Skip to content

Adding audit report link #420

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kevinlewi merged 1 commit into from
Nov 15, 2023
Merged

Adding audit report link #420

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 2 additions & 6 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,4 @@
[workspace]

members = [
"akd",
"akd_core",
"examples",
"xtask",
]
members = ["akd", "akd_core", "examples", "xtask"]
resolver = "2"
7 changes: 7 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,13 @@ Top-Level Directory Organization
| `xtask` | | Used for running the code coverage pipeline. |


Audit
-----

This library was audited by NCC Group in August of 2023. The audit was sponsored by Meta for its use in [WhatsApp's key transparency deployment](https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/).

The audit found issues in release `v0.9.0`, and the fixes were subsequently incorporated into release `v0.11.0`. See the [full audit report here](https://research.nccgroup.com/2023/11/14/public-report-whatsapp-auditable-key-directory-akd-implementation-review/).

Contributors
------------

Expand Down
14 changes: 7 additions & 7 deletions akd/src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -403,12 +403,12 @@
//! ## Configurations
//!
//! This library supports the notion of a [Configuration], which can be used to customize the directory's cryptographic operations. We provide
//! two default configurations: [WhatsAppV1Configuration] and [ExperimentalConfiguration].
//! two default configurations: `WhatsAppV1Configuration` and `ExperimentalConfiguration`.
//!
//! - [WhatsAppV1Configuration] matches the configuration used for Whatsapp's key transparency deployment
//! - [ExperimentalConfiguration] is the configuration which matches the main branch deployment for AKD
//! - `WhatsAppV1Configuration` matches the configuration used for Whatsapp's key transparency deployment
//! - `ExperimentalConfiguration` is the configuration which matches the main branch deployment for AKD
//!
//! An [ExperimentalConfiguration] implements domain separation for its hashing operations by the specifying of a struct that
//! An `ExperimentalConfiguration` implements domain separation for its hashing operations by the specifying of a struct that
//! implements [DomainLabel]. For example, to set the domain label as `"ExampleLabel"`, we define the struct [ExampleLabel] as:
//! ```
//! #[derive(Clone)]
Expand All @@ -427,8 +427,8 @@
//! This crate supports multiple compilation features:
//!
//! Configurations:
//! - `whatsapp_v1`: Enables usage of [WhatsAppV1Configuration]
//! - `experimental`: Enables usage of [ExperimentalConfiguration]
//! - `whatsapp_v1`: Enables usage of `WhatsAppV1Configuration`
//! - `experimental`: Enables usage of `ExperimentalConfiguration`
//!
//! Performance optimizations:
//! - `parallel_vrf`: Enables the VRF computations to be run in parallel
Expand All @@ -442,7 +442,7 @@
//!
//! Utilities:
//! - `public_auditing`: Enables the publishing of audit proofs
//! - `serde_serialization`: Will enable [`serde`] serialization support on all public structs used in storage & transmission operations. This is helpful
//! - `serde_serialization`: Will enable `serde` serialization support on all public structs used in storage & transmission operations. This is helpful
//! in the event you wish to directly serialize the structures to transmit between library <-> storage layer or library <-> clients. If you're
//! also utilizing VRFs (see (2.) below) it will additionally enable the _serde_ feature in the ed25519-dalek crate.
//! - `runtime_metrics`: Collects metrics on the accesses to the storage layer
Expand Down