►
Description
------ Description ------
Le Laboratoire d'identité numérique du Canada (IDLab) est heureux de partager les résultats de son examen du code de sécurité et de cryptographie de la librairie d'outils cryptographiques Hyperledger URSA.
Afin de soutenir les futurs déploiements de services d'identité numérique, et dans un esprit « de confiance, et de vérification » (de l’anglais : trust but verify), IDLab a réalisé une évaluation indépendante de la librairie URSA afin de comprendre et d'atténuer les risques potentiels associés à l'utilisation de la technologie Hyperledger dans le domaine de l'identité décentralisée. Pierre Roberge présentera l'approche adoptée, suivie d'une revue des principaux constats et conclusions tirés de l'exercice.
------ À propos du orateur ------
Pierre A. Roberge est co-fondateur et directeur général du Laboratoire d’identité numérique du Canada. Pierre a plus de 25 années d'expertise et d'expérience en transformation numérique dans différent domaines tel que l'identité numérique, protection intégrée de la vie privée, paiement électronique, opérations bancaires et, plus généralement, en cybersécurité.
Pierre jette les ponts entre les domaines des affaires et de la technologie dans l’utilisation des technologies émergentes, afin de créer et d’opérationnaliser de nouvelles opportunités stratégiques.
----
Hyperledger – Open Source Blockchain Technologies
Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use
Discord: https://discord.gg/rVCn4j7UFd
Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory
Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter
Follow-us on Twitter @Hyperledger
Learn about Hyperledger Membership: https://www.hyperledger.org/about/join
#Hyperledger #Blockchain
License
Creative Commons Attribution license (reuse allowed)
A
A
Thank
you.
Many
thanks
keven
for
the
introduction,
thanks
to
the
community
a
bit
the
job
for
giving
us
the
opportunity
presented,
the
results,
our
independent
review
of
the
code,
the
security
of
the
ursa
library,
as
keven
mention
my
name
and
pierre
roberge,
general
manager
and
founder
of
the
lab
from
canada's
digital
I,
would
like
to
inform
you
that
the
environment.
This
event
is
recorded
and
I
will
ask
you
to
keep
your
questions
at
the
end.
We
will
take
the
questions
at
the
end.
Please
so.
A
A
We
go
today
we
will
do
a
brief
intro
of
the
digital
identity
lab
we'll
do
a
brief
intro
of
haye
for
the
duration
of
their
ca.
After
that,
we'll
focus
on
the
genesis,
the
door
and
the
process
that
led
to
the
implementation
of
this
code
review
and
we
will
share
with
you
the
summaries
of
the
conclusions.
The
meeting
today
is
really
for
elected
officials
really
made
for
art
enthusiasts
rogers
loans,
practitioners,
an
identity,
decentralized
where
people
who
are
responsible
for
projects
in
digital
identity,
I
invite
you
is
a
blog
that
has
been
written.
A
A
Of
an
information
technology,
security
practitioner
or
a
cryptographer,
I
warn
you.
I
am
not
a
crime,
a
cryptographer
and
I
believe
you
will
have
a
lot
more
fun
reading
the
detailed
report
that
was
produced
that
was
shared
by
the
lab
to
the
community
and
that's
the
case.
First,
the
qr
code
at
the
bottom
right.
That's
an
e
report,
n
english!
This
is
a
detailed
report.
A
A
Then
about
the
digital
identity,
laboratory,
the
digital
identity,
laboratory
of
canada
is
a
canadian
organization
which
is
non-profit,
which
is
which
exists
to
promote
the
'
digital
identity.
Adoption
a
way
to
promote
digital
identity.
Adoption
has
progressed
from
digital
trust.
It's
since
compliance
and
interoperability
efforts
to
a
digital
identity.
The
lab
is
technologically
not
one
is
not
a
laboratory
to
be
the
lab
point
day
of
the
w3c.
A
I
think
we
recognize
that
there
are
going
to
be
different
technologies,
different
standards
that
are
going
to
be
used
depending
on
the
codes
of
use
depending
on
the
places
of
use,
but
there
so
the
market
will
decide
destruction
which
are
the
most
appropriate,
which
are
the
muses
implemented.
But
the
laboratory
is
there
to
support
compliance
efforts.
Interoperability.
A
It
is
not
enough
to
say
that
our
wireless
technology
of
time
in
the
standard
x,
y
or
z,
the
laboratory,
is
there
as
a
neutral
actor
trusted
actors
to
ensure
compliance
of
the
implementation,
a
formula
that
we
see
in
others
in
other
industries
such
as
telecommunications
payments,
therefore
the
identity
laboratory,
but
that
we
are
unique
in
our
focus
to
ensure
that
our
digital
identity,
but
the
way
the
operating
model
the
service
offer
we
make.
We
see
it
in
others.
In
d.
A
Other
industries
I
think
it's
important
to
note
that
the
lab
works
with
public
sector
actors,
acts
of
private
sector
actors.
We
work
with
technology
buyers
in
digital
identity.
We
work
with
digital
identity
technology
providers,
so
we
see
end
to
end
on
that
side
and
we
have
cooked
our
efforts
in
the
laboratory.
Today,
for
a
little
over
two
years
with
about
12
employees
like
it's
mentioned,
we're
based
in
canada.
Finally,
I
reinforce
the
point
that
the
laboratory
doesn't
have
an
incubator
and
we
don't
develop
digital
identity
solutions
at
the
age
of
9.
A
So
I
think
it's
important
today,
hui
to
put
in
context
pro.
Probably
many
of
you
are
jo
for
a
good
part
of
you
will
be
common
to
be
there
playing
hard.
What
does
it
feel,
but
just
in
case
for
to
put
update
everyone
present
today?
I
think
it
might
be
interesting
and
necessary
to
do
a
brief
introduction
from
deputy
yves
bur
gosh
for
the
jet
set
a
multi
project,
open
source
tech,
stack,
focus
ent,
mainly
on
blockchain
technologies
and
the
tools
associated
with
it.
There
is
a
truce,
the
technology
is
for
the
games.
A
It
is
used
a
lot
in
digital
identity
projects
through
a
number
of
its
sub-projects.
We
can
talk
later.
Ursa
is
the
cryptographic
library
share?
It's
a
repository
library
which
is
optional
for
the
different
projects,
but
that's
where
they
have.
We
find
there
all
the
security
cryptography
functions
of
the
different
smaller
projects
and
that
andy
harries
manufactures
and
such
there
are
many
advantages
of
having
a
shared
library
module
library
for
cryptography.
One
can
think
of
several
advantages
as
a
link.
Reduction
of
duplicates
cryptography
implementations
are
notoriously
notoriously
difficult
to
implement.
A
Well,
so
to
do
it
just
one
times
to
do
in
a
place,
it
becomes
a
little
bit
easier
to
be
able
to
leave,
manage
encryption,
implementations,
avoiding
duplicates
and
additional
work,
and
the
main
advantage
is
to
have
a
single
library
to
have
all
the
cryptography
in
one
place.
It
also
facilitates
security
code
review.
It
is
a
single
place
can
check
and
it
allows
the
cryptography
team
to
the
security
team
to
focus
on
on
the
libraries
instead
of
all
the
other
lines
of
code
of
the
different
projects.
A
Finally,
the
third
advantage
we
can
see
there
having
a
hybrid
security
is
on
a
certain
cross-platform
interoperability.
If
we
have
two
projects
that
use
the
same
encryption
library,
we
simplify
interoperability
between
the
platforms,
because
the
cryptographic
verification
will
imply
that
the
same
implementation
of
the
protocol
and
effect
on
both
sides.
So
it
does
not
become
a
question.
Father
skill
inside
the
projects
after
the
jos
inside
the
projects
using
this
trailer
urso
ultimate
hands
having
a
security
library
makes
it
easier
to
start
new
projects.
A
A
So
the
genesis
of
our
beautiful
project,
the
adoption
of
digital
identity,
is
accelerating
around
the
world.
That's
I
think
it's
clear.
Canada
is
home
to
a
number
of
such
projects
that
are
led
by
both
public
and
private
sector
organizations
technology
and
for
the
ols.
It
is
contemplated
in
many
of
the
projects
that
we
see
rolling
out
in
canada
and
it
is
not
going
to
finds
its
genesis
in
part
in
the
due
diligence
process
required
for
eventual
use.
The
technology
is
for
the
jo
in
productionio
n.
We
have
three
provinces
today
in
canada
which
have
publicly.
A
A
These
three
provinces,
together,
I,
believe,
represents
more
than
70%
of
the
population
in
canada,
so
it
is
important
and,
as
the
province
is
organized,
the
1st
wins
to
work
on
the
technology
uses
spring
technology
to
support
the
digital
identification
project.
It
became
important
to
be
able
to
guarantee
that
the
cryptography
had
been
done
well,
that
we
can
only
say
that
the
best
practices
were
in
place
in
the
development
of
this
library
there
to
ensure
precisely
the
security
and
protection
of
information
of
the
different
organizations,
even
in
history,
so
the
best
practices.
A
What
was
already
in
place
within
the
team
ipe
slider
to
ensure
proper
generic
quality
and
safety.
But
there
was
no
independent
public
review
that
had
been
that
had
been
done.
So
the
certain
organizations
I
mentioned
mentioned
provinces
and
within
an
industry
organization,
private
interac.
We
see
the
logo
here
have
retained
the
laboratory
services
to
carry
out
this
safety
review.
A
I
want
to
do
a
quick
parenthesis
on
privacy
by
design
privacy
by
design
c
is
a
cave
or
kahn.
Who
created
this.
She
is
an
ontarian.
Is
the
reason
why
I
talk
about
it.
I
talk
about
it
for
two
ra.
Let's
first
of
all,,
privacy
by
design
is
reflected
in
a
growing
number
of
projects
of
new
initiatives
that
we
find
in
canada,
and
the
reason
is
another
aspect
to
prove.
If
necessary,
it
is
the
spirit
of
trust,
but
checks
in
English.
We
say,
therefore
explain
trust
but
checks.
A
A
It's
in
the
code,
it's
open
the
other
important
aspect
who
it
is,
who
another
of
the
benefits
that
the
actors
see
in
it
is
through
with
a
community
that
shares
its
values.
P,
ovinces,
where
the
actors
who
those
who
have
supported
the
code
review
benefit
from
the
work
that
has
been
done
in
open
source.
They
want
to
give
back
to
the
community
want
to
bring
improvements
to
the
codes
and
mn
a
certain
a
certain
when
I
am
looking
for
a
certain
maturity
in
the
implementation.
They
want
socialize,
the
community.
A
So
from
the
beginning,
in
this
spirit
of
collaboration
of
community
contributions,
the
sponsors
of
the
project
are
expected
to
make
available
sition
a
report
that
is
presented
to
you
today,
which
is
considered
a
public
good
and
to
ensure
that
the
and
the
results
benefit
the
whole
community.
So
that
I
am.
We
are
very
happy
laboratory
very
happy
to
be
here
today
the
able
to
share
the
results
of
this
to
of
the
study.
A
A
The
scope,
yes,
that's
it
the
door
and
the
scope
of
the
code,
so
the
scope
first,
there
is
a
review
of
the
red
code
review
and
I
leave
myself
to
ddd
some
different
ways
that
we
have
that
a
few
ways
that
it
was
looked
at
may
1st.
There
are
entry
points
to
it's,
a
library,
it's
a
function,
library,
so
many.
A
There
are
many
entry
points,
because
the
most
important
part
of
the
functions
are
brought
public
and
also
that
bisons,
which
are
also
present,
and
that
one
is
able
to
reference
and
from
a
client
code
just
to
give
figures
of
the
entry
points
and
surroundings
of
the
connections
years
there
at
about
138
and
arras
links.
There
are
above
2732
so
that
's
all
entry
points
that
have
been
reviewed
that
have
been
analyzed
to
ensure
that
best
practices
have
been
followed
to
ensure
that
it
does
not.
A
There
is
no
logic
problem
and
and
ratchet
and
one
day,
I
continue
with
the
points.
We
also
wanted
to
review
the
coding
standards
we
wanted
to
validate
and
evaluate
the
coding
standards
used
for
the
implementation
in
the
code.
There
is
a
review
of
the
cryptography
of
key
management,
including,
but
not
limited,
to
the
generation
of
random
standards,
the
generation
of
keys
the
signatures,
the
verification
of
identification
of
possible
backdoors
there
is
also
attention,
was
also
brought
immediately
kg
to
the
transfer
of
data.
A
It
is
part
of
an
examination,
however,,
as
it
is
a
library,
data
storage
is
usually
the
responsibility
of
the
client
code,
which
sums
up.
We
looked
at
how
the
cash
was
and
is
managed.
There
was
a
review
of
es
cob
in
and
security
episodes
to
make
sure
all
and
then
integrity
review
all
episodes,
because
the
code
is
open.
A
So
you
have
there
be
possible
modifications
of
entry
points
which
can
create
any
modification
entry
points
that
can
be
done
by
developers.
So
it
was
important
to
see
how
the
and
looting
and
had
been
had
been
secured
had
been
implemented.
Looked
for
coding
issues,
including
if
they
had
management
issues,
memory,
concurrency
issues,
exceptions
detected.
A
At
the
level
of
the
cryptography
review,
there
was
an
evaluation
of
the
cryptography
for
gar
antir,
the
use
that
the
use
the
cryptography,
which
has
been
implemented,
the
safe
ones
that
include
an
examination
of
the
entropy
and
an
examination
of
the
seas
practical
everywhere
and
particularly
at
the
level
of
the
length
describes.
The
use
of
the
curves,
which
are
which
are
acquired,
are
weak
in
the
free,
and
it
is
important
to
note
that
the
mathematical
foundations
of
the
different
cryptography
was
not
part
of
the
code
review.
So
there
are
bbs.
A
Algorithms
more
is
at
terra,
who
we
look
at
how
the
algorithm
is
described
publicly
and
we
make
sure
that
the
way
the
algorithm
as
developed,
such
as
the
mathematics
they
developed,
represented
it
that
the
code
implementation
followed
that
implementation
there.
But
there
is
no
judgment.
There
is
not
an
evaluation
of
the
academic
king
that
was
done
to
know
if
this
is
so.
If
the
algorithm
itself,
the
mathematical
foundations
of
the
game,
was,
is
enough,
so
I
just
wanted
to
check
that
a.
A
The
first
step
was
to
define
the
scope
of
the
review.
The
second
step
is
to
identify
it
know
what
the
code
of
the
version
of
the
code
that
will
be
used
by
the
journal.
So
we
used
version
0.3
point
7
follows
the
review
of
the
code.
Women,
then
the
validation,
the
planning
of
their
mediation,
is
carried
out
in
partnership
with
the
community.
So
we
have
identified
potential
problems.
These
problems,
the
they
are
evaluated
in
terms
of
impact,
and
once
we
did
this
work,
we
hired.
A
We
had
had
communications
with
the
community
and
for
the
double
to
make
sure
that
we
were
all.
We
all
had
the
same
reading
the
information
and
to
begin
planning
possible
remediation
efforts.
So
we
are
working
with
representatives
in
the
next
few
days,
a
drinking
establishment
world.
We
have
been
working
with
representatives
from
ursa,
I
v
ais
go
tomorrow.
They
helped
us
a
lot
rhythm,
gomery,
mike
ward,
camara
and
nintendogs,
the
digital
identity
lab
and
women,
as
soldiers
heroine
also
part
participated
in
this
work
once
the
validation,
the
planning
of
the
parties.
A
We
looked
for
the
measures
of
the
rectifications,
so
the
worst
case
scenario
found
a
major
problem
without
having
an
answer
without
having
a
plan
for
is
able
to
remedy
this
problem
it
could,
it
could
have
arisen,
it
could
have
caused
problems
to
support
it,
certain
actors
who
want
them
production
so
of
them
there
were
rectification,
measures
that
were
put
in
place
and
that
was
done
with
the
ursa
community.
And
finally,
today
we
are
in
a
little
bit
in
this
phase
report
and
communication
of
what
is
it
that
we
did
as
we
do.
A
A
Firstly,
I
start
again
by
saying
that
the
consensus
at
the
level
of
categorizing
problems
with
the
community
and
in
putting
in
place
remedial
plans
and
in
putting
in
place
remedial
plans
that
remediate
with
the
community
more
often
than
not
this
remediation
there
only
for
problems
that
were
identified,
then,
wouldn't
like
them
all
today,
but
that's
what
the
way
it's
gonna
be
done
is
there
were
bugs
and
kate
that
went
through
the
workflows
normal
the
community
to
solve
these
problems
there.
So
it
is
the
community.
We
identify
a
problem.
The
community
takes
impregnable.
A
In
the
main
categories
of
the
observations
that
have
been
made,
one
of
the
categories
are
really
at
the
level
at
the
level
of
the
warning
at
the
level
of
the
compilation
of
the
library.
If
we
do
not
have
an
environment
which
is
safe
for
compilation,
but
that
we
can
not
guarantee
that
the
result
of
this
library,
the
lsn
so
I
think
it
is
important
to
understand,
to
understand
that,
and
we
made
some
observations
in
the
report-
another
another
precaution
at
the
level
of
the
compilation.
It
is
the
dependence
on
third-party
libraries.
A
A
Technically,
the
implementation
does
not
always
check
that
a
signature
is
an
element
of
a
subgroup,
so
it
is
a
low
severity,
but
it
is
something
that
has
been
identified.
There
is
also
the
verification
of
public
clips,
which
is
not
always
carried
out.
That
must
always
be
explicit,
for
example,
in
the
module
the
bls
cursors.
There
is
no
explicit
verification
of
public
credits.
It
could
cause
a
problem
because
the
key
was
revoked.
We
will
be
in
power
and
that
pushes
to
create
a
chain
like
that
creates
issues.
A
It's
something
that
had
been
identified
in
the
past,
but
for
performance
reasons,
hadn't
been
done
explicitly,
so
we
brought
it
back
to
the
community
community.
You
develop
an
explicit
verification
as
soon
as
the
public.
The
library
does
not
do
it
on
behalf
of
the
developer,
on
behalf
of
the
application
so
ways
to
solve
this
problem
there.
But
it
was
this
aspect
there
was
identified
and
the
community
at
jump
is
committed
to
reviewing.
A
There
was
no
better
way
or
a
different
way
of
resolving
this
situation
there,
one
to
the
problems
that
were
identified,
plus
the
surprise
in
there
was
a
problem
with
the
tooth.
A
way
to
break
the
'indissociability
of
the
mixer
identity
and
if
we
have
a
key
that
is
malicious,
a
certificate
that
is
malicious
from
an
issuer.
It
would
be
possible
between
an
issuer
if
there
is
collusion
between
an
issuer
and
a
verifier
to
be
able
to
extract
information.
A
So
that's
a
certain
it's
a
strength
and
a
weakness.
There
is
a
research
group
that
has
been
set
up
to
rectify
the
problem,
and
solutions
have
been
identified:
s
for
precisely
the
rectifies.
This
problem
there
high
level
of
leader
and
acting
etc,
on
which
it
is
a
problem.
It
is
a
low
gravity,
but
are
a
sound,
a
transmitter
which
is
malicious
and
are
with
collusion
with
the
verifiers.
A
With
this,
when
it
would
be
possible
to
compromise
the
coast
and
the
protection
of
the
privacy
of
a
user
I
invite
you
to
see
the
detailed
report
for
the
complete
list
of
the
things
that
have
been
identified.
I
have
just
named
a
few
here:
I
have
not
shared
all
the
details.
There
is
a
complete
list
that
has
been
done.
They
are
all
the
severity
of
ddd
trap,
the
problem
identified
and
document
them.
The
remediation
plan
and
documented
so
I
very
very
strongly
urge
you
to
review
the
detailed
report.
A
A
I
would
like,
if
the
main
contributors
to
the
independent
review
I
want
to
mention
we
are.
We
have
worked
a
lot
with
the
orson
community
to
work
a
lot
and
that
the
community
for
the
hard
way,
but
I
would
like
to
take
the
time
to
thank
the
independent
contributors
to
the
review,
so
we're
talking
about
hooch
giveaway,
we're
talking
about
matthew,
barker,
justin,
gage,
the
picks
and
francis
a
bruce
dali
and
past
twelve
months.
A
If
you
have
any
level
specific
questions,
it's
hard
g1k.
First
in
the
presentation,
it's
first
the
discord
server
for
that
it's
in
English,
but
it's
the
sea
place
to
ask
your
questions.
It's
the
common
to
the
famous
of
people
who
deal
of
the
library.
So
if
you
have
specific
questions
at
the
level
of
the
implementation
of
the
use,
I
invite
you
to
present
your
questions
on
the
descordes
server.
A
Thank
you
for
having
p
laugh
the
time
to
participate
today
in
the
presentation.
Thank
you
for
watching
video.
We
will
play
the
rsa
first
of
the
glass,
their
detailed
reports,
and
we
will
take
the
questions
now.
I
remind
you
that
I
am
not
a
cryptographer,
but
if
you
want
we're
going
to
take
questions
today,
if
you
want
to
send
me
questions,
you
can
do
it
by
email.
My
email
address
is
pierre
points.
Roberge
@
idée
lab
points,
so
we're
going
to
take
questions
now.
If
we.