v0.1.27 - Entropy audit: remediate 3 findings (F-006 RP2040 xorshift fallback, F-007 PQ DRBG docs, F-008 SLH-DSA SK.prf domain separation)
This commit is contained in:
Laan Tungir
@@ -1,21 +1,21 @@
|
||||
# n_signer Security Audit — Remediation Report
|
||||
# n_signer Security Audit — Consolidated Remediation Report
|
||||
|
||||
**Date:** 2026-08-13
|
||||
**Scope:** Full static security audit of [`src/`](../src/), [`client/`](../client/), [`libotppad/`](../libotppad/), and build configuration
|
||||
**Result:** 5 findings identified, all remediated and verified
|
||||
**Scope:** Full static security audit of [`src/`](../src/), [`client/`](../client/), [`libotppad/`](../libotppad/), build configuration, and entropy/key-derivation paths
|
||||
**Result:** 8 findings identified, all remediated and verified
|
||||
|
||||
---
|
||||
|
||||
## Executive Summary
|
||||
|
||||
A comprehensive security audit of the `n_signer` codebase identified **5 security findings** across memory safety, network parsing, authentication, and build hardening. All findings have been remediated, code-reviewed, and verified against the existing test suite.
|
||||
A comprehensive security audit of the `n_signer` codebase identified **8 security findings** across memory safety, network parsing, authentication, build hardening, and entropy/key-derivation. All findings have been remediated, code-reviewed, and verified against the existing test suite.
|
||||
|
||||
| Severity | Count | Status |
|
||||
|----------|-------|--------|
|
||||
| High | 1 | ✅ Remediated |
|
||||
| Medium | 3 | ✅ Remediated |
|
||||
| Low | 1 | ✅ Remediated |
|
||||
| **Total** | **5** | **All Fixed** |
|
||||
| High | 2 | ✅ All Remediated |
|
||||
| Medium | 5 | ✅ All Remediated |
|
||||
| Low | 1 | ✅ All Remediated |
|
||||
| **Total** | **8** | **All Fixed** |
|
||||
|
||||
---
|
||||
|
||||
@@ -128,9 +128,67 @@ The initial monotonic-only version was caught by the existing test suite ([`test
|
||||
|
||||
---
|
||||
|
||||
### F-006: RP2040 Fallback RNG Uses Cryptographically Weak xorshift32
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| **Severity** | **High** |
|
||||
| **File** | [`firmware/kb2040_hidden_signer/src/platform/rp2040.c`](../firmware/kb2040_hidden_signer/src/platform/rp2040.c):31–78 |
|
||||
| **Status** | ✅ Remediated |
|
||||
|
||||
**Problem.** [`nostr_platform_random()`](../firmware/kb2040_hidden_signer/src/platform/rp2040.c:31) is the sole entropy source for the KB2040 hidden signer, used to generate private keys, mnemonic entropy, secp256k1 context randomization, NIP-04 IVs, and NIP-44 nonces. When the Pico SDK's hardware RNG (`get_rand_32()`) is unavailable, it fell through to a **deterministic xorshift32 PRNG** seeded from a hardcoded constant XOR'd with `micros()`, `millis()`, a stack address, and ADC temperature sensor readings. xorshift32 is not cryptographically secure — its 32-bit state is trivially brute-forceable. An attacker who observes boot timing could reconstruct all keys.
|
||||
|
||||
**Fix.** Removed the xorshift32 fallback entirely. If `get_rand_32()` is unavailable, the function now returns `-1` and refuses to generate keys. The Pico SDK's ring-oscillator-based RNG is available on all official RP2040 boards. The ADC and Arduino timing code was also removed since it was only used to seed the xorshift.
|
||||
|
||||
**Files changed:**
|
||||
- [`firmware/kb2040_hidden_signer/src/platform/rp2040.c`](../firmware/kb2040_hidden_signer/src/platform/rp2040.c) — removed xorshift32 fallback, fail closed on missing `get_rand_32()`
|
||||
|
||||
---
|
||||
|
||||
### F-007: PQ DRBG is Not a NIST SP 800-90A Compliant Construction
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| **Severity** | Medium |
|
||||
| **File** | [`src/pq_drbg.c`](../src/pq_drbg.c):1–134 |
|
||||
| **Status** | ✅ Remediated |
|
||||
|
||||
**Problem.** The PQ deterministic DRBG uses a custom `SHAKE-256(seed || counter)` construction rather than a NIST SP 800-90A DRBG. While cryptographically sound for single-shot keygen, it had issues: (1) the buffer-size comment confused SHAKE-256's rate (136 bytes) with SHAKE-128's rate (168 bytes); (2) the non-standard nature was documented but the rationale for why it's acceptable could be clearer.
|
||||
|
||||
**Fix.** Fixed the rate comment to correctly explain that 168 is the requested output length, not the SHAKE-256 rate (136 bytes). Strengthened the file header documentation with a detailed security argument listing 5 reasons why this non-standard construction is acceptable for this use case. Domain separation across algorithm types is not needed because the DRBG is initialized once per keygen and zeroized after — different algorithm types use different seeds.
|
||||
|
||||
**Files changed:**
|
||||
- [`src/pq_drbg.c`](../src/pq_drbg.c) — fixed comment, strengthened documentation
|
||||
|
||||
---
|
||||
|
||||
### F-008: SLH-DSA-128s SK.prf Used as Both PRF Key and DRBG Seed
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| **Severity** | Medium |
|
||||
| **File** | [`src/pq_crypto.c`](../src/pq_crypto.c):1457–1471 |
|
||||
| **Status** | ✅ Remediated |
|
||||
|
||||
**Problem.** In the SLH-DSA-128s signing path, `SK.prf` (bytes 16..31 of the secret key) was used for two distinct purposes: (1) as the PRF key for `PRF_msg()` per FIPS 205, and (2) as the raw seed for the deterministic DRBG that produces `opt_rand`. This dual use was non-standard — if the DRBG output were ever compromised, `SK.prf` would also be compromised, breaking the `PRF_msg` security guarantee.
|
||||
|
||||
**Fix.** Replaced the direct `pq_drbg_init(sk_prf, ...)` call with a domain-separated derivation:
|
||||
|
||||
```c
|
||||
drbg_seed = HMAC-SHA256(SK.prf, "slh-dsa-drbg-seed")
|
||||
pq_drbg_init(drbg_seed, 32)
|
||||
```
|
||||
|
||||
This ensures that even if the DRBG output is somehow compromised, `SK.prf` remains secret and `PRF_msg` remains secure. The HMAC key is `SK.prf` (16 bytes), the message is the ASCII string `"slh-dsa-drbg-seed"`, and the output is a 32-byte DRBG seed that is zeroized after initialization.
|
||||
|
||||
**Files changed:**
|
||||
- [`src/pq_crypto.c`](../src/pq_crypto.c):1457–1471 — domain-separated DRBG seed from SK.prf via HMAC-SHA256
|
||||
|
||||
---
|
||||
|
||||
## Post-Remediation Defects Caught in Review
|
||||
|
||||
During code review of the initial fixes, 4 defects were identified and corrected before final verification:
|
||||
During code review of the initial fixes, 5 defects were identified and corrected before final verification:
|
||||
|
||||
| # | Defect | File | Resolution |
|
||||
|---|--------|------|-----------|
|
||||
@@ -161,6 +219,9 @@ During code review of the initial fixes, 4 defects were identified and corrected
|
||||
| `test_mnemonic_input` | ✅ All passed |
|
||||
| `test_path_whitelist` | ✅ 40/41 (1 pre-existing failure, unrelated) |
|
||||
| `test_selector` | ⚠️ Stack smashing detected — **hardening caught a pre-existing latent bug** (unrelated to remediations) |
|
||||
| `test_ml_dsa_65` | ✅ 26/26 passed |
|
||||
| `test_ml_kem_768` | ✅ 29/29 passed |
|
||||
| `test_pq_crypto` | ✅ All passed |
|
||||
|
||||
---
|
||||
|
||||
@@ -187,3 +248,7 @@ These items were noted during the audit but are not security findings:
|
||||
| [`src/auth_envelope.c`](../src/auth_envelope.c) | F-003 |
|
||||
| [`src/otp_pad.c`](../src/otp_pad.c) | F-004 |
|
||||
| [`Makefile`](../Makefile) | F-005 |
|
||||
| [`firmware/kb2040_hidden_signer/src/platform/rp2040.c`](../firmware/kb2040_hidden_signer/src/platform/rp2040.c) | F-006 |
|
||||
| [`firmware/kb2040_hidden_signer/src/nostr_core/nip006.c`](../firmware/kb2040_hidden_signer/src/nostr_core/nip006.c) | F-006 (propagation) |
|
||||
| [`src/pq_drbg.c`](../src/pq_drbg.c) | F-007 |
|
||||
| [`src/pq_crypto.c`](../src/pq_crypto.c) | F-008 |
|
||||
Reference in New Issue
Block a user