Martin R. Albrecht
@malb.bsky.social
936 followers 308 following 133 posts
Cryptography Professor at King's College London and Principal Research Scientist at SandboxAQ. Erdős–Bacon Number: 6. He/him or they/them. malb.io
Cryptography Professor at King's College London and Principal Research Scientist at SandboxAQ. Erdős–Bacon Number: 6. He/him or they/them. malb.io
![A worrying trend in this area is that vendors “outsource” this process to “bug bounty” service providers. These services are based around the idea of vulnerability disclosure being financially rewarded, often in return for some form of agreement on non-disclosure. This process is unsuited to the activities considered here; both with regard to their motivation – improving security independently of financial reward – and with regard to their content – cryptographic vulnerabilities are rarely disclosed and thus the industry around vulnerability disclosures and bug bounties is inexperienced in dealing with them.
We recommend avoiding any intermediaries in the disclosure process, since they may impose their own policies with negative consequences. For example, our disclosure of the previously mentioned plaintext recovery attack against (Open)SSH was hampered by us going via the UK’s Centre for the Protection of National Infrastructure, resulting in the following notification on the OpenSSH project webpages:
The OpenSSH team has been made aware of an attack against the SSH protocol version 2 by researchers at the University of London. Unfortunately, due to the report lacking any detailed technical description of the attack and CPNI’s unwillingness to share necessary information, we are unable to properly assess its impact.[1]
[1] See https://www.openssh.com/txt/cbc.adv.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:eoakxdfddsy4p2m4liifdnki/bafkreihoychxaxc2ds2dj7lw76opso2mug4p26k5f5br5n7bfiu37sn2uy)
