Summary
This document is a technical report detailing the implementation review of the Auditable Key Directory (AKD) library conducted by NCC Group for Meta Platforms. The review, initiated in August 2023, focused on the AKD library's functionality, which provides an append-only directory of public keys associated with user accounts and a framework for cryptographic validation. The evaluation was performed remotely by three consultants over a two-week period, totaling 20 person-days. The review identified several findings, including one medium severity and eight low severity issues, all of which were addressed by Meta following the review. The report outlines the scope of the evaluation, which primarily targeted cryptographic primitives, and discusses limitations regarding non-cryptographic performance optimizations. Recommendations for future improvements include maintaining up-to-date external dependencies and enhancing testing of public API functions. The report concludes with a table summarizing the findings and their statuses.
