[tptacek]

To be clear: I don't think you need to disclose any vulnerabilities. Just talk about the process you used to reverse the protocol.