A Dead Man's Full-yet-responsible-disclosure System

Overview

Do you worry about responsible disclosure because they could instead exploit the time-to-patch to find you and remove you from the equation? Dead man switches exist for a reason... In this talk, we present a new form of vulnerability disclosure relying on timelock encryption of content: where you encrypt a message that cannot be decrypted until a given (future) time. This notion of timelock encryption first surfaced on the Cypherpunks mailing list in 1993 by the crypto-anarchist founder, Tim May, and to date, while there have been numerous attempts to tackle it, none have been deployed at scale, nor made available to be used in any useful way. This changes today: we’re releasing a free, open-source tool that achieves this goal with proper security guarantees.

Methodology

We rely on threshold cryptography and decentralization of trust to exploit the existing League of Entropy (that is running a distributed, public, verifiable randomness beacon network) in order to do so. We will first cover what all of these means, we will then see how these building blocks allow us to deploy a responsible disclosure system that guarantees that your report will be fully disclosed after the time-to-patch has elapsed. This system works without any further input from you, unlike the usual Twitter SHA256 commitments to a file on your computer.

Video Link

DEF CON 30 - Yolan Romailler - A Dead Man’s Full-yet-responsible-disclosure System - YouTube

Event: DEFCON 30
Date: 2022.08.11
Location: Las Vegas, NV, USA
Speaker: Yolan Romailler
Topic: Distributed systems

Conclusion

This new approach to vulnerability disclosure aims to enhance security and responsible disclosure practices, addressing concerns that have persisted over time.