Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
From: Cameron Garnham <da2ce7@gmail.com>
In-Reply-To: <CAJowKg+MZfdfSkZQQutKsFY=rcQSAhLtpRT7dAEH=qyYPNN67A@mail.gmail.com>
Date: Wed, 24 May 2017 20:59:28 +0300
Content-Transfer-Encoding: quoted-printable
Message-Id: <A2E37BF2-F1FF-4273-A0CE-08384D41E450@gmail.com>
References: <4BA0FA5D-7B29-4A7F-BC5B-361ED00D5CB2@gmail.com>
	<CAMnpzfoe1jNu6Uj8uXTJeGNLHG1O9DGtvy=aMJd=6OBS+_weSw@mail.gmail.com>
	<CAJowKgLurok+bTKrt8EAAF0Q7u=cEDwfxOuQJkYNKieFpCPErQ@mail.gmail.com>
	<CAJowKg+r3XKaoN3ys3o3FWhpJ3w8An1q0oYMmu_KzDfNdzF8Vg@mail.gmail.com>
	<CAJowKgKf22b2jjRbmG+k53g4bOzXrk7AHVcR02xqXPU8ZLJhaQ@mail.gmail.com>
	<CAJowKg+LAcVCsH7gbuZhKnnv8p5=WXqNCs5oqub3bacRpQ7n9w@mail.gmail.com>
	<CAJowKg+MZfdfSkZQQutKsFY=rcQSAhLtpRT7dAEH=qyYPNN67A@mail.gmail.com>
To: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Cc: cve-request@mitre.org, Jeremy Rubin <jeremy.l.rubin.travel@gmail.com>
Subject: Re: [bitcoin-dev]
 =?utf-8?b?VHJlYXRpbmcg4oCYQVNJQ0JPT1NU4oCZIGFzIGEg?=
 =?utf-8?q?Security_Vulnerability?=
Precedence: list

Hello Bitcoin-Dev,

A quick update that CVE-2017-9230 has been assigned for the security =
vulnerability commonly called =E2=80=98ASICBOOST=E2=80=99:

"The Bitcoin Proof-of-Work algorithm does not consider a certain attack =
methodology related to 80-byte block headers with a variety of initial =
64-byte chunks followed by the same 16-byte chunk, multiple candidate =
root values ending with the same 4 bytes, and calculations involving =
sqrt numbers. This violates the security assumptions of (1) the choice =
of input, outside of the dedicated nonce area, fed into the =
Proof-of-Work function should not change its difficulty to evaluate and =
(2) every Proof-of-Work function execution should be independent.=E2=80=9D=


I would like to especially thank the CVE team at Mitre for their =
suggested description that was more appropriate than my proposed text.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=3D+CVE-2017-9230

Cameron.


> Begin forwarded message:
>=20
> From: <cve-request@mitre.org>
> Subject: Re: [scr-xxxxx] Bitcoin - All
> Date: 24 May 2017 at 18:52:22 GMT+3
> To: <da2ce7@gmail.com>
> Cc: <cve-request@mitre.org>
>=20
> Signed PGP part
> > [Suggested description]
> > The Bitcoin Proof-of-Work algorithm does not consider a certain =
attack
> > methodology related to 80-byte block headers with a variety of =
initial
> > 64-byte chunks followed by the same 16-byte chunk, multiple =
candidate
> > root values ending with the same 4 bytes, and calculations involving
> > sqrt numbers. This violates the security assumptions of (1) the =
choice
> > of input, outside of the dedicated nonce area, fed into the
> > Proof-of-Work function should not change its difficulty to evaluate
> > and (2) every Proof-of-Work function execution should be =
independent.
> >
> > ------------------------------------------
> >
> > [Additional Information]
> > ASICBOOST, originality promoted as a patented mining =
optimisation(1).
> > Has under detailed study (2), become regarded as an actively =
exploited
> > (3), security vulnerability (4), of Bitcoin.
> >
> > The Bitcoin Proof-of-Work Algorithm is dependent on the following =
two
> > security assumptions that are both broken by 'ASICBOOST':
> > 1. The choice of input, outside of the dedicated nonce area, fed =
into
> > the Proof-of-Work function should not change it's difficulty to
> > evaluate.
> > 2.  Every Proof-of-Work function execution should be independent.
> >
> > 'ASICBOOST' creates a layer-violation where the structure of the =
input
> > outside of the dedicated nonce area will change the performance of =
the
> > mining calculations (5). 'ASICBOOST' exploits a vulnerability where
> > the Proof-of-Work function execution is not independent (6).
> >
> > References:
> > (1) Original Whitepaper by Dr. Timo Hanke: =
https://arxiv.org/ftp/arxiv/papers/1604/1604.00575.pdf
> > (2) Academic Write-up by Jeremy Rubin: =
http://www.mit.edu/~jlrubin//public/pdfs/Asicboost.pdf
> > (3) Evidence of Active Exploit by Gregory Maxwell:
> >  =
https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-April/013996.=
html
> > (4) Discussion to assign a CVE Number, by Cameron Garnham:
> >   =
https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-May/014349.ht=
ml
> > (5) Discussion of the perverse incentives created by 'ASICBOOST' by =
Ryan Grant:
> >   =
https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-May/014352.ht=
ml
> > (6) Discussion of ASICBOOST's non-independent PoW calculation by =
Tier Nolan:
> >   =
https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-May/014351.ht=
ml
> >
> > The patent holder of this particular security vulnerability has a =
dedicated website: https://www.asicboost.com/
> >
> > ------------------------------------------
> >
> > [VulnerabilityType Other]
> > Cryptocurrency Mining Algorithm Weakness
> >
> > ------------------------------------------
> >
> > [Vendor of Product]
> > Bitcoin
> >
> > ------------------------------------------
> >
> > [Affected Product Code Base]
> > Bitcoin - All
> >
> > ------------------------------------------
> >
> > [Affected Component]
> > Bitcoin
> >
> > ------------------------------------------
> >
> > [Attack Type Other]
> > Cryptocurrency Proof-of-Work Algorithm Weakness
> >
> > ------------------------------------------
> >
> > [CVE Impact Other]
> > Creation of Perverse Incentives in a Cryptocurrency
> >
> > ------------------------------------------
> >
> > [Attack Vectors]
> > Bitcoin Mining Unfair Advantage
> > Bitcoin Layer-Violations Creating Perverse System Incentives
> >
> > ------------------------------------------
> >
> > [Reference]
> > https://arxiv.org/ftp/arxiv/papers/1604/1604.00575.pdf
> > http://www.mit.edu/~jlrubin//public/pdfs/Asicboost.pdf
> > =
https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-April/013996.=
html
> > =
https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-May/014349.ht=
ml
> > =
https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-May/014352.ht=
ml
> > =
https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-May/014351.ht=
ml
> >
> > ------------------------------------------
> >
> > [Has vendor confirmed or acknowledged the vulnerability?]
> > true
> >
> > ------------------------------------------
> >
> > [Discoverer]
> > Original Discovery: Dr. Timo Hanke and Sergio Lerner. Proof of =
Active
> > Exploit: Gregory Maxwell. CVE Reporter: Cameron Garnham
>=20
> Use CVE-2017-9230.
>=20
>=20
> --
> CVE Assignment Team
> M/S M300, 202 Burlington Road, Bedford, MA 01730 USA
> [ A PGP key is available for encrypted communications at
>   http://cve.mitre.org/cve/request_id.html ]
>=20