bitcoin-s/docs/security.md
2020-03-23 09:46:56 -05:00

130 lines
7.0 KiB
Markdown

---
id: security
title: Security
---
The Bitcoin-S developers take security very seriously. This library has
very few dependencies (at least in the `core` module), which is for
security reasons.
## Disclosure
If you have any security disclosures related to Bitcoin-S, please send an
email to either [stewart.chris1234@gmail.com](mailto:stewart.chris1234@gmail.com?subject=Bitcoin-S%20Security%20Disclosure),
[nadavk25@gmail.com](mailto:nadavk25@gmail.com?subject=Bitcoin-S%20Security%20Disclosure),
or [benthecarman@live.com](mailto:benthecarman@live.com?subject=Bitcoin-S%20Security%20Disclosure).
If you want to encrypt said email (which you should), Ben's key is available on [his Keybase](https://keybase.io/benthecarman/pgp_keys.asc?fingerprint=0ad83877c1f0cd1ee9bd660ad7cc770b81fd22a8), and Chris and Nadav's
are posted below:
Chris:
```
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQINBF53d98BEAC6oxrqPIN2pzd6ScJ8N48rOQS0S7QP4owXAObkXIzH0I0XawOZ
cPAAPnO1NQnTABL7XWuIYWxAeDGoe5CbZENGenKdCBDsNwB0mQuLkyUdFqADJkHQ
dAeTeuFFyifSJPGCsOcuXr25AW1QDUlfzXsWfIPib3gzonoTI8yK4D5/n6fVrrjj
6JCCQ6a0M74k85AsyJV+mBjRVbmt0vQ0egJTwLyTTCYKSOBofbv0AFPjp4b2lzrB
c+O0JkmPas2FqNFVD08S63tGjI8k2ll6WPzen8kDdt+wvJI0R3jdJO02Z1BxphA/
kGWeyfgay6LLOPy/DlSE5BPwoSaAb7R2VEEALC/JoP8pjeACCoIcekV0xWU6x2j1
G4onlPN0+GI5ybLQR5iLFY86IkhaNMy6v+s0LgUs1ZIPx8me1m+YZaY6UpYIDL8I
QA9c5nXfwZWh+htbn7dfE5UOVYr6b9uQllEaoJkms/DUa92CMaNCNvBMWRazEQqF
g6YR2hV9eR/fF7MAwyWz0p0UopAkx1SvGrrtcPq9FUNpW+fTt06eKwICES8a055W
3H8gBH2dFSWWv9GZSiQ0/6E1jfqIi42NlIdd2yYnTujIrKZt0hyxtS6eqAsokRfX
5+2zUFJZYOurQcuEsqW/Bs8Qfn5bpaspbbcL9REuEXmEwAp3OxCBUks18QARAQAB
tCtDaHJpcyBTdGV3YXJ0IDxzdGV3YXJ0LmNocmlzMTIzNEBnbWFpbC5jb20+iQJU
BBMBCgA+FiEEM5pJIpV2BQgZCD6z+Zckhy+CKRAFAl53d98CGwMFCQPCZwAFCwkI
BwIGFQoJCAsCBBYCAwECHgECF4AACgkQ+Zckhy+CKRD3sw//bcv5+kRhGXwaaQgR
CYdJFf77ZjBdoS0oEVnbLz40kWu+z/Cy7FaYBEBecGPJwjnzDb1yHEDUq+t7funi
6KBAo0HctnxoTDrpH7dIlaK7tIDxKaSM67pbZrP+AQWi6F3PsNBScTl5NrKsOTTC
Q+q2TS+X9ZmzDDlNLGMQPhPRg2ak9lkmhX7wVxOYA13c8YhirtCXipzcqpC76qKz
VjklfahNKYtFRlfiJ3ZlLdjyEXJoyIw1cDhmmNGI0hXarlUbS4P8Ux43B+x1nYv0
s3d2rM49lNU2uQ5LCb24h9ViKlm3qcJ6iba5QDaRuWwpII7mAf1PcLYSHNGR7GRx
m0iZqFzG/QuNb/mFzy2AaC8TZAQkQd0Rd7ZpKlTXoWs2yqRtM2vjjHEbwGFEZvH4
dM9vBIOrV+fL/CkjMu5ZBXkLj2oH9kYRVxnD7H2a6ZGL63nXqVCVEaPLgDdmWkgy
Wp6f1RumOjQE4nXpKfHP8xm8qKS4FAr6gB/7r1sJ4j0p7AXYA1YYP9zEFCZ3Itom
yMTLg9S8iO2Nljd3Y2fkTJpCe35ksw9X5yOV+x4PjYFGcvcDYd44vI65LyJ5j71C
YpxLUdI5a6k+YClvpT/G8PzllIR1B9m0SLYMNebvY82GzZGmDTX/3Qaxt+xZNqHz
h+NhpoPpJwNWd4RJZf7ebH6FfBC5Ag0EXnd33wEQALGFwe+Wpy1NjHy82jJHEwiK
0bJLZ/IDc6Vcn2nVYDEI4C3X+RiEQ+JZ7QZFgW8hiHFaQ40Cx3gAGPGysgPQ6pW+
42w1BiDaq3AIqBBAyYJbcc2qRLb04/BAKerfYS7KPzusUGfLXHUFHIYu/p03wOrU
VXTFA4tCOnDGQOq+R3D8JQzsGBVSbzkIkZDIgsS/e0Xpp8e/BFOcol2fQMGrUROF
QMiprL0smLpv4qjuYsVWFZd6w+7nHExmf5OndMsNBUhcYcggED8oKtotfFSzJG9Y
V0G+0yV/6dFzw5wiPkjyN80pDQdT80gEJC1JfWtTXXT+EZ6JpiRRfZyZsA/c8wXJ
rI+FscvtLWTKzKdMHv7a7gqfFOj9XbxuriZFez3DhyEIOynbjCVGX+U4Nqp7b93B
RrNPF8a9DIeVI3IdrK9NclAlHXPeZwVWPUmP3ibf9SE5Asf6dEMtZBx2MJXlHp6I
y0/pz1a8XIqVrX1H6A8QtjlA+DlWqA/RtVRPa67E96u3d5n5SyQMua9BE8h55X35
+nbIEvu2+PIjZAUAxMrJGzXzeDhHiYeZdGLQ+gu75h0x9jjdeHL3Wqf4IizTJs3R
nvri0PvxJcyheBAvjrOgViFEdMF3MFD5TVxS7Y2w0pxg+aTV0Uve4xR7LBHAeyjO
Q8A9wNXh3Pfy+M8wGA+zABEBAAGJAjwEGAEKACYWIQQzmkkilXYFCBkIPrP5lySH
L4IpEAUCXnd33wIbDAUJA8JnAAAKCRD5lySHL4IpEJnKD/9ZBlJmaIUchSsZUvgz
sas+fqHUPQWkTMHnWFfT3iQwjiQrvjENN3ys6B7sKics+ytfVGDuv1dBsuZ+oQNK
jxvpauoCQAo3me7jOIwNghSdbDtOKhr6eC2Eap+6zYSyWhFhVexww76i4Pv0/+Rw
JOU8yM9SODwWgE7GyLmcU2TPRCZPZDNUS95+3X/zWUA9cNdYR+JYGN+Vp2Ii1QVA
DSUe3DCmskdED6EtnHxmF304H5X6Ec/b2XwnC7Ug1FyMGneO96W12I2jI0Zc8icb
DD8Jra+uAk5mR4ysRv8YgE9vBfI2K2LWcN9Xs79MghZ5867Ifvgo6kmQTyd5dNCG
wYg5yjOd2pAVtIP8YuSvYqphqrykMyC8AH0mqqRqQAMT8LWo69cJGU4kVrpArA84
u9v0kAbM+LsnzSzCQxrQKeRPJNDrg28X47ANKSnqukqAQiS95uDXAEXslS8cIpgu
fqbcQubec6ZEvB59MoxoRsVZ2p2VaWFPMakR4ssdiM2Yl8XZDqhUDBQ4v0ELolj9
uqH5u5Z6JUL3NnPd4hK4LqYoIPYhgHEjriMB6cslk2dcn//8xjaH4W7Ri6Ud/Lpx
URnYhu0yULf1X6/79i1cN8WfrDexB5X1WGipNphkuPSHElBnQ2koO45I+h+PIk8K
+cOyekIHrOA3YqR2V6Ck6NjRxA==
=e/f8
-----END PGP PUBLIC KEY BLOCK-----
```
Nadav:
```
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQINBFsSA9kBEACfC4nxfmQAw8bepv4uE3v9I9hOJ63bH/DKcrslkSmxEUW6e+A9
LLqvejlRclXVcYz6D6GxHTeS1PVVqHK3++CG2QfeTIsRdG3gMt8LhamJ/m4hmPYu
5JRVjMvY2ORvO4owQcT5YSNWPMEUdK4Y6NRXPK/9mVvTIsGaiqxAoeGRgZ5TXCVV
bEPRBGY2PsVPCq4QPmw+jqQfh8tLtLj7r44kbjTGj8tO5+KDnZpM7Ed4A41LTmbR
zYmxPApRfgEZrHy5GpnvYI/EcpEBrftda1KRVCX1uhPuvHKcFy0mJ/ctJX4ocIBc
7sPbrf2WIU/FgrZgtdEjC4smRuIe/oeryuQDcHThImMLe/iehrVoYY/dgVJ05Kpq
/No/mDGpN/7S+Nylj9FZaCzbjrg3xlm/gxmwxZBRBoxH0r7MQrY8XkYKw/j+804o
fZmoWNW/aCrHpRHm+yd88AdlYEAKJv8l2AFgnXfszO0b5ax6ArZXI/zTVIFLebwn
msqCkgeZptQpzV2moMAHQiUsshyhdu8SVx6f9alRyhLbUxYyrm82Rp+4XhZxNf0w
rJUMAe7uq8c85RWhWml46jIIasx7oaG0VBRjaRlbqvfu2ST5RowKAGs36aF089MM
DHH751MSPQlTR+lCP+nxHM7t2+kFJ4VfuIy6/aOyVGLlNqEeMr/fYlQdpwARAQAB
tChOYWRhdiBLb2hlbiAoTGludXgpIDxuYWRhdmsyNUBnbWFpbC5jb20+iQJOBBMB
CgA4FiEE2HuwjJv2Vb/j2Shhnqz5XGuw42IFAlsSA9kCGwMFCwkIBwIGFQoJCAsC
BBYCAwECHgECF4AACgkQnqz5XGuw42JyUw/9HNAdcCx0ji02rBmrfVNc2EYaV5v6
t+fcHxEC4NJB2ilmtE9bxxQgLof0Yb27DTxFvG3AHfds6Xwgzh0W8caZFguaGk8m
kEIdi33lK1H3VGBzuJzIfNqd08iZppTZ+hV8gxdq5APrY3AFjQM3jNAdmVjPn6P5
GkiOWaVdqS7OnrpZmqOblQGjyB8WrIBP17lrQRN487NtaCbRTSxzqnUAyaKKzY8u
4ZHDTfogdgAaSqtJO2MLSqs/b/vwk22pThgCy0dt99eaXbrtYTP4S4OPFFPuV/23
e6BJFfSqugDPcZxE4ms0QzfZDmFS5WZrvNa03pUa4Ch8rXH7tkdpMxdKNKLL6uqy
9PA732gOxGPJLZ9ZiDcrTQX1fApnTEtUuu5pLX1U9y81+fv04wB0SRR5sggtwg2a
x+6rwvdwtx/7rM4WbqATvo1MDkA8SkbWGur06tm4yQrLI7YhNrEC91H3l8SXnIQZ
o7/LDhoW3FvvzpPfQMnNwyPV9VoKCnsS7w40rwiLTuS0xvYNZY8eSY3SgM8EtpG2
iLgW8Fnavs8lyCTrl9NFnFw7W2OEan0xpc0/N9pEC6+O+zp3Td9Qr0yhk8g7kMU/
FghEgDZay2LyiefHqQy1R/YV/GNjLJvOIADH3x7mLI/Wyk9TQvQHgnLO9ksDsp/Y
eqeDoRHfy8a8IEe5Ag0EWxID2QEQAOpM8Jz7W1sdsO7nDw29skfGG/6YX+2n/hIr
w2GgHoV5LrN3rCo/wYkfZBQK/cnHdlG7n1E1Ih5XnNIsvGb8riAeX0C6htm44QZW
XcQs1pfaOSXMjuTzRDW37lQFJDZcTPouber6jWWLuwBLu6gKHT8ihBRQxUuPoanX
NCQxGdim4MgW3PT+2BCmkoviuTDSrDlW7IY1+g5EuQTR7a5R54sEFE3evE8r92OI
HnfekX0+be9w89jZqiLZZQfgmgTBWkb/yt26AQ1StST/JsoAUkLjT3EaAhXnd9gf
bAPl5q62bqFBgis5n2GRvI+MMV6qBtscskZTp7eYHDvl4jCOebp7Yx9gXJuWiuKK
g/fQQJuQgDA6eop1BJYJdNWUUy/fA4avegDg6ZTyYhU3gckyT/84jYvDRj82SerN
3oKWjtJ03QtInlxJ/BvndibhrZKUKrGtX1BzkFGzuvehKoYdKcZcgF4ryeVY5TTB
08NoAQQ/Iy5RKdbHJg/1jMxp2z0UrND51akGpxXbfV4UBZzmJzLb7RB9SvpUe0xb
NqJT1lAiE6biybHG9O5MtpG9SjCRnXtM7Cvd1kn1o+cuF3vvxDvFmvCRJCV/s1tj
sJU6bPTusT5HZ4VWQuXD5zEBA7bvPQR89S1WjadfFOL8/cVGiMJ0567HBxg1B0yo
6XX36q59ABEBAAGJAjYEGAEKACAWIQTYe7CMm/ZVv+PZKGGerPlca7DjYgUCWxID
2QIbDAAKCRCerPlca7DjYpFhD/41PIalkLWols5959nMAxbwLS3wnSbHg6n713Df
2jdnXr7NdfJiI6Pb3aCphOcTQ8F1H9AbZlCBo9AwzzCrL9MBZNdeMF5RySYdNQS4
nlpdgaqN53zWfjewz8e9Nr8SMVeQgDhE/+wgMvxGd2NxXgtEJHQvFOOicgR+osAR
AJnQ/ajdxm57zzsTStXMt5DTAah2nCj42A5T6fcRXhOsTF3V8QVJ2T7xZLt8rjwD
Iw03W3Z/0MefvQKPHk8ywPXwbdQ7CWDq5AK3JtZtQO+uHYOhObucoJJLXXHuehRb
geJA1gW50d6iDqC7f0t+Wm2U6paNNwpIhhE8NHBHRUSIC1fFe3XYlzBieQessr7L
ilfYEo7V+5Ez6Kgjvtb7zwgN6GNv0IsilJ0lJyZ6Dj02BP8qCBY5t+0Asuc6qUVM
pIxM+DD9PAesSrzJPLwwTXRvgjfDtKjGTz5bOpF6mzMP7WcPRDbplRay+j2ta8ig
szLZeLuBGc0i9X9vliEWKbJq3aubCboQDTpYXhNzi0LiHoeDdXlBtnQiRHTU80oT
57EwGJOjD9VkyN0vhwi7fKBmpTZjR2mqVNRuQTtkW4VpUDQ74RvQTY5CmHbh9kli
LyHFHMU7bblbIp7Jc9z6qzXEHd39fAbexXtRsWKM8GiylGOLS1xotfHAPxfWaze3
yCLXAg==
=fx/l
-----END PGP PUBLIC KEY BLOCK-----
```