Thread by @durumcrustulum

LIVE FROM COLUMBIA, IT'S DAY 3 OF #REALWORLDCRYPTO

Starting the Messaging session is "E2EE for Messenger: goals, plans and thinking"

#realworldcrypto

Zuck wants to integrate and E2E encrypt all the messaging services (messenger, Instagram, WhatsApp)

#realworldcrypto

Want to avoid accidental logging of messages and crash reports, same with any data derived from message contents

#realworldcrypto

This requires pushing a lot of existing server functionality to the client, making the server basically a dumb router. 👍

#realworldcrypto

Would like to automatically enforce rules on metadata on the client too, need to build privacy into existing FB tooling and infra

#realworldcrypto

"Messenger is inherently multi device and multi platform" , this includes the web. 😬

#realworldcrypto

Would binary transparency help here?

#realworldcrypto

Store as little data as we can to maintain functionality

#realworldcrypto

Migrating an existing product to E2E is really complex

#realworldcrypto

"We are going to ship this." 🤞

#realworldcrypto

Q: Pushing social graph to the client?

A: no comment

#realworldcrypto

Q: Key transparency?

A: We allow manual verification of keys in the app, nothing newer than that

#realworldcrypto

Q: Usage stats of existing Secret Conversations?

A: No public numbers atm

#realworldcrypto

Next up, "Security Analysis and Improvements for the IETF MLS Standard for Group Messaging"

#realworldcrypto

Long lived group chats, federated E2E encrypted

#realworldcrypto

Goal is to do for group chats what TLS did for transport layer

#realworldcrypto

Goals include forward secrecy and post-compromise security, DoS is out of scope for now

#realworldcrypto

The current MLS spec draft: ietf.org/id/draft-ietf-…

#realworldcrypto

'group management'

#realworldcrypto

Continuous group key agreement

#realworldcrypto

These control messages need to be processed in the same order by all group members…

#realworldcrypto

CGKA allows us to assume authenticated channels

#realworldcrypto

#realworldcrypto

#realworldcrypto

This gives us TreeKEM, and the TreeKEM with blanks variant

prosecco.gforge.inria.fr/personal/karth…

#realworldcrypto

Modify the existing tree from epoch to epoch, each user gets a leaf, each node gets a keypair except root node

#realworldcrypto

#realworldcrypto

Updating the tree as keys are ratcheted, conveyed over a packet 'message' encrypted to the copath

#realworldcrypto

#realworldcrypto

We need all the critical keys to e removed to maintain forward secrecy

😬

#realworldcrypto

😬😬😬

#realworldcrypto

We can do better!

#realworldcrypto

RTreeKem, closely related to Key-Updateable PKE in 2-party messaging

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

Paper! eprint.iacr.org/2019/1189.pdf

#realworldcrypto

No time for questions, moving onto the compromised credentials session with "Protecting accounts from credential stuffing with password breach alerting"

#realworldcrypto

Large breaches result in massive amounts of compromised credentials that attackers just try in other services, over and over

#realworldcrypto

Want to make queries about which passwords are compromised, without leaking

#realworldcrypto

#realworldcrypto

Want to make sure that the cost of abusing this query API is larger than just going directly to cred dumps on the dark web or wherever

#realworldcrypto

Hash to curve! "An elliptic curve where the discrete log is hard."

'oh ok I won't choose a supersingular curve then' ;)

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

A memory-hard hash function can also help mitigate abuse risk

#realworldcrypto

OK so where do you get the collection of compromised creds? It sounds like the abuse team at Google has… access to those?

#realworldcrypto

Implemented as part of the Password Checkup Chrome extension: chrome.google.com/webstore/detai…

#realworldcrypto

Collected anonymous telemetry on extension usage on login, ignore the alert, and on actual password changes prompted by the extension alert.

#realworldcrypto

The install base is biased towards people who care enough to install such an extension so maybe these numbers are not representative of the general population but even so, on 26% of breached creds were rotated!

#realworldcrypto

94% of the new passwords were as strong or stronger, so that's good.

#realworldcrypto

Now implemented into Chrome itself! 👏

#realworldcrypto

Q: Can this be abused to try to match a weak password?

A: Attacker would need to spend more time to do that, we rate limit queries and note that on their accounts if logged into Chrome (???)

#realworldcrypto

Next up, "Protocols for Checking Compromised Credentials"

#realworldcrypto

#realworldcrypto

They claim these services do leak information about passwords 😯

#realworldcrypto

#realworldcrypto

The checking service stores hundreds of millions of passwords, needs to be able to handle many queries

#realworldcrypto

#realworldcrypto

#realworldcrypto

If the username is known to the attacker, the H(user || password) prefix as an id is insecure

#realworldcrypto

For password only, like HIBP, there is still enough leakage that speeds up remote guessing attacks.

#realworldcrypto

🤔

#realworldcrypto

"Easy to guess the password if you know the bucket", and more common passwords can be bucketed together easily

#realworldcrypto