Thread by @durumcrustulum

LIVE FROM TOKYO, IT'S #REALWORLDCRYPTO

(for a preview discussion of the whole program, check out our episode: securitycryptographywhatever.com/2023/03/24/rwc…)

First up in the PQC session is "How We Broke a Fifth-Order Masked Kyber Implementation by Copy-Paste" presented by Elena Dubrova

#realworldcrypto

"SIKE (dead)" 💀

#realworldcrypto

Tricksy FO transform

#realworldcrypto

mmmhmmm

#realworldcrypto

🥷

#realworldcrypto

Very easy to extract

#realworldcrypto

#realworldcrypto

Hahaha oh boy

#realworldcrypto

*shuffle shuffle* ah boo

#realworldcrypto

*slaps Kyber impl* we fit so many orders of masking in this thing

#realworldcrypto

Can ChatGPT given some Kyber power traces spit out the secret key??? (this talk is not about ChatGPT but)

#realworldcrypto

"Don't believe countermeasures exist at present" 😅

#realworldcrypto

"Hardware impls are harder to attack"

#realworldcrypto

Next up, "When Frodo Flips: End-to-End Key Recovery on FrodoKEM via Rowhammer", presented by Hunter Kippen

#realworldcrypto

FrodoKEM

#realworldcrypto

Recovered e2e key with ~8,000USD's of AWS compute 💰

#realworldcrypto

Gandalf shaking his head at not keeping it secret, not keeping it safe

#realworldcrypto

Abort leaks magnitude (excellent, excellent)

Can we make this leakage less rare, and use that to attacker's advantage?

#realworldcrypto

With 7 bitflips, very reasonable

#realworldcrypto

Balancing on failure rate, keeps undetectable to honest users

#realworldcrypto

#realworldcrypto

#realworldcrypto

Rowhammer! (Needs orc memes)

#realworldcrypto

Exploits a vuln in how we manufacture memory

#realworldcrypto

/You're/ a large chunk 😒

#realworldcrypto

How do you suppress bad bit flips?

#realworldcrypto

🐐🩸 (Rambleed)

#realworldcrypto

7 bit flips, suppressed 117

Bruteforce session keys in 2 mins on regular laptop

#realworldcrypto

Mitigate: use AES-NI instructions for hashing, reorder ops (expand from seed, gen random before sampling), verify PK!

#realworldcrypto

Public key is poisoned undetectably forever ☠️

#realworldcrypto

Next up, "Lessons Learned from Protecting CRYSTALS-Dilithium", presented by Tobias Schneider

#realworldcrypto

Dilithium is the lattice-based signature scheme that has been chosen out of the NIST PQC competition along with Kyber for KEM

#realworldcrypto

Similar to Kyber talk earlier, masking has been a go-to mitigation technique to protect lattice schemes from side-channel attacks

#realworldcrypto

What needs protecting in Dilithium?

#realworldcrypto

Masking Dilithium requires a mix of boolean and arithmetic masking; switching from a prime modulus to a power of 2 results in 7-9X speedup

#realworldcrypto

Deterministic vs randomized variants of Dilithium signatures are more vulnerable 😅

#realworldcrypto

oof

#realworldcrypto

🤔

#realworldcrypto

Flexible sampling provides significant speedup over randomized 📈

#realworldcrypto

Combine deterministic and randomized Dilithium into one:

#realworldcrypto

Hedged provides comparable perf as randomized 👍

#realworldcrypto

Randomized should be the default mode for deploying Dilithium on embedded devices, hedged has negligible performance impact; flexible sampling would enable significant speedup; hardening Dilithium is still a work in progress, less studied than Kyber

#realworldcrypto

Coffee time! ☕

#realworldcrypto

Next up is "Crypto Agility and Post-Quantum Cryptography @ Google" presented by Sophie Schmieg

#realworldcrypto

So cute

#realworldcrypto

Key rotation! Bread and butter stuff

#realworldcrypto

At Google scale, key rotation becomes a distributed-systems problem

#realworldcrypto

Horizontally monitor usage of keys within library (on users behalf)

#realworldcrypto

#realworldcrypto

Relies on the key management service backend

#realworldcrypto

This plays into the post-quantum migration at google

#realworldcrypto

Store now, decrypt later, is a primary present risk

#realworldcrypto

Hardware roots of trust are hard to rotate!

#realworldcrypto

mmmhmmmmmm

#realworldcrypto

"Disclosed to us by an external security researcher" 😏

#realworldcrypto

Why not mTLS? Over a decade ago, we have strict requirements for latency that it didn't fit

#realworldcrypto

ALTS whitepaper: cloud.google.com/static/docs/se…

#realworldcrypto

static-static ECDH

#realworldcrypto

resumption tickets too

#realworldcrypto

lol rip sidh

#realworldcrypto

😭

#realworldcrypto

Added ephemeral PQC to clientinit and PQC KEM ciphertext to ServerInit

#realworldcrypto

Cache client key a bit in case server doesn't speak PQ

#realworldcrypto

Just too bit to fit on the stack, had to put it on the heap

#realworldcrypto

Allocation of a benchmark is very different than allocation behavior of a full production system 😹

#realworldcrypto

Rolling out PQC takes a long time, it's been almost 3 years in this project

#realworldcrypto

Q: For encrypt at rest, how do i know how long that ciphertext will remain there, to enable key rotation?

A: Encrypt at regular interval to address this; if ciphertext not in your control it becomes tricky

#realworldcrypto

KMS is notified on every key use and can keep track of whether a key can be deleted/rotated

#realworldcrypto

Q: Can you replace that PQ alg with something else in ALTP?

A: There is some version negotiation to enable this

#realworldcrypto

Next up, Post Quantum Noise, presented by Florian Weber

#realworldcrypto

Noise! Foundation of Wireguard, others

noiseprotocol.org/noise.html

#realworldcrypto

Diffie-Hellman based → not Quantum-safe

#realworldcrypto

#realworldcrypto

How can we replace the DH's in Noise with PQ KEMs?

#realworldcrypto

However, DH allows non-interactive, creates bidirectional authenticity, and can be freely-combined 🤔

#realworldcrypto

Some cases are easy, some are challenging, some are impossible 😭

#realworldcrypto

DH our OG NIKE 💖

#realworldcrypto

lol #realworldcrypto

Static-Ephemeral Entropy-Combination (SEEC)

#realworldcrypto

#realworldcrypto

'Many reviewers disliked this model' 😅

#realworldcrypto

All KEMs treated separately, allows mix-and-match PQ KEMs like Kyber for ephemeral and McEliece for static

#realworldcrypto

Nice

#realworldcrypto

Q: Did you benchmark with the other ciphersuites besides kyber?

A: No

#realworldcrypto

LWE would not replace a NIKE, CSIDH could, but the params for CSIDH are large and slow

#realworldcrypto

Next up, "Post-Quantum Privacy Pass via Post-Quantum Anonymous Credentials", presented by Guru Vamsi Policharla

#realworldcrypto

In PQ, we have sigs, we have KEMs, but we don't really have bling sigs, oprfs, anonymous credentials :(

#realworldcrypto

"semi-practical"

#realworldcrypto

Blind signatures support private web service access

#realworldcrypto

#realworldcrypto

General purpose proofs are thought to be too big and slow; what about sign & prove?

#realworldcrypto

#realworldcrypto

- Dilithium → zkDilithium
- zkSTARK proof

#realworldcrypto

Winterfell is getting quite popular for STARKs

#realworldcrypto

This "crucial for performance", "careful hand-optimization" stuff is really ripe to be solved by some toolchain, ala real compilers/circuit design tools

#realworldcrypto

#realworldcrypto

'figure roughly to scale' 😹

#realworldcrypto

Try it out live!

zkdilithium.cloudflareresearch.com/index.html

#realworldcrypto

PQ Anonymous Credentials are semi-practical, careful tailoring of ZKPs to circuit being proved performs surprisingly well, should PQ sigs be designed with proof verification in mind?

#realworldcrypto

Formal verification for the AIR translation (🎉)

#realworldcrypto

Code: github.com/guruvamsi-poli…

#realworldcrypto

(oh that's formal verification would be nice to have)

#realworldcrypto

Q: Why care about pq-soundness vs a R1CS proof?

A: Don't need it /now/ but need to start eventually to have it available when you need it

#realworldcrypto

Q: What is the mental model for attacking classical anon credentials with a quantum computer?

A: It's not just about captchas; the primitive is useful elsewhere (ie breaking privacy of Signal group metadata is valuable to a quantum-capable adversary)

#realworldcrypto

Next up, the Levchin Prize!

#realworldcrypto

First 2023 winner: Vincent Rijmen for co-designing AES!

#realworldcrypto

#realworldcrypto

Computers all over the world go brrrr with the block cipher named after him :D

#realworldcrypto

Mathematical elegance of AES

#realworldcrypto

Publishing often, and shallow 👀

#realworldcrypto

Double-edged sword of academic vs real-world / commercial cryptography

#realworldcrypto

Also winner of 2023: Paul Kocher for pioneering work on side-channel analysis!

#realworldcrypto

#realworldcrypto

#realworldcrypto

Kocher also co-authored SSL 3.0! 🤯

#realworldcrypto

"I wrote to Marty Hellman, they welcomed me into this world of cryptography" :D

#realworldcrypto

18,000 citations 👀

#realworldcrypto

evil monster living in a cave outside of town -> spectre :D

#realworldcrypto

(right? or is it another thing, just side-channels in general)

#realworldcrypto

"The future is bright [for security researchers] but in a really dark way"

#realworldcrypto

Paul has 'just' an undergrad degree in biology 💚

#realworldcrypto

Lunch time!

#realworldcrypto

Next up, iCloud Private Relay: Multi-hop Internet privacy at scale, from Tommy Pauly Chris Wood Jana Iyengari

#realworldcrypto

#realworldcrypto

#realworldcrypto

Reminds me of something... 🧅

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

No version, ciphersuite negotiation; no X.509 certificate parsing

#realworldcrypto

#RealWorldCrypto

#realworldcrypto

Saves on latency

#realworldcrypto

How do we prevent abuse?

#realworldcrypto

Ingress and egress relays MUST be independent otherwise they could collude and link indentities

#RealWorldCrypto

#RealWorldCrypto

Also want to prevent tracking

#realworldcrypto

#realworldcrypto

Trusted iCloud server, creates per-region bundles that are signed and synced down to clients

#RealWorldCrypto

What if there are malicious clients?

#RealWorldCrypto

#RealWorldCrypto

"Certain geo-based region restrictions" 🇨🇳

#RealWorldCrypto

Anonymous credentials!

#RealWorldCrypto

"This is basically Privacy Pass" yes!

#RealWorldCrypto

Return of Blind RSA :P

#RealWorldCrypto

"Why in 2023 are we using RSA for new applications? Efficiency."

#realworldcrypto

"we were not able to integrate them into our production software"

#RealWorldCrypto

(pairing-based schemes)

#RealWorldCrypto

Yes!

#RealWorldCrypto

#realworldcrypto

🤞🤞🤞

#realworldcrypto

Next up, "Framing Frames: Bypassing Wi-Fi Encryption by Manipulating Transmit Queues", presented by Mathy Vanhoef

#RealWorldCrypto

🔓🔓🔓

#RealWorldCrypto

#realworldcrypto

#RealWorldCrypto

If you don't model part of the protocol you will miss issues :P

#RealWorldCrypto

#RealWorldCrypto

"Client isolation was bolted-on to the protocol by vendors: fewer researchers looked at it than the rest of the standard"

#RealWorldCrypto

Fix: disallow recently-used MAC address unless a certain amount of time has passed (but how long?)

#RealWorldCrypto

Disallow recently-used MAC addresses based on 802.1X identity or cached keys

#RealWorldCrypto

Don't rely on client isolation for security; instead use VLANs to isolate groups of users

#RealWorldCrypto

#RealWorldCrypto

Next up, "Cellular Radio “Null Ciphers” and Android " by Yomna Nasser

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

hoo boy

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

"network equipment is just mis-configured" 😭

#RealWorldCrypto

dl.acm.org/doi/10.1145/33…

#RealWorldCrypto

#RealWorldCrypto

connectivity >> security

#RealWorldCrypto

🎉

#RealWorldCrypto

😭

#RealWorldCrypto

Next up, "TLS-Anvil: Adapting Combinatorial Testing for TLS Libraries", presented by Marcel Maehren

#RealWorldCrypto

ayup

#RealWorldCrypto

...I'm getting the feeling it's not always checked

#RealWorldCrypto

oop

#RealWorldCrypto

(I hate padding)

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

Awesome

#RealWorldCrypto

No BearSSL? ʕ·͡ᴥ·ʔ

#RealWorldCrypto

I stand corrected!

#RealWorldCrypto

🔮

#RealWorldCrypto

segfault! 😭

#RealWorldCrypto

Poor MatrixSSL

#RealWorldCrypto

another one

#RealWorldCrypto

🐺🔒

#RealWorldCrypto

Better than I thought

#RealWorldCrypto

github.com/tls-attacker/T…

#RealWorldCrypto

Next up, "Careful with MAc-then-SIGn: A Computational Analysis of the EDHOC Lightweight Authenticated Key Exchange Protocol", presented by Marc Ilunga

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

TLS 1.3 is not lightweight enough!

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

Bandwidth-saving measure

#RealWorldCrypto

Send a short ID associated with the cert for X

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

🐻

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

boo hiss ecdsa

#RealWorldCrypto

eprint.iacr.org/2022/1705.pdf

#RealWorldCrypto

Last session of the day, starting with "WhatsApp End-to-End Encrypted Backups" presented by Kevin Lewi

#RealWorldCrypto

What if one of your ends ends up in the toilet?

#RealWorldCrypto

Want the backups to have the ~same guarantees as the original messaging protocol

#RealWorldCrypto

Having both options (encryption key bytes, key protected by password & attempt limit) is very nice

#RealWorldCrypto

#RealWorldCrypto

What's this

#RealWorldCrypto

After programming the HSMs, they are no longer updateable, immutable computation environment

#RealWorldCrypto

HSMs have a limited amount of secure memory, just using a merkle tree whose root is stored in the HSM helps get around this

#RealWorldCrypto

PAAAAKE

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

boo hiss RSA-OAEP

#RealWorldCrypto

#RealWorldCrypto

Neat

#RealWorldCrypto

Can we move away from HSMs? What about threshold OPRFs/OPAQUE?

#RealWorldCrypto

This has been rolled out to over 100 million users 😳

https://twitter.com/wcathcart/status/1600603826477617152

#RealWorldCrypto

Password in this protocol is only for backups

#RealWorldCrypto

PBKDF because of client restrictions

#RealWorldCrypto

Q: How many HSMs could die and keep the service operational?

A: 3/5 need to be up

#RealWorldCrypto

Q: DDoS countermeasures?

A: Only authenticated WhatsApp users via phone number access can make attempts

#RealWorldCrypto

Q: Did you re-eval the security proof for OPAQUE (PAKE?) after modifying it?

A: The proof was against a black-box version so we didn't need to change anything in that regard

#RealWorldCrypto

Next up, "Why E2EE Cloud Storage is hard - Challenges, Attacks and Best Practices" on MEGA, by Matilda Backendal and Miro Haller

#RealWorldCrypto

Can we ensure E2EE cloud storage against a malicious or compromised server?

#RealWorldCrypto

Gotta sync those key encryption keys??

#RealWorldCrypto

Can't really expect humans to remember key encryption keys, so, passwords; password managers, password generation, eek

#RealWorldCrypto

RSA again!

#RealWorldCrypto

> AES-ECB

oh no

#RealWorldCrypto

#RealWorldCrypto

Server can exploit that the ciphertext is malleable

#RealWorldCrypto

ECB also for the file keys and the file encryption - cut and paste 😭

#RealWorldCrypto

- use authenticated encryption!
- key separation!
- don't design your own file encrpytion scheme!
- cant move away from this vulnerable instantiation

#RealWorldCrypto

team broke the patches for their first round of attacks ;)

#RealWorldCrypto

- no post-compromised security

#RealWorldCrypto

What to actually do:

#RealWorldCrypto

Standardization?

#RealWorldCrypto

Q: Client where the server is just a block box that makes blobs of bytes available?

A: Need key management; need some support from the platform

#RealWorldCrypto

"i wouldn't propose using MEGA's design even if they fixed everything"

#RealWorldCrypto

Last talk of day 1, "Reversing, Breaking, and Fixing the French Legislative Election E-Voting Protocol", by Lucca Hirschi

#RealWorldCrypto

#RealWorldCrypto

FLEP (not BLEP)

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

4 different receipts received by the voting client 🎟️

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

Attacker can learn some target voters' vote (and perform remote coercion)

#RealWorldCrypto

Fixes ✅

#RealWorldCrypto

eprint.iacr.org/2022/1653

#RealWorldCrypto

Adapting a proven-secure protocol for real-world deployment resulted in an implementation that was badly broken!

#RealWorldCrypto

That's day 1! See you tomorrow!

#RealWorldCrypto

Good morning! Kicking off day 2 with "Design, Applied Cryptography, and Humans" by Stephan Somogyi

#RealWorldCrypto

Strive to build tools that users can use safely without an abundance of advanced training: good for couches and cryptography

#RealWorldCrypto

"Not everyone likes the clicking of someone else's clicky pen" 😉

#RealWorldCrypto

Micro consideration: thought into the tiny details and composition of the thing

#RealWorldCrypto

Industrial craft; picking the wrong metrics doesn't always lead to better quality

#RealWorldCrypto

Exposure Notifications: people stopped looking into the cryptography after a while because it was open, transparent, and boring, it was fine and good to go

#RealWorldCrypto

Meet users where they are in the context they are

#RealWorldCrypto

"If we focus on the extremes [of our users], the middle will take care of itself." Interesting!

#RealWorldCrypto

Stress cases, not edge cases

#RealWorldCrypto

Reminds me of nonces at AWS scale

#RealWorldCrypto

Q: How do you keep up those design detail considerations in a software project that tends to evolve over time?

A: Wireguard did well; it's hard; having values documented, getting feedback, parameters of your design space, if you need to move away eventually

#RealWorldCrypto

Q: Create products for a broader swathe of people, including those not like them?

A: Gentle ways to introduce them to the outside world; listening, seeking common understanding

#RealWorldCrypto

Q: What do at-risk users need?

A: Don't betray trust; some at-risk users need more options, getting the defaults right is crucial; the nature of the tools affects these greatly

#RealWorldCrypto

Q: Inspiring crypto systems?

A: How PGP came to be is useful, good lessons; it did things at the time that nothing else did; eventually key management became where its's at, it's going to be hard for a while; Signal; WhatsApp

#RealWorldCrypto

Anyone of us can become high-risk users ~instantly; how do you help users like that in your tool? [YES]

#RealWorldCrypto

Next up, "Cryptography for Grassroots Organizing" presented by Leah Namisa Rosenbloom

#RealWorldCrypto

How do we, as cryptographers, understand
systems of power? How does our understanding inform our threat
modeling and design choices? How might we work toward building power
for communities?

#RealWorldCrypto

Operation Vula

#RealWorldCrypto

😅

#RealWorldCrypto

COINTELPRO 👀

#RealWorldCrypto

Arab Spring, major social media dynamics

#RealWorldCrypto

Be safe, or be seen?

#RealWorldCrypto

Face to face preceeds phone to phone

#RealWorldCrypto

Remote deletion re: compromise

#RealWorldCrypto

How might we use cryptographic tools to adapt the existing trust and communication protocols of grassroots organizers from physical to digital spaces, without increasing the risk of surveillance, disinformation, and infiltration of grassroots
movements?

#RealWorldCrypto

Key agreement over bluetooth roots digital trust in interpersonal interaction (proximity required)

#RealWorldCrypto

#RealWorldCrypto

"Grounded pairs" that were in physical proximity

#RealWorldCrypto

#RealWorldCrypto

Alice looks bothered

#RealWorldCrypto

#RealWorldCrypto

Future work: formalizing 'the vibes were off' in this security model

#RealWorldCrypto

Neat

#RealWorldCrypto

Trust metrics over social networks

#RealWorldCrypto

#RealWorldCrypto

Want a public profile to welcome new people and private aspect for information sharing within the group

#RealWorldCrypto

Next up, "Designing cryptography for small organizations and projects", presented by Sofia Celi

#RealWorldCrypto

cui bono?

#RealWorldCrypto

Can proposals be used by small organizations with constrained budgets or are run by volunteers?

#RealWorldCrypto

For privacy-preserving schemes, who can afford to run them/use them?

#RealWorldCrypto

How hard is it to deploy non-colluding servers?

#RealWorldCrypto

STAR 🤩

#RealWorldCrypto

Easy, 'boring' cryptography

#RealWorldCrypto

FrodoPIR

#RealWorldCrypto

Supports single server, no special hardware

#RealWorldCrypto

Need to address financial costs as part of protocol design

#RealWorldCrypto

#RealWorldCrypto

Break time!

Next up, "SGX.Fail: How Secrets Get eXtracted"

#realworldcrypto

This is amazing, 2003-me would love this

#RealWorldCrypto

smart contracts 🤓

#RealWorldCrypto

Any registered validator had access to the secret seed even if they weren't contributing blocks

#RealWorldCrypto

#ttants : IAS, AES

#RealWorldCrypto

Secret: no strat for rolling their consensus seed 🙃

#RealWorldCrypto

#RealWorldCrypto

"These attacks are not just done in research labs, they're also done in grad students' apartments"

#realworldcrypto

/must/ plan on TCB recovery (sgx breakage) as part of deployment

#RealWorldCrypto

"SGX breaks early and often"

#RealWorldCrypto

😹

#RealWorldCrypto

Q: How do I make an unbreakable enclave?

A: Depends (😹)

#RealWorldCrypto

Q: What's stopping you from tweeting out the seed?

A: That would not be nice!

#RealWorldCrypto

Next up, "Randomness of random in Cisco ASA", by Ryad BENADJILA and Arnaud EBALARD

#RealWorldCrypto

ECDSA certificates: 😵

#RealWorldCrypto

nonce reuse w/ same ECDSA signing key -> leaked key!

#RealWorldCrypto

#RealWorldCrypto

oof these network appliances

#RealWorldCrypto

👀

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

🤔

#RealWorldCrypto

oh boy

#RealWorldCrypto

Fail instead of falling back to bad entropy source

#realworldcrypto

Next up, "On the possibility of a backdoor in the Micali-Schnorr generator", presented by Adam Suhl

#RealWorldCrypto

👀👀👀

#RealWorldCrypto

Juniper 😓

#RealWorldCrypto

Some familiar patterns between Dual EC DRBG and Micali-Schnorr

#RealWorldCrypto

Some subtle changes between the first proposal of Micali-Schnorr and the ISO standard, against the proof of security 😳

#RealWorldCrypto

Repeated RSA encryption

#RealWorldCrypto

Can you use knowledge of the rsa prime factors to rewind the state?

#RealWorldCrypto

Does any malicious construction of these moduli give you an advantage in Micali-Schnorr?

#RealWorldCrypto

#RealWorldCrypto

There /is/ an algebraic attack, in non-default settings

#RealWorldCrypto

#RealWorldCrypto

Compliant with the standard!

#RealWorldCrypto

RSA PRG

#RealWorldCrypto

Short cycles 😳

#RealWorldCrypto

A possible undetectable backdoor 👀

#RealWorldCrypto

But how to exploit? NOBUS-style? Truncation makes it harder

#RealWorldCrypto

Contact the authors!

#RealWorldCrypto

eprint.iacr.org/2023/440.pdf

#RealWorldCrypto

Q: performance?

A: Supposedly they are 'better' / stronger, but slower

#RealWorldCrypto

Q: Special primes?

A: For Mersenne primes, there is some work on special attacks (or something)

#RealWorldCrypto

Next up, lightning talks!

#RealWorldCrypto

Rosenpass pq vpn: github.com/rosenpass/rose…

#RealWorldCrypto

Poseidon hash function, all usages insecure (!), safe api (?), Fiat-Shamir for you?

#RealWorldCrypto

Do you need a nice chip as a trusted platform for crypto ops? Missed the name

#RealWorldCrypto

RingVRF: eprint.iacr.org/2023/002.pdf

#RealWorldCrypto

key management via threshold, millions of keys

#RealWorldCrypto

meshcal.co

#RealWorldCrypto

eprint.iacr.org/2021/326.pdf 🎉

#RealWorldCrypto

Lurk: github.com/lurk-lang

#RealWorldCrypto

zCalc

#RealWorldCrypto

zka.lc

#RealWorldCrypto

SAFE api (sponge api for field elements): hackmd.io/@7dpNYqjKQGeYC…

#RealWorldCrypto

Martin Albrecht is hiring post-docs

#RealWorldCrypto

Nigel is hiring at COSICs

#RealWorldCrypto

Eli from @NCCsecurityUS, Cryptopals Guided Tour youtube.com/playlist?list=…

#RealWorldCrypto

@isogenies from CryptoHack needs assistance to implement PQ CTF challenges!

#RealWorldCrypto

ISRG has money to help run infra like DivvyUp

#RealWorldCrypto

Lunchtime!

Coming up, "Reactionary Authoritarianism, Encryption, and You!", presented by Erica Portnoy

#RealWorldCrypto

The reactionary authoritarian drive to
rein in unacceptable social deviance is
directly linked to limiting the internet for
kids and the scanning of private content,
which means technologists must encrypt
content quickly and defend encryption
publicly.

#RealWorldCrypto

The authoritarian impulse to restore control overrides other rights like privacy, free speech

#RealWorldCrypto

Empowering bounty hunters in Texas against people seeking healthcare

#RealWorldCrypto

Hungarian law prohibits sharing any lgbtq+ content with minors. How do you enforce when most content today is digital?

#RealWorldCrypto

BUNNY. 💜

#RealWorldCrypto

The internet is where ideas spread [which is why authoritarians want to control it]

#RealWorldCrypto

#RealWorldCrypto

Utah bill ready to be signed 😳

#RealWorldCrypto

Sleepy bunny :😴

#RealWorldCrypto

Authoritarians cannot allow uncontrolled private communication

#RealWorldCrypto

#RealWorldCrypto

Pivot to CSAM instead of in-person abuse

#RealWorldCrypto

Surveillance impinges freedom

#RealWorldCrypto

Inserting ghost users in e2ee group chats or other channels

#RealWorldCrypto

/intended recipients/ matter

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

Yes yes this 💯

#RealWorldCrypto

#RealWorldCrypto

🐰

#RealWorldCrypto

So, what can we, the people building technology, do about it?

#RealWorldCrypto

#RealWorldCrypto

Myth: we have to settle for the least bad option. False! You don't have to pick one!

#RealWorldCrypto

Don't design a system that will reveal people's data just because there's cool crypto involved.

#RealWorldCrypto

It's easier to defend E2EE that's already deployed than hypothetical systems that haven't been deployed yet.

#RealWorldCrypto

Pin this one.

#RealWorldCrypto

"It's impossible [to legislate this]"

#RealWorldCrypto

Just because they don't understand technology doesn't mean they can't or won't legislate about it.

#RealWorldCrypto

</fin>

#RealWorldCrypto

Q: Areas where we're missing privacy technology now?

A: E2EE cloud backups, hard but not impossible (mostly e2ee iCloud, WhatsApp)

#RealWorldCrypto

Q: "it's impossible" sounds like lying?

A: Impossible to build in the real world under real constraints.

#RealWorldCrypto

Q: What about the "we have to do something!!!" line?

A: In politics you have to get elected, to get elected to have to be seen doing things, that will get people to vote for you, so the pressures are different vs technologists

#RealWorldCrypto

Next up, "Three Lessons From Threema: Analysis of a Secure Messenger", by Kien Tuong Truong and Matteo Scarlata

#RealWorldCrypto

(We went in-depth on their paper on this episode of @SCWpod: securitycryptographywhatever.com/2023/01/27/thr…)

@SCWpod "tries to hide the message length"

#realworldcrypto

If this metadata box appears bolted-on, you would be right

#RealWorldCrypto

C2S is basically hand-rolled TLS, but it uses the same keypair as the E2E protocol 😬

#RealWorldCrypto

#RealWorldCrypto

"Hwat is a vouch box??"

#RealWorldCrypto

Lack of domain separation 😭

#RealWorldCrypto

#RealWorldCrypto

lol. lmao

Stunt crypto :P

#RealWorldCrypto

Threema, just like a good Swiss cheese, it has holes 😂

#RealWorldCrypto

'lose your threema attack as a service' 💀

#RealWorldCrypto

(See the WhatsApp E2EE backup talks yesterday, instead of how Threema did E2EE backup here)

#RealWorldCrypto

Fun

#RealWorldCrypto

Extract whole encrypted backup private key 💀

#RealWorldCrypto

All fixed by Threema

#RealWorldCrypto

"Don't roll your own crypto^H^H^H^H^Hprotocol!"

securitycryptographywhatever.com/2021/07/31/the…

#RealWorldCrypto

Strong cryptobox API influence on the design of a whole protocol (in a bad way)

#RealWorldCrypto

#RealWorldCrypto

Cross-protocol interactions!

#RealWorldCrypto

Also seen in other systems like Matrix!

securitycryptographywhatever.com/2022/11/02/Mat…

#RealWorldCrypto

Beware!

#RealWorldCrypto

Next up, "Interoperability in E2EE Messaging", presented by Julia Len

#RealWorldCrypto

Yup

#RealWorldCrypto

EU DMA is forcing interop. Somehow.

#RealWorldCrypto

Would allow a Signal user to message a WhatsApp user without the Signal user needing to make a WhatsApp account

#RealWorldCrypto

Initial deadline of March 2024 (!)

#RealWorldCrypto

Different services can vary on a lot of axes

#RealWorldCrypto

Retrofitting protocols and systems to support interop that were never designed to do so

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

¯\_(ツ)_/¯

#RealWorldCrypto

Server-to-server makes more sense

#RealWorldCrypto

Identity discovery

#RealWorldCrypto

"Everybody use a standardized protocol" yeah right

#RealWorldCrypto

Hm

#RealWorldCrypto

Could get code complexity expensive and more attack surface

#RealWorldCrypto

Interop abuse prevention: just don't? 😅

#RealWorldCrypto

#RealWorldCrypto

Message franking!

#RealWorldCrypto

(This does seem like a lot of work to deploy)

#RealWorldCrypto

#RealWorldCrypto

Key transparency? Metadata leakage? Calling?

#RealWorldCrypto

Hm! eprint.iacr.org/2023/386.pdf

#RealWorldCrypto

Q: Crypto agility?

A: Making it hard to interop seems to violate DMA; would have to standardize something

#RealWorldCrypto

Next up, "Metadata Protection for MLS and Its Variants", by Shuichi Katsumata Thomas Prest Keitaro Hashimoto

#RealWorldCrypto

Content but also metadata leaks a lot about users

#RealWorldCrypto

Bootstrapping Messaging Layer Security to have the metadata privacy properties of Signal

#RealWorldCrypto

ietf.org/archive/id/dra…

#RealWorldCrypto

The messaging service needs to know who the msg is for to route it; this communication graph metadata is valuable!

#RealWorldCrypto

#RealWorldCrypto

NSA: "we kill people based on metadata"

#RealWorldCrypto

[To be precise, Michael Hayden, former head of NSA and CIA, said that]

#RealWorldCrypto

3 layers: messages, static explicit metadata, dynamic implicit metadata

#RealWorldCrypto

Yep, MLS motivated by the poor scaling of using pairwise channels for groups

#RealWorldCrypto

Instead of pairwise keys, MLS uses TreeKEM to calc common group message keys and ratchet treekem as users enter/leave group or whenever a rekey is invoked, scales to tens of thousands of group members

#RealWorldCrypto

#RealWorldCrypto

Because there is a unique continually evolving key, can use that key to encrypt and sign group metadata privately that any group member can update and verify

#RealWorldCrypto

#RealWorldCrypto

Proof in UC model!

#RealWorldCrypto

next steps, work on content moderation?

#RealWorldCrypto

Next up, "Real World Deniability in Messaging", presented by Daniel Collins

#RealWorldCrypto

How relevant is deniability, really?

#RealWorldCrypto

Signal: X3DH and Double Ratchet

Claims that X3DH provides deniability

#RealWorldCrypto

By composition, using Double Ratchet with X3DH is also deniable

#RealWorldCrypto

oh ho

#RealWorldCrypto

🤔

#RealWorldCrypto

#RealWorldCrypto

Hm!

#RealWorldCrypto

(lots of screenshots submitted as evidence)

#RealWorldCrypto

#RealWorldCrypto

Hmmm

#RealWorldCrypto

[this feels fraught for users who butt-type a lot]

#RealWorldCrypto

'practical/explainable deniability is better'

'minimize metadata/auxilary info'

#RealWorldCrypto

eprint: eprint.iacr.org/2023/403.pdf

#RealWorldCrypto

Q: Deniability is a good property but complex; in practice maybe it doesn't give you what you think it does; can we ever really achieve deniability?

A: Under restricted circumstances it seems so

#RealWorldCrypto

break time!

#RealWorldCrypto

Next up, "The Path to Real World FHE: Navigating the Ciphertext Space", by Shruthi Gorantala

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

Huge ciphertext size, complexity

#RealWorldCrypto

Multiverse of FHE schemes 🍩

#RealWorldCrypto

#RealWorldCrypto

Which fhe library? Which fhe compiler? How to interop?

#RealWorldCrypto

How do you paint the whole elephant?

#RealWorldCrypto

frontend
middle-end
backend

A whole compiler toolchain (like llvm to a point)

#RealWorldCrypto

Nice

#RealWorldCrypto

#RealWorldCrypto

Synthesis this far up!

#RealWorldCrypto

#RealWorldCrypto

Nice nice nice

#RealWorldCrypto

[need more like this in ZK proof circuits]

#RealWorldCrypto

#RealWorldCrypto

😵‍💫

#RealWorldCrypto

FHE programs are huge [😬]

#RealWorldCrypto

#RealWorldCrypto

So cool

#RealWorldCrypto

#RealWorldCrypto

lol mobile FHE no time soon

#RealWorldCrypto

That was Boolean, now arithmetic:

#RealWorldCrypto

heh

#RealWorldCrypto

😬

#RealWorldCrypto

#RealWorldCrypto

'The ultimate success of cryptography lies in kicking the developer out of the loop' 😁

#RealWorldCrypto

#RealWorldCrypto

Actualization starts to sound like 'just software engineering' 👍

#RealWorldCrypto

💯

#RealWorldCrypto

github.com/google/fully-h…
[e-mail]

FHE is at where deep learning was 10 years ago 📈

#RealWorldCrypto

Q: Any opportunity to combine infra (MLIRs, math layers) between FHE, MPC, and ZKP?

A: Lots of modular layers agnostic to underlying crypto, that may make crossover possible

#RealWorldCrypto

Next up, "Prime Match: A Privacy Preserving Inventory Matching System", by Antigoni Polychroniadou

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

Privacy-preserving auctions

#RealWorldCrypto

Ha

#RealWorldCrypto

🕳️ 🕳️

#RealWorldCrypto

#RealWorldCrypto

Then on the commitments

#RealWorldCrypto

eprint: eprint.iacr.org/2023/400.pdf

#RealWorldCrypto

Nex tup, "Interoperable Private Attribution (IPA)", presented by Erik Taubeneck and Ben Savage

#RealWorldCrypto

🍻

#RealWorldCrypto

bye bye third party cookies 👋🍪

#RealWorldCrypto

#RealWorldCrypto

Doesn't this enable tracking?

#RealWorldCrypto

OK

#RealWorldCrypto

Secret sharing prevents linking

#RealWorldCrypto

#RealWorldCrypto

3 party honest majority

#RealWorldCrypto

Capped contributions, add noise, aggregate

#RealWorldCrypto

#RealWorldCrypto

Need to be able to sort by match key (🤔)

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

Privacy across queries not just per-query

#RealWorldCrypto

SHARDing

#RealWorldCrypto

Fallback to random match keys

#RealWorldCrypto

#RealWorldCrypto

Seems bad?

#RealWorldCrypto

Next up, CFRG! Presented by Stanislav V. Smyshlyaev

#RealWorldCrypto

IRTF != IETF but sure whatever

#RealWorldCrypto

🌶️

#RealWorldCrypto

Some recent specs:

#RealWorldCrypto

CFRG -> IETF

#RealWorldCrypto

CFRG vs ISO

#RealWorldCrypto

FROST is almost done!

#RealWorldCrypto

#RealWorldCrypto

moar

#RealWorldCrypto

wiki.ietf.org/en/group/cfrg

#RealWorldCrypto

Next up, "NIST Call for Threshold Schemes", by Luis Brandao

#RealWorldCrypto

Some recent NIST crypto projects

#RealWorldCrypto

Also 'exploratory' vs standardization

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

look at this absolute legend

#RealWorldCrypto

Neat

#RealWorldCrypto

#RealWorldCrypto

ooo

#RealWorldCrypto

Need interaction from the community

#RealWorldCrypto

Not a competition!

#RealWorldCrypto

#RealWorldCrypto

That's it for day 2!

#RealWorldCrypto

Day 3! Starting with "HACSPEC: a gateway to high-assurance cryptography", with Karthikeyan Bhargavan and Franziskus Kiefer

#RealWorldCrypto

#RealWorldCrypto

🧡 hacspec 🧡

#RealWorldCrypto

#RealWorldCrypto

Purely functional style

#RealWorldCrypto

#RealWorldCrypto

u32 vs U32 (U32 only supports secret / constant-time behavior) [not my favorite naming scheme but i like the feature]

#RealWorldCrypto

Translates to Coq, EasyCrypt, F* backends (for now)

#RealWorldCrypto

The hacspec itself is executable!

#RealWorldCrypto

#RealWorldCrypto

libcrux!

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

Pretty fast!

#RealWorldCrypto

🎉

#RealWorldCrypto

🎉💖

#RealWorldCrypto

#RealWorldCrypto

(i love this line of work)

#RealWorldCrypto

Q: Properties of implementations vs specifications?

A: hacspec is practically a reference implementation, not just a formal (math) spec; but you can do what you want, matter of taste

#RealWorldCrypto

Next up, "High-assurance Go cryptography in practice", by Filippo Valsorda

#RealWorldCrypto

#RealWorldCrypto

go stdlib re-implemented all its crypto in its native language, originally because it was easier re: the build chain

#RealWorldCrypto

Gives golang crypto a lot of latitude

#RealWorldCrypto

Making it easier not to make mistakes

#RealWorldCrypto

#RealWorldCrypto

The performance cost is worth it! The safety and maintainability advantage is worth it

#RealWorldCrypto

language-agnostic test vectors

#RealWorldCrypto

de-duplication across languages, implementations

#RealWorldCrypto

age testkit

#RealWorldCrypto

#RealWorldCrypto

Published test vectors to github.com/C2SP/CCTV

#RealWorldCrypto

General-purpose fuzzers struggle with crypto code

#RealWorldCrypto

Weighted fuzzing distributions

#RealWorldCrypto

The chance of hitting important field values with random fuzzers is the definition of negligible

#RealWorldCrypto

You should not be allowed to tickle the dragon's tail

#RealWorldCrypto

Nice

#RealWorldCrypto

#RealWorldCrypto

Definining your high-level APIs in terms of bytes helps in avoiding exposing the grotty guts of points, coordinates, etc, to an end-user (vs an implementer)

#RealWorldCrypto

#RealWorldCrypto

Code evolves, original programmers leave and new ones start messing around

#RealWorldCrypto

fiat-crypto generates golang, c, rust, from Coq models of various curve, field math, and other crypto formal models, some with Coq checks of math correctness (like Montgomery arithmetic)

#RealWorldCrypto

The safest code is the code you don't write

#RealWorldCrypto

Deprecate!

#RealWorldCrypto

#RealWorldCrypto

"Performance is a matter of practicality; if it's fast enough, it doesn't need to be faster"

#RealWorldCrypto

yuuup

#RealWorldCrypto

Spending the complexity budget on the subject /matter/, not on the code itself

#RealWorldCrypto

Leaving 5% performance hit on the table because the code is more understandable and reviewable by humans

#RealWorldCrypto

🎉

#RealWorldCrypto

Q: Garbage collector?

A: One solution to temporal memory safety; the garbage collector prevents use-after-free; Rust does borrow checking at compile etc

#RealWorldCrypto

Next up, "CryptOpt: Verified Compilation with Random Program Search for Cryptographic Primitives", presented by Joel Kuepper

#RealWorldCrypto

#RealWorldCrypto

Being super careful does not prevent significant bugs

#RealWorldCrypto

#RealWorldCrypto

Very small trusted computing base

#RealWorldCrypto

Hm!

#RealWorldCrypto

#RealWorldCrypto

CryptOpt basically automates random local search

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

github.com/mit-plv/fiat-c…

Take the output of fiat-crypto, and optimize it with cryptopt

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

it's faster, is it correct? verified checker

#RealWorldCrypto

#RealWorldCrypto

github.com/0xADE1A1DE/Cry…

#RealWorldCrypto

Q: Operate on the operation graph not just the instructions?

A: Get the graph from fiat-crypto, which is optimized, cryptopt doesn't change it, just instructions

#RealWorldCrypto

Q: architecture-specific heuristics?

A: 'yes', double-edged sword

#RealWorldCrypto

Q: How many architectures?

A: Just x86, but all CPUs that support x86

#RealWorldCrypto

Q: How much work to port to another platform?

A: Supporting all the instructions makes a difference for x86; arm doesn't have as many, but we don't expect as much of a perf boost because there is less variety

#RealWorldCrypto

#RealWorldCrypto

Q: Time to generate?

A: Couple of hours

#RealWorldCrypto

Break time!

Next up, "E2EE in Japan – culture and policy", by Hinako Sugiyama

#RealWorldCrypto

👀

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

Next up, "DatashareNetwork: A Decentralized Privacy-Preserving Search Engine for Investigative Journalists", by Kasra EdalatNejad

#RealWorldCrypto

Slap some tor on it 😂

#RealWorldCrypto

prepare to interop with legacy code (incl. oauth)

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

DatashareNetwork paper: usenix.org/system/files/s…

Code: github.com/spring-epfl/da…

#RealWorldCrypto

Next up, "Using ZK Proofs to Fight Disinformation", by Trisha Datta

#RealWorldCrypto

Image provenance verification (bet BeilingCat would like this)

#RealWorldCrypto

C2PA

#RealWorldCrypto

But an original photo often is transformed (compressed, resized, greyscale, cropping) all normal parts of publishing photos; this would affect verification of photo signatures

#RealWorldCrypto

zkSNARKs

#RealWorldCrypto

zkproofs that witness the original photo and the transform(s) applied honestly/correctly

#RealWorldCrypto

#RealWorldCrypto

Original PhotoProof in 2016 was cutting edge but took several minutes to generate a proof for a small image; new advances in zkproof tools now makes it much more efficient

#RealWorldCrypto

Proof verification is /very/ fast, must be

#RealWorldCrypto

Doing SHA256 inside a snark is expensive, even Poseidon is too slow, so Poseidon(LatticeHash(photo_bytes))

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

lol Poseidon-only hash ran out memory at largest input size

#RealWorldCrypto

Neato

#RealWorldCrypto

Q: keep ID of camera private?

A: Not in our threat model

#RealWorldCrypto

Next up, "I was told there would be blockchain: 5 Years of Real World Crypto at DARPA", by Joshua Baron

#RealWorldCrypto

'Are blockchains decentralized?' blog.trailofbits.com/2022/06/21/are…

#RealWorldCrypto

Crypto programs at DARPA

#RealWorldCrypto

Everything on-device

#RealWorldCrypto

"Securing Information for Encrypted Verification and Evaluation
(SIEVE)" (everything at DARPA needs an acronym)

#RealWorldCrypto

#RealWorldCrypto

Care less about succintness, the proof statements are just massive

#RealWorldCrypto

Yessss

#RealWorldCrypto

Extremely difficult to capture say, Rowhammer, but can capture Heartbleed

/17 million gates/

#RealWorldCrypto

#RealWorldCrypto

Relevance to policy

#RealWorldCrypto

#RealWorldCrypto

ZKP to prove you drove on Estonian roads without where/when

#RealWorldCrypto

Resilient Anonymous Communication for Everyone (RACE

#RealWorldCrypto

#RealWorldCrypto

#RealWorldCrypto

All open source; "there is no world where you should trust closed-source DARPA code for anonymous communication" 😁

#RealWorldCrypto

'steganography' encodings

#RealWorldCrypto

[is it butkus or bupkis?]

#RealWorldCrypto

#RealWorldCrypto

better obfuscated tor bridges! 🧅

#RealWorldCrypto

Using MPC for metadata security ("send this e2ee msg to Bob" is moot)

#RealWorldCrypto

Distributed protocols are hard to engineer especially with weird crypto and transports

#RealWorldCrypto

Measuring the Information Control Environment (MICE)

#RealWorldCrypto

Using AI for measurement and analysis of tons of data

#RealWorldCrypto

psiphon.ca

#RealWorldCrypto

#RealWorldCrypto

Lunch time!

#RealWorldCrypto

Next up, "From Theory to Practice to Theory: Lessons Learned from Multi-Party Schnorr Signatures", from Elizabeth Crites, Chelsea Komlo, Tim Ruffing

#realworldcrypto

#realworldcrypto

Schnorr signatures! 💖

#realworldcrypto

Threshold vs multi sigs

#realworldcrypto

#realworldcrypto

#realworldcrypto

Need to commit to our nonces to avoid ROS attacks

#realworldcrypto

#realworldcrypto

Standard single party Schnorr verification

#realworldcrypto

Adaptive security against a continuously-meddling adversary

#realworldcrypto

#realworldcrypto

mult, or threshold?

#realworldcrypto

#realworldcrypto

BROADCAST CHANNEL

(no not like twitter.com)

#realworldcrypto

So if you want to use threshold, how do you pick t and n? FROST just leaves that to you!

#realworldcrypto

#realworldcrypto

No progress, but no forgery

#realworldcrypto

t == n?

#realworldcrypto

Robustness: the protocol succeeds so long
as at least t players participate honestly.
(required for liveness!)

#realworldcrypto

FROST is /not/ robust. Efficient, but

#realworldcrypto

ROAST takes FROST and makes it robust, with n-t+1 FROST protocol runs

#realworldcrypto

FROST draft: datatracker.ietf.org/doc/draft-irtf…

FROST for Zcash draft: github.com/ZcashFoundatio…

MuSig2 for Bitcoin: github.com/bitcoin/bips/b…

#realworldcrypto

NIST call for threshold schemes:

csrc.nist.gov/publications/d…

#realworldcrypto

Some open research problems include efficient deterministic signatures

#realworldcrypto

You /cannot/ use that EdDSA-style deterministic nonce derivation in FROST, it allows key recovery!

#realworldcrypto

#realworldcrypto

So, if we can't do that, can we build a real-world (efficient) deterministic threshold signature at all?

#realworldcrypto

Can we prove that the 2-round schemes require these stronger assumptions?

#realworldcrypto

🔑🔑🔑

#realworldcrypto

#realworldcrypto

✨

#realworldcrypto

3-round and 2-round DKG schemes based on different assumptions

#realworldcrypto

Do two-round, efficient and composable DKGs exist?

#realworldcrypto

🎉

[check out some FROST impls in Rust: github.com/zcashfoundatio…]

#realworldcrypto

Q: BLS sigs?

A: Threshold BLS is great you should use it; of course it's hard to switch when you have deployed ecdsa or schnorr

#realworldcrypto

Q: Adaptive security for 2-round FROST?

A: Proof coming; can maintain 1-round w/ preprocessing FROST variant

#realworldcrypto

Next up, "Threshold ECDSA Towards Deployment", by abhi shelat

#realworldcrypto

Assuming 1 honest party

#realworldcrypto

#realworldcrypto

ECDSA and its weirdness exists because Schnorr sigs were patented until about 2007

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

Subtle work to get our security proof working

#realworldcrypto

✨ Lagrange ✨

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

Nice for key refresh

#realworldcrypto

💯

#realworldcrypto

#realworldcrypto

5 rounds

#realworldcrypto

#realworldcrypto

In the random oracle model, /every/ (sub)protocol instance needs a /different/ random oracle! Prefix it!

#Realworldcrypto

#realworldcrypto

🐘

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

Recovery!

#realworldcrypto

Is threshold a 10x better experience for
{user, organization}?

#realworldcrypto

For the org, yes; for the user, it's annoying/friction, but it's security

#realworldcrypto

Q: Beaver triples—

A: No triples! That's why we avoid the overhead

#realworldcrypto

Next up, "How a Blockchain Can Keep Many Secrets", by Gregory Neven

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

BLS back again

#realworldcrypto

#realworldcrypto

#realworldcrypto

Nice

#realworldcrypto

#realworldcrypto

'status: complicated!' 😅

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

#realworldcrypto

Internet Computer 💻

#realworldcrypto

#realworldcrypto

#realworldcrypto

Q: When subnet validators change, do a key refresh?

A: Yes; you need some forward security notions

#realworldcrypto

Break!

Last session! "tlock: Practical timelock encryption based on threshold BLS", by Yolan Romailler

#realworldcrypto

#realworldcrypto

#realworldcrypto

Applications: 'responsible ransomware' :P

#realworldcrypto

#realworldcrypto

🦸

#realworldcrypto

#realworldcrypto

#realworldcrypto

Chained randomness 👀⛓️

#realworldcrypto

unchained randomness

#realworldcrypto

on-chain size: BLS sigs on BLS12-381 are 96bytes compressed in G_2, and mapping the message to G_2 is 10x more costly than G_1

#realworldcrypto

So, swap G_1 and G_2

#realworldcrypto

age!

#realworldcrypto

eprint: eprint.iacr.org/2023/189.pdf

#realworldcrypto

Code:

github.com/drand/tlock/
github.com/drand/tlock-js/
github.com/thibmeu/tlock-…

#realworldcrypto

Try it now: timevault.drand.love

#realworldcrypto

Q: PQ IBE?

A: Maybe, NIST call may motivate it

#realworldcrypto

Next up, "Portunus: Re-imagining Access Control In Distributed Systems Using Attribute-Based Encryption", by Tanya Verma

#realworldcrypto

heh

#realworldcrypto

#realworldcrypto

But key is not supposed to be outside of the EU 🤔

#realworldcrypto

Naïve approach: every data center gets its own key

#realworldcrypto

Goals:

#Realworldcrypto

Region-based encryption

#realworldcrypto

#realworldcrypto

github.com/cloudflare/cir…

#realworldcrypto

🔑🌐🔑

#realworldcrypto

Nice ✨

#realworldcrypto

Not bad

#realworldcrypto

Classical hybrids

#realworldcrypto

"Formidable notation can hide significant computation steps" oh man yeah

#realworldcrypto

Smells like pairings 😹

#realworldcrypto

Q: How are changes in policy handled by the system?

A: More demand than we can handle (per country, needs a few large datacenters in a region/country before we can deploy)

#realworldcrypto

A: For changes, we ask user to re-upload

#realworldcrypto

Last talk! "Ask Your Cryptographer if Context-Committing AEAD Is Right for You", by Sanketh Menda

#realworldcrypto

mmm mmm love that AEAD 🥰

#realworldcrypto

However:

#realworldcrypto

#realworldcrypto

Multi-recipient integrity

#realworldcrypto

Malicious sender can arrange for different plaintexts to be received! 😭

#realworldcrypto

Currently deployed AEADs are not /key-commiting/

#realworldcrypto

🙈

#realworldcrypto

[are axolotls salamanders?]

#realworldcrypto

#realworldcrypto

#realworldcrypto

These attacks do not invalidate prior security analyses, but they do exploit the lack of key commitment

#realworldcrypto

#realworldcrypto

We could standardize a key-committing solution, but fear this is short-sighted

#realworldcrypto

What we want is /context commitment/, not just key commitment

#realworldcrypto

#realworldcrypto

Key commitment approaches don't ensure context commitment

#realworldcrypto

#realworldcrypto

Some proposals for context commitment schemes:

#realworldcrypto

I see you sponge 🧽

#realworldcrypto

OCH:

+ Simple, single primitive
+ optimal length ciphertexts
+ Maximally parallelizable

#realworldcrypto

Is context-committing AEAD right for you? YES

#realworldcrypto

let's standardize and deploy them!

#realworldcrypto

Q: OCB is my favorite mode

A: Me too!

#realworldcrypto

Q: When are we done?

A: Our applications are getting more and more complex, it's hard to say

#realworldcrypto

Wrap up:

#realworldcrypto

650 in-the-flesh attendees! 150 remote! 🥴

#realworldcrypto

#realworldcrypto

Thanks for attending!

#realworldcrypto

Propose venue for RWC 2025

#realworldcrypto

RWC 2024: Toronto Canada

#realworldcrypto

TIFF Bell Lightbox venue

#realworldcrypto

#realworldcrypto

See you in Canada! 🍁 👋

</fin>

#realworldcrypto