Skip to content

Vultron Protocol Reference

Prerequisites

The Reference section assumes that you have

  • specific questions about or a desire for a detailed understanding of the Vultron Protocol
  • familiarity with the Explanation section
  • familiarity with the Coordinated Vulnerability Disclosure (CVD) process in general

If you are unfamiliar with the Vultron Protocol, start with Explanation. If you are familiar enough with the Vultron Protocol that you're interested in implementing it, see How-to Guides. And finally, if you're just trying to understand the CVD process, start with the CERT Guide to Coordinated Vulnerability Disclosure.

The Vultron Protocol Reference includes the formal Vultron Protocol specification, and crosswalks the protocol with other related standards and protocols, including:

  • Glossary — The terms this documentation uses for the Vultron Coordinated Vulnerability Disclosure (CVD) protocol and its reference implementation, with the aliases to avoid and the ambiguities to watch for.
  • Documentation Conventions — The call-out boxes this documentation uses, and how to tell a normative page from an informative one.
  • Versioning — The release versioning scheme for the Vultron repository.
  • User Stories — Requirements captured as user stories.
  • Standards Crosswalks — Crosswalks of the Vultron Protocol against the ISO/IEC standards on vulnerability handling and disclosure, against SSVC, and against the CSAF 2.1 draft, each routed to the explanation that covers it and to the specification section that governs it.
  • Concept Taxonomy — Reference definitions for the distinct concepts that together constitute Vultron. Use this document to understand what each named concept covers, what it excludes, and how the concepts relate to each other.
  • Vultron AS Objects — The Vultron ActivityStreams objects that extend the ActivityStreams vocabulary.
  • rv Demo Protocol — The message-level protocol trace of the Reporter + Vendor (rv) demo: every ActivityStreams activity exchanged, the trigger that causes it, and the case ledger entries it produces.
  • Protocol Specification — The Vultron Protocol specification: its semantic and syntactic layers and the state machines participants use to track a shared case.
  • Protocol Quick Reference — A single-page summary of the protocol's state machines, message types, and how they interact.
  • Conformance Matrix — Which capability sets each Vultron role requires, which transitions each role may drive, and the named configurations a conformance claim can use, as tables checked against the specification.
  • Trigger API — The POST /actors/{actor_id}/trigger/{behavior} endpoints, each of which starts a protocol behavior on an actor's behalf.
  • Notation — The mathematical and diagram notation used in the formal treatment of the Vultron Protocol.
  • Case Model Fields — The fields of the case, participant, and status objects, as the reference implementation defines them.
  • Formal Protocol — The Multi-Party Coordinated Vulnerability Disclosure (MPCVD) process defined as a communicating hierarchical state machine.
  • Messages — How the formal message set relates to the ActivityStreams 2.0 (AS2) wire vocabulary the prototype sends and receives.
  • Specifications — Structured requirements organized by portability tier: Protocol, Foundation, Architecture, Project, and Process.

Metrics and benchmarks for Coordinated Vulnerability Disclosure (CVD) efficacy are explained in Measuring CVD.