From fe90139a2128aad31187c084342ccef943052795 Mon Sep 17 00:00:00 2001 From: Amaury <1293565+amaurym@users.noreply.github.com> Date: Mon, 5 Sep 2022 17:24:51 +0200 Subject: [PATCH] docs(textual): Require signing over raw bytes (#12910) ## Description Security concerns around what's signed, pulled out from https://github.com/cosmos/cosmos-sdk/pull/12785#discussion_r935040037. cc @peterbourgon --- ### Author Checklist *All items are required. Please add a note to the item if the item is not applicable and please add links to any relevant follow up issues.* I have... - [ ] included the correct [type prefix](https://github.com/commitizen/conventional-commit-types/blob/v3.0.0/index.json) in the PR title - [ ] added `!` to the type prefix if API or client breaking change - [ ] targeted the correct branch (see [PR Targeting](https://github.com/cosmos/cosmos-sdk/blob/main/CONTRIBUTING.md#pr-targeting)) - [ ] provided a link to the relevant issue or specification - [ ] followed the guidelines for [building modules](https://github.com/cosmos/cosmos-sdk/blob/main/docs/building-modules) - [ ] included the necessary unit and integration [tests](https://github.com/cosmos/cosmos-sdk/blob/main/CONTRIBUTING.md#testing) - [ ] added a changelog entry to `CHANGELOG.md` - [ ] included comments for [documenting Go code](https://blog.golang.org/godoc) - [ ] updated the relevant documentation or specification - [ ] reviewed "Files changed" and left comments if necessary - [ ] confirmed all CI checks have passed ### Reviewers Checklist *All items are required. Please add a note if the item is not applicable and please add your handle next to the items reviewed if you only reviewed selected items.* I have... - [ ] confirmed the correct [type prefix](https://github.com/commitizen/conventional-commit-types/blob/v3.0.0/index.json) in the PR title - [ ] confirmed `!` in the type prefix if API or client breaking change - [ ] confirmed all author checklist items have been addressed - [ ] reviewed state machine logic - [ ] reviewed API design and naming - [ ] reviewed documentation is accurate - [ ] reviewed tests and test coverage - [ ] manually tested (if applicable) --- .../architecture/adr-050-sign-mode-textual.md | 26 ++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/docs/architecture/adr-050-sign-mode-textual.md b/docs/architecture/adr-050-sign-mode-textual.md index aaa7e2bfd8..05f4085916 100644 --- a/docs/architecture/adr-050-sign-mode-textual.md +++ b/docs/architecture/adr-050-sign-mode-textual.md @@ -5,6 +5,7 @@ - Dec 06, 2021: Initial Draft. - Feb 07, 2022: Draft read and concept-ACKed by the Ledger team. - May 16, 2022: Change status to Accepted. +- Aug 11, 2022: Require signing over tx raw bytes. ## Status @@ -115,6 +116,7 @@ Tip: *Public Key: *Sequence: *End of other signers +*Hash of raw bytes: // Hex encoding of bytes defined in #10, to prevent tx hash malleability. ``` ### 8. Encoding of the Transaction Body @@ -158,7 +160,26 @@ Grantee: cosmos1ghi...jkl End of transaction messages ``` -### 9. Signing Payload and Wire Format +### 10. Require signing over the `TxBody` and `AuthInfo` raw bytes + +Recall that the transaction bytes merklelized on chain are the Protobuf binary serialization of [TxRaw](https://github.com/cosmos/cosmos-sdk/blob/v0.46.0/proto/cosmos/tx/v1beta1/tx.proto#L33), which contains the `body_bytes` and `auth_info_bytes`. Moreover, the transaction hash is defined as the SHA256 hash of the `TxRaw` bytes. We require that the user signs over these bytes in SIGN_MODE_TEXTUAL, more specifically over the following string: + +``` +*Hash of raw bytes: +``` + +where: +- `++` denotes concatenation, +- `HEX` is the hexadecimal representation of the bytes, all in capital letters, no `0x` prefix, +- and `len()` is encoded as a Big-Endian uint64. + +This is to prevent transaction hash malleability. The point #1 about bijectivity assures that transaction `body` and `auth_info` values are not malleable, but the transaction hash still might be malleable with point #1 only, because the SIGN_MODE_TEXTUAL strings don't follow the byte ordering defined in `body_bytes` and `auth_info_bytes`. Without this hash, a malicious validator or exchange could intercept a transaction, modify its transaction hash _after_ the user signed it using SIGN_MODE_TEXTUAL (by tweaking the byte ordering inside `body_bytes` or `auth_info_bytes`), and then submit it to Tendermint. + +By including this hash in the SIGN_MODE_TEXTUAL signing payload, we keep the same level of guarantees as [SIGN_MODE_DIRECT](./adr-020-protobuf-transaction-encoding.md). + +These bytes are only shown in expert mode, hence the leading `*`. + +### 11. Signing Payload and Wire Format This string array is encoded as a single `\n`-delimited string before transmitted to the hardware device, and this long string is the signing payload signed by the hardware wallet. @@ -232,6 +253,7 @@ Amount: 10 atom // Conversion from uatom to atom using value renderer End of transaction messages Fee: 0.002 atom *Gas: 100'000 +*Hash of raw bytes: ``` #### Example 2: Multi-Msg Transaction with 3 signers @@ -320,6 +342,7 @@ Tip: 200 ibc/CDC4587874B85BEA4FCEC3CEA5A1195139799A1FEE711A07D972537E18FDA39D *Sign mode: Direct Aux *Sequence: 42 *End of other signers +*Hash of raw bytes: ``` #### Example 5: Complex Transaction with Nested Messages @@ -466,6 +489,7 @@ Fee: 0.002 atom *Sign mode: Direct *Sequence: 42 *End of other signers +*Hash of raw bytes: ``` ## Consequences