Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(content): add implementations audits as a dedicated section in the spec #1214

Merged
merged 7 commits into from
Oct 15, 2020
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions content/appendix/audit_reports/_index.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
---
title: Security Audit Reports
weight: 4
dashboardState: wip
dashboardAudit: n/a
---

# Security Audit Reports

Security is a critical component in ensuring Filecoin can fulfill its mission to be the storage network for humanity. In addition to robust secure development processes, trainings, theory audits, and investing in external security research, the Filecoin project has engaged reputable third party auditing specialists to ensuring that the implementation of the protocol matches the spec / intent, and succesully delivers a secure network. This section covers a selection of audit reports that have been published on Filecoin's implementation.
24 changes: 24 additions & 0 deletions content/appendix/audit_reports/rust-fil-proofs.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
---
title: rust-fil-proofs
weight: 1
dashboardState: wip
dashboardAudit: n/a
---

# rust-fil-proofs

## Filecoin Proving Subsystem

Audit report: [Security Assessment - Filecoin Proving Subsystem](https://github.com/filecoin-project/rust-fil-proofs/blob/master/audits/Sigma-Prime-Protocol-Labs-Filecoin-Proofs-Security-Review-v2.1.pdf)

Date published: 28 July, 2020

This audit covers the full Proving Subsystem, including [rust-fil-proofs](https://github.com/filecoin-project/rust-fil-proofs) and [filecoin-ffi](https://github.com/filecoin-project/filecoin-ffi), through which Proof of Space-Time (PoSt), Proof of Retrievability (PoR), and Proof of Replication (PoRep) are implemented. The audit process included using fuzzing to identify potential vulnerabilities in the subsystem, each of which was resolved (the details of all issues raised and their resolutions are available in the report).

## zk-SNARK proofs

Audit report: [zk-SNARK Proofs Audit](https://github.com/filecoin-project/rust-fil-proofs/blob/master/audits/protocolai-audit-20200728.pdf)

Date published: 28 July, 2020

This audit covers the core logic and implementation of the zk-SNARK tree-based proofs-of-replication (including the [fork of bellman](https://github.com/filecoin-project/bellman)), as well as the SNARK circuits creation. All issues raised by the audit were resolved.
4 changes: 2 additions & 2 deletions content/implementations/lotus.md
Original file line number Diff line number Diff line change
Expand Up @@ -19,9 +19,9 @@ implRepos:
auditState: done
audits:
- auditDate: '2020-07-28'
auditURL: https://github.com/filecoin-project/rust-fil-proofs/blob/master/audits/protocolai-audit-20200728.pdf
auditURL: /#appendix__audit_reports__rust-fil-proofs__filecoin-proving-subsystem
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you paste a screenshot of what the dashboard looks like?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you have the preview below

- auditDate: '2020-07-28'
auditURL: https://github.com/filecoin-project/rust-fil-proofs/blob/4a07a868d077f5926b23c3f913f99d8b46b8cebc/audits/Sigma-Prime-Protocol-Labs-Filecoin-Proofs-Security-Review-v2.1.pdf
auditURL: /#appendix__audit_reports__rust-fil-proofs__zk-snark-proofs
---

# Lotus
Expand Down
4 changes: 1 addition & 3 deletions content/libraries/libp2p/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,7 @@ bookCollapseSection: true
dashboardWeight: 1
dashboardState: stable
dashboardTests: 0
dashboardAudit: done
dashboardAuditDate: '2019-10-10'
dashboardAuditURL: https://github.com/protocol/libp2p-vulnerabilities/blob/master/DRAFT_NCC_Group_ProtocolLabs_1903ProtocolLabsLibp2p_Report_2019-10-10_v1.1.pdf
dashboardAudit: wip
---

# Libp2p
Expand Down