OSTVIK TRUST SERVICES SECURITY BULLETIN OTS-SB-0032 · PLATFORM ROOT PQ1 · UNAUTHORIZED UPDATES Issued on behalf of the Platform Root Transition Group Wednesday · 1:00 p.m. ET · TLP:CLEAR
SUMMARY
Beginning at approximately 12:20 UTC Tuesday, an unauthorized party distributed firmware and software updates signed with the Platform Root PQ1 signing key. Since 14:16 UTC today, no unauthorized update is known to have been accepted by any device served by a participating organization.
Participating organizations should assume that the PQ1 signing key is known to parties other than Ostvik.
WHAT HAPPENED
On Monday, the Transition Group was notified of a weakness in nib 4.2.1, the FN-DSA implementation used for all signing under PQ1. A party that collected enough PQ1 signatures from the PQ1 Transparency Log could derive the signing key from them.
The weakness was corrected in nib 4.2.2 at 06:41 UTC Tuesday by the contributor who maintains the affected component. Ostvik paused signing under PQ1 at 07:00 UTC Tuesday.
The unauthorized updates carried transparency receipts that do not appear in the PQ1 Transparency Log.
WHAT HAS CHANGED
Update servers operated by participating organizations now check every receipt against the PQ1 Transparency Log and withhold any update whose receipt the log does not contain.
At 19:57 UTC Tuesday, participating organizations began distributing an update that requires every later update to carry a second signature, using ML-DSA (FIPS 204), from a key generated Tuesday at the National Institute of Standards and Technology. A device that has installed this update will not accept any update without that signature. As of 12:00 p.m. ET it had been installed on more than 1.1 billion devices.
AFFECTED DEVICES
Approximately 2.3 million devices, most of them point-of-sale terminals, accepted an unauthorized update before receipt checking was in place. A further 37,400 line devices used by electric utilities accepted one this morning, from update servers on which receipt checking had been incorrectly configured. These devices must be restored by the manufacturer or operator and should not be relied on until they are.
Devices that cannot accept a trust store update remain outside the scope of this bulletin.
NATIONAL NEWS NETWORK · THE THREE O’CLOCK HOUR · 3:04 PM ET
CRISIS AVERTED
HOLT: — those were the President’s words, from the Oval Office, a little after two o’clock. Here is more of what he said.
THE PRESIDENT: This morning an attack from overseas on the systems that run this country was detected and it was stopped. I want to thank the companies who worked through the night, the scientists at NIST, CISA, and the FBI. The crisis has been averted.
HOLT: Back with us is Dr. Alan Pruitt, former deputy CIO at the Department of Commerce. Doctor, two weeks ago you sat in that chair and told our viewers their bank was safe.
PRUITT: And the encryption held, Bill. What broke was signatures.
HOLT: Help me with the difference.
PRUITT: Encryption keeps somebody from reading your email. A signature tells you who sent it. For two weeks nobody could be sure who sent anything.
HOLT: Ostvik says two point three million devices took the bad update. Most of them cash registers.
PRUITT: Out of billions.
HOLT: That’s a lot of cash registers. And thirty-seven thousand devices on power lines, this morning.
PRUITT: Switches on poles. Nobody lost power.
HOLT: Who do we thank, Doctor? Is there a name?
PRUITT: The flaw in the software was fixed by the person who wrote it, Monday night, before anyone could use it. That’s open source working the way it’s supposed to.
HOLT: Do we know who that is?
PRUITT: It’s a username. Nobody has said.
HOLT: Dr. Alan Pruitt, thank you. It has been two weeks since the two Colorado founders disappeared. When we come back, we will ask a former FBI agent where they could be.
CRAWL: FED, FDIC, OCC TO ISSUE STATEMENT ON INTERBANK PAYMENTS AFTER THE CLOSE · DOW UP 1,140 IN AFTERNOON TRADING · AIRLINES RESTORE ONLINE CHECK-IN
BOARD OF GOVERNORS OF THE FEDERAL RESERVE SYSTEM OFFICE OF THE COMPTROLLER OF THE CURRENCY FEDERAL DEPOSIT INSURANCE CORPORATION
JOINT STATEMENT ON INTERBANK MESSAGE AUTHENTICATION For immediate release · 5:00 p.m. ET
The agencies welcome today’s announcement by the Platform Root Transition Group. The agencies have been advised that the unauthorized software updates it describes did not reach the Fedwire Funds Service or the National Settlement Service.
Effective Monday, the threshold for out-of-band confirmation set by the joint statement of Tuesday of last week is raised from $250,000 to $1,000,000.
Fedwire operating hours remain extended to 11:00 p.m. ET through Friday and return to normal on Monday.
The Federal Reserve expects to begin issuing post-quantum credentials for interbank messaging within four weeks. Institutions will be enrolled in order of settlement volume.
The agencies note that no depository institution has failed and that deposit insurance is unaffected.
This statement supersedes all prior joint statements on this subject.
CROSSWIRE.NET › /openresearch/ › PQ1 — what if the new key is worse than the old one? 164 replies
#83 dryfly_co · Wednesday 17:09 UTC From Ostvik’s bulletin: “The weakness was corrected in nib 4.2.2 at 06:41 UTC Tuesday by the contributor who maintains the affected component.”
The contributor who maintains the sampler is kolobok. It’s still the only name on that line in AUTHORS.
#84 tallgrass1974 · 17:15 UTC so the new lock had a door. i said it monday. 80 replied telling me no
#86 glassdark · 17:31 UTC No. It was a bug in how it made the randomness.
#87 tallgrass1974 · 17:33 UTC ok so the guy who wrote the bug fixes the bug the night before somebody uses the bug, and nobody knows who the guy is. you dont think thats strange
#89 glassdark · 17:40 UTC I think it’s a guy who found a bug in his own code. Happens to me twice a week.
#95 quark_soup · 18:02 UTC update, the registers at my work were in the 2.3 million. all 9 of them. corporate says cash only until somebody comes to fix them, maybe friday. my manager has been making change out of her own wallet since we opened
#103 bvanleer · 19:20 UTC Corvane engineer again. We signed our 40,000 images on 4.2.1 Monday night like I said we would. Now everything has to carry the new second signature too, so we’re signing all 40,000 again tonight, and the queue for the new key is very long because everybody else is doing the same thing. For what it’s worth I did ask on Monday whether 4.2.1 was the right version and nobody ever answered that.
#118 glassdark · 21:48 UTC dryfly, I said on Monday the signatures verified so it was fine. They did verify, which is apparently how it got past everybody. You actually went and read the AUTHORS file. I went to bed instead. Sorry about that.
#126 quietroom · 22:51 UTC 4.2.2 is signed with the same key as the original pull request. Commit time is +0000. No email.
#131 tallgrass1974 · 23:20 UTC quantum lab in colorado breaks bitcoin. two weeks later the new lock has a bug and a nobody with a fairy tale name fixes it overnight. meanwhile the colorado two are still “missing.” you all think those are three different stories
#132 glassdark · 23:24 UTC Yes.
#140 dryfly_co · 01:10 UTC I emailed security@nib-project.org and asked them to pass a thank-you on to kolobok. Same auto-reply as Monday.