The fuzzy tale of an x/crypto vulnerability Michael McLoughlin Gophercon 2019 Lightning Talks Uber Advanced Technologies Group 8,140 lines of amd64 assembly in crypto 10,474 lines of amd64 assembly assembly in golang.org/x/crypto Fuzzing Fuzzing is an automated testing technique for hardening safety-critical software Typically used where code must handle untrusted inputs or correctness is paramount: 0 }  crypto/aes (GCM mode)  crypto/elliptic (P256)  crypto/sha1  crypto/sha256  crypto/sha512  x/crypto/chacha20poly1305  x/crypto/sha3  x/crypto/blake2b  x/crypto/blake2s  x/crypto/argon2

pluggable membership service provider is responsible for associating entities in the network with crypto- graphic identities. • An optional peer-to-peer gossip service disseminates the blocks output by other pertinent information • Channels contain Membership Service Provider instances allowing for crypto materials to be derived from different certificate authorities See the ledger topic for a deeper folder ˓→not found at [/Users/xxx/dev/byfn/crypto-config/ordererOrganizations/example.com/ ˓→msp/intermediatecerts]. Skipping.: [stat /Users/xxx/dev/byfn/crypto-config/ ˓→ordererOrganizations/example.

other pertinent information Channels contain Membership Service Provider instances allowing for crypto materials to be derived from different certificate authorities See the Ledger topic for a deeper certs folder not found at [/Users/xxx/dev/byfn/crypto- config/ordererOrganizations/example.com/msp/intermediatecerts]. Skipping.: [stat /Users/xxx/dev/byfn/crypto- config/ordererOrganizations/example.com/ explore the network setup one step at a time. The following will kill your containers, remove the crypto material and four artifacts, and delete the chaincode images from your Docker Registry: ./byfn.sh

pluggable membership service provider is responsible for associating entities in the network with crypto- graphic identities. • An optional peer-to-peer gossip service disseminates the blocks output by other pertinent information • Channels contain Membership Service Provider instances allowing for crypto materials to be derived from different certificate authorities See the ledger topic for a deeper folder ˓→not found at [/Users/xxx/dev/byfn/crypto-config/ordererOrganizations/example.com/ ˓→msp/intermediatecerts]. Skipping.: [stat /Users/xxx/dev/byfn/crypto-config/ ˓→ordererOrganizations/example.

other pertinent information Channel’s contain Membership Service Provider instances allowing for crypto materials to be derived from different certificate authorities See the Ledger topic for a deeper certs folder not found at [/Users/xxx/dev/byfn/crypto- config/ordererOrganizations/example.com/msp/intermediatecerts]. Skipping.: [stat /Users/xxx/dev/byfn/crypto- config/ordererOrganizations/example.com/ explore the network setup one step at a time. The following will kill your containers, remove the crypto material and four artifacts, and delete the chaincode images from your Docker Registry: ./byfn.sh

other pertinent information • Channel’s contain Membership Service Provider instances allowing for crypto materials to be derived from different certificate authorities See the Ledger topic for a deeper folder ˓→not found at [/Users/xxx/dev/byfn/crypto-config/ordererOrganizations/example.com/ ˓→msp/intermediatecerts]. Skipping.: [stat /Users/xxx/dev/byfn/crypto-config/ ˓→ordererOrganizations/example. explore the network setup one step at a time. The following will kill your containers, remove the crypto material and four artifacts, and delete the chaincode images from your Docker Registry: ./byfn.sh

other pertinent information Channels contain Membership Service Provider instances allowing for crypto materials to be derived from different certificate authorities See the Ledger topic for a deeper certs folder not found at [/Users/xxx/dev/byfn/crypto- config/ordererOrganizations/example.com/msp/intermediatecerts]. Skipping.: [stat /Users/xxx/dev/byfn/crypto- config/ordererOrganizations/example.com/ explore the network setup one step at a time. The following will kill your containers, remove the crypto material and four artifacts, and delete the chaincode images from your Docker Registry: ./byfn.sh

pluggable membership service provider is responsible for associating entities in the network with crypto- graphic identities. • An optional peer-to-peer gossip service disseminates the blocks output by other pertinent information • Channels contain Membership Service Provider instances allowing for crypto materials to be derived from different certificate authorities See the ledger topic for a deeper folder ˓→not found at [/Users/xxx/dev/byfn/crypto-config/ordererOrganizations/example.com/ ˓→msp/intermediatecerts]. Skipping.: [stat /Users/xxx/dev/byfn/crypto-config/ ˓→ordererOrganizations/example.

pluggable membership service provider is responsible for associating entities in the network with crypto- graphic identities. • An optional peer-to-peer gossip service disseminates the blocks output by other pertinent information • Channels contain Membership Service Provider instances allowing for crypto materials to be derived from different certificate authorities See the ledger topic for a deeper folder ˓→not found at [/Users/xxx/dev/byfn/crypto-config/ordererOrganizations/example.com/ ˓→msp/intermediatecerts]. Skipping.: [stat /Users/xxx/dev/byfn/crypto-config/ ˓→ordererOrganizations/example.

pluggable membership service provider is responsible for associating entities in the network with crypto- graphic identities. • An optional peer-to-peer gossip service disseminates the blocks output by other pertinent information • Channels contain Membership Service Provider instances allowing for crypto materials to be derived from different certificate authorities See the ledger topic for a deeper folder ˓→not found at [/Users/xxx/dev/byfn/crypto-config/ordererOrganizations/example.com/ ˓→msp/intermediatecerts]. Skipping.: [stat /Users/xxx/dev/byfn/crypto-config/ ˓→ordererOrganizations/example.