Security Cryptography Whatever

Alle afleveringen

68 afleveringen, van nieuw naar oud

1. Hertzbleed

   18 juni 2022 · 59 min

   Afspelen
   Side channels! Frequency scaling! Key encapsulation, oh my! We're talking about the new Hertzbleed paper, but also cryptography conferences, 'passkeys', and end-to-end encrypting yer twitter.com DMs. Lees meer

   Transcript:
   https://securitycryptographywhatever.com/2022/06/17/hertzbleed/

   Links:

   Hertzbleed Attack | ellipticnews (wordpress.com)

   https://www.hertzbleed.com/hertzbleed.pdf

   https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3920031

   Merch: https://merch.scwpodcast.com

   "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

2. OMB Zero Trust Memo with Eric Mill

   11 juni 2022 · 1 uur 1 min

   Afspelen
   The US government released a memo about moving to a zero-trust network architecture. What does this mean? We have one of the authors, Eric Mill, on to explain it to us. Lees meer

   As always, your @SCWPod hosts are Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@davidcadrian).

   Transcript:
   https://securitycryptographywhatever.com/2022/06/10/omb-zero-trust-memo-with-eric-mill/

   Links:

   OMB Memo

   Executive order on cybersecurity

   PIV card

   Derived PIV

   BeyondCorp

   HSTS Preloading

   .gov preloading

   Neither Rain, Nor Snow, Nor MITM

   EDR memo

   Technology Transformation Services (TTS)

   Is it Christmas?

   "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

3. Tink with Sophie Schmieg

   28 mei 2022 · 1 uur 7 min

   Afspelen
   We talk about Tink with Sophie Schmieg, cryptographer and algebraic geometer at Google. Lees meer

   Transcript:
   https://securitycryptographywhatever.com/2022/05/28/tink-with-sophie-schmieg/

   Links:

   Sophie: https://twitter.com/SchmiegSophie

   Tink: https://github.com/google/tink

   RWC talk: https://youtube.com/watch?t=1028&v=CiH6iqjWpt8

   Where to store keys: https://twitter.com/SchmiegSophie/status/1413502566797778948

   EAX mode: https://en.wikipedia.org/wiki/EAX_mode

   AES-GCM-SIV: https://en.wikipedia.org/wiki/AES-GCM-SIV

   Deterministic AEADs: https://github.com/google/tink/blob/master/docs/PRIMITIVES.md#deterministic-authenticated-encryption-with-associated-data

   Thai Duong: https://twitter.com/XorNinja

   AWS-SDK Vuln: https://twitter.com/XorNinja/status/1310587707605659649

   "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

4. Cancellable Crypto Takes and Real World Crypto

   13 april 2022 · 1 uur 11 min

   Afspelen
   Live from Amsterdam, it's cancellable crypto hot takes! A fun little meme, plus a preview of the Real World Crypto program! Lees meer

   Transcript:
   https://securitycryptographywhatever.com/2022/04/12/cancellable-crypto-takes-and-real-world-crypto/

   Links:

   Tony's twete: https://twitter.com/bascule/status/1512539700220805124
   Real World Crypto 2022: https://rwc.iacr.org/2022
   Merch! https://merch.scwpodcast.com

   Find us at:
   https://twitter.com/scwpod
   https://twitter.com/durumcrustulum
   https://twitter.com/tqbf
   https://twitter.com/davidcadrian

   "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

5. Lattices and Michigan Football with Chris Peikert

   13 maart 2022 · 1 uur 10 min

   Afspelen
   We're back! With an episode on lattice-based cryptography, with Professor Chris Peikert of the University of Michigan, David's alma mater. When we recorded this, Michigan football had just beaten Ohio for the first time in a bajillion years, so you get a nerdy coda on college football this time! Lees meer

   Transcript:
   https://securitycryptographywhatever.com/2022/03/12/lattices-and-michigan-football-with-chris-peikert/

   Slides: https://web.eecs.umich.edu/~cpeikert/pubs/slides-qcrypt.pdf

   Links:

   He Gives C-Sieves on the CSIDH: https://eprint.iacr.org/2019/725
   Lattice-based Cryptography: https://cims.nyu.edu/~regev/papers/pqc.pdf
   NIST PQC Competition: https://csrc.nist.gov/Projects/post-quantum-cryptography
   The 2nd Bar Ilan Winter School on Cryptography Lattice- Based Cryptography and Applications: https://www.youtube.com/playlist?list=PL8Vt-7cSFnw2OmpCmPLLwSx0-Yqb2ptqO
   A Decade of Lattice Cryptography: https://eprint.iacr.org/2015/939.pdf

   Find us at:
   https://twitter.com/scwpod
   https://twitter.com/durumcrustulum
   https://twitter.com/tqbf
   https://twitter.com/davidcadrian

   "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

6. Biscuits with Geoffroy Couprie

   29 januari 2022 · 59 min

   Afspelen
   We've trashed JWTs, discussed PASETO, Macaroons, and now, Biscuits! Actually, multiple iterations of Biscuits! Pairings and gamma signatures and Datalog, oh my! 🍪 Lees meer

   Transcript:
   https://securitycryptographywhatever.com/2022/01/29/biscuits-with-geoffroy-couprie/

   Links:

   Biscuits V2: https://www.biscuitsec.org

   Experiments iterating on Biscuits: https://github.com/biscuit-auth/biscuit/tree/master/experimentations

   Apache Pulsar: https://pulsar.apache.org

   Spec: https://github.com/biscuit-auth/biscuit/blob/master/SPECIFICATIONS.md

   Find us at:
   https://twitter.com/scwpod
   https://twitter.com/durumcrustulum
   https://twitter.com/tqbf
   https://twitter.com/davidcadrian

   "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

7. Tailscale with Avery Pennarun and Brad Fitzpatrick

   15 januari 2022 · 1 uur 18 min

   Afspelen
   “Can I Tailscale my Chromecast?” Lees meer

   You love Tailscale, I love Tailscale, we loved talking to Avery Pennarun and Brad Fitzpatrick from Tailscale about, I dunno, Go generics. Oh, and TAILSCALE! And DNS. And WASM.

   Transcript:
   https://securitycryptographywhatever.com/2022/01/15/tailscale-with-avery-pennarun-brad-fitzpatrick/

   People:

   Avery Pennarun (@apenwarr)

   Brad Fitzpatrick (@bradfitz)

   Deirdre Connolly (@durumcrustulum)

   Thomas Ptacek (@tqbf)

   David Adrian (@davidcadrian)

   @SCWPod

   Links:

   DERP server: https://github.com/tailscale/tailscale/tree/main/derp

   https://xtermjs.org/

   The Tail at Scale : https://research.google/pubs/pub40801/

   Raft: https://raft.github.io/

   Litestream: https://litestream.io/

   MagicDNS: https://tailscale.com/kb/1081/magicdns/

   Netstack: https://github.com/google/netstack

   "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

8. The feeling's mutual: mTLS with Colm MacCárthaigh

   29 december 2021 · 1 uur 11 min

   Afspelen
   We recorded this months ago, and now it's finally up! Lees meer

   Colm MacCárthaigh joined us to chat about all things TLS, S2N, MTLS, SSH, fuzzing, formal verification, implementing state machines, and of course, DNSSEC.

   Transcript:
   https://securitycryptographywhatever.com/2021/12/29/the-feeling-s-mutual-mtls-with-colm-maccarthaigh/

   Find us at:
   https://twitter.com/scwpod
   https://twitter.com/durumcrustulum
   https://twitter.com/tqbf
   https://twitter.com/davidcadrian

   "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

9. Holiday Call-in Spectacular!

   22 december 2021 · 1 uur 22 min

   Afspelen
   Happy New Year! Feliz Navidad! Merry Yule! Happy Hannukah! Pour one out for the log4j incident responders! Lees meer

   We did a call-in episode on Twitter Spaces and recorded it, so that's why the audio sounds different. We talked about BLOCKCHAIN/Web3 (blech), testing, post-quantum crypto, client certificates, ssh client certificates, threshold cryptography, U2F/WebAuthn, car fob attacks, geese, and more!

   Transcript:
   https://securitycryptographywhatever.com/2021/12/21/holiday-call-in-spectacular/

   Find us at:
   https://twitter.com/scwpod
   https://twitter.com/durumcrustulum
   https://twitter.com/tqbf
   https://twitter.com/davidcadrian

   "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

10. WireGuard with Jason Donenfeld

    5 december 2021 · 1 uur 21 min

    Afspelen
    Hey, a new episode! We had a fantastic conversation with Jason Donenfeld, creator of our favorite modern VPN protocol: WireGuard! We touched on kernel hacking, formal verification, post-quantum cryptography, developing with disassemblers, and more! Lees meer

    Transcript:
    https://securitycryptographywhatever.com/2021/12/05/wireguard-with-jason-donenfeld/

    Links:

    WireGuard: https://www.wireguard.com

    Tamarin: https://tamarin-prover.github.io

    IDApro: https://hex-rays.com/ida-pro

    NIST PQC: https://csrc.nist.gov/projects/post-quantum-cryptography/round-3-submissions

    WireGuard Patreon: https://www.patreon.com/zx2c4

    "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

11. PAKEs, oPRFs, algebra with George Tankersley

    27 oktober 2021 · 1 uur 15 min

    Afspelen
    A conversation that started with PAKEs (password-authenticated key exchanges) and touched on some cool math things: PRFs, finite fields, elliptic curve groups, anonymity protocols, hashing to curve groups, prime order groups, and more. Lees meer

    With special guest, George Tankersley!

    Transcript:
    https://securitycryptographywhatever.com/2021/10/26/pakes-oprfs-algebra-with-george-tankersley/

    Links:

    SRP deprecation: https://blog.cryptographyengineering.com/should-you-use-srp

    OPAQUE: https://www.ietf.org/id/draft-irtf-cfrg-opaque-06.html

    obfs: https://github.com/shadowsocks/simple-obfs

    Elligator: https://elligator.cr.yp.to

    Hash to Curve: https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-12.html

    Magic Wormhole: https://github.com/magic-wormhole/magic-wormhole

    Biscuits: https://github.com/CleverCloud/biscuit

    Ristretto: https://ristretto.group

    Monero signature bug: https://www.getmonero.org/ru/2017/05/17/disclosure-of-a-major-bug-in-cryptonote-based-currencies.html

    SIDH smooth-order supersingular curves: https://link.springer.com/chapter/10.1007/978-3-662-53018-4_21

    "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

12. "Patch, Damnit!"

    20 september 2021 · 1 uur 15 min

    Afspelen
    A lot of fixes got pushed in the past week! Please apply your updates!
    Apple, Chrome, Matrix, Azure, and more nonsense. Lees meer

    Transcript:
    https://securitycryptographywhatever.com/2021/09/20/patch-damnit/

    Find us at:
    https://twitter.com/scwpod
    https://twitter.com/durumcrustulum
    https://twitter.com/tqbf
    https://twitter.com/davidcadrian

    Links!
    The accuvant story in MIT Technology Review
    All the Apple platforms patched FORCEDENTRY no-click 0-day
    Chrome patched some 0-days that were being exploited in the wild
    PASETO update

    "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

13. How to be a Certificate Authority with Ryan Sleevi

    6 september 2021 · 1 uur 34 min

    Afspelen
    Not the hero the internet deserves, but the one we need: it's Ryan Sleevi! Lees meer

    We get into the weeds on becoming a certificate authority, auditing said authorities, DNSSEC, DANE, taking over country code top level domains, Luxembourg, X.509, ASN.1, CBOR, more JSON (!), ACME, Let's Encrypt, and more, on this extra lorge episode with the web PKI's Batman.

    Transcript:
    https://securitycryptographywhatever.com/2021/09/06/how-to-be-a-certificate-authority-with-ryan-sleevi/

    Find us at:
    https://twitter.com/scwpod
    https://twitter.com/durumcrustulum
    https://twitter.com/tqbf
    https://twitter.com/davidcadrian

    "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

14. Apple's CSAM Detection with Matthew Green

    28 augustus 2021 · 53 min

    Afspelen
    We're talking about Apple's new proposed client-side CSAM detection system. We weren't sure if we were going to cover this, and then we realized that not all of us have been paying super close attention to what the hell this thing is, and have a lot of questions about it. So we're talking about it, with our special guest Professor Matthew Green. Lees meer

    We cover how Apple's system works, what it does (and doesn't), where we have unanswered questions, and where some of the gaps are.

    Transcript:
    https://securitycryptographywhatever.com/2021/08/27/apple-s-csam-detection-with-matthew-green/

    Find us at:
    https://twitter.com/scwpod
    https://twitter.com/durumcrustulum
    https://twitter.com/tqbf
    https://twitter.com/davidcadrian

    Links:
    https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf

    https://www.apple.com/child-safety/pdf/Apple_PSI_System_Security_Protocol_and_Analysis.pdf

    https://www.law.cornell.edu/uscode/text/18/2258A

    https://www.missingkids.org/content/dam/missingkids/gethelp/2020-reports-by-esp.pdf

    https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT

    https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_what_it_does

    https://research.fb.com/blog/2021/02/understanding-the-intentions-of-child-sexual-abuse-material-csam-sharers/

    https://www.nytimes.com/interactive/2019/11/09/us/internet-child-sex-abuse.html

    https://www.apple.com/child-safety/pdf/Expanded_Protections_for_Children_Frequently_Asked_Questions.pdf

    "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

15. Platform Security Part Deux with Justin Schuh

    21 augustus 2021 · 1 uur 20 min

    Afspelen
    We did not run out of things to talk about: Chrome vs. Safari vs. Firefox. Rust vs. C++. Bug bounties vs. exploit development. The Peace Corps vs. The Marine Corps. Lees meer

    Transcript:
    https://securitycryptographywhatever.com/2021/08/21/platform-security-part-deux-with-justin-schuh/

    Find us at:
    https://twitter.com/scwpod
    https://twitter.com/durumcrustulum
    https://twitter.com/tqbf
    https://twitter.com/davidcadrian

    "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

16. What do we do about JWT? with Jonathan Rudenberg

    12 augustus 2021 · 1 uur 15 min

    Afspelen
    🔥JWT🔥 Lees meer

    We talk about all sorts of tokens: JWT, PASETO, Protobuf Tokens, Macaroons, and Biscuits. With the great Jonathan Rudenberg!

    After we recorded this, Thomas went deep on tokens even beyond what we talked about here: https://fly.io/blog/api-tokens-a-tedious-survey/

    Transcript: https://securitycryptographywhatever.com/2021/08/12/what-do-we-do-about-jwt-with-jonathan-rudenberg/

    Find us at:
    https://twitter.com/durumcrustulum
    https://twitter.com/tqbf
    https://twitter.com/davidcadrian
    https://twitter.com/scwpod

    "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

17. The Great "Roll Your Own Crypto" Debate with Filippo Valsorda

    1 augustus 2021 · 1 uur 1 min

    Afspelen
    Special guest Filippo Valsorda joins us to debate with Thomas on whether one should or should not "roll your own crypto", and how to produce better cryptography in general. Lees meer

    After we recorded this, David went even deeper on 'rolling your own crypto' in a blog post here: https://dadrian.io/blog/posts/roll-your-own-crypto/

    Transcript:
    https://securitycryptographywhatever.com/2021/07/31/the-great-roll-your-own-crypto-debate-with-filippo-valsorda/

    Links:
    https://peter.website/meow-hash-cryptanalysis
    https://arxiv.org/pdf/2107.04940.pdf
    https://ristretto.group
    https://filippo.io/heartbleed

    Find us at:
    https://twitter.com/durumcrustulum
    https://twitter.com/tqbf
    https://twitter.com/davidcadrian

    "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

18. NSO group, Pegasus, Zero-Days, i(OS|Message) security

    27 juli 2021 · 1 uur

    Afspelen
    Deirdre, Thomas and David talk about NSO group, Pegasus, whether iOS a burning trash fire, the zero-day market, and whether rewriting all of iOS in Swift is a viable strategy for reducing all these vulns. Lees meer

    Transcript:
    https://securitycryptographywhatever.com/2021/07/26/nso-group-pegasus-zero-days-i-os-message-security/

    Find us at:

    https://twitter.com/durumcrustulum
    https://twitter.com/tqbf
    https://twitter.com/davidcadrian

    "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)