2020 Crypto Talk Resources
News
Factoring Tempest in a teacup
PGP ? Maybe not
- Debian alternate trust - the last unique use-case for PGP Web-of-Trust replaced due to COVID in part
- Latacora - stop using encrypted email 2020
- Latacora - The PGP Problem 2019
- my 2019 comments odp flipbook * pdf
- A history of end-to-end encryption and the death of PGP Jan, 2020
Alternatives - always know your threat model, as a solution against a different threat model may not be right for you!
- Divorce/Probate Lawyers and Child Welfare Dept ?
- Foreign Nation-State Intelligence / Sabotage?
- Domestic Tax or Law enforcement?
- Housemates ?
- Religious Police ?
- Advertising privacy-breaking data-hoarders ?
Alternatives
- Alternatives to PGP by author of Manning Real-world Cryptography - recaps what's wrong too. May, 2020
- 2021 public Pros and Cons
PGP email plug-in provided a semi-convenient integration to do attachment of real-body as encrypted file, that used the Web of Trust PKI for public-key distribution.
Internet Email protocols are basically broken from birth re Security/Privacy/authenticity. PGP only ever did securing of bodies, not of headers, which for many threat models are problematic too. Secure attachments by encrypting the real message as a file and attaching it is possible with any file-at-rest encryptor, using either PKI or symmetric with out-of-band key or passphrase transmission.
- AxCrypt - Freemium, Windows Mac & Mobile only. Targetted to securing email attachments.
One-time Authenticated Message (^signcryption^)
Assymetric keyed -
- saltpack (lacks forward secrecy?), implemented at keybase.io (now owned by Zoom, so if you're worried about China, maybe not?) and keys.pub
- age and rage alas don't provide signing yet?
Chat
- Tweet
- Signal "is hardened" requires phone#; single device at a time plus desktop; FLOSS.
- WhatsApp "is popular" but owned by FaceBook since 2014 so ...
- Wire "is beautiful"
- Threema "lets you talk to Europeans" works well to EU; mobile only?
- Matrix - Federated protocol ! Element aka Riot=> is lead implementation; see e.g 2019 LWN; bridges networks, Voip, decentralized.
- TextSecure
- Telegram (not fully FLOSS, requires a phone #, only some messages E2E)
File Authentication (Signing)
- minisign
- Signify used by OpenBSD packaging
- Debian alternate trust
- TUF/Notary
Files at rest, Files in motion; Blobs=file at rest
Blob could also be an Attachment - provided symmetric key is passed via a secure channel.
Symmetric encryption - require secure channel to agree a key, of course!
-
nacl/box and nacl/secretbox and impleemntations in the language of your choice! See Saltpack above at Signcryption.
-
Magic Wormhole - in motion only, Syncronous transfer E2E only. (So competes with Apple Airdrop?) Uses PAKE: Password Authenticated Key Exchange 2; handles firewalls and optionally TOR. 2016 slides
-
Encrypted backups - tneds to be a feature of your backup provider. Can of course use any file at rest encryption on a GZ file.
Keyservers/Web-of-Trust
- Keybase.io - bought by Zoom so plausibly under control of hostile nation-state if that bothers you
- "Broadcast of Trust" - posting public key or key signatures on social media, as we did with PGP Fingerprints in .sig
- LastPass Family/Group (paid tier) to share symetric key / passphrase with frequent people you can be seen to be associated with.
Post Quantum Future
Rerun from 2020
- Bruce S
- More Bruce
- Hacker Public Radio episode HPR3147 * eps
- IACR 2020-455
- Overview scribd
- NIST forum
- Dilitium crystals yes they went for the punt
- NIST forum 2
- NSA
- WP: McEliece
- article
- LLNL report
Declassified MILCRYPT III
Dermot Turing & Bletchley Park ; US National Crypto museum
- BP
- UK Nat'l Museum of Computing, at BP
- NSA Museum about https://cryptologicfoundation.org/visit/museum/national_cryptologic_museum.html
- Book X-Y-Z
- Book The Bombe
- The real story of how Enigma was broken - Sir Dermot Turing
- new Collosus video
- The Lawfare Podcast: Project VENONA, with David Hatch, senior historian NSA
RUBICON/MINERVA Scandal Part II: "The Last Rotor Machine"
Continued from 2020 slides video
Late Breaking History "The Scandalous History of the Last Rotor Cipher Machine" IEEE Spectrum, Peter Adams Aug 2021
Reinjecting Rotor Machines: Late Electro-Mechanical Transitional
What came after WW2 Rotor machines ( Enigma (1920s-1930), US SIGABA, and UK TYPEX ), and before Elelectronic machines, besides the WW2 and early Cold War "Pinwheel" machines?
Fialka M-125 (Soviet/Russian)
Doesn't appear to actually reinject but improves on Enigma otherwise.
- CM
- german museum
- wp
- jproc
- W1TP
- article
- another
- tech details archived
- Reflector "Magic Circuit" hack that makes non-reciprocal and allows 1/30 identity
