Skip to content

Commit

Permalink
Merge pull request #12 from ycashfoundation/documention
Browse files Browse the repository at this point in the history
Update COPYING page and Responsible Disclosure page.
  • Loading branch information
hloo committed Jul 2, 2019
2 parents 8aab94b + e7539d7 commit c3acdeb
Show file tree
Hide file tree
Showing 3 changed files with 50 additions and 40 deletions.
5 changes: 3 additions & 2 deletions COPYING
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
Copyright (c) 2019 The Ycash developers
Copyright (c) 2016-2019 The Zcash developers
Copyright (c) 2009-2019 The Bitcoin Core developers
Copyright (c) 2009-2019 Bitcoin Developers
Expand Down Expand Up @@ -32,7 +33,7 @@ OpenSSL Toolkit (https://www.openssl.org/). This product includes cryptographic
software written by Eric Young (eay@cryptsoft.com).


Although almost all of the Zcash code is licensed under "permissive" open source
Although almost all of the Ycash code is licensed under "permissive" open source
licenses, users and distributors should note that when built using the default
build options, Zcash depends on Oracle Berkeley DB 6.2.x, which is licensed
build options, Ycash depends on Oracle Berkeley DB 6.2.x, which is licensed
under the GNU Affero General Public License.
2 changes: 1 addition & 1 deletion code_of_conduct.md
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ By adopting this Code of Conduct, project maintainers commit themselves to
fairly and consistently applying these principles to every aspect of managing
this project. Project maintainers who do not follow or enforce the Code of
Conduct may be permanently removed from the project team.

This Code of Conduct applies both within project spaces and in public spaces
when an individual is representing the project or its community.

Expand All @@ -50,4 +51,3 @@ version 1.3.0, available at

[homepage]: https://www.contributor-covenant.org
[version]: https://www.contributor-covenant.org/version/1/3/0/

83 changes: 46 additions & 37 deletions responsible_disclosure.md
Original file line number Diff line number Diff line change
@@ -1,65 +1,74 @@
This page is copyright The Electric Coin Company, 2019. It is posted in order to conform to this standard: https://github.com/RD-Crypto-Spec/Responsible-Disclosure/tree/d47a5a3dafa5942c8849a93441745fdd186731e6
This page is copyrighted by the Ycash Foundatoin, 2019. It is posted in order to conform to this standard: https://github.com/RD-Crypto-Spec/Responsible-Disclosure/tree/d47a5a3dafa5942c8849a93441745fdd186731e6

# Security Disclosures
## Receiving Disclosures

The Electric Coin Company is committed to working with researchers who submit security vulnerability notifications to us to resolve those issues on an appropriate timeline and perform a coordinated release, giving credit to the reporter if they would like.
The Ycash Foundation is committed to working with researchers who submit security vulnerability notifications to us to resolve those issues on an appropriate timeline and perform a coordinated release, giving credit to the reporter if they would like.

Please submit issues to security@z.cash, using the following PGP key:

```
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQENBFaegcoBCAC+G82ZBYYm1GoVn4dKa0WiLYD/Q+BuU89PS1X7A4eOOy8g9yS4
wJKMzB0AxFsH/t85P7pPZwHw3i2gmiJKeIqEGhEBL08D3id2u6ZyCnwDuWs0i6My
MXWTwK5shvE61ZI/KPbjemoOG6MPF5QdrouNqei2Vk+4RjbRCyyS0A59GQi2dNZX
BMwTnHnUZ5qi6T0RFelqJ3dE5Nc/UwJPdAcg71c3b3dMOHjaDBMPB6+fTLBeidV6
5B72nGO3eIYkMUNj+qCQmM/esRkmGmlDH/9WGMBOKCq7Yw3LyEoPOi5cba1m8SN2
xFlNzkUGrlVrwZMF+1UdjvN7BGDypA3Dr/STABEBAAG0JVpjYXNoIFNlY3VyaXR5
IFRlYW0gPHNlY3VyaXR5QHouY2FzaD6JATcEEwEIACEFAlaegcoCGwMFCwkIBwIG
FQgJCgsCBBYCAwECHgECF4AACgkQiPuLhti1poxlRAf/bZ6fhUby5bAbViAO4TzQ
yfbD0ksGeF8MHicPz7HqOYuXAE9GrKnVAOFptwRo94O+iRC5aXhW8OAP+38IWorv
gsAuag7Y8k0nlfNdrJRqqJpjyxtiuv+cd2o5dre8E9PVNE5IPv9qEJA4Zag3snmC
a+O4HAqKeXYddunFq2drLkTRlOwuFkGXJzwi3VSNVYCuuGyezFDuaD45ltmsXgid
jZSdnnc6L1BrEd9LVzahvFV0+fT4bNKQHQDk+f0RTnHed+m9NqAoC9K8ftPTQ/i4
5+W/dXJATztWDrJ7ZevHXGR+RAhMNsT1psvnQsJzMkUz1GMdQOtk4PfuZLGSIiTM
ErkBDQRWnoHKAQgAp+w+xsPJWFdadE6Ok1aZC0Lk1J9xU/cqX1aBlkwi5SynwOkV
Eg1xNHLJMelp13bgDjLRsvaMbsseaCVk3goNln4atNbZpqz6FoM/f8pJx52LFD0j
CFFOVUlGEF0h+KdFr+3JHI+mg+3ifXTD4Dajj4lpu8kR/FQjftcxyttByz01wLRO
sK5BDC856WzHXAJuX6TpX4sGJujzKoLXR5V0SkUopqn9g4aJGnWuNh4kyOQI6fd7
YZyPZhWDrXdgInCKAKAgq8r6hgSDMYFvmflp6+reCfeOe1VFF8q3Foio02YPIrQW
WjjH0w6nOvOKCEtxistz1sP6ZoYq4gR41LOwIQARAQABiQEfBBgBCAAJBQJWnoHK
AhsMAAoJEIj7i4bYtaaMiA4IALIy4xP/Btu86yT3b53t8cfYZddFSO8Nlg+y3EMu
1LchdSOpWgpXCvQ7d4ndWGsuBSmQ+jaRwU2UIkq2iIxf5cg63dJz9grAcF6MXCrO
t5BSowFC4m3RFaEaG6G6SjDVIA0ZEdEMFd9Gzc1ikqbVLyNuJXKmzz0evvbAJgVO
D0nht5ifwLjQxM4olvYHUwtT0wPhniH69ghFo8LQiMgncjaukDzbgANiuj07QYy/
DlzhQUsp1qZvqZnVKqUJ3lFb86b6zoqoRNiUnvP9JB2v3kLG0T39UlcXUFnZJ/4H
CDHCrwSovQRMHtoOWZijBNobO2y1d0FkUpzNlNw44Ssw0Vo=
=6GYS
mQGNBF0RxEQBDADd2HCfZ7e9zolqtWL4gJnUGRcI3x6JFZiAGrml1+a/KGbSrJgj
ySRLf1fQkhmc8xic4qXH36xK1kIYcpqZo404VPrLlDmSvVSi2kdPBe3oMGsu14K8
/0Djkz/QZOwpE8t9cJsDR9Bi5u48JSwT4bdezTDPmt7AFLnHDCPp2iskTSgAXpgG
4dLJRQdpe57eCX28Ejv2RIBE/2fGYLta66y/6EwyJbq7hp3Qy1gnQ0b2rqquD9XK
I5uwm+CM9laiLv0JtvTmRMhW3A1EfhPTl5UusGHxjmUiVDpVedTm4DXi2YGpTYNW
g9lZIycJIpJg7/74NqFdAewEll+c7YsCqlJHsGubdYqDAOH12SgvJTytfrcoz8up
VfnouaFtJ2MiVo5ZsBtxQvLj0Jkt0oEtIAXP7L9aSrQMv/PDU7Dck+bfu6ONyOyH
3oKbUsvRxIBx2HDmnt3yvdMeeizqGpgBB2Snw1/Tahh2QrtJUnKsM2ixAjM6imQS
YIzN61HfHnKtVAkAEQEAAbQbSG93YXJkIExvbyA8aGxvb0B5Y2FzaC54eXo+iQHO
BBMBCgA4FiEE1gGs5jq6fRZhyI5OjU6e0ziDVykFAl0RxEQCGwMFCwkIBwIGFQoJ
CAsCBBYCAwECHgECF4AACgkQjU6e0ziDVylPMgwAslaCaDX11YEt4zD2yF/ftkyL
wKghs4gcVMxoEqcgEKI94WzU6GsRPkae1cHh+2KuxI3Gw5i8HjVXru26VJku8z9H
/8XLMAarhVSXnlUnGKxQSZ0HNOXuy77NLL544ncrWjRuVG8xOkthkvOGJenxuJO2
ZKD2JOl4RUKb+ZIMIwmo8mc4V7IHvlGn7YkOip3VguuvNiawvoXn3q8TTm6L82B8
0d8noLUyRA/XSbopijjScPR8NG4RoPSDIBkmPBwlun/FGQKl1Nom+8b3TmTYLwgr
3C9ro7t7ZCr0Xa0wgcuXE3aJgAKSqr1J2qjKMSYp450EBVqVciZDWruPfBLNiPZx
gG3XkiX1tS8nNeg2YBSqlC396AwgR03jy03S9mw9VliUEIap14q9OdZz7seswZsN
3cvYjs3eqb26u2ejq2eQIsSr2friNZENosMT/burKf8i1QW/1pOqBzGUY1h6Mkfo
m4plOrikhuyx8GuGmjwGMxzAHCQrpNZjt/SxpNqauQGNBF0RxEQBDAC5+9boERaW
929lUF8xyxA5Io2/jQmqoSMJC3YgfdBY3G6+prVcu26loSECUsLar1Ysqcrfk4Lk
nXKEYyA7WxvQ6XMPuYpEXmGQ6IjNQaSGluWTbYCVkWPIqQaxeUdcDRKgK+fzId2D
ETvgEvE+WHi6ffOul9bwPc/kyubbPHIxOndiPVTKL6sxk0CnH1g8hHtbAwYxH2ug
TST4Fpxr6h9efesDGJslaHaGwpiXUB2GC95bXxXyxYxoj7HJZiv7s8+qLI8efc0y
6msr3znhymysSi3mVyDgsF3tSQHWA4C2aMAKcYymyZMKLi+obS9B6Z5XyG4ADFxo
RF9OaJrS+79a0UnRhCovQZr9hYwek6/3cQykbxd5Dp1/VFmI2QMB0x8ngVpSJYhW
20hJRMRW0Wn06F/5NCYXmkitTnyjbN5cCJCxeO66wEOr7o4x/8n0U4YKmW8/YgLn
ypAr7xwEAujGDQEeraicF59dHK2Tsu2L78o6n2zXeU5e9JO+AW+tMMkAEQEAAYkB
tgQYAQoAIBYhBNYBrOY6un0WYciOTo1OntM4g1cpBQJdEcREAhsMAAoJEI1OntM4
g1cpUi8L/A4qAYpp7goIftnXLMhRzXfPf8IMP+/dC+fkuQvJmMc4zgEd2o/+jRxL
k3I5ZeDAehLpVQSnrsxAfKq3MKdP6B9DrKh04jdR8aMRqwz8bbsJcXDrT9vlsQ5t
joQPRl/WtWNSR5lFB4rrtDsKI/KkXI9ioJU+0IPsTWWlLmP5AOiSLgKHjnW8NaUw
SV/+jYA54a4P0MUtOg1f1TmW1NgiFJ8tE+aDTVdf709H6sUhD47o4+8RZp8f80nO
HGL4/qo1AkvhMWzNVbJEHYn54u9hjwONN6ZlFFOEldagzJDcRMmiQapNJ3lzLhHR
YlK/G5/AizZlM2SMqUZf3hOyE/zhaQQr9u7+6ZuUwXQaRFOd04EpQAnhtCGT8SdQ
vl+YhP037cKEG9kmH+JdfQ8Cwo5yaXEa3yXcdPqCPt78RQ0GmHjnMGH4tLyfktKl
yA5HyRRZ05aCvIIfgojBwZt8OjncJ8p9kWJD61+l6yXffKL1AATGIP12hvrqonUh
TSBL4cNNGQ==
=cQ+c
-----END PGP PUBLIC KEY BLOCK-----
```

## Sending Disclosures

In the case where we become aware of security issues affecting other projects that has never affected Zcash, our intention is to inform those projects of security issues on a best effort basis.
In the case where we become aware of security issues affecting other projects that has never affected Ycash, our intention is to inform those projects of security issues on a best effort basis.

In the case where we fix a security issue in Zcash that also affects the following neighboring projects, our intention is to engage in responsible disclosures with them as described in https://github.com/RD-Crypto-Spec/Responsible-Disclosure, subject to the deviations described in the section at the bottom of this document.

## Bilateral Responsible Disclosure Agreements
## Unilateral Commitment to Responsible Disclosure

We have set up agreements with the following neighboring projects to share vulnerability information, subject to the deviations described in the next section.
We unilaterally commit to share vulnerability information with the following neighboring projects, subject to the deviations described in the next section.

Specifically, we have agreed to engage in responsible disclosures for security issues affecting Zcash technology with the following contacts:
Specifically, we unilaterally commit to engage in responsible disclosures for security issues affecting Ycash technology with the following contacts:

- security@horizen.com via PGP
- ca333@komodoplatform.com via PGP
- security@z.cash via PGP

## Deviations from the Standard

Zcash is a technology that provides strong privacy. Notes are encrypted to their destination, and then the monetary base is kept via zero-knowledge proofs intended to only be creatable by the real holder of Zcash. If this fails, and a counterfeiting bug results, that counterfeiting bug might be exploited without any way for blockchain analyzers to identify the perpetrator or which data in the blockchain has been used to exploit the bug. Rollbacks before that point, such as have been executed in some other projects in such cases, are therefore impossible.
Ycash is based on Zcash. Zcash is a technology that provides strong privacy. Notes are encrypted to their destination, and then the monetary base is kept via zero-knowledge proofs intended to only be creatable by the real holder of Zcash. If this fails, and a counterfeiting bug results, that counterfeiting bug might be exploited without any way for blockchain analyzers to identify the perpetrator or which data in the blockchain has been used to exploit the bug. Rollbacks before that point, such as have been executed in some other projects in such cases, are therefore impossible.

The standard describes reporters of vulnerabilities including full details of an issue, in order to reproduce it. This is necessary for instance in the case of an external researcher both demonstrating and proving that there really is a security issue, and that security issue really has the impact that they say it has - allowing the development team to accurately prioritize and resolve the issue.

In the case of a counterfeiting bug, however, just like in CVE-2019-7167, we might decide not to include those details with our reports to partners ahead of coordinated release, so long as we are sure that they are vulnerable.


0 comments on commit c3acdeb

Please sign in to comment.