cvelistv5 - cve-2024-45040

cve-2024-45040

Vulnerability from cvelistv5

Published

2024-09-06 12:53

Modified

2024-09-06 13:57

Severity ?

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

gnark's commitments to private witnesses in Groth16 as implemented break zero-knowledge property

References

URL	Tags
security-advisories@github.com	https://github.com/Consensys/gnark/commit/afda68a38acca37becb8ba6d8982d03fee9559a0	Patch
security-advisories@github.com	https://github.com/Consensys/gnark/pull/1245	Product
security-advisories@github.com	https://github.com/Consensys/gnark/security/advisories/GHSA-9xcg-3q8v-7fq6	Third Party Advisory

Impacted products

Vendor

Product

Version

▼

Consensys

gnark

Version: < 0.11.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:consensys:gnark:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "gnark",
            "vendor": "consensys",
            "versions": [
              {
                "lessThanOrEqual": "0.11.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45040",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-06T13:57:02.916086Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-06T13:57:49.796Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gnark",
          "vendor": "Consensys",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.11.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.11.0, commitments to private witnesses in Groth16 as implemented break the zero-knowledge property. The vulnerability affects only Groth16 proofs with commitments. Notably, PLONK proofs are not affected. The vulnerability affects the zero-knowledge property of the proofs - in case the witness (secret or internal) values are small, then the attacker may be able to enumerate all possible choices to deduce the actual value. If the possible choices for the variables to be committed is large or there are many values committed, then it would be computationally infeasible to enumerate all valid choices. It doesn\u0027t affect the completeness/soundness of the proofs. The vulnerability has been fixed in version 0.11.0. The patch to fix the issue is to add additional randomized value to the list of committed value at proving time to mask the rest of the values which were committed. As a workaround, the user can manually commit to a randomized value."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-06T12:53:30.622Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Consensys/gnark/security/advisories/GHSA-9xcg-3q8v-7fq6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Consensys/gnark/security/advisories/GHSA-9xcg-3q8v-7fq6"
        },
        {
          "name": "https://github.com/Consensys/gnark/pull/1245",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Consensys/gnark/pull/1245"
        },
        {
          "name": "https://github.com/Consensys/gnark/commit/afda68a38acca37becb8ba6d8982d03fee9559a0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Consensys/gnark/commit/afda68a38acca37becb8ba6d8982d03fee9559a0"
        }
      ],
      "source": {
        "advisory": "GHSA-9xcg-3q8v-7fq6",
        "discovery": "UNKNOWN"
      },
      "title": "gnark\u0027s commitments to private witnesses in Groth16 as implemented break zero-knowledge property"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-45040",
    "datePublished": "2024-09-06T12:53:30.622Z",
    "dateReserved": "2024-08-21T17:53:51.330Z",
    "dateUpdated": "2024-09-06T13:57:49.796Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-45040\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-09-06T13:15:04.893\",\"lastModified\":\"2024-09-20T00:13:23.323\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.11.0, commitments to private witnesses in Groth16 as implemented break the zero-knowledge property. The vulnerability affects only Groth16 proofs with commitments. Notably, PLONK proofs are not affected. The vulnerability affects the zero-knowledge property of the proofs - in case the witness (secret or internal) values are small, then the attacker may be able to enumerate all possible choices to deduce the actual value. If the possible choices for the variables to be committed is large or there are many values committed, then it would be computationally infeasible to enumerate all valid choices. It doesn\u0027t affect the completeness/soundness of the proofs. The vulnerability has been fixed in version 0.11.0. The patch to fix the issue is to add additional randomized value to the list of committed value at proving time to mask the rest of the values which were committed. As a workaround, the user can manually commit to a randomized value.\"},{\"lang\":\"es\",\"value\":\"gnark es una librer\u00eda zk-SNARK r\u00e1pida que ofrece una API de alto nivel para dise\u00f1ar circuitos. Antes de la versi\u00f3n 0.11.0, los compromisos con testigos privados en Groth16 tal como se implementaron rompen la propiedad de conocimiento cero. La vulnerabilidad afecta solo a las pruebas de Groth16 con compromisos. En particular, las pruebas PLONK no se ven afectadas. La vulnerabilidad afecta la propiedad de conocimiento cero de las pruebas: en caso de que los valores de los testigos (secretos o internos) sean peque\u00f1os, entonces el atacante puede enumerar todas las opciones posibles para deducir el valor real. Si las opciones posibles para las variables que se comprometer\u00e1n son grandes o hay muchos valores comprometidos, entonces ser\u00eda computacionalmente inviable enumerar todas las opciones v\u00e1lidas. No afecta la integridad/solidez de las pruebas. La vulnerabilidad se ha corregido en la versi\u00f3n 0.11.0. El parche para solucionar el problema es agregar un valor aleatorio adicional a la lista de valores comprometidos en el momento de la prueba para enmascarar el resto de los valores que se comprometieron. Como workaround, el usuario puede comprometerse manualmente con un valor aleatorio.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6},{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]},{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:consensys:gnark-crypto:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"0.11.0\",\"matchCriteriaId\":\"622EAC41-6FA3-4B4A-948D-81E243DEFAA7\"}]}]}],\"references\":[{\"url\":\"https://github.com/Consensys/gnark/commit/afda68a38acca37becb8ba6d8982d03fee9559a0\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/Consensys/gnark/pull/1245\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\"]},{\"url\":\"https://github.com/Consensys/gnark/security/advisories/GHSA-9xcg-3q8v-7fq6\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]}]}}"
  }
}

ghsa-9xcg-3q8v-7fq6

Vulnerability from github

Published

2024-09-06 19:40

Modified

2024-11-18 16:27

Severity ?

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
8.2 (High) - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

gnark commitments to private witnesses in Groth16 as implemented break zero-knowledge property

Details

This report concerns the Groth16 prover when used with commitments (as in frontend.Committer). To simplify exposition of the issue, I will focus on the case of a single commitment, to only private witnesses. But the issue should be present whenever commitments are used that include private witnesses.

The commitment to private witnesses w_i is computed as c = sum_i w_i * b_i where b_i would be ProvingKey.CommitmentKeys[0].Basis[i] in the code.

While this is a binding commitment, it is not hiding. In practice, an adversary will know the points b_i, as they are part of the proving key, and can verify correctness of a guess for the values of w_i by computing c' as the right hand side of the above formula, and checking whether c' is equal to c. I attach a proof of concept that demonstrates this.

This breaks the perfect zero-knowledge property of Groth16, so the Groth16 scheme using commitments to private witnesses as implemented by gnark fails to be a zk-SNARK.

The code indicates that the extension to Groth16 given by the commitments follows the paper "Recursion over Public-Coin Interactive Proof Systems; Faster Hash Verification" by Alexandre Belling, Azam Soleimanian, and Olivier Begassat. In that paper, it seems that commitments are applied to what were originally public inputs, which are moved to private witnesses for efficiency reasons. In any case, that paper does not discuss any hiding/privacy/zero-knowledge properties of their protocols.

So for the use-cases envisioned by that paper, having the commitment not be hiding and losing zero-knowledge of Groth16 might be adequate. However, the documentation by gnark does not make clear that committing to private witnesses loses the zero-knowledge property. The documentation for frontend.Committer does not mention this, and the following snippet from std/multicommit/doc_test.go, where private witness variables are named Secrets and are committed, seems to actively suggest that committed witnesses are still private. ```go // MultipleCommitmentCircuit is an example circuit showing usage of multiple // independent commitments in-circuit. type MultipleCommitmentsCircuit struct { Secrets [4]frontend.Variable }

func (c *MultipleCommitmentsCircuit) Define(api frontend.API) error { // first callback receives first unique commitment derived from the root commitment multicommit.WithCommitment(api, func(api frontend.API, commitment frontend.Variable) error { // compute (X-s[0]) * (X-s[1]) for a random X res := api.Mul(api.Sub(commitment, c.Secrets[0]), api.Sub(commitment, c.Secrets[1])) api.AssertIsDifferent(res, 0) return nil }, c.Secrets[:2]...) // ... ```

Thus it seems to me that the intention likely was (and users will be expecting) that gnark's implementation of Groth16 with these commitments should still have zero-knowledge and that the commitments should be hiding.

The way to fix this is likely to adjust the commitment to be hiding the way that is done in the LegoSNARK paper (https://eprint.iacr.org/2019/142.pdf). To expand:

First, let me fix some notation.

Currently, the verifying key has two points on G2 used for checking the proof of knowledge for the commitment: g and g'=-1/σ * g (in the code: VerifyingKey.CommitmentKey.G and VerifyingKey.CommitmentKey.GRootSigmaNeg). The commitment itself is then c = sum_i w_i * b_i, where b_i are on G1, and the proof of knowledge associated to c is calculated as pok = sum_i w_i * b'_i, where b'_i = σ*b_i (in the code b_i and b'_i are ProvingKey.CommitmentKeys.Basis[0][i] and ProvingKey.CommitmentKeys.BasisExpSigma[0][i]). The proof of knowledge is then verified by checking e(c, g) + e(pok, g') = 0 (I am using additive notation throughout here).

The Groth16 proof is verified by checking e(Krs, -[δ]₂) + e(c, -[γ]₂) + e(term involving public inputs, -[γ]₂) + other terms = 0

The construction ccGro16 from the LegoSNARK paper (page 73 in https://eprint.iacr.org/2019/142.pdf) is a similar construction. They do not have a proof of knowledge accompanying the commitment because they are considering the case where there are no public inputs. However, they claim that their scheme is zero-knowledge, and the crucial difference for this is that their commitment has an extra blinding term as is usual for Pedersen commitments. Concretely, it is of the form: c_new = sum_i w_i * b_i + v*[η/γ]₁ where [η/γ]₁ is a new element of G1 that is part of the proving key, with η a new toxic waste field element. The value of v is randomly chosen by the prover.

When adding this additional term to c, then to make the proof verification still succeeds, the proof point Krs is changed accordingly: Krs_new = Krs_old - v*[η/δ]₁ where [η/δ]₁ is another new element of G1 that is part of the proving key. As e([η/γ]₁, -[γ]₂) = e([η/δ]₁, -[δ]₂), the contributions from the new terms cancel each other in the proof verification pairing check.

This modification should ensure that the commitment is hiding.

The proof of knowledge would also need to be adapted accordingly, with pok = sum_i w_i * b'_i + v*[σ*η/γ]₁ where [σ*η/γ]₁ is another point of G1 to add to the proving key.

Impact

The vulnerability affects only Groth16 proofs with commitments. Notably, PLONK proofs are not affected.

The vulnerability affects the zero-knowledge property of the proofs - in case the witness (secret or internal) values are small, then the attacker may be able to enumerate all possible choices to deduce the actual value. If the possible choices for the variables to be committed is large or there are many values committed, then it would be computationally infeasible to enumerate all valid choices.

It doesn't affect the completeness/soundness of the proofs.

Patches

The vulnerability has been fixed in https://github.com/Consensys/gnark/pull/1245. Corresponding commit on the master branch https://github.com/Consensys/gnark/commit/afda68a38acca37becb8ba6d8982d03fee9559a0.

The patch to fix the issue is to add additional randomized value to the list of committed value at proving time to mask the rest of the values which were committed.

Workarounds

The user can manually commit to a randomized value.

Show details on source website