The OpenSSL 1.1.1 Audit Fundraising has Begun!
What are we doing?
Like our other fundraisers, OSTIF is reaching out to the public to fund a thorough and open audit of OpenSSL 1.1.1. This particular version is important because OpenSSL 1.1.1 introduces significant pieces of new code to implement the new TLS 1.3 standard.
Millions of websites (including 70% of the top million sites), apps, and individuals rely on OpenSSL 1.1.1 to keep user data safe and private. It is impossible to surf the web and not have OpenSSL protecting you during your travels.
A thorough and public review of the code will allow us to verify that OpenSSL is as safe as possible, and assure people around the world that this library is well coded and significantly hardened against flaws in both its software and its cryptography.
What is the plan?
This fundraiser will be ongoing until we meet our financial goal to get the project done. Then, we will schedule the audit and move forward. Once the audit is completed and the results are in, we will responsibly and securely disclose our findings to the OpenSSL security team, who will make any necessary updates to the software. After the patching is completed, our findings will be released to the public for transparent review.
Who is conducting the audit?
This audit is larger in scope than our previous two audits, both because of the size of the codebase and the enormous number of ways that the software is used. This audit will be a joint effort by QuarksLab and Kudelski Security. Two teams (two cryptographers and two software security experts) will review the code for a total of 1920 hours.
What will the audit focus on?
This is a wide security review that covers multiple areas of concern. OpenSSL has support from other groups and the core code is regularly fuzzed for typical programming errors. This means that our efforts will need to focus on areas that these techniques will frequently miss. We will be searching for more complex problems, verifying the cryptography, and looking at the areas that do not get the full attention of the current review process.
The areas of focus are:
TLS 1.3 – This is all green code that implements the new TLS 1.3 cryptographic standard. This is a large addition to the codebase and needs verification from outside experts that this new code is cryptographically sound, that the new software is free of serious problems, and that the TLS 1.3 code properly integrates with all other features.
Crypto Engine based plugins – This is code that allows OpenSSL to work with other crypto engines such as Microsofts CryptoAPI. This code has not had a deep review and there’s potential for some issues with the interaction between the CryptoAPI and the OpenSSL Engine.
The SRP Authentication Protocol – This code handles user/pass login systems and has not had a thorough review after its latest large update.
OpenSSL’s updated PRNGs – The Pseudorandom Number Generator (PRNG) is one of the most crucial components in digital security. The OpenSSL PRNGs have had significant updates and changes that need to be verified for safety. A problem with a PRNG can break an entire crypto system and has in the past ( Debian Weak RNG and NSA Compromised Dual-EC-DRBG )
x86, x86-64, ARM, and ARM-64 – We will investigate the differences between OpenSSL 1.1.1 for different hardware/OS architectures to look for unique problems that arise. x86 and x86-64 (aka x64) cover the vast majority of PC and server hardware. ARM and ARM-64 covers the vast majority of mobile device hardware as well as many low-power devices such as routers, consumer level firewalls, smart TV PCs, and much more.
Adding more hooks for libfuzzer and ossfuzzer – This will expand the area of the app that can be monitored by automated fuzzing, increasing the safety of OpenSSL through more thorough checking of memory safety and other common software errors that can lead to vulnerabilities.
How much do we need to raise?
This project is more than four times as large as our OpenVPN 2.4. project, and the budget reflects that. We need to raise approximately $435,000 USD to pay the auditors, cover the overhead of the transactions, and leave a cushion in case of currency fluctuations in our cryptocurrency accounts or changes in international exchange rates. It also includes the costs of the fundraising activities themselves with advertising, designing and printing new shirts, and a travel budget if/when companies want to meet with us directly to talk about long-term support of the organization. As always, all remaining funds will go toward the bug bounty program to drive research that will further harden our supported applications.
How can I contribute to this project?
These projects only get done because the community comes together and contributes to the cause. The path to truly safe software starts here with public review and accountability in plain sight for everyone to see.
You can contribute monetarily by donating to our cause, but there’s also many other ways to make OpenSSL safer. You can add us to your Amazon Smile account, and Amazon will contribute 0.5% of your order’s total to our cause at no cost to you. You can spread the word to your employer, or on social media (Facebook) (Twitter) (Reddit /u/ostifofficial). Getting the word out is an absolutely crucial step that only happens with the support of the community. You can volunteer with OSTIF and help us work on our website, art assets, t-shirt designs, or wherever your skills may lie. If you’d like to volunteer, our contact information is on the About Us page.
My organization has special requests to donate, is that okay?
As long as your requirements do not impact our independent, objective stance, we are happy to work with organizations on special requirements such as requirements on how money is spent, using our marketing materials, or filing extra required paperwork. Our job is to raise money and get these projects done in the most cost-effective, open, and neutral manner possible. We will work with you if our goals are aligned. Contact us!