Add references to security response process (#2077)

* Add link to security response process [skip ci]

Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
* Add security support info to PLATFORMS.md [skip ci]

Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
* Add SECURITY.md to Doxyfile

Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
* Fix links for Doxygen

Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
---------

Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>

diff --git a/PLATFORMS.md b/PLATFORMS.md
index 1c2cfceea90c77eeffac007244d4d788fc14395f..2f750ebb25cb40073c3320518e67d9ae748ba5ec 100644 (file)
--- a/PLATFORMS.md
+++ b/PLATFORMS.md
@@ -10,6 +10,8 @@ This classification is roughly based on the [rust platform support tier classifi
 
 Tier 1 targets can be thought of as "guaranteed to work". The CI system builds and tests binary versions for each tier 1 target to make sure any change does not negatively affect those platforms. Platform-specific build documentation must exist. Tier 1 targets marked with a dagger (†) are additionally tested for constant-time behaviour. The CI system contains automated constant-time testing for each of these starred targets, and all failures are documented in the `tests/constant_time` directory. IMPORTANT: This does not mean that constant-time behaviour is guaranteed on these targets, or that non-constant-time behaviour is limited to documented exceptions. It does, however, mean that `liboqs` developers should track constant-time issues on these platforms.
 
+Tier 1 platforms are also prioritized for security support, as per the [OQS security response process](https://github.com/open-quantum-safe/tsc/blob/main/security/response-process.md).
+
 ### Tier 2
 
 Tier 2 targets can be thought of as "guaranteed to build". The `liboqs` CI system contains builds for each tier 2 target; testing may or may not be available (typically depending on CI system platform availability). Therefore, tier 2 targets often work to quite a good degree and patches are always welcome! Tier 2 targets may also have known deficiencies caused by a lack of expertise to fix those on a given platform. Again, help and PRs to move platforms from tier 2 to tier 1 are always welcome.

diff --git a/README.md b/README.md
index 0fa5c5a9ae498f727af3b6c4daf24124f25a3749..8c898a953209b53f990e8a355905733cc2da3aea 100644 (file)
--- a/README.md
+++ b/README.md
@@ -88,6 +88,8 @@ We realize some parties may want to deploy quantum-safe cryptography prior to th
 
 **WE DO NOT CURRENTLY RECOMMEND RELYING ON THIS LIBRARY IN A PRODUCTION ENVIRONMENT OR TO PROTECT ANY SENSITIVE DATA.** This library is meant to help with research and prototyping.  While we make a best-effort approach to avoid security bugs, this library has not received the level of auditing and analysis that would be necessary to rely on it for high security use.
 
+Please see [SECURITY.md](SECURITY.md#security-policy) for details on how to report a vulnerability and the OQS vulnerability response process.
+
 #### Platform limitations
 
 In order to optimize support effort,

diff --git a/SECURITY.md b/SECURITY.md
index 4dcdca3db0da4030bab5b9ccc5c9abf1557970e9..c885f9065496c032e6c88d2be454305a8ba90fb0 100644 (file)
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -4,7 +4,7 @@
 
 We only support the most recent release.
 
-Using any code prior to 0.10.1 is strongly discouraged due to a [known security vulnerability in Kyber](https://github.com/open-quantum-safe/liboqs/releases/tag/0.10.1).
+Using any code prior to 0.12.0 is strongly discouraged due to a [known security vulnerability in HQC](https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-gpf4-vrrw-r8v7).
 
 | Version | Supported          |
 | ------- | ------------------ |
@@ -29,3 +29,7 @@ The following types of attacks are outside the scope of our threat model:
 Mitigations for security issues outside the stated threat model may still be applied depending on the nature of the issue and the mitigation.
 
 (Based in part on https://openssl-library.org/policies/general/security-policy/index.html)
+
+## Security Response Process
+
+Security reports for liboqs will be handled in accordance with the [OQS security response process](https://github.com/open-quantum-safe/tsc/blob/main/security/response-process.md).

diff --git a/docs/.Doxyfile b/docs/.Doxyfile
index a4e173ecf46e9afe958f9e6bce092e9e13afce50..a52b9685b8a38643d64c7ef92bb9a7b813145ca5 100644 (file)
--- a/docs/.Doxyfile
+++ b/docs/.Doxyfile
@@ -960,6 +960,7 @@ INPUT                  = src/common/aes/aes_ops.h \
                          src/sig_stfl/sig_stfl.h \
                          README.md \
                          CONFIGURE.md \
+                         SECURITY.md \
                          CONTRIBUTORS
 
 # This tag can be used to specify the character encoding of the source files

diff --git a/scripts/run_doxygen.sh b/scripts/run_doxygen.sh
index 3faa64cf75ff59568802f1f673862a3bd9f2e03d..42b81f944269444ab620bff5ad2ac23c7951a0e7 100755 (executable)
--- a/scripts/run_doxygen.sh
+++ b/scripts/run_doxygen.sh
@@ -8,10 +8,11 @@ if [ "$#" -ne 3 ]; then
 fi
 
 # Doxygen can't handle Github Markdown so we temporarily reformat it
-cp README.md README.md-orig
-python3 scripts/doxyfy.py README.md-orig README.md
-cp CONFIGURE.md CONFIGURE.md-orig
-python3 scripts/doxyfy.py CONFIGURE.md-orig CONFIGURE.md
+for file in README.md CONFIGURE.md SECURITY.md
+do
+       cp $file $file-orig
+       python3 scripts/doxyfy.py $file-orig $file
+done
 
 # run doxygen:
 mkdir -p "$3/docs"
@@ -19,7 +20,9 @@ env DOXYGEN_DESTIONATION_DIR="$3/docs" "$1" "$2"
 EXITCODE=$?
 
 # undo the Github Markdown reformatting
-mv README.md-orig README.md
-mv CONFIGURE.md-orig CONFIGURE.md
+for file in README.md CONFIGURE.md SECURITY.md
+do
+       mv $file-orig $file
+done
 
-exit ${EXITCODE}
\ No newline at end of file
+exit ${EXITCODE}