Write a draft security triage RFC

[teor2345]

Scheduling

Let's spend up to half a day on a draft, then review after each incident.

Is your feature request related to a problem? Please describe.

Let's be explicit about how we triage security vulnerabilities.

Describe the solution you'd like

• Summarise next steps

  • https://chromium.googlesource.com/chromium/src/+/master/docs/security/rule-of-2.md
  • sandboxing and process isolation for:
    • zebra-script (untrusted script data, C/C++)
    • zebra-network (untrusted peer data, Rust)
    • rocksdb (contextually verified data, C/C++)
    • other C/C++ dependencies
    • zebra-client (private keys, Rust)
    • zebrad
  • memory safe zebra-script impl
  • network integration testing
  • cross-fuzzing Zebra and zcashd verification

• Summarise types of vulnerabilities

  • Denial of service to remote nodes
  • Arbitrary code execution (prevented by safe Rust, focus on unsafe and C/C++ dependencies)
  • Unauthorised spends / lost outputs
  • Privacy violations
  • Breaking consensus rules
  • Denial of service to the local node
  • Peer set takeover (eclipse attacks)

• Summarise attack surfaces

Here are the barriers, dependencies, and risks:

• zebra-network (remote DoS, peer set takeover, local DoS, privacy)

1. Peer set fanout

• zebra-chain (local memory DoS, broken consensus rules)

2. Structural verification
3. Proof of work threshold + binding the block contents (fully binds transactions in a pre-NU5 block, only binds effecting data in post-NU5 blocks, doesn't bind mempool transactions)

• script validation (arbitrary code, local DoS, broken consensus rules, unauth spends)
• C/C++ cryptographic dependencies (arbitrary code, broken consensus rules, unauth spends)

4. Semantic verification

• rejects some blocks and mempool transactions

5. Contextual verification

• fully binds post-NU5 blocks
• checks current difficulty, rather than minimum difficulty
• rejects all invalid blocks
• rejects more mempool transactions

• RocksDB (arbitrary code, local DoS, broken consensus rules)

It gets tricker when we start thinking about system C libraries, and indirect C/C++ dependencies.

Describe alternatives you've considered

We could just keep doing implicit best-effort security triage. But even a draft document would make a big difference.

Additional context

https://noncombatant.org/2021/04/11/long-live-sandboxing/
https://noncombatant.org/2021/04/09/prioritizing-memory-safety-migrations/
https://chromium.googlesource.com/chromium/src/+/master/docs/security/side-channel-threat-model.md

[teor2345]

Let's re-open this when we have more experience dealing with security issues, so we know what we need out of this RFC.