Require message in musig protocol in an earlier state #73

jonasnick · 2019-06-21T14:56:55Z

This PR removes the set_msg function from the musig module and adds a msg argument get_public_nonce which must be non-null if the message has not been set during initialization.

The reason for this is that I think that our current set_msg logic is vulnerable to Wagner's attack. The main problem is that by grinding the message an attacker has control over the final hash being signed.

Assume the combined pubkey of Alice and the attacker is P.
The attacker wants to forge a signature on message m' and opens 3 parallel sessions with Alice.
They exchange nonce commitments and nonces.
Let's call the combined nonces Ri for sessions i = 0,1,2.
Now the attacker draws ka and sets R' = R0 + R1 + R2 + ka*G and runs Wagner's algorithm grinding mi to find

H(P, R',m') = H(P, R1, m1) + H(P, R2, m2) + H(P, R3, m3)

with about 2^100 work (with more parallel sessions requires much less work).

Then the attacker and Alice set the message in session i to mi and Alice creates partial signatures si = ki + H(P, Ri, mi).
Now (R', s' = s0 + s1 + s2) is a valid partial signature under Alice's public key A as well:

s'*G = (k0 + k1 + k2)*G + (H(P, R1, m1) + H(P, R2, m2) + H(P, R3, m3))*A
     = R' - ka*G + H(P, R', m')*A

This signature is completed by the attacker adding the partial signature using nonce ka which results in the forgery.

This PR does keeps allows to set the message after nonce commitments have been exchanged, unfortunately the possibility of pre-sharing nonces while not knowing the messages is removed.

real-or-random · 2019-06-21T15:31:50Z

Oh nice observation. That the message is fixed upfront is apparently not an artefact of the formal model either...

Concept ACK.

real-or-random

Looks good except the nits. I haven't tested it yet.

real-or-random · 2019-06-24T12:52:13Z

include/secp256k1_musig.h

    const secp256k1_pubkey *combined_pk,
    const unsigned char *pk_hash32,
    const unsigned char *const *commitments,
    size_t n_signers


(not touched by this PR:) maybe we can use ARG_CHECK also for the restrictions on n_signers

real-or-random · 2019-06-24T13:02:22Z

src/modules/musig/tests_impl.h

-    CHECK(secp256k1_musig_session_get_public_nonce(ctx, &session, signers, &nonce, ncs, 2) == 1);
+
+    /* Trying to get the nonce without providing a message fails. */
+    CHECK(secp256k1_musig_session_get_public_nonce(ctx, &session, signers, &nonce, ncs, 2, NULL) == 0);


Should we ARG_CHECK this violation?

If the rationale for ARG_CHECKing is still "everything that the rust typesystem would have caught" then I guess no.

We could prevent this with session types, i.e. have a Session<NonceUnset> and Session<NonceSet>

I considered this but thought that this is not exactly the rust type system as you could do something similar with C. But actually this is what we'll be doing in rust. Fixing.

src/modules/musig/tests_impl.h

real-or-random · 2019-07-02T23:19:45Z

ACK read the code, but did not test it

apoelstra · 2019-07-03T21:24:27Z

include/secp256k1_musig.h

 *                     require sharing public nonces before the message is known
 *                     because it reduces nonce misuse resistance. If NULL, must be
- *                     set with `musig_session_set_msg` before signing and verifying.
+ *                     set with `musig_session_get_public_nonce`.


We should probably cut this comment down even further to get rid of the "unless you require" clause.

Hm, not sure what exactly you're suggesting. Something like that?

* msg32: the 32-byte message to be signed. Shouldn't be NULL. If NULL, must be * set with `musig_session_get_public_nonce`.

Seems to be less clear. Also I assume sharing nonce commitments won't be a very exotic thing. Lightning will likely use it to avoid roundtrips. I have an open PR in the scriptless scripts repo (BlockstreamResearch/scriptless-scripts#6) that explains how to do this because I was contacted by someone concerned that MuSig will end up being very expensive in communication costs.

I think if you change "require sharing public nonces" to "require sharing nonce commitments" I'll be happy

apoelstra · 2019-07-03T21:27:56Z

src/modules/musig/tests_impl.h

+    /* Providing a message should make get_public_nonce succeed. */
+    CHECK(secp256k1_musig_session_get_public_nonce(ctx, &session, signers, &nonce, ncs, 2, msg) == 1);
+    /* Trying to set the message again fails. */
+    CHECK(secp256k1_musig_session_get_public_nonce(ctx, &session, signers, &nonce, ncs, 2, msg) == 0);


I don't have a strong opinion but I feel like this should also be an ARG_CHECK (and that rust-secp should prevent it statically)

By using something like a state machine/session types? Yes, fixing.

apoelstra · 2019-07-03T21:31:30Z

I see a bunch of stuff when I run valgrind ./tests 4 with this code.

Edit: oh for some reason I'm compiling with openssl, that's probably all it is. (Which means some broken Arch package must have depended on openssl recently, because it definitely was not installed before..)

jonasnick · 2019-07-09T11:32:00Z

rebased

remove the set_msg function and require the message in get_public_nonce at the latest.

jonasnick · 2019-08-01T14:19:35Z

ping @apoelstra

real-or-random · 2019-08-01T23:31:44Z

ACK 6a57be0

apoelstra · 2019-10-18T20:42:25Z

ACK 6a57be0

real-or-random reviewed Jun 24, 2019

View reviewed changes

jonasnick force-pushed the fix-musig-message branch from e940896 to f215a4c Compare June 25, 2019 12:16

apoelstra reviewed Jul 3, 2019

View reviewed changes

jonasnick force-pushed the fix-musig-message branch from f215a4c to b934674 Compare July 5, 2019 15:42

Fix my_index in musig state machine tests

57ce588

jonasnick force-pushed the fix-musig-message branch from b934674 to 6a57be0 Compare July 9, 2019 11:31

Require message in musig protocol in an earlier state. In particular,

6a57be0

remove the set_msg function and require the message in get_public_nonce at the latest.

apoelstra merged commit cad7cc8 into BlockstreamResearch:secp256k1-zkp Oct 18, 2019

Require message in musig protocol in an earlier state #73

Require message in musig protocol in an earlier state #73

Uh oh!

Conversation

jonasnick commented Jun 21, 2019

Uh oh!

real-or-random commented Jun 21, 2019

Uh oh!

real-or-random left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

real-or-random commented Jul 2, 2019

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

apoelstra commented Jul 3, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jonasnick commented Jul 9, 2019

Uh oh!

jonasnick commented Aug 1, 2019

Uh oh!

real-or-random commented Aug 1, 2019

Uh oh!

apoelstra commented Oct 18, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

apoelstra commented Jul 3, 2019 •

edited

Loading