Modern Crypto

I think he already made a strong point why CONIKS style transparency isn't all that great for end-users. See this mailing list thread that includes the author of CONIKS talking about it with moxie before CONIKS was published: https://moderncrypto.org/mail-archive/messaging/2014/000226.html https://moderncrypto.org/mail-archive/messaging/2014/000234.html Basically, users change their identity key in practice so often that a 3rd-party can't be the source of truth on whether a MITM has happened. Only the user can audit that and most users are not equipped to do so. So, towards the goal of universal e2e messaging its not clear that key transparency is a real win over the simplicity of trust-on-first-use.

It's not (only?) a question of "gaining value". End-to-end encryption is fundamentally incompatible with many features that Gmail users rely on. I would recommend reading https://moderncrypto.org/mail-archive/messaging/2014/000780.html from an ex Gmail anti-abuse tech lead. And for 99.99% of Gmail users, protecting automatically against untargeted phishing and malware attacks is a larger security improvement than having e2e encryption.

Because you need something paid for underneath it to stop spam. This fantastic post from Mike Hearn, who was on the GMail spam team and now makes P2P decentarlized stuff, explains it all: https://moderncrypto.org/mail-archive/messaging/2014/000780.html Essentially, every large provider (e.g. Facebook, GMail) of network services ultimately uses phone numbers now as a common thing that can't be infinitely reproduced. They underpin all high quality antispam on large Internet systems.

FWIW this is on hold until I know for sure what high-security-margin curve to use. I'd like this to be a "one-ciphersuite-fits-all" protocol, which puts a lot of pressure on getting that choice right. In addition to DJB's Curve41417 (not yet implemented), Mike Hamburg's Goldilocks-448 curve looks pretty good, so I'm waiting for that to shake out. http://sourceforge.net/p/ed448goldilocks/wiki/Home/ The "curves" mailing list will (hopefully) be a good place to track that discussion: https://moderncrypto.org https://moderncrypto.org/mail-archive/curves/2014/000139.html

http://blog.cryptographyengineering.com/ He posts more regularly on Twitter, and his tweets are pretty interesting: https://twitter.com/matthew_d_green https://www.imperialviolet.org/ http://www.cryptofails.com/ http://blog.cr.yp.to/index.html (new) https://whispersystems.org/blog/ (good team to follow on their progress) https://moderncrypto.org/ (new)

Mike Hearn. https://moderncrypto.org/mail-archive/messaging/2014/000780.html

I think you're referring to Mike Hearn's https://moderncrypto.org/mail-archive/messaging/2014/000780.html

Youtube in particular sort of famously had content protection code, which took in part the form of a VM implemented in Javascript that probed its runtime to detect non-browser or otherwise headless clients. I think Mike Hearn worked on it. Found it: https://moderncrypto.org/mail-archive/messaging/2014/000780.html

Predicted a few weeks ago, before any news of this came out: https://moderncrypto.org/mail-archive/messaging/2020/002586.html

Simple, non-evil answer: because it would severely impede spam prevention. This extensive writeup has details: https://moderncrypto.org/mail-archive/messaging/2014/000780.html Long story short, to control spam, you basically have 2 options: 1. Control who can send messages 2. Inspect message content 3. Impose costs Signal and WhatsApp chose (1). E-mail (and probably any federated protocol) requires (2) or (3), and there is no universally-adopted (3) for e-mail.

This is relevant in a way: Modern anti-spam and E2E crypto https://moderncrypto.org/mail-archive/messaging/2014/000780.html

It's not a good defense, because a double fault injection attack could bypass the signature verification as well. The only software defense that actually works reliably is preventing duplicate r-values from being generated in the first place. This can be accomplished by augmenting the fully deterministic r with some additional randomness, producing a synthetic r which is still guaranteed to be unique-per-message even if we have an RNG failure. See: https://moderncrypto.org/mail-archive/curves/2017/000925.html Note this is quite different from the k-value in ECDSA, which is not synthesized from the message contents at all.

I think you're underestimating the issue. The core issue here is spam, and whether or not it's possible to make a non-centralized open source self-contained spam figthing engine is still unanswered. I'm not going to go into details, but I invite you to read this article for some background: https://moderncrypto.org/mail-archive/messaging/2014/000780.html

A lot of this echos Daniels Bernstein's email about CPUS are designed for video games. https://moderncrypto.org/mail-archive/noise/2016/000699.html

A possible procedure is described by Moxie here: https://moderncrypto.org/mail-archive/messaging/2014/001022.html

They can always add some obfuscated code in their proprietary version and require a code every so often or something similar. Google has been known to do this https://moderncrypto.org/mail-archive/messaging/2014/000780.html "As an example, I created a system that randomly generates encrypted JavaScripts that are designed to resist reverse engineering attempts." If they provide a binary blob that resists reversing, there might not be a way around including that blob.

Boxbe is an interesting service, thanks. Maybe this 'permission-based' was never a standard because spam didn't exist back then and, later when it did exist, didn't play well with the idea of mailing lists. In the latter context it's funny how this search term is SEO'd to return marketing services! Having just read a former google abuse team member's take on end to end encryption and anti-spam[1], this topic now looks a lot more complex. Regarding IM's, he mentions how spam-free WhatsApp is and argues that spam is a lot easier to fight when you have central control because you can change anything at any time at any point (client or server). [1] Mike Hearn, https://moderncrypto.org/mail-archive/messaging/2014/000780.html

This is actually very hard to sort out and is a deal-breaker for end-to-end email encryption. https://moderncrypto.org/mail-archive/messaging/2014/000780.html

So, as mentioned in the first link, client audits via the browser would do absolutely nothing during an attack: "None of CT’s proofs (audit or consistency proofs) will detect mis-issuance of a certificate by a rogue CA, not even if gossip of STHs (signed-tree-heads) successfully occurs [1]" And that's for today's attacks. In the section before that paragraph, another attack is demonstrated that also cannot be prevented by CT's audit proofs. [1] https://moderncrypto.org/mail-archive/messaging/2014/000873.html

Interesting thoughts on how spam detection would work in such a system: https://moderncrypto.org/mail-archive/messaging/2014/000780.html.

Thanks for the clarification! You might want to add that point to your technical how-it-works section[1]. I was wondering how older browsers would accept a new CA's signature. Also, I really wish AOL would have donated their root certs to y'all[2] so you didn't have to set up a whole new CA. [1]: https://letsencrypt.org/howitworks/technology/ [2]: https://moderncrypto.org/mail-archive/messaging/2014/000618.html

That's a common problem when using OTR with the same account in a multi-device environment. It is fixed by the introduction of instance tags in libotr 4.x [0]. You should check the versions of libotr used by all your clients - if they are all libotr 4.0+, you shouldn't have these problems. [0] https://otr.cypherpunks.ca/UPGRADING-libotr-4.1.0.txt A simple workaround is to use a different account for each device (e.g. [email protected], [email protected]). TextSecure's developers recognize that a good multi-device experience is essential to provide a comparable experience to other messaging apps. Their approach is different from OTR's, and is described here [0]. [0] https://moderncrypto.org/mail-archive/messaging/2014/001022.html

Interesting. The link I posted above must not be the one I read a few days ago on HN (or somewhere else?), cause it was actually posted several years ago on HN. Let me find what I read recently... Aha, it was on reddit, and is here: https://moderncrypto.org/mail-archive/messaging/2014/000780.html Ah, and you're right, I misremembered what it said about that, indeed it says gmail does not do that. okay! Obviously it _could_ if it wanted to, and other webmail might. But gmail does not, okay!

TLDR is: Distributed (as in DNS) directory with append-only entries keyed by hash-of-email and third party replication/validation/logging. Discussion of spam implications at https://moderncrypto.org/mail-archive/messaging/2014/000727.html Widespread encryption could be a recipe for Google (as the largest of the proposed directories) sliding in an identity reputation scheme (eg. based on location / communications history) and brokering it as a service.

Not sure why this was downvoted, but something like this[1] posted by the author was helpful. [1] https://moderncrypto.org/mail-archive/messaging/2014/000602.html

Hi, I'm the author of this document and principal developer of the project. This is a somewhat detailed design overview for a proposed alternative to the PGP keyserver system that I'm building and I didn't really write it for a general audience to avoid cluttering it up with too much background information. Sometime soon we're going to improve the website with a friendlier high-level description of the goals of the project and the problems that it solves. For now, I apologize that this rather dense document is the only information available. It might be easier to understand what I'm trying to achieve by reading a post I made yesterday to the modern crypto mailing list which summarized the important features of Nyms: https://moderncrypto.org/mail-archive/messaging/2014/000602.html

Hi, I wrote about it before here: https://moderncrypto.org/mail-archive/messaging/2014/000780.html > most of your discussion of what to do is to increase the cost of sending lots of email. I don't think I've ever proposed increasing the cost of sending lots of mail? Or not that I recall! I've definitely discussed increasing the cost of sending lots of unwanted mail, but that's not the same thing. > No one credible is trying to do this: every complete and in-depth model for this that I have heard involves variable pricing, decided by the receiver per-sender, and entirely solves these use cases. Variable pricing doesn't solve the issue because a key part of email is the ability to receive emails from strangers who haven't contacted you before. This can also be the case for bulk mailers, e.g. if you write down your email address with pen and paper for your local school, who then emails every parent. How do you price that? And is this "price" measured in abstract units people have no intuition for, like CPU cycles, because it's surely not in dollars. So I've never seen a workable proposal for introducing pricing or charging into email. > maybe those solutions don't work, but you have to argue that. Jameson only mentions hashcash in passing, he's mostly writing about how email was better when it was more decentralised, before the coming of big providers. Which is a bit odd to me because in the early days of the internet the only people with email accounts were those…

I don't use Signal mostly because nobody I know uses it, even though I know they have it installed. By pure usage statistics the winner would be WhatsApp. I also use Wire. In terms of issues with each of these, Wire has occasional bugs and hiccups (UX wise) and would be unsuitable for large groups exchanging messages (every device implies an entirely new ratchet, users own multiple devices, and all Wire group chats are client-fan-out, meaning pairwise ratchets with all members. Users with more than one device, even if they communicate one-on-one, are effectively in a group session). However the group message problem implies trade-offs and doesn't have an easy solution, so this shouldn't be seen as game-ending criticism (there's an ongoing effort involving people from all three messengers to figure out group messaging in a safe and scalable way, called Message Layer Security). WhatsApp is much more feature stable, but compromises on client-fan-out to make group messaging simpler. I think Signal also does client fan-out. I think Signal were also a bit dismissive of the low order point issue in their protocol (https://research.kudelskisecurity.com/2017/04/25/should-ecdh-keys-be-v… but it's arguable whether this is an issue at all their instantiation of DH (https://moderncrypto.org/mail-archive/curves/2017/000896.html). So in terms of cryptography, all three are state-of-the-art. I haven't really used Threema, but for completeness I had a brief look at their crypto…

What my blog actually said about that was: "I’ve had some experts tell me they thought the security level was 2^80 operations (very weak), while others (including Zooko himself) thought it was [more like 2^96](https://moderncrypto.org/mail-archive/curves/2016/000742.html). I’m not sure which figure is right, but the fact that there’s disagreement is a bad sign." I made it very clear that it is an unsubstantiated figure, and linked to Zooko's analysis. To both yourself and the person you're replying too, please don't put words in my mouth. > We provided participants with a reproducibly built and stripped down version of Alpine Linux, employed grsec, wrote all of our crypto software in pure Rust, etc. All of our software is reproducibly built, hashed and signed. There is nothing (software-wise) that cannot be caught in post-hoc review. All of it is open-source: https://github.com/zcash/mpc I agree. But that's not what I said; what I said is that post-hoc review hasn't been done, even a year after the fact.