diff --git a/README.md b/README.md index eb4dff0..5d3980a 100644 --- a/README.md +++ b/README.md @@ -850,10 +850,16 @@ utils.equalBytes(Uint8Array.from([0xde]), Uint8Array.from([0xde])); The library has been independently audited: +- at version 1.2.0, in Sep 2023, by [Kudelski Security](https://kudelskisecurity.com) + - PDFs: [offline](./audit/2023-09-kudelski-audit-starknet.pdf) + - [Changes since audit](https://github.com/paulmillr/noble-curves/compare/1.2.0..main) + - Scope: [scure-starknet](https://github.com/paulmillr/scure-starknet) and its related + abstract modules of noble-curves: `curve`, `modular`, `poseidon`, `weierstrass` + - The audit has been funded by [Starkware](https://starkware.co) - at version 0.7.3, in Feb 2023, by [Trail of Bits](https://www.trailofbits.com) - PDFs: [online](https://github.com/trailofbits/publications/blob/master/reviews/2023-01-ryanshea-noblecurveslibrary-securityreview.pdf), [offline](./audit/2023-01-trailofbits-audit-curves.pdf) - - [Changes since audit](https://github.com/paulmillr/noble-curves/compare/0.7.3..main). + - [Changes since audit](https://github.com/paulmillr/noble-curves/compare/0.7.3..main) - Scope: abstract modules `curve`, `hash-to-curve`, `modular`, `poseidon`, `utils`, `weierstrass` and top-level modules `_shortw_utils` and `secp256k1` - The audit has been funded by [Ryan Shea](https://www.shea.io) diff --git a/audit/2023-09-kudelski-audit-starknet.pdf b/audit/2023-09-kudelski-audit-starknet.pdf new file mode 100644 index 0000000..6bd94be Binary files /dev/null and b/audit/2023-09-kudelski-audit-starknet.pdf differ diff --git a/audit/README.md b/audit/README.md index 9e45d22..375eb91 100644 --- a/audit/README.md +++ b/audit/README.md @@ -1,11 +1,7 @@ # Audit -The library has been audited during Jan-Feb 2023 by an independent security firm [Trail of Bits](https://www.trailofbits.com): -[PDF](https://github.com/trailofbits/publications/blob/master/reviews/2023-01-ryanshea-noblecurveslibrary-securityreview.pdf). -The audit has been funded by Ryan Shea. Audit scope was abstract modules `curve`, `hash-to-curve`, `modular`, `poseidon`, `utils`, `weierstrass`, and top-level modules `_shortw_utils` and `secp256k1`. See [changes since audit](https://github.com/paulmillr/noble-curves/compare/0.7.3..main). +All audits of the library are described in [README's Security section](../README.md#security) -File in the directory was saved from +`2023-01-trailofbits-audit-curves.pdf` file in the directory was saved from [github.com/trailofbits/publications](https://github.com/trailofbits/publications). Check out their repo and verify checksums to ensure the PDF in this directory has not been altered. - -See information about fuzzing in root [README](../README.md).