A Dead Man's Full-Yet-Responsible-Disclosure System
Yolan Romailler designs a cryptographic dead man's switch for vulnerability disclosure, using timelock encryption and witness networks to ensure ethical release.
Summary
The Dilemma of Vulnerability Disclosure Timelines
Security researchers facing non-responsive vendors or hostile legal threats often lack guaranteed mechanisms to ensure vulnerabilities are addressed before disclosures become public.
Designing a Cryptographic Dead Man's Switch
Yolan Romailler introduces a protocol combining secret sharing, timelock puzzles, and decentralized witness networks to create an immutable disclosure countdown.
Automating Progressive and Responsible Key Release
Romailler demonstrates how researchers can pause, extend, or permanently abort the decryption process upon successful vendor patch verification.
Legal and Ethical Implications for Security Researchers
The author discusses the legal protections, game theory incentives, and ethical safeguards built into automated disclosure systems.
Related talks
Main Stage·1 hr 47 min
Tobias · Fiddler
Tobias and Fiddler details matt Fiddler & Marc Weber Tobias: High Insecurity: Locks, Lies, and Liability Matt Fiddler leads a Threat Management Team for a Fortune 100 Organization.
Main Stage·48 min
David Mortman · Paul Proctor · Window Snyder · Ian Robertson · David Maynor · Dave Goldsmith
David Mortman and Paul Proctor explores vulnerability disclosure panel at DEF CON 15, examining vulnerability-disclosure and practical defenses.
Main Stage·50 min
Granick
Granick explores disclosure and intellectual property law 2006 - 2007 at DEF CON 15, examining vulnerability-disclosure and practical defenses.