From f196c27faf265cd14d8d7accf58e87b4df3c8a91 Mon Sep 17 00:00:00 2001 From: Doan Luu Duc Tai Date: Fri, 30 Oct 2026 17:04:10 -0500 Subject: Add experimental PQ browser probe and document blocking timing review --- docs/CHAT-SECURITY-REVIEW.txt | 119 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 119 insertions(+) create mode 100644 docs/CHAT-SECURITY-REVIEW.txt (limited to 'docs/CHAT-SECURITY-REVIEW.txt') diff --git a/docs/CHAT-SECURITY-REVIEW.txt b/docs/CHAT-SECURITY-REVIEW.txt new file mode 100644 index 0000000..7de1d36 --- /dev/null +++ b/docs/CHAT-SECURITY-REVIEW.txt @@ -0,0 +1,119 @@ +Copyright (C) 2026 Doan Luu Duc Tai + +This program is free software: you can redistribute it and/or modify +it under the terms of the GNU Affero General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. + +This program is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU Affero General Public License for more details. + +You should have received a copy of the GNU Affero General Public License +along with this program. If not, see . + + +CHAT CRYPTOGRAPHY SECURITY REVIEW + + Date: 2026-10-30. Status: blocked for deployment and private-message use. + Branch: feature/private-chat. Production and main remain unchanged. + +FIXED REQUIREMENT + + Encryption must remain RFC 9980 ML-KEM-1024 + X448 using v6 keys. + The compatibility probe pairs it with ML-DSA-87 + Ed448 signatures. + No fallback encryption profile is implemented or approved. + +TEST RESULTS + + Sequoia OpenPGP 2.4.2 with its Rust backend generated password-protected v6 + secret keys, serialized and reimported them, signed UTF-8 content, encrypted + to both participants, and decrypted successfully for both participants. + Wrong passwords, unexpected signers, and modified ciphertext were rejected. + The same probe passed in actual Chromium using Rust compiled to WASM. + + Functional tests are not a cryptographic audit, constant-time analysis, + conformance certification, or demonstration that side channels are absent. + The test uses no user-supplied key files and does not provide chat service. + +RUSTSEC-2026-0387: REACHABLE DEPENDENCY + + Sequoia 2.4.2's crypto-rust backend selects cx448 0.1.1 for both X448 + and Ed448. cx448 depends on crypto-bigint 0.5.5. + + Source paths within these exact published crates: + + sequoia-openpgp/src/crypto/backend/rust/asymmetric.rs + x448_generate_key, x448_derive_public, x448_shared_point + ed448_generate_key, ed448_sign + cx448/src/x448.rs + PublicKey::from(&Secret), Secret::as_diffie_hellman + cx448/src/curve/montgomery.rs + Montgomery scalar multiplication and projective-to-affine conversion + cx448/src/field.rs + elliptic_curve::bigint and constant-modulus Montgomery representation + cx448/src/field/element.rs + field subtraction, multiplication, inversion + cx448/src/field/scalar.rs + scalar arithmetic using crypto-bigint integer operations + + The flagged crate is part of the required curve arithmetic. It cannot be + dismissed as an unused RSA dependency. The advisory covers timing variation + in arithmetic intended to be constant-time and identifies >=0.7.6 as fixed. + cx448 0.1.1 requires the incompatible 0.5 series. Updating Cargo.lock alone + cannot satisfy that requirement with 0.7.6. Source changes or another backend + would require a separate review and tests; no local cryptographic patch has + been invented to bypass this gate. + + This establishes a reachable affected dependency and prevents a claim of + unreachability. It does not prove practical key extraction from this WASM + binary on a particular browser/CPU. No such exploit has been demonstrated. + The hybrid construction's independent component may preserve protection + under some component failures; that is not grounds for ignoring the audit. + + Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0387.html + +RUSTSEC-2023-0071: RSA + + Sequoia's crypto-rust feature also includes rsa 0.9.10. The probe generates + only the specified PQ identities and calls their corresponding primitives; + it does not generate an RSA key or exercise RSA private-key operations. + + That observation applies only to this closed, generated-input probe. It is + not proof that a future importer, certificate verifier, authentication + endpoint, or decryption interface cannot be induced to use another algorithm. + The future application needs an explicit supported-algorithm policy and + hostile-input tests before any narrower exception could be assessed. + + Advisory: https://rustsec.org/advisories/RUSTSEC-2023-0071.html + +BACKEND CHECK + + In the installed Sequoia 2.4.2 source, the Nettle and Botan asymmetric + backends report these required composite algorithms unsupported. The OpenSSL + backend conditionally supports them, depending on the available OpenSSL + version/features. Its browser/WASM build has not been demonstrated here. + Native OpenSSL support alone would not satisfy client-side browser encryption. + + The Rust backend requires allow-experimental-crypto and + allow-variable-time-crypto. These are explicit prototype build opt-ins, + not security approvals or claims that the selected operations are safe. + +OTHER AUDIT GATES + + The new dependency graph also contains multiple crate versions. Its exact + graph is pinned in Cargo.lock. Duplicate bans have not been relaxed, and + no vulnerability advisory has been ignored. License permissions for Sequoia + and its dependencies must remain correctly attributed in generated notices. + + The project check must audit the whole workspace. A root-package-only + cargo-deny invocation misses a workspace member that is not a dependency + of the root CLI. The branch changes that invocation to --workspace. + +NEXT GATE + + Retain the fixed algorithms. Resolve the curve-backend dependency through + a reviewed upstream-compatible fix or demonstrate an acceptable alternative + backend in the browser. Repeat the native and browser tests, review imported + hostile inputs, and pass the full dependency audit before private-message use. -- cgit v1.2.3