  Cyberspace is a fragile construct threatened by malicious cyber operations of
different actors, with vulnerabilities in IT hardware and software forming the
basis for such activities, thus also posing a threat to global IT security.
Advancements in the field of artificial intelligence accelerate this
development, either with artificial intelligence enabled cyber weapons,
automated cyber defense measures, or artificial intelligence-based threat and
vulnerability detection. Especially state actors, with their long-term
strategic security interests, often stockpile such knowledge of vulnerabilities
and exploits to enable their military or intelligence service cyberspace
operations. While treaties and regulations to limit these developments and to
enhance global IT security by disclosing vulnerabilities are currently being
discussed on the international level, these efforts are hindered by state
concerns about the disclosure of unique knowledge and about giving up tactical
advantages. This leads to a situation where multiple states are likely to
stockpile at least some identical exploits, with technical measures to enable a
depletion process for these stockpiles that preserve state secrecy interests
and consider the special constraints of interacting states as well as the
requirements within such environments being non-existent. This paper proposes
such a privacy-preserving approach that allows multiple state parties to
privately compare their stock of vulnerabilities and exploits to check for
items that occur in multiple stockpiles without revealing them so that their
disclosure can be considered. We call our system ExTRUST and show that it is
scalable and can withstand several attack scenarios. Beyond the
intergovernmental setting, ExTRUST can also be used for other zero-trust use
cases, such as bug-bounty programs.
