Epic: Improvements from FROST Audit

[mpguerra]

Motivation

We want to ensure that we track and act upon findings from the audit.

Scope

frost-core

• [NCC-E008263-2WM] frost-core: Missing Signing Package Validation May Cause a Panic #442
  • fixed in Add validation for missing identifier in signing package #452
• [NCC-E008263-XLV] frost-core: Minimum Participant Constraint Enforcement Improvements #443
  • fixed in Add minimum participant constraints #453
• [NCC-E008263-AW3] Insufficient Participant Commitment List Checks #455
  • fixed in check number of commitments in sign() #480
• [NCC-E008263-9XW] Missing Length Check in Identifiers List #456
  • fixed in check if the correct number of identifiers was provided in split() #481
• [NCC-E008263-4VP] Unchecked Accesses to Data Structures #457
  • fixed in Fix unchecked access #477

frost-ed25519

No findings

frost-ed448

• NCC-E008263-72Y: Ed448 Base Field Incorrect Negation
  • Fixed in Missing reduction in negation in the base field crate-crypto/Ed448-Goldilocks#28 by fix FieldElement56::negate() crate-crypto/Ed448-Goldilocks#29, and
  • in Types for strict and loose field elements should prevent misuse mit-plv/fiat-crypto#1620 by Rust: Create newtype structs for typedefs mit-plv/fiat-crypto#1623
• NCC-E008263-T3P: Potential Timing Attacks in Ed448
  Implementation
  • Fixed in Potential timing attacks in asserts crate-crypto/Ed448-Goldilocks#30 by remove asserts that could leak timing information (credits to @pornin) crate-crypto/Ed448-Goldilocks#31
• NCC-E008263-HGL: Lack of Zeroization in Ed448 Scalar Inversion
  • Fixed in Lack of zeroization in Scalar inversion crate-crypto/Ed448-Goldilocks#32 by use stack for table in Scalar::invert() to prevent leaking values to the heap (credits to @pornin) crate-crypto/Ed448-Goldilocks#33

frost-p256

No findings

frost-secp256k1

No findings

frost-ristretto255

No findings

Optional Tasks

Other miscellaneous remarks that are not considered security vulnerabilities. Fixing these could increase code quality.

• General Notes on frost-core
  • validate length of shares in reconstruct() #458
    • fixed in change reconstruct() to take KeyPackages; validate size #482
  • Check zero scalar validation, update documentation #459
    • fixed in fix Field::deserialize() docs #483
  • Generate default identifiers only when needed #460
    • fixed by check if the correct number of identifiers was provided in split() #481
  • Check if iterators have the same length in multiscalar multiplication #461
    • fixed by check if iterators have the same size in multiscalar mul #494
  • Fix order of inputs in DKG challenge hashing #462
    • fixed by fix DKG challenge hashing order to match paper #484
  • Improve clarity of bounds in number of signers #463
    • fixed in fix some docs issues from audit #485
  • Fix PublicKeyPackage documentation about signer_pubkeys #464
    • fixed in fix some docs issues from audit #485
  • Improve handling of identity/zero in VerifyingKey/SigningKey #465
    • fixed in return error when creating a zero SigningKey #496
• Notes on RedDSA
  • No Action: We acknowledge the comment and have an explanation for the discrepancies.
• Observations on Batch Verification
  • Look into batch verification blinding factor #444
  • Make empty batches fail to validate #445
    • fixed in return error when validating an empty batch #487
  • Improve Batch::verify() #446
    • fixed in return error when validating an empty batch #487
• Notes on the Different FROST Versions
  • Fix spec links #447
    • fixed in update spec links #488
  • Update CONTEXT_STRING values to match latest spec
    • fixed in Update test vectors #438
• Notes on the IETF Draft
  • incorrect list is provided as argument to the call to derive_interpolating_value() cfrg/draft-irtf-cfrg-frost#445 - fixed by s/x_list/participant_list/ cfrg/draft-irtf-cfrg-frost#448
  • typo: recommended  cfrg/draft-irtf-cfrg-frost#446 - fixed by fix typo cfrg/draft-irtf-cfrg-frost#447
  • Old MAX_PARTICIPANTS definition in Appendix cfrg/draft-irtf-cfrg-frost#453 - fixed by Update old reference cfrg/draft-irtf-cfrg-frost#456
• Minor Documentation Notes on the Source Code
  • Misc documentation fixes #448
    • fixed in fix misc docs issues #489
    • There's one outstanding TODO in the code which is still waiting for div_ceil to make it into stable rust
• Notes on the FROST Book
  • Improve FROST book per audit report #466
    • fixed in improve book per audit report #491

[mpguerra]

All done here!