chainpoint-node/chainpoint-security.txt at develop · pkm2/chainpoint-node · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
Chainpoint Network Security

This file contains important information relevant to
the security of the Chainpoint Network and Chainpoint
software. This is considered the canonical source of
truth for related information.

Warning : You should never accept information provided
in public channels as being safe to use for security
sensitive information such as Ethereum contract
addresses.

Chainpoint Network Core
-----------------------------------------------------------

Core Clusters:
https://a.chainpoint.org/config
https://b.chainpoint.org/config
https://c.chainpoint.org/config


Calendar Block Signature Public Keys
-----------------------------------------------------------

The partial hash (fingerprint) of each public key and
the Base64 encoded Ed25519 public key. Current public
keys are also available from the Core `/config` endpoints.

  "public_keys": {
    "09b0ec65fa25": "Q88brO55SfkY5S0Rbnyh3gh1s6izAj9v4BSWVF1dce0=",
    "fcbc2ba6c808": "UWJSQwBjlvlkSirJcdFKP4zGQIq1mfrk7j0xV0CZ9yI="
  }


TNT Rewards
-----------------------------------------------------------

Rewards are issued periodically to a Node that
passes the eligibility criteria.

Tierion is ineligible to receive rewards.

The current Ethereum address that is used to pay rewards is:

0xdDFFF2b78463AB1cA781e853BB888FDfd06083d3

Rewards are also published as a `reward` type block in the
Calendar, permanently recording that reward and the
Ethereum address it was sent to. This ensures that
rewards are also anchored to public blockchains.


Signature Verification
-----------------------------------------------------------

This file is OpenPGP signed with the official
Tierion PGP key:

Tierion Security <security@tierion.com>
fingerprint: 86B6E539C21BCC44E3364495AB003F4636464A38
64 bit fingerprint: AB003F4636464A38

You can find the public key at one of these locations:

https://keybase.io/tierion

http://pgp.mit.edu/pks/lookup?op=get&search=0xAB003F4636464A38

A good location that can be used to retrieve this
file is the official Keybase signed filesystem for the
'tierion' account:

https://keybase.pub/tierion/

You can import the public key and verify this
file by downloading this file and its signature
and executing the following commands:

# Import the public key to gpg
curl https://keybase.io/tierion/pgp_keys.asc | gpg --import

# Verify the detached signature
gpg --verify chainpoint-security.txt.sig chainpoint-security.txt

For a GOOD signature you should see something like the
following output:

gpg: Signature made Sat Mar 24 16:52:02 2018 PDT
gpg:                using RSA key ED9238941FDD8A7F5401EDA9A4D3FEA87211FE71
gpg: Good signature from "Tierion Security <security@tierion.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 86B6 E539 C21B CC44 E336  4495 AB00 3F46 3646 4A38
     Subkey fingerprint: ED92 3894 1FDD 8A7F 5401  EDA9 A4D3 FEA8 7211 FE71

Thank you for using our systems securely!

security@tierion.com