in SecureRandom(), numerous cryptocurrency products affected. X-BeenThere: bitcoin-dev@lists.linuxfoundation.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Bitcoin Protocol Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Apr 2018 20:51:33 -0000 --94eb2c04c9329420db0569343817 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Source? On Fri, Apr 6, 2018 at 4:53 PM, ketamine--- via bitcoin-dev < bitcoin-dev@lists.linuxfoundation.org> wrote: > A significant number of past and current cryptocurrency products > contain a JavaScript class named SecureRandom(), containing both > entropy collection and a PRNG. The entropy collection and the RNG > itself are both deficient to the degree that key material can be > recovered by a third party with medium complexity. There are a > substantial number of variations of this SecureRandom() class in > various pieces of software, some with bugs fixed, some with additional > bugs added. Products that aren't today vulnerable due to moving to > other libraries may be using old keys that have been previously > compromised by usage of SecureRandom(). > > > The most common variations of the library attempts to collect entropy > from window.crypto's CSPRNG, but due to a type error in a comparison > this function is silently stepped over without failing. Entropy is > subsequently gathered from math.Random (a 48bit linear congruential > generator, seeded by the time in some browsers), and a single > execution of a medium resolution timer. In some known configurations > this system has substantially less than 48 bits of entropy. > > The core of the RNG is an implementation of RC4 ("arcfour random"), > and the output is often directly used for the creation of private key > material as well as cryptographic nonces for ECDSA signatures. RC4 is > publicly known to have biases of several bits, which are likely > sufficient for a lattice solver to recover a ECDSA private key given a > number of signatures. One popular Bitcoin web wallet re-initialized > the RC4 state for every signature which makes the biases bit-aligned, > but in other cases the Special K would be manifest itself over > multiple transactions. > > > Necessary action: > > * identify and move all funds stored using SecureRandom() > > * rotate all key material generated by, or has come into contact > with any piece of software using SecureRandom() > > * do not write cryptographic tools in non-type safe languages > > * don't take the output of a CSPRNG and pass it through RC4 > > - > 3CJ99vSipFi9z11UdbdZWfNKjywJnY8sT8 > _______________________________________________ > bitcoin-dev mailing list > bitcoin-dev@lists.linuxfoundation.org > https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev > --=20 Mat=C3=ADas Alejo Garcia @ematiu Roads? Where we're going, we don't need roads! --94eb2c04c9329420db0569343817 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Source?=C2=A0

On Fri, Apr 6, 2018 at 4:53 PM, ketamine--- via bitcoin-= dev <bitcoin-dev@lists.linuxfoundation.org> wrote:
A significant number of past a= nd current cryptocurrency products
contain a JavaScript class named SecureRandom(), containing both
entropy collection and a PRNG. The entropy collection and the RNG
itself are both deficient to the degree that key material can be
recovered by a third party with medium complexity. There are a
substantial number of variations of this SecureRandom() class in
various pieces of software, some with bugs fixed, some with additional
bugs added. Products that aren't today vulnerable due to moving to
other libraries may be using old keys that have been previously
compromised by usage of SecureRandom().


The most common variations of the library attempts to collect entropy
from window.crypto's CSPRNG, but due to a type error in a comparison this function is silently stepped over without failing. Entropy is
subsequently gathered from math.Random (a 48bit linear congruential
generator, seeded by the time in some browsers), and a single
execution of a medium resolution timer. In some known configurations
this system has substantially less than 48 bits of entropy.

The core of the RNG is an implementation of RC4 ("arcfour random"= ),
and the output is often directly used for the creation of private key
material as well as cryptographic nonces for ECDSA signatures. RC4 is
publicly known to have biases of several bits, which are likely
sufficient for a lattice solver to recover a ECDSA private key given a
number of signatures. One popular Bitcoin web wallet re-initialized
the RC4 state for every signature which makes the biases bit-aligned,
but in other cases the Special K would be manifest itself over
multiple transactions.


Necessary action:

=C2=A0 * identify and move all funds stored using SecureRandom()

=C2=A0 * rotate all key material generated by, or has come into contact
=C2=A0 =C2=A0 with any piece of software using SecureRandom()

=C2=A0 * do not write cryptographic tools in non-type safe languages

=C2=A0 * don't take the output of a CSPRNG and pass it through RC4

-
3CJ99vSipFi9z11UdbdZWfNKjywJnY8sT8
_______________________________________________
bitcoin-dev mailing list
= bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org= /mailman/listinfo/bitcoin-dev



--
Ma= t=C3=ADas Alejo Garcia
@ematiu
Roads? Where we're going, we don&#= 39;t need roads!
--94eb2c04c9329420db0569343817--