00:14:00 <br-m> <ofrnxmr:xmr.mx> @jeffro256: Yeah. I thought i was remembering wrong. When running out of inputs, it would do random numbers. Thanks for correction
06:36:26 <DataHoarder> specific implementation Bulletproofs bug in Beam https://beam.mw/blog/news/hardfork-six
08:35:30 <sech1> Not applicable to Monero?
08:52:42 <DataHoarder> no
13:38:00 <br-m> <rucknium> Thanks DataHoarder  . This section caught my eye:
13:38:00 <br-m> <rucknium> > This was a very difficult vulnerability to discover, and it is worth noting that before the release of its mainnet in 2019, Beam code underwent security audits by several companies, which did not identify it:
13:38:00 <br-m> <rucknium> > Kudelski
13:38:00 <br-m> <rucknium> > Least Authority[... more lines follow, see https://mrelay.p2pool.observer/e/wd7J25QLYXhVXzdV ]
13:38:40 <br-m> <rucknium> I don't know if the bulletproofs part would have been in-scope for any or all of those audits.
13:38:53 <DataHoarder> (AI review did find a similar bug on my original BP implementation)
13:39:20 <br-m> <rucknium> In Go?
13:39:23 <DataHoarder> yes
13:39:39 <DataHoarder> not BP+, it was in some untested part for generating proofs
13:40:08 <DataHoarder> In this case the transcription being done at the wrong time with wrong parts requires in-depth knowledge about how BP works, plus what could go wrong, plus novel ways of attacking it
13:40:56 <DataHoarder> which The AI (TM) doesn't do as well, it's good at finding more samples of know issues or documented methods, but not novel ways or approaches
13:41:35 <br-m> <rucknium> IIRC, a few years ago Sarang (IIRC) caught a bulletproofs implementation bug that affected several codebases. I wonder how that bug compares to this one.
13:42:23 <br-m> <rucknium> Back then, the write-up said "only someone intimately familiar with bulletproofs would have seen this" or something like that. I think.
13:44:49 <DataHoarder> I used the BP+ proof generation in Go (and CLSAG) the other day to make the sweep tx that the normal wallet couldn't do, so at least that's good and accepted :)
13:44:59 <DataHoarder> Hmm, I only find the other audit results
13:45:36 <DataHoarder> https://blog.quarkslab.com/security-audit-of-monero-bulletproofs.html this also lists a few specific issues on areas that got used by BP, not BP itself
13:49:40 <br-m> <rucknium> This one: https://blog.trailofbits.com/2022/04/13/part-1-coordinated-disclosure-of-vulnerabilities-affecting-girault-bulletproofs-and-plonk/
13:51:16 <br-m> <rucknium> Maybe Sarang didn't initially discover it.
13:53:22 <DataHoarder> that link describes the issue that affects beam too :)
13:53:51 <br-m> <rucknium> Is it really the same issue?
13:55:18 <DataHoarder> but it's also wide/generic, it just mentions the class of vulnerabilities
13:55:27 <DataHoarder> maybe https://blog.trailofbits.com/2022/04/15/the-frozen-heart-vulnerability-in-bulletproofs/ ?
13:55:34 <DataHoarder> as the original paper had a mistake
13:55:46 <DataHoarder> (this is one of the later parts mentioned on your link)
13:56:41 <DataHoarder> they define "Frozen Heart vulnerability" as any vulnerability that allows forging of proofs due to bad inclusion of values on the transcript/challenge
13:58:18 <DataHoarder> so the "general process to forge" is out there, but not the specifics.
14:14:44 <br-m> <ofrnxmr:xmr.mx> didnt he find it when implementing monero bps, meaning our version never had the issue due to his design choice > <@rucknium> IIRC, a few years ago Sarang (IIRC) caught a bulletproofs implementation bug that affected several codebases. I wonder how that bug compares to this one.
14:16:34 <br-m> <sgp_> "hold my beer" > <@rucknium> Thanks DataHoarder  . This section caught my eye:
14:17:43 <br-m> <sgp_> I provided the prompt as simply:
14:17:43 <br-m> <sgp_> > Perform an audit of the bulletproofs implementation in this Beam branch: https://github.com/BeamMW/beam/tree/beam-7.5.13882
14:18:46 <br-m> <sgp_> it found the issue in about 1 minute and has spent the rest of the time writing and testing PoCs to fully test the scope
14:19:20 <br-m> <rucknium> It found the issue after the issue was published on the internet :D
14:19:50 <DataHoarder> but before it was trained with
14:20:24 <br-m> <sgp_> nah it didn't know of this one. It found this one but missed the Bisq one from this week (the test was run after it was paused)
14:22:52 <br-m> <sgp_> fwiw this is after a month of carefully curating resources for it to efficiently have on-hand, including for bulletproofs
14:33:38 <br-m> <sgp_> - **[CRITICAL] BEAM-BP-01 — Inner-product Fiat-Shamir challenges derived before the round L/R messages → range-proof soundness break → coin inflation.** In `InnerProduct::Challenges::Init` (`core/ecc_bulletproof.cpp:476-485`) and the matching prover loop, each reduction-round challenge `x_i` is squeezed from the `Oracle [... too long, see https://mrelay.p2pool.observer/e/x7mV3ZQLOUdVb1Zp ]