Reinventing Vulnerability Disclosure using Zero-knowledge Proofs

Summary: Trail of Bits and Johns Hopkins University partner Matthew Green are using zero-knowledge proofs to let vulnerability researchers prove they possess a valid exploit without disclosing it, as part of a four-year DARPA SIEVE program effort. The work aims to model processor architectures as Boolean circuits, starting with the MSP430 chip used in the Microcorruption CTF and eventually targeting x86, where a proof for an exploit taking 10,000 instructions could reach 48 gigabytes.
Key Takeaway: The disclosure standoff the article describes is concrete: researchers either stay silent while users remain at risk or disclose publicly and hand attackers a path to exploitability. A proof that demonstrates exploitability without revealing the exploit changes who holds leverage in that negotiation.

Read the original at Trail of Bits Blog ↗