►
From YouTube: Hyperledger Ursa code review: Ready for Production?
Description
A virtual Hyperledger meetup hosted on May 24, 2022 featuring Pierre A. Roberge is co-founder and General Manager of the Digital Identity Laboratory of Canada speaking about Hyperledger Ursa. Hyperledger Ursa is a shared cryptographic library that would enable people (and projects) to avoid duplicating other cryptographic work and hopefully increase security in the process.
The Digital Identity Laboratory of Canada (IDLab) is pleased to share the results of its security and cryptography code review of the Hyperledger URSA crypto library. In support to future deployments of digital identity services toward production, rooted in a “trust but verify” mindset, the IDLab completed an arms-length third party assessment of the URSA crypto library to understand and mitigate the risks associated with the use of Hyperledger technology in the domain of decentralized identity. Pierre Roberge will present the approach that was taken, followed by a review of the key findings and conclusions drawn from the exercise.
The Hyperledger Ursa code review report is available at: https://www.hyperledger.org/learn/research
More about Hyperledger Ursa is at: https://wiki.hyperledger.org/display/ursa/
B
Very
good,
thank
you,
david
thank
you
to
the
ipreligio
community
for
giving
us
the
opportunity
today
to
present
the
finding
on
our
independent
security
code
review
of
the
ursa
library.
My
name
is
pierre
roberge.
I'm
the
general
manager
of
the
digital
identity
lab
I'm
happy
to
share
that.
Today's
presentation
will
be
available
in
french
later
in
june,
scheduled
for
june
23..
I
see
some
of
my
my
french
colleague
in
in
in
the
zoom,
so
there
will
be
another
presentation
june
23
in
french.
B
Very
good,
so
today's
today's
presentation,
the
agenda,
brief
introduction
about
the
id
lab.
We
need
to
do
a
bit
of
level
setting
about
hyper
ledger
and
ursa,
but
the
the
meat
of
the
presentation
today
will
be
in
the
genesis,
the
scope
and
the
engagement
process
describing
the
engagement
process
defining
in
the
summary.
B
Today's
meeting
is
really
tailored
for
the
ipr
ledger:
enthusiast
for
the
decentralized
identity
practitioner
and
other
digital
id
program
and
project
manager.
If
you're
really
looking
at
the
if
you're,
particularly
looking
at
the
at
the
crypto
with
the
security
detail
of
the
review,
I
invite
you
to
look
at
the
full
report
that
has
been
published.
B
It's
on
the
on
the
website
of
of
the
hyper
ledger
research
website,
I've
put
a
a
url
encoded,
I've,
I've
encoded
the
url
here
for
your
convenience,
and
this
is
where
you'll
find
all
of
the
details
for
that
will
be
presented
today.
So
if
you
want
to
learn
about
the
journey
we
went
through,
if
you
want
to
learn
about
the
scope,
the
conclusion
please
stay
with
us,
a
small
small
clarification.
I
am
not
a
cryptographer
and,
while
I'm
happy
to
present
here
today,
I
just
want
to
make
that
clear.
B
So,
there's
again
a
bit
of
level
setting
so
very
briefly
about
the
digital
identity
lab
the
digital
identity.
Lab
is
a
not-for-profit
organization
that
exists.
That
that
is
mission
is
to
accelerate
the
conformity
and
the
interoperability
of
digital
identity.
Ultimately
we're
our
arms-length
independent
organization
that
exists
to
promote
the
adoption
of
digital
identity.
B
B
So
about
hyper
ledger
and
ursa,
so
some
some
necessary
context
setting
here
to
start
for
everybody's
benefit,
hyper
ledger:
multi
project,
open
source
community,
it's
a
technology
stack
primarily
looking
at
blockchain
technology
and
related
tools,
and
there
is
many
use
of
the
and
adoption
of
the
hyperledger
technology
and
and
digital
identity,
rollout
or
so
specifically,
is
the
shared
cryptographic
library
that
is
being
used.
That's
an
opt-in
repository
for
the
various
hyperledger
project,
it's
being
used
today
by
indy
by
aries
by
fabric
and
by
other
there's
many
benefit
of
having
this
modular
shared
library.
B
So
it's
a
single
location
where
it
simplifies
substantially
the
review
of
the
security
analysis
and
maintaining
the
code,
ultimately
also
the
the
library
provide
for
cross-platform
interoperability.
So
when
two
project
use
the
same
library,
the
same
crypto,
it's
a
it's.
It's
a
lot
easier
for
the
verification
because
they
use
the
same
protocol
on
both
sides
so
ultimately
to
make
it
easier
for
for
pro,
for
for
existing
project
and
for
a
new
project
to
start
from
the
ground
up.
B
B
B
A
quick
parenthesis.
Canada's
birth
to
privacy,
by
design
from
dr
ann
cavulkian
and
privacy
by
design
is
reflected
in
so
many
way
in
the
and
how
we
deploy
digital
id
in
canada.
So
I
thought
it
was
appropriate
to
talk
about
a
trust
but
verify
so
the
work
we've
done
was
really
in
that
spirit,
trust,
but
verify
we're
not
expecting
nightmare.
We're
not.
We
didn't
expect
backdoor.
B
B
I
want
to
point
out
that
there
is
perceived
value
in
open
source
project
that
working
in
the
open
and
working
with
other
like-minded
community
of
practice
is
is,
is
a
value,
and
that
was
really
the
spirit
under
which
right
from
the
beginning,
the
the
project
sponsor
for
this
wanted
to
make
this
report
public
see
this
report
as
public
good
and
and
and
wanted
to
make
it
to
the
benefit
of
the
community.
So
we're
quite
happy
to
to
share
the
sharedo's
finding
today
with
you.
B
So
the
ursa
library
review
there
was
a
number.
The
code
was
examined
from
a
number
of
different
angle,
entry
points,
coding,
standard
data,
storage
and
transfer,
and
others
you
have
the
bullet
there,
but
but
briefly,
so
the
entry
point.
This
is
a
library
after
all,
right
so
there's,
a
large
number
of
function
that
have
public
scope,
binding,
are
is
also
present,
which
constitute
further
means
to
call
the
library
from
the
client
code
this
this.
B
The
key
generation,
the
signing,
the
verification
and
and
identify
possible
backdoor
data,
storage
and
transfer
is
always
part
of
a
security
review.
Here
we
look
at
caching.
We
look
at
temporary
file
creation.
That
said,
for
this
library
we
really
think
about
data
storage
and
the
responsibility
of
the
the
client
code.
B
On
the
cryptographic
side,
we
focus
on
ensuring
that
the
use
of
the
cryptography
within
the
library
is
secure.
We
look
at
the
entropy
looking
at
the
the
method
that
the
random
number
generation
was
done
and
if
it
was
deem
appropriate,
then
we
look
at
general
best
practices,
so
we
examine
a
key
length
and
a
use
of
of
of
different
curve
following
best
practices
in
the
industry,.
B
So
the
engagement
process-
this
was
about
a
four-month
project
from
inception
to
today
we
started
with
a
scope
and
definition,
and
I
I've
shared
those.
Those
were
the
that
was
the
previous
slide
we
I've
shared.
Then
we
start
we
we
identify,
which
code,
which
version
of
the
code
we
wanted
to
use.
So
we
use
the
branch
for
the
the
branch
version
0.3.7.
B
Then
there
was
examination
that
was
done
by
a
group
of
experts
following
the
examination
in
february
there
was
validation
and
the
validation
and
the
remediation
was
done
together
was
done
in
partnership
straight
from
the
beginning
with
the
community.
So
we
had
david
with
us
that
was
that
was
part
of
this
effort
and
we
also
work
with
the
the
eurozone
representatives.
I
would
like
to
name
them:
they've
been
a
key
contributor
to
to
the
work
so
art
montgomery,
mike
lauder,
cam,
para
and
nathan.
George.
B
Remediation
itself
will
be
done
by
the
ursa
community,
but
there
was
there
is
action,
action,
item
and
plan
that
were
put
in
place
and,
and
today
we
are
reporting
and
communicating
with
you-
the
report
for
this,
so
I've
also
included
in
the
in
the
presentation
the
link
to
the
report
you
edit
in
the
in
the
url
encoding
earlier.
This
is
the
url
of
the
report
and
the
work
again
was
done
by
a
group
of
people.
So
we
have.
We
have
the
identity
lab.
B
What
are
we
doing
with
time?
We're
good,
so
the
finding
summary
bottom
line
there?
The
it
was
a
very
successful
review.
I
think
we
we
didn't
expect
to
find
any
any
major
issue
and
it
it.
We
did
not
find
any
major
issue
like
like
it's
always
good,
to
have
an
extra
pair
of
fresh
eyes
looking
at
the
code,
and
I
think
there
was
some
issues-
low
severity
issues
that
were
identified
and
were
documented.
B
There
were
some
issues
around
the
build
process,
so
we
need
to
be
careful
with
this.
There
was
also
a
minor
issue
with
the
possible
vulnerability
in
the
open
ssl.
So
I
think
it's
important
to
use
the
latest
version
of
the
openssl
and
keep
track
of
of
the
vulnerability
that
exists
in
that
project.
But
if
you
link
the
project
you
enable
so
it's
important
to
we've
identified
this
for
the
for
the
community
to
keep
an
eye
on
and
that's
primarily
a
build
issue.
B
There
has
been
some
minor
issue
related
to
lack
of
support
for
message.
Authentication
two
issues
came
come
to
mind,
so
one
was
around
the
implementation
that
does
not
check
for
the
signature
in
an
element
of
a
prime
order,
subgroup
in
the
and
and
and
so
that
was
it's
always
good
practices
to
verify
your
the
signature,
and
there
was
also
something
around
the
public
key
check
in
the
lib
ursa
bls
module.
B
So
these
were
these
issue
were
identified.
One
was
identified
as
a
low
severity.
One
was
identified
as
a
medium
severity
and
both
have
been
the
the
the
the
severity
was
in
a
the.
The
setting
of
the
severity
was
done
with
with
the
ursa
team.
I
think
it
was
accepted
as
as
as
this
and
there's
some
it's
being
taken
care
right
now,
right
inside
the
the
community
to
to
resolve.
B
There
was
some
minor
issue
related
to
the
subgroup
validation.
I
will.
I
will
not
go
into
the
detail
here,
and
there
was
one
issue
around
the
breaking:
the
unlinkability
of
the
identity
mixer
using
malicious
key.
This
is
probably
the
the
biggest
surprise
in
the
yeah,
the
biggest
surprise
in
in
the
review.
B
The
main
contributor
to
the
report
I
want
to
thank
them
for
their
work:
neil
kettles,
matthew,
barker,
justin,
gage,
liz
shaw,
lis,
roy
francis
bruce
dele.
Thank
you
very
much
for
your
contribution
with
the
report.
If
there
is
any
specific
question
about
the
ursula
library
itself,
I
invite
I
invite.
B
I
invite
people
to
connect
to
the
discord
server
of
the
ursus
of
ursa.
Once
again,
I've
put
the
url
encoded,
the
encoding
of
the
barcode
for
the
url,
I'm
sorry
it's
present
there
and
my
name
is
pio
robert.
I'm
happy
to
have
shared
a
result
with
you
today.
Thank
you
for
taking
the
time
to
participate
today.
Thank
you
for
watching
and
we'll
take
some
q
a
right
now.
A
B
Yeah,
so
basically
you
know
this
project.
I
think
this
project
was
really
done
and
from
a
community
perspective,
you
have
a
community
of
developer
that
that
putting
sweat
and
and
time
into
into
the
library
we
have
a
community
of
user.
That's
looking
to
adopt,
and-
and
I
think
this
was
really
foster
and
and
and
and
and
and
the
idea
that
we
want
to
you-
know
how
do
we
get
ready
to
to
use
hyper
ledger
technology
into
production
and
doing
that
necessary
trust,
but
verify
exercise?
B
A
Well
sure,
well,
in
the
same
way
that
you're
taking
a
look
at
the
you
know
doing
a
review
of
the
code.
First,
I
mean
I
think,
if
somebody's
considering
adopting
an
open
source
project,
they
you
know,
they
may
also
want
to.
Similarly
do
a
you
know,
a
review
of
the
community
of
the
code,
for
example,
because
you
know
no
open
source
project
is
not
just
you
know
a
set
of
code.
You
know
some
code
somewhere
in
some
repository
right.
It's
the
you
know
the
people,
the
infrastructure,
the
ecosystem
around
that
code
right.
A
A
Is
you
know
kind
of
my
angle
on
things?
I'm
not
super
technical
myself,
so
I
don't
really
have
an
opinion
on
the
you
know.
The
the
ursa
code
side
of
things,
but
in
terms
of
you
know,
is
the
community
a
place
where
somebody
is
who
wants
to
adopt
her.
So
can
they
go
and
interact
and
engage?
It
was
really
my
angle.
So
it's
great
to
see
us
talking
about
this.
It's
great
to
see
people
you
know
join,
you
know
and
be
interested
in
the
discussion.
B
But
as
as
as
organizations
are
looking
to
adopt
the
library,
I
think
it's
important
and
because
it's
open
source,
I
think
it's
you
need
to
put
a
level
of
care
as
much
level
of
care
and
and
how
your
your
build
environment
is
is
set
up
than
the
library
itself,
because
it
would
be.
We
can
have
a
clean
library.
B
The
build
process
would
allow
for
injecting
potential
risk
into
that,
and
so,
while
there
is
some
issues
that
have
been
identified
as
as
implementation,
cautious,
they
are
part
of
the
overall
equation
of
of
security
end-to-end.
So
I
invite
people
to
not
over
oversee
that
or
or
or
or
having
this
in
their
blind
spot.
B
So
I
want
to
go
back
while
people
maybe
write
their
question.
I
want
to
go
back
a
year,
so
there's
today's
presentation.
There
will
be
a
blog
that
will
be
posted
soon,
think
about
it
as
something
you
can
for
for
people
to
share
within
their
within
their
project
team
or
within
their
organization.
To
talk
about
about
the
review,
the
finding
and
and
and
the
process
and
the
actual
report
itself.
B
B
B
There
was
one
issue
give
me
one
second
here
there
was
one
issue
that
was
identified
along
those
line,
so
in
the
lib
ursa
bls
module
there's
it
does
not
check
the
public
key
consistently,
and
so
this
has
been
considered
in
the
past
by
the
ursa
community.
If
they're
aware
of
this,
but
due
to
performance
reason,
it
was
not,
it
was
not
addressed
or
or
or
changed.
B
My
understanding,
I
know
that
hyper
ledger
technology
broadly
is
used
in
in
the
province
of
alberta,
I'm
not
sure
exactly
if
they're
using
indy,
maybe
there's
somebody
else
that
can
that
can.
Let
us
know,
there's
few
canadian
on
the
call
today
but
but
yeah,
and
we
are
aware
of
a
number
of
deployment
in
canada
and
outside
of
canada,
where,
where
nd
or
aries
and
other
of
the
technology
stack,
source
or
ohm,
that
at
hyperledger
are
being
used
here,
we
are.
A
A
B
B
B
C
Yeah
yeah
sure
I
can
ask
a
question,
probably
about
broader
context
like
for
me,
this
is
a
an
especially
valuable
exercise
in
due
diligence,
especially
again
where
I
came
from
a
public
sector
where
you
have
to
make
strategic
bets
or
strategic
investments
that
are
very
difficult
to
roll
back
or
if
there's
something
that
is
like
a
deficiency
or
an
error,
and
it
impacts
like
public
sector
service.
It's
really
hard
to
roll
back
and
regain
trust.
C
C
And
that's
I
just
I
just
want
to
point
this
out,
so
this
is
excellent
work,
and
but
there
still
is
a
need
that
if,
if
I
was
a
public
sector
decision
maker,
this
would
give
me
some
comfort
it.
It
would
enable
me
to
advocate
for
a
solution
with
like
eyes,
wide
open
reasonably
on
what
the
risk
might
be,
and
it's
just
another
another
great
piece
to
the
corpus.
If
you
will.
B
I
think
the
the
ursa
team
has
done
a
fantastic
work
in
and
putting
the
lab
recognizing
the
need
for
a
common
library,
the
the
quality
of
the
engineering,
the
implementation,
the
documentation
was
visible
across
the
code,
but
this
you
need,
you
know
and
that
third-party
validation,
arms,
land,
neutral
validation,
I
think
is,
is
another
a
milestone
for
for
broader
adoption
by
in
the
marketplace,
and
so
the
the
stage
is
set.
I
think
for
for
a
number
of
upcoming
product,
rollout
or
service
rollout.
B
And
it's,
it
was
also
important
for
organizing
the
other
thing
I'll
point
out.
It's
also
important
for
organizations
that
don't
use
hyper
ledger
today.
I
think
that,
broadly,
if
we
look
at
the
industry
of
digital
identity,
there's
a
number
of
organizations
that
are
involved,
there's
a
you
know
many
way
of
of
getting
to
of
of
implementing
self-sovereign
identity
or
their
flavor
of
digital
identity.
But
we
are
all
in
it
together,
because
if
one
ecosystem
fail
miserably
it
doesn't,
it
has
a
ripple
effect
on
on
the
others.
B
There's
a
there's,
a
kind
of
a
a
brand
risk
or
an
or
or
an
implement
or
a
state.
You
know
a
risk-free
state
of
the
art,
and
so
even
if
you
are
not
using
hyper
ledger
today
in
in
your
in
your
organization,
maybe
you
should,
but
I
think
you
can
take.
You
should
take
comfort
and
and
the
report
showing
that
the
in
in
in
the
technology
and
the
technology
stack
of
viper
ledger
has
been
done
properly,
and
so
you
can.
A
A
Yeah,
that's
great,
thank
you
for
that,
and
I
was
gonna
say
I
was
gonna
share.
Some
of
these
links
with
everybody
who
signed
up
on
the
meetup
pages
and
I'll
I'll
add
the
discord
link
as
well
I'll
put
the
report
in
this
recording
and
the
discord
link.
So
everybody
can
join
us
there
for
further
discussion.