Thread by @durumcrustulum

LIVE FROM COLUMBIA, IT'S DAY 2 OF #REALWORLDCRYPTO

I'm starting another thread because there were multiple branches in the previous one 🤦‍♀️

Second talk of the MPC session is on Apple's 'Find My Device' feature

#realworldcrypto

Keys are beaconed over Bluetooth ever few seconds, with a key period of 15 minutes

#realworldcrypto

Preventing local tracking with forward unlinkability, good!

#realworldcrypto

Fantastic

#realworldcrypto

The finder needs a place to store the actual location

#realworldcrypto

This is my use case.

#realworldcrypto

Up to 300 indexes sent in one query

#realworldcrypto

#realworldcrypto

Need to clean up the results (dupes, outdated, etc)

#realworldcrypto

Your move, Android.

#realworldcrypto

Lots of questioners lined up

#realworldcrypto

Q: Linkable if not rotating at the same time?

A: They are rotating at the same time.

Reliable time is handy like that.
#realworldcrypto

Q: Do all Apple devices participate as finders?

A: Not all, there are some requirements

#realworldcrypto

Q: How do you manage collisions?

A: Rare but they happen, don't know offhand

#realworldcrypto

Q: What about a malicious finder?

A: Those reports are considered outliers and are filtered out (?)

#realworldcrypto

Next up, "Detecting Money Laundering Activities via Secure Multi-PartyComputation for Structural Similarities in Flow Networks"

#realworldcrypto

Hm

#realworldcrypto

Oh, different talk topic

#realworldcrypto

Proving hashes are in some merkle tree is computationally expensive

#realworldcrypto

This is "One out of billion within one second: ZK-friendly hash functions for Merkle tree proofs"
#realworldcrypto

Traditional hash functions like SHA256 aren't great inside circuits because they are complex and slow over SNARK/STARK-friendly fields

#realworldcrypto

Proof generation time depends on the circuit size, width, and degree.

#realworldcrypto

Pedersen hash with curve points has problems including homomorphism, length-extension attacks, and low preimage security 😬

#realworldcrypto

Early MIMC hash design

#realworldcrypto

Proposals Poseidon (prime fields) and Starkad (binary fields)

#realworldcrypto

🧽

#realworldcrypto

Most powerful attacks are algebraic

#realworldcrypto

"We are not very good at estimating their complexity." Therefore they lean towards a pessimistic estimate (8 outer rounds have s-boxes everywhere)

#realworldcrypto

Support a large number of modes, impls in various languages, support for Merkle trees, AE

#realworldcrypto

If you are working over binary fields, use Starkad instead

#realworldcrypto

🧽🧽🧽
🧽🧽
🧽

#realworldcrypto

#realworldcrypto

Our hash functions will be ~10x faster than pedersen hashes in merkle trees inside SNARKs

#realworldcrypto

Ristretto! ☕

#realworldcrypto

PLŒNK

#realworldcrypto

RedShift is a post-quantum trustless SNARK using Reed-Solomon commitments ⚛️

#realworldcrypto

(RedShift eprint: eprint.iacr.org/2019/1400.pdf)

#realworldcrypto

#realworldcrypto

poseidon-hash.info

#realworldcrypto

Q: Can you use in Picnic-like signature constructions?

A: Yeah yeah sure!

🙌

#realworldcrypto

Q: What Pederson hash did you benchmark?

A: Didn't benchmark, got it from the Zcash spec 🦓

#realworldcrypto

Coffee break!

Next up, @veorq on "Too Much Crypto" 😏

#realworldcrypto

This is specific to symmetric crypto, not public key

#realworldcrypto

"broken" as in, on paper, an attack that is faster than the generic attack.

#realworldcrypto

vs practical attacks. Why the margin?

#realworldcrypto

1000X attack speedup in 30 years for AES with 5 rounds

#realworldcrypto

vs 6 rounds, slowdown! 🙃

#realworldcrypto

Sometimes faster, but less efficient?

#realworldcrypto

And chacha

#realworldcrypto

"Attacks don't _really_ get better [against these primitives]."

#realworldcrypto

"Even DES and GOST are not convincingly broken (the keys are too short but still)"

#realworldcrypto

'impossible is impossible'

#realworldcrypto

#realworldcrypto

"The theory I'd like to present today, without any proof of course…"

#realworldcrypto

Too many, or too few rounds?

#realworldcrypto

🤔👩‍🔬📚

#realworldcrypto

@cfail2019 shout out! Negative results really matter!

#realworldcrypto

You can read negative results in multiple ways (different takeaways), it's about risk assessment.

#realworldcrypto

"Cryptographers are not very good at risk assessment."

#realworldcrypto

// @alexstamos

#realworldcrypto

@alexstamos "Attacks will always get better*"

* maybe not in speed but in cost, space, etc

#realworldcrypto

https://twitter.com/reaperhulk/status/1215306913103126540

#realworldcrypto

"We don't have a primitive attack on SHA-1, nor MD5."

#realworldcrypto

"Crypto is never an island, it is part of a system."

#realworldcrypto

#realworldcrypto

"Just buy an HSM…" 😏

Want more scientific and rational approach to choosing round numbers, tolerance for corrections.

More consistent security margins across primitives.

Better nomenclature for better understanding.

#realworldcrypto

#realworldcrypto

Eg:

#realworldcrypto

#realworldcrypto

"I see no one running screaming from the room, so…"

#realworldcrypto

"It's not just about speed, but attacks like distinguishers"

#realworldcrypto

#realworldcrypto

"If NIST is in the room, I hope they're paying attention…"

#realworldcrypto

Eprint: eprint.iacr.org/2019/1492.pdf

#realworldcrypto

Q: Hardware vendors thank you.

#realworldcrypto

Q: Limit round parameter input, choose a secure 'fast' version and less fast higher round version.

A: Agreed. Also I'm not responsible for any damage as a result of this talk. 😆

#realworldcrypto

Next up! "The First Chosen-Prefix Collision on SHA-1" -> sha-mbles.github.io

#realworldcrypto

SHA-1 is still used in many places in the real world, X.509 certificates, PGP (stop using PGP, use age), TLS, SSH, HMAC-SHA-1, and

GIT GIT GIT

#realworldcrypto

Why still used? Collision attacks are hard to run in practice, and you might end up with garbage that's not very useful.

#realworldcrypto

#realworldcrypto

https://twitter.com/cryptodavidw/status/1215310778183622656

Totally within the cost budget of academics, so nation states can definitely afford it

#realworldcrypto

#realworldcrypto

When the Bitcoin price crashed in 2018, there was suddenly a glut of cheap GPUs! Nice for researchers :)

#realworldcrypto

I hope they put these graphs in a grant proposal

#realworldcrypto

#realworldcrypto

#realworldcrypto

If you achieve a collision, you can snipe an existing signature over that hash and 'verify' the wrong binary/cert/etc

#realworldcrypto

PGP id certs. Stop using PGP.

#realworldcrypto

#realworldcrypto

msn.com uses sha-1 in its certs?!

#realworldcrypto

As long as SHA-1 is supported, downgrade attacks are possible!

#realworldcrypto

Q: Do you think sha-1 would still be safe with a few more rounds? 😏

A: tl;dr 'yes'

#realworldcrypto

Q: Does not apply to HMAC-SHA-1, right?

A: Correct no known attacks on HMAC, but why keep using SHA-1 there or anywhere else? I wouldn't recommend using HMAC-MD5 either.

// @SchmiegSophie

#realworldcrypto

https://twitter.com/veorq/status/1215314337197436928

Next up, "Adept Secret Sharing" by Phil Rogaway

#realworldcrypto

https://twitter.com/cryptodavidw/status/1215314301625434114

#realworldcrypto

Classical Shamir, Blakely secret sharing. What could go wrong?

#realworldcrypto

Application: Sunder, multi-ownership of docs so it makes less sense to kill or jail a single journalist that has access to them.

github.com/freedomofpress…
sunder.readthedocs.io/en/latest/

#realworldcrypto

Lots of mismatches between the way we have formalized classical secret sharing and how it gets applied.

#realworldcrypto

https://twitter.com/__tux/status/1215315688639934466

#realworldcrypto

#realworldcrypto

A need for at least the option of regenerating secret shares

#realworldcrypto

Robust computational secret sharing comes with lots of caveats, such as requiring an honest majority.

#realworldcrypto

#realworldcrypto

We want to be able to specify the access structure when we generate a share

#realworldcrypto

Underlying syntax needs to understand which shares are bad and which are good (who's player #1 vs #2?)

#realworldcrypto

ooo error correction

#realworldcrypto

Why these properties? Um, user testing.

#realworldcrypto

"Strong intution" 🤔

#realworldcrypto

"Secret sharing is strongly analogous to symmetric encryption."

#realworldcrypto

#realworldcrypto

"For some reason, all the lessons we've learned about authenticated encryption did not get translated to secret sharing."

#realworldcrypto

Tagging a secret share to a specific session so we don't try to combine incompatible shares ("associated data").

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

"Beware of crypto with too few guarantees."

#realworldcrypto

No time for questions :(

#realworldcrypto

Time for 🌩️lightning talks 🌩️!

#realworldcrypto

There is a prize of @CrdsAgnstCrypto which I think is for the best talk.

#realworldcrypto

Patent on ECC endomorphisms for speedups will expire in the US at the end of this year 🏎️

#realworldcrypto

@BenarrochDaniel on zkproof.org

(fix your http -> https redirect!)

#realworldcrypto

acrab.isi.jhu.edu

#realworldcrypto

mpcalliance.org

#realworldcrypto

Microsoft Research on QUIC, has its own encryption protocol that diverged from TLS, it needs analysis pls, workshop at NDSS on the security of QUIC

#realworldcrypto

Facebook RFC for applied cryptography proposals for privacy preserving tech in advertising 😶

#realworldcrypto

NIST crypto group: want to standardize threshold schemes

#realworldcrypto

Fintec functional encryption

#realworldcrypto

@veorq new E2E protocol for IoT context

#realworldcrypto

CT and key transparency at Google - Trillian stack github.com/google/trillian

#realworldcrypto

PKI and the supply chain problem

#realworldcrypto

@veorq says BLAKE2 is too slow so now BLAKE3! 4.5X faster. 20X faster than SHA?. It's a merkle tree on the inside! One function. ❤️

github.com/BLAKE3-team/BL…

#realworldcrypto

https://twitter.com/FredericJacobs/status/1215324580216279040

#realworldcrypto

Prize for making on device encryption for low-cost android phones efficient

#realworldcrypto

@FiloSottile on the golang checksum database

blog.golang.org/module-mirror-…

#realworldcrypto

@str4d on age/rage to encrypt stuff! No config, small keys, minimal well-oiled joints, boring crypto under the hood.

github.com/str4d/rage
github.com/FiloSottile/age

#realworldcrypto

arm job post

#realworldcrypto

@hashbreaker wins the @CrdsAgnstCrypto set because he keeps flying United so

#realworldcrypto

Lunch!

https://twitter.com/ciphergoth/status/1215336421667561473?s=19

#realworldcrypto

Next up is the privacy preserving primitives session, starting with "Privacy-preserving telemetry in Firefox" by Henry Corrigan-Gibbs

#realworldcrypto

https://twitter.com/Blake3Team/status/1215324692170596357?s=19

#realworldcrypto

Prio!

#realworldcrypto

Say you want to know, how many Firefox users blocked cookies on fb.com? How can we do this privately?

#realworldcrypto

#realworldcrypto

Currently available in Nightly Firefox builds

#realworldcrypto

Per-user, per-domain blocklist

#realworldcrypto

How do we compute this sum privately?

#realworldcrypto

computers are revolting

Goals include protection against malicious clients, correctness, differential privacy, efficiency (scale)

#realworldcrypto

There have been other differential privacy schemes but depending on the application may blow away the signal you are actually looking for.

#realworldcrypto

computer's haunted

#realworldcrypto

#realworldcrypto

Unfortunately one malicious client can corrupt the output here, which is not acceptable

#realworldcrypto

MPC is very powerful but sometimes too much, traditional ZKPs also powerful but kinda complex and slow…

#realworldcrypto

So Prio prevents disruption using proofs on secret-shared data

#realworldcrypto

#realworldcrypto

"Just run a secure MPC t o check that the validity of the shares hold", with the client helping out, since it knows ~all

#realworldcrypto

time to shoot the computer, 's haunted

#realworldcrypto

Servers check that heir transcripts are valid and consistent; checking a transcript is much easier than generating one.

#realworldcrypto

No asymmetric crypto, just hashing

#realworldcrypto

No asymmetric crypto ➡️much faster

#realworldcrypto

Also means a much smaller codebase/attack surface (still written in C: you're mozilla people, why not Rust???), Mozilla runs all the servers for now.

#realworldcrypto

#realworldcrypto

blog.mozilla.org/security/2019/…

#realworldcrypto

BigData™️

#realworldcrypto

Prio requires 2+ non-colluding servers, Mozilla is looking for partner orgs in 2020

#realworldcrypto

github.com/mozilla/libprio

Yiss, planning to rewrite in Rust 🦀

#realworldcrypto

Q: How is server identity established so that clients know to trust it?

A: Server keys in the browser on the client.

#realworldcrypto

Q: local differential privacy?

A: The variance grows with the square root of the number or reporters, and the noise will wash out the signal in the data

#realworldcrypto

Q: Prevent a malicious client sybil attacks?

A: Mozilla already has a system for the regular telemetry reporting to protect against sybil attacks. 👍

#realworldcrypto

Next up, "Pass-as-you-go: Widespread Deployment of Direct Anonymous Attestation"

#realworldcrypto

#realworldcrypto

GDPR ha changed the requirements for NFC authentication

#realworldcrypto

#realworldcrypto

The current standards for NFC auth make users traceable 😬

#realworldcrypto

'metadata is data'

#realworldcrypto

Group signatures! Unlinkable and non-frameable

#realworldcrypto

#realworldcrypto

Direct anonymous attestation schemes history:

#realworldcrypto

The previous protocol, not the updated one:

#realworldcrypto

Properties that needed to be maintained: low latency, clone detection, anti-passback, works without battery, anonymous and untraceable, stand-alone.

#realworldcrypto

wait, i'm interpreting "pre-DAA" wrong

#realworldcrypto

Doesn't protect against turnstile hopping 😉

#realworldcrypto

Q: Does this work with auth with transit that auths on entry and exit?

A: If we change the timestamp range we can do that, the current scheme has kept it to 15 minutes.

#realworldcrypto

Next up is the side channels session, starting with "Pseudorandom Black Swans: Cache Attacks on CTR DRBG"

#realworldcrypto

Everybody remember Dual_EC ??? 🙀

#realworldcrypto

Of the other standardized RBG's, CTR-DRBG is the most popular in FIPS certified impls

#realworldcrypto

#realworldcrypto

#realworldcrypto

Problems: key not rotated enough, lack of entropy. So are these impls vulnerable to side-channel attacks?

#realworldcrypto

These DRBGs use AES under the hood, so, use AES-NI and you're good, right? Except many of these _don't_ use AES-NI.

#realworldcrypto

#realworldcrypto

Where can we find extended output, say in TLS? Maybe PKCS#1 1.5 in RSA key exchange?

#realworldcrypto

#realworldcrypto

'lots of padding'

#realworldcrypto

pheeeew

#realworldcrypto

30 MINUTES

#realworldcrypto

Welp, RNGs can be side-channel'd too. 'Cool'.

#realworldcrypto

Um, do any of them not have problems?

#realworldcrypto

Next talk, "Cryptographic Software in a Post-Spectre World" by @chandlerc1024

#realworldcrypto

"I am not a cryptographer… I work on compilers." Much love to compiler wizards!

#realworldcrypto

One of the two leads at Google for the Spectre response.

#realworldcrypto

There are _so many side channels_. Why even bother trying to mitigate them all? Hard to exploit, there are plenty of others bugs to exploit, and you know, phishing still works.

#realworldcrypto

Well if you use a side-channel attack, you have plausible deniability, no tracks left behind. 😶

#realworldcrypto

The side-channel threat model is (probably) not _your_ threat model…

#realworldcrypto

👇

#realworldcrypto

Exposing hardware telemetry via apis can expose hardware side channels as _software observable_ side channels. Eek.

#realworldcrypto

Spectre expands our side-channel risks

#realworldcrypto

"None of the software guarantees that you expected hold. Invisible bugs, that you can't see, everywhere." 😭

#realworldcrypto

There are more side-channel vulns (ones without logos!)

#realworldcrypto

#realworldcrypto

"Many forms of Spectre don't directly impact crypto code." You have to fix them at the hardware and OS level so, 'nothing to worry about'. 😅

#realworldcrypto

We hope hardware will fix these eventually, but it's not happening anytime soon.

#realworldcrypto

However, Spectre v1 will not be fixed, for decades. CPU vendors _do not know_ how to fix it. We have to plan on it being around for a long time.

#realworldcrypto

#realworldcrypto

Cache timing side channel

#realworldcrypto

And the code to read it back out

#realworldcrypto

Extracted from test suites at

github.com/google/safeside

#realworldcrypto

"It's scary how few of the Spectre v1 mitigations are actually applied or applied correctly."

#realworldcrypto

"These gadgets can look like almost anything, and the attacker can read anything from the process address space."

#realworldcrypto

Spectre v1 will speculatively-execute past this check, spectrev1 don't give an f

#realworldcrypto

"We know there's a side channel right on the other side of this action, where you will access the private key."

#realworldcrypto

Everyone should read NetSpectre!

arxiv.org/pdf/1807.10535…

#realworldcrypto

#realworldcrypto

"The side channel is that you branch to a series of instructions that reduces the speed of the processor. " 😓

#realworldcrypto

This is the big case that really needs to care about these attacks: distributed keys for things like TLS termination

#realworldcrypto

lfence! extreme performance hit!

#realworldcrypto

Masking in a branchless way! Low cost mitigation, but hard to deploy

#realworldcrypto

It just doesn't work very often in practice

#realworldcrypto

TAKE MY MONEY, RUSTC

#realworldcrypto

And _then_, which branches need this? Like, all of them? ¯\_(ツ)_/¯

#realworldcrypto

These gadgets do exist, but they are rare, and it's currently tricky to find them via static analysis.

#realworldcrypto

So, SLH (speculative load hardening), have caveats, really expensive (40% in latency and QPS), but automatic via a compiler flag

#realworldcrypto

So, what you should you actually do _today_:

- patch everything
- TEST YOUR PATCHES
- did you actually test them???

#realworldcrypto

- use agent in separate process for long-lived keys

- isolate your agent to a single _physical_ core on Intel CPUs

- harden your agents with SLH if you can afford it

#realworldcrypto

Only data-invariant techniques with untrusted inputs in isolated agent

#realworldcrypto

Compiler support key

#realworldcrypto

No time for Q's :(

#realworldcrypto

Short break.

Next up, "CRLite: Where Industry and Academia Collide"

#realworldcrypto

Mmm mmm heartbleed

#realworldcrypto

When it really mattered, revocation of keys really fell down.

#realworldcrypto

#realworldcrypto

CRLs, cert revocation lists issued by CAs. Grow ~forever. Not used in Firefox.

#realworldcrypto

OCSP (classic)

#realworldcrypto

vs OCSP staple, and in TLS, OCSP-muststaple, which fails closed. Not widely deployed yet.

#realworldcrypto

CRLite makes use of CRLs but adds bloom filters to shrink, and supports queries for un-expired certs

#realworldcrypto

#realworldcrypto

We might get false positives tho

#realworldcrypto

Cascading bloom filters

#realworldcrypto

#realworldcrypto

#realworldcrypto

Uses CRLs and OSCP responses

#realworldcrypto

Oh also CT logs feed into this pipeline 🌲

#realworldcrypto

Oh in Firefox, they don't use OCSPs, just the CRLs. Distributed 4X per day. Already had the infra for signing and pushing down to clients.

#realworldcrypto

Aww the paper version used javascript crypto, Firefox uses native code (C++ and Rust) and a little but of js (?)

0.04ms to check a cert, <8ms to check a whole chain

#realworldcrypto

turns out engineering is hard

#realworldcrypto

#realworldcrypto

Set generation takes about 30 minutes, generating the filter files takes about 20 minutes

#realworldcrypto

The data shows that on the client, CRLite is faster than OCSP. ✔️

#realworldcrypto

Bah, not capturing Let's Encrypt certs yet

#realworldcrypto

"crypto agility" 👀

#realworldcrypto

ayup

#realworldcrypto

The Web PKI is fundamental but fragile. 💔

#realworldcrypto

Q: Why cascading bloom filters?

A: The paper we were implementing suggested them, but it did mention other options like hashing

#realworldcrypto

Q: How large is the set of revoked certs?

A: ~700k, doesn't included Let's Encrypt

#realworldcrypto

A: We hope Let's Encrypt will support CRLs

#realworldcrypto

Q: Does this replace OCSP-must-staple or is it an intermediate step?

A: OCSP-must staple is an idea that's been around for a while without much adoption, we think CRLite is a replacement.

#realworldcrypto

Next up, "Are certificate thumbprints unique?"

#realworldcrypto

Hashes hashes hashes hashes

#realworldcrypto

> often use MD5 or SHA-1

uuuuuum

#realworldcrypto

Thumbprints are _aliases_ for certs, they aren't really unique

#realworldcrypto

🤔

#realworldcrypto

No two certs should have the same thumbprint, and a thumbprint should uniquely ID a cert. Right? (Spoiler: nope.)

#realworldcrypto

Tricky to mount a collision attack as the hash is over the whole cert and the signature on the cert

#realworldcrypto

boo PEM boo @str4d

#realworldcrypto

@str4d SHAttered, amirite

#realworldcrypto

@str4d X.509 specifies that the signatureAlgorithm must match the signature field of the tbs Certificate. It doesn't always (cough windows cough).

#realworldcrypto

Actually did a key substitution attack plus chose MD5 to produce collisions

#realworldcrypto

The cert _signature_ uses (or should be using) a cryptographically strong hash

#realworldcrypto

Shout out to ZMap

#realworldcrypto

During scanning, discovered a Cisco CVE due to insufficient entropy in the DRBG (RELEVANT) that resulted in the same ECDSA blinding value.

#realworldcrypto

- Please migrate to SHA256 or stronger
- If that's too long, truncate the stronger hash instead
- PKI like CT should scan for MD5 and SHA-1 thumbprints w/ collision detection
- be wary

#realworldcrypto

Q: How do you check for collisions?

A: While computing an mD5 or SHA-1 hash, check for diffs in input blocks while hashing (i'm a little confused by this)

#realworldcrypto

A: re the cisco vuln of low entropy, new vendors keep introducing the same vuln over and over so, it's never going away

#realworldcrypto

Next up, "Implementing a Crypto Services Strategy at ABN AMRO Bank"

#realworldcrypto

> SHA-1 migration

Good!

#realworldcrypto

Took over a year (at a bank)

#realworldcrypto

- very long
- very painful
- expensive
- "know where all your crypto is" oooof for some orgs this is _not_ feasible

#realworldcrypto

> Augment with HSMs

Re the talks yesterday: 😬

#realworldcrypto

#realworldcrypto

"I like post-quantum cryptography", me too! Came up as a way to head off emergency deprecation when large quantum computers come online.

#realworldcrypto

"I hear a lot of talk about crypto agility at the moment..." who? I feel like we've been moving away from 'agility' because look at TLS, that's what agility results in.

#realworldcrypto

Bank: "We want to do [crypto] innovation!"

…why

#realworldcrypto

Success story: fraud detection using MPC to exchange flagging with other banks. 'ok fine'

#realworldcrypto

#realworldcrypto

Q: What steps are you taking to prepare for PQ crypto

A: Need inventory of all your current usage, waiting for asymmetric standards (NIST), can double symmetric keys sizes today.

#realworldcrypto

Last talk of the day, "Rolling the DiSE: Taking Threshold Encryption to Enterprise"

#realworldcrypto

The problem of key management ➡️HSMs

#realworldcrypto

#realworldcrypto

You financial institutions do not have it easy with all the PCI compliance stuff

#realworldcrypto

🎲

#realworldcrypto

eprint: eprint.iacr.org/2018/727.pdf

#realworldcrypto

My next level of live tweeting will be screen recording slide animations 📹

Very small network cost

#realworldcrypto

Cheaper and more scalable than HSMs (more secure too? 🤞)

No need to recombine as in secret sharing

Better performance than MPC

#realworldcrypto

Deployment of DiCE in North america and in europe, same data, need to import/export master keys, have key backup, data migration in and out, and built on top of hardware root of trust for PCI compliance.

#realworldcrypto

Need authentication and authorization controls for use of different master keys, committing to policies…

#realworldcrypto

API and Connection Management:
- minimal API
- connection broker

Avoiding single points of failure and mitigating attack surface

#realworldcrypto

Many different DiCE nodes. An attacker needs to break a threshold number of nodes, so they are varied (linux, windows, etc) to make the burden on attackers higher (but also admins?)

Security people, what do you think about this strategy?

#realworldcrypto

Q: Key rotation?

A: Would be very useful, don't have yet

#realworldcrypto

Q: Any risk analysis on the diversity of platforms?

A: Not yet, we would not necessarily do this for every project

#realworldcrypto

That's it for day 2! See you tomorrow.

#realworldcrypto