path: root/1a/657ccb0a3569d8b0b6846e7d64d5f0c035f3e9

Return-Path: <mus@musalbas.com>
Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org
	[172.17.192.35])
	by mail.linuxfoundation.org (Postfix) with ESMTPS id 5BC12CB2
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Mon,  9 Apr 2018 21:17:14 +0000 (UTC)
X-Greylist: delayed 00:06:08 by SQLgrey-1.7.6
Received: from algebra.musalbas.com (algebra.musalbas.com [163.172.28.238])
	by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 73F5E625
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Mon,  9 Apr 2018 21:17:13 +0000 (UTC)
Received: from [10.15.0.6] (unknown [10.15.0.6])
	(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
	(No client certificate requested)
	by algebra.musalbas.com (Postfix) with ESMTPSA id C64CA12C025E;
	Mon,  9 Apr 2018 23:17:11 +0200 (CEST)
To: Matias Alejo Garcia <ematiu@gmail.com>,
	Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>,
	ketamine@national.shitposting.agency
References: <84976adb75bef1dfdb12b98c19811278@national.shitposting.agency>
	<CA+vKqYc3X6ZjVNXs0xgsLGekxPCTcLZj7t2vkyBOV_o=2C2qPA@mail.gmail.com>
	<921edfdb-e0e5-8ce4-55d8-ba4e84ef633f@musalbas.com>
From: Mustafa Al-Bassam <mus@musalbas.com>
Message-ID: <010e34a3-f9cf-fba1-5482-de06bc350d64@musalbas.com>
Date: Mon, 9 Apr 2018 22:17:11 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
	Thunderbird/45.8.0
MIME-Version: 1.0
In-Reply-To: <921edfdb-e0e5-8ce4-55d8-ba4e84ef633f@musalbas.com>
Content-Type: multipart/alternative;
	boundary="------------BE7E39D4A25C9CCC843DA757"
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=musalbas.com; s=dkim;
	t=1523308632; bh=oM9WuKq6C5W6hA4rc7V3g51rJzOnCtGADEY4ygTTHyI=;
	h=Subject:To:References:From:Message-ID:Date:MIME-Version:In-Reply-To:Content-Type;
	b=XNZayF9Ouur2GeHjiqnkLaiu1x8OPJWTlW7gbIxqFeJoBioizKA7hlliHoSV9fRmGfNVKu5E3q4pTmgUH/+J+yYgsCiAYBQvF5hu1NrD3dTslW/0ZZeJhFCg9SpwflYNAj4I9PIn+TFYoE/qki+aJCXtvwmLEJ91MC/D8MkKXzU=
X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,HTML_MESSAGE autolearn=ham version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
	smtp1.linux-foundation.org
Subject: Re: [bitcoin-dev] KETAMINE: Multiple vulnerabilities in
 SecureRandom(), numerous cryptocurrency products affected.
X-BeenThere: bitcoin-dev@lists.linuxfoundation.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Bitcoin Protocol Discussion <bitcoin-dev.lists.linuxfoundation.org>
List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/bitcoin-dev>,
	<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=unsubscribe>
List-Archive: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/>
List-Post: <mailto:bitcoin-dev@lists.linuxfoundation.org>
List-Help: <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=help>
List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>,
	<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=subscribe>
X-List-Received-Date: Mon, 09 Apr 2018 21:17:14 -0000

This is a multi-part message in MIME format.
--------------BE7E39D4A25C9CCC843DA757
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 8bit

And specifically, here's a version of it that uses Arcfour:
https://gist.github.com/jonls/5230850


On 09/04/18 22:11, Mustafa Al-Bassam wrote:
>
> Here's the code in question: https://github.com/jasondavies/jsbn/pull/7
>
> Best,
>
> Mustafa
>
>
> On 06/04/18 21:51, Matias Alejo Garcia via bitcoin-dev wrote:
>> Source? 
>>
>> On Fri, Apr 6, 2018 at 4:53 PM, ketamine--- via bitcoin-dev
>> <bitcoin-dev@lists.linuxfoundation.org
>> <mailto:bitcoin-dev@lists.linuxfoundation.org>> wrote:
>>
>>     A significant number of past and current cryptocurrency products
>>     contain a JavaScript class named SecureRandom(), containing both
>>     entropy collection and a PRNG. The entropy collection and the RNG
>>     itself are both deficient to the degree that key material can be
>>     recovered by a third party with medium complexity. There are a
>>     substantial number of variations of this SecureRandom() class in
>>     various pieces of software, some with bugs fixed, some with
>>     additional
>>     bugs added. Products that aren't today vulnerable due to moving to
>>     other libraries may be using old keys that have been previously
>>     compromised by usage of SecureRandom().
>>
>>
>>     The most common variations of the library attempts to collect entropy
>>     from window.crypto's CSPRNG, but due to a type error in a comparison
>>     this function is silently stepped over without failing. Entropy is
>>     subsequently gathered from math.Random (a 48bit linear congruential
>>     generator, seeded by the time in some browsers), and a single
>>     execution of a medium resolution timer. In some known configurations
>>     this system has substantially less than 48 bits of entropy.
>>
>>     The core of the RNG is an implementation of RC4 ("arcfour random"),
>>     and the output is often directly used for the creation of private key
>>     material as well as cryptographic nonces for ECDSA signatures. RC4 is
>>     publicly known to have biases of several bits, which are likely
>>     sufficient for a lattice solver to recover a ECDSA private key
>>     given a
>>     number of signatures. One popular Bitcoin web wallet re-initialized
>>     the RC4 state for every signature which makes the biases bit-aligned,
>>     but in other cases the Special K would be manifest itself over
>>     multiple transactions.
>>
>>
>>     Necessary action:
>>
>>       * identify and move all funds stored using SecureRandom()
>>
>>       * rotate all key material generated by, or has come into contact
>>         with any piece of software using SecureRandom()
>>
>>       * do not write cryptographic tools in non-type safe languages
>>
>>       * don't take the output of a CSPRNG and pass it through RC4
>>
>>     -
>>     3CJ99vSipFi9z11UdbdZWfNKjywJnY8sT8
>>     _______________________________________________
>>     bitcoin-dev mailing list
>>     bitcoin-dev@lists.linuxfoundation.org
>>     <mailto:bitcoin-dev@lists.linuxfoundation.org>
>>     https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>>     <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>
>>
>>
>>
>>
>> -- 
>> Matías Alejo Garcia
>> @ematiu
>> Roads? Where we're going, we don't need roads!
>>
>>
>> _______________________________________________
>> bitcoin-dev mailing list
>> bitcoin-dev@lists.linuxfoundation.org
>> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>


--------------BE7E39D4A25C9CCC843DA757
Content-Type: text/html; charset=windows-1252
Content-Transfer-Encoding: 8bit

<html>
  <head>
    <meta content="text/html; charset=windows-1252"
      http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <p>And specifically, here's a version of it that uses Arcfour:
      <a class="moz-txt-link-freetext" href="https://gist.github.com/jonls/5230850">https://gist.github.com/jonls/5230850</a><br>
    </p>
    <br>
    <div class="moz-cite-prefix">On 09/04/18 22:11, Mustafa Al-Bassam
      wrote:<br>
    </div>
    <blockquote
      cite="mid:921edfdb-e0e5-8ce4-55d8-ba4e84ef633f@musalbas.com"
      type="cite">
      <meta content="text/html; charset=windows-1252"
        http-equiv="Content-Type">
      <p>Here's the code in question: <a moz-do-not-send="true"
          class="moz-txt-link-freetext"
          href="https://github.com/jasondavies/jsbn/pull/7">https://github.com/jasondavies/jsbn/pull/7</a></p>
      <p>Best,<br>
      </p>
      <p>Mustafa<br>
      </p>
      <br>
      <div class="moz-cite-prefix">On 06/04/18 21:51, Matias Alejo
        Garcia via bitcoin-dev wrote:<br>
      </div>
      <blockquote
cite="mid:CA+vKqYc3X6ZjVNXs0xgsLGekxPCTcLZj7t2vkyBOV_o=2C2qPA@mail.gmail.com"
        type="cite">
        <div dir="ltr">Source? </div>
        <div class="gmail_extra"><br>
          <div class="gmail_quote">On Fri, Apr 6, 2018 at 4:53 PM,
            ketamine--- via bitcoin-dev <span dir="ltr">&lt;<a
                moz-do-not-send="true"
                href="mailto:bitcoin-dev@lists.linuxfoundation.org"
                target="_blank">bitcoin-dev@lists.linuxfoundation.org</a>&gt;</span>
            wrote:<br>
            <blockquote class="gmail_quote" style="margin:0 0 0
              .8ex;border-left:1px #ccc solid;padding-left:1ex">A
              significant number of past and current cryptocurrency
              products<br>
              contain a JavaScript class named SecureRandom(),
              containing both<br>
              entropy collection and a PRNG. The entropy collection and
              the RNG<br>
              itself are both deficient to the degree that key material
              can be<br>
              recovered by a third party with medium complexity. There
              are a<br>
              substantial number of variations of this SecureRandom()
              class in<br>
              various pieces of software, some with bugs fixed, some
              with additional<br>
              bugs added. Products that aren't today vulnerable due to
              moving to<br>
              other libraries may be using old keys that have been
              previously<br>
              compromised by usage of SecureRandom().<br>
              <br>
              <br>
              The most common variations of the library attempts to
              collect entropy<br>
              from window.crypto's CSPRNG, but due to a type error in a
              comparison<br>
              this function is silently stepped over without failing.
              Entropy is<br>
              subsequently gathered from math.Random (a 48bit linear
              congruential<br>
              generator, seeded by the time in some browsers), and a
              single<br>
              execution of a medium resolution timer. In some known
              configurations<br>
              this system has substantially less than 48 bits of
              entropy.<br>
              <br>
              The core of the RNG is an implementation of RC4 ("arcfour
              random"),<br>
              and the output is often directly used for the creation of
              private key<br>
              material as well as cryptographic nonces for ECDSA
              signatures. RC4 is<br>
              publicly known to have biases of several bits, which are
              likely<br>
              sufficient for a lattice solver to recover a ECDSA private
              key given a<br>
              number of signatures. One popular Bitcoin web wallet
              re-initialized<br>
              the RC4 state for every signature which makes the biases
              bit-aligned,<br>
              but in other cases the Special K would be manifest itself
              over<br>
              multiple transactions.<br>
              <br>
              <br>
              Necessary action:<br>
              <br>
                * identify and move all funds stored using
              SecureRandom()<br>
              <br>
                * rotate all key material generated by, or has come into
              contact<br>
                  with any piece of software using SecureRandom()<br>
              <br>
                * do not write cryptographic tools in non-type safe
              languages<br>
              <br>
                * don't take the output of a CSPRNG and pass it through
              RC4<br>
              <br>
              -<br>
              3CJ99vSipFi9z11UdbdZWfNKjywJnY<wbr>8sT8<br>
              ______________________________<wbr>_________________<br>
              bitcoin-dev mailing list<br>
              <a moz-do-not-send="true"
                href="mailto:bitcoin-dev@lists.linuxfoundation.org"
                target="_blank">bitcoin-dev@lists.linuxfoundat<wbr>ion.org</a><br>
              <a moz-do-not-send="true"
                href="https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev"
                rel="noreferrer" target="_blank">https://lists.linuxfoundation.<wbr>org/mailman/listinfo/bitcoin-d<wbr>ev</a><br>
            </blockquote>
          </div>
          <br>
          <br clear="all">
          <div><br>
          </div>
          -- <br>
          <div class="gmail_signature" data-smartmail="gmail_signature">
            <div dir="ltr">Matías Alejo Garcia<br>
              @ematiu<br>
              Roads? Where we're going, we don't need roads!</div>
          </div>
        </div>
        <br>
        <fieldset class="mimeAttachmentHeader"></fieldset>
        <br>
        <pre wrap="">_______________________________________________
bitcoin-dev mailing list
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:bitcoin-dev@lists.linuxfoundation.org">bitcoin-dev@lists.linuxfoundation.org</a>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev">https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev</a>
</pre>
      </blockquote>
      <br>
    </blockquote>
    <br>
  </body>
</html>

--------------BE7E39D4A25C9CCC843DA757--