Our Strategy for Vulnerability Disclosure
The topic of disclosing security vulnerabilities is complex and often debated. Some advocate for “No Disclosure,” believing that publicizing such vulnerabilities equips malicious actors with essential knowledge for conducting attacks. Conversely, proponents of “Full Disclosure” argue that making vulnerabilities known allows the public to safeguard themselves while promoting the urgency of security updates. In the realm of cybersecurity, discussions have come to focus on a balanced approach known as “Responsible Disclosure” or “Coordinated Vulnerability Disclosure.” These strategies involve initially withholding details about the vulnerability to give affected systems time to implement necessary fixes. Leading security research organizations, such as CERT/CC at Carnegie Mellon University and Google’s Project Zero, have embraced variations of Responsible Disclosure with specific timelines. This methodology has also been formalized as an international standard under ISO/IEC 29147:2018.
When it comes to the disclosure of security flaws in blockchain technologies, the scenario is further complicated since cryptocurrencies are more than just decentralized processing networks. Their value as digital assets stems from both the network’s security and the public trust in the system. While digital security can be threatened by CRQCs, public confidence may also be shaken through tactics that create fear, uncertainty, and doubt (FUD). Thus, inaccurate and speculative estimates regarding the capacity of quantum algorithms to breach ECDLP-256 can inadvertently serve as a threat to the system.
Our approach in disclosing revised estimates of resources required for quantum assaults on blockchain technology utilizing elliptic curve cryptography is guided by these considerations. Firstly, we aim to diminish the potential for FUD by pinpointing the aspects where blockchains are resistant to quantum threats and showcasing the advancements made toward achieving post-quantum security for blockchain technologies. Secondly, we substantiate our resource estimates by sharing a cutting-edge cryptographic method known as a “zero-knowledge proof.” This enables third parties to validate our claims while keeping sensitive details about potential attacks confidential.
We encourage ongoing conversations with the quantum, security, cryptocurrency, and policymaking communities to establish norms around responsible disclosure in the future.