Can sombody explain this in a bit less technical terms?
It's a security bounty contest that requires no intervention by the organisers to hand out the bounty. Break in and take it.
The Bitcoin Piñata
11–20 of 112 posts
Re: The Bitcoin Piñata
#12FYI The bounty is about $2000.
Re: The Bitcoin Piñata
#13Re: The Bitcoin Piñata
#14FYI The bounty is about $2000.
As Bruce Schneier pointed out [1], the price is definitely not meant to be a massive incentive -- any cryptographer worth their salt is going to be worth a hell of a lot more than our prize amount. But at the same time, we're really keen to make it easier to audit protocols in MirageOS, and hope that this Piñata "permitted breakin" is something that'll catch on. The worst case for us is that someone does break in and doesn't tell us how they did it. Let's hope the eventual winner wants to brag, and we get to improve our source code :-)
[1] https://www.schneier.com/crypto-gram/archives/1998/1215.html...
Re: The Bitcoin Piñata
#15Can sombody explain this in a bit less technical terms?
It's a security bounty contest that requires no intervention by the organisers to hand out the bounty. Break in and take it.
> "Break in and take it."
But please tell us if you do. We'd like to learn from this exercise and improve the stack.
Re: The Bitcoin Piñata
#16Earlier quoted context omitted.
It's a security bounty contest that requires no intervention by the organisers to hand out the bounty. Break in and take it.
> "Break in and take it." But please tell us if you do. We'd like to learn from this exercise and improve the stack.
If you're not already, it'd be a good idea to log all traffic to/from the box so that you'll at least have something if no one owns up.
Re: The Bitcoin Piñata
#17Suggestion: add an endpoint on the piñata that proves it has the private key. You can do this using Bitcoin's sign message method.
Re: The Bitcoin Piñata
#18Suggestion: add an endpoint on the piñata that proves it has the private key. You can do this using Bitcoin's sign message method.
that wouldn't help - would it? any owner of the bitcoin secret can sign this message and include it then in the pinata...
for online signing we'd first need to implement the bitcoin protocol...
or am I getting something wrong?
Re: The Bitcoin Piñata
#19As far as I can tell (I can't read O'Caml very well) the crypto library underpinning this makes the same mistake that all PKCS#1 signature verification functions have had at some point or another: they unpick the padding by hand[1], and then decode the ASN1 DigestInfo. The only sane way to do this is to generate the padding from scratch and check if the signature plaintext is the same (the added benefit is your ASN1 decoder is now not on a front-line security boundary).
Is this exploitable in this bounty? No idea. At least, it's the right kind of vulnerability you need to forge a certificate.
CVE-2014-1568 was this problem in NSS.
[1]: https://github.com/mirleft/ocaml-nocrypto/blob/master/src/rs...
Re: The Bitcoin Piñata
#20As far as I can tell (I can't read O'Caml very well) the crypto library underpinning this makes the same mistake that all PKCS#1 signature verification functions have had at some point or another: they unpick the padding by hand[1], and then decode the ASN1 DigestInfo. The only sane way to do this is to generate the padding from scratch and check if the signature plaintext is the same (the added benefit is your ASN1…
This is about the DigestInfo -- which we generate and compare here: https://github.com/mirleft/ocaml-tls/blob/master/lib/handsha...
The unpad does RSA unpadding... or am I completely mistaken?