Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update readme to reflect audit #408

Merged
merged 2 commits into from
Mar 21, 2022
Merged

Update readme to reflect audit #408

merged 2 commits into from
Mar 21, 2022

Conversation

obstropolos
Copy link
Contributor

@obstropolos obstropolos commented Mar 18, 2022

  • Updates the readme to reflect the most recent audit of ssi
  • Quick update to the badge to reflect new handle

@obstropolos obstropolos requested a review from wyc March 18, 2022 21:08
@obstropolos obstropolos merged commit f4fc478 into main Mar 21, 2022
@obstropolos obstropolos deleted the docs/audit-update branch March 21, 2022 02:53
@clehner
Copy link
Contributor

clehner commented Mar 24, 2022

ssi pull-requests related to this security assessment

The following are the fixes and partial fixes in this repo described in the Fix Log (pages 86-93) of the referenced PDF (via trailofbits/publications#186).

Finding number Finding title Page number Pull requests
1 The Tezos DID resolver accepts invalid input that can crash the program 19 #299
2 The program can crash when parsing EIP-712 types 21 #302
3 Potentially unsafe dependency on the internal representation of types from the bbs crate 23 (partial) #334
4 Potential panic when creating a new BLS key pair 24 #338
5 Tezos DID resolver does not take the network into account 26 #350
6 PassthroughDigest reduces the entropy of the output for digests that are not 32 bytes 27 (partial) #337, #385
7 HTTPS is not enforced when loading a revocation list 29 #317
8 Potential resource exhaustion when loading a revocation list 30 #339
9 JWT encoding may produce an invalid credential 31 #313
10 Issuer that is used for testing is exposed in release builds 33 #316
12 Smart contract address–based Tezos DIDs are not implemented 36 #363
14 Verifiable credentials with invalid revocation list indices are accepted by default 39 #314
17 Private key material is not cleared from memory when no longer needed 43 #327, #328, #391

In response to code quality recommendations (page 84):

  1. Address clippy errors and warnings #305 (partial)
  2. Justify use of unsafe/transmute #334
  3. Remove redundant assignment for seed boolean #306

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants