9 research outputs found
Software Supply Chain Attribute Integrity (SCAI)
The Software Supply Chain Attribute Integrity, or SCAI (pronounced "sky"),
specification proposes a data format for capturing functional attribute and
integrity information about software artifacts and their supply chain. SCAI
data can be associated with executable binaries, statically- or
dynamically-linked libraries, software packages, container images, software
toolchains, and compute environments.
As such, SCAI is intended to be implemented as part of an existing software
supply chain attestation framework by software development tools or services
(e.g., builders, CI/CD pipelines, software analysis tools) seeking to capture
more granular information about the attributes and behavior of the software
artifacts they produce. That is, SCAI assumes that implementers will have
appropriate processes and tooling in place for capturing other types of
software supply chain metadata, which can be extended to add support for SCAI
SoK: Why Johnny Can't Fix PGP Standardization
Pretty Good Privacy (PGP) has long been the primary IETF standard for
encrypting email, but suffers from widespread usability and security problems
that have limited its adoption. As time has marched on, the underlying
cryptographic protocol has fallen out of date insofar as PGP is unauthenticated
on a per message basis and compresses before encryption. There have been an
increasing number of attacks on the increasingly outdated primitives and
complex clients used by the PGP eco-system. However, attempts to update the
OpenPGP standard have failed at the IETF except for adding modern cryptographic
primitives. Outside of official standardization, Autocrypt is a "bottom-up"
community attempt to fix PGP, but still falls victim to attacks on PGP
involving authentication. The core reason for the inability to "fix" PGP is the
lack of a simple AEAD interface which in turn requires a decentralized public
key infrastructure to work with email. Yet even if standards like MLS replace
PGP, the deployment of a decentralized PKI remains an open issue
ClaimChain: Improving the Security and Privacy of In-band Key Distribution for Messaging
The social demand for email end-to-end encryption is barely supported by
mainstream service providers. Autocrypt is a new community-driven open
specification for e-mail encryption that attempts to respond to this demand. In
Autocrypt the encryption keys are attached directly to messages, and thus the
encryption can be implemented by email clients without any collaboration of the
providers. The decentralized nature of this in-band key distribution, however,
makes it prone to man-in-the-middle attacks and can leak the social graph of
users. To address this problem we introduce ClaimChain, a cryptographic
construction for privacy-preserving authentication of public keys. Users store
claims about their identities and keys, as well as their beliefs about others,
in ClaimChains. These chains form authenticated decentralized repositories that
enable users to prove the authenticity of both their keys and the keys of their
contacts. ClaimChains are encrypted, and therefore protect the stored
information, such as keys and contact identities, from prying eyes. At the same
time, ClaimChain implements mechanisms to provide strong non-equivocation
properties, discouraging malicious actors from distributing conflicting or
inauthentic claims. We implemented ClaimChain and we show that it offers
reasonable performance, low overhead, and authenticity guarantees.Comment: Appears in 2018 Workshop on Privacy in the Electronic Society
(WPES'18
CONIKS: Bringing Key Transparency to End Users
We present CONIKS, an end-user key verification service capable of integration in end-to-end encrypted communication systems. CONIKS builds on transparency log proposals for web server certificates but solves several new challenges specific to key verification for end users. CONIKS obviates the need for global third-party monitors and enables users to efficiently monitor their own key bindings for consistency, downloading less than 20 kB per day to do so even for a provider with billions of users. CONIKS users and providers can collectively audit providers for non-equivocation, and this requires downloading a constant 2.5 kB per provider per day. Additionally, CONIKS preserves the level of privacy offered by today’s major communication services, hiding the list of usernames present and even allowing providers to conceal the total number of users in the system
Recommended from our members
CONIKS: Bringing Key Transparency to End Users
We present CONIKS, an end-user key verification service capable of integration in end-to-end encrypted communication systems. CONIKS builds on transparency log proposals for web server certificates but solves several new challenges specific to key verification for end users. CONIKS obviates the need for global third-party monitors and enables users to efficiently monitor their own key bindings for consistency, downloading less than 20 kB per day to do so even for a provider with billions of users. CONIKS users and providers can collectively audit providers for non-equivocation, and this requires downloading a constant 2.5 kB per provider per day. Additionally, CONIKS preserves the level of privacy offered by today’s major communication services, hiding the list of usernames present and even allowing providers to conceal the total number of users in the system