Cryptography FM

On March 1st, 2021, a curious paper appeared on the Cryptology ePrint Archive: senior cryptographer Claus Peter Schnorr submitted research that claims to use lattice mathematics to improve the fast factoring of integers so much that he was able to completely “destroy the RSA cryptosystem” -- certainly a serious claim.

Strangely, while the paper’s ePrint abstract did mention RSA, the paper itself didn’t. Two days later, Schnorr pushed an updated version of the paper, clarifying his method.

Does Schnorr’s proposed method for “destroying RSA” hold water, however? Some cryptographers aren’t convinced. Joining us today is Leo Ducas , a tenured researcher at CWI, Amsterdam who specialises in lattice-based cryptography, to help us understand where Schnorr was coming from, whether his results stand on their own, and how the influence of lattice mathematics in applied cryptography has grown over the past decade.

Links and papers discussed in the show:

• Schnorr's ePrint submission
• Leo Ducas's implementation of Schnorr's proposed algorithm in Sage

Music composed by Toby Fox and performed by Sean Schafianski.

Special Guest: Léo Ducas.

Sponsored By:

• Symbolic Software: This episode is sponsored by Symbolic Software. Symbolic Software helps you bring in the experience and knowledge necessary to design, or prove secure, state-of-the-art cryptographic systems for new solutions. We've helped design and formally verify some of the world's most widely used cryptographic protocols.

Links:

• Fast Factoring Integers by SVP Algorithms by Claus Peter Schnorr — "[...] This destroys the RSA cryptosystem."
• Testing Schnorr's factoring Claim in SageMath

Ever since its introduction in 2012, the BLAKE hash function has been reputed for achieving performance matching and even exceeding MD5 while still maintaining a high security margin.

While the original BLAKE did make it as a finalist to the NIST SHA3 competition, Keccak was ultimately selected. But this hasn’t discouraged the BLAKE team, who in January of this year, published BLAKE3, promising to be even faster than BLAKE2 thanks to a highly parallelizable design and fewer rounds.

But wait, what exactly is a parallelizable hash function? Isn't a lower round number risky? And heck, how do you even design a hash function?! Joining me today are two of the four BLAKE3 authors: Jack O’Connor and Jean-Philippe Aumasson, to discuss these questions and more.

Links and papers discussed in the show:

• BLAKE3
• Too Much Crypto
• PoSH: Proof of Staked Hardware Consensus
• Online Authenticated-Encryption and its Nonce-Reuse Misuse-Resistance

Music composed by Toby Fox and performed by Sean Schafianski.

Special Guests: Jack O'Connor and Jean-Philippe Aumasson.

Sponsored By:

• NSU: This episode of Cryptography FM is sponsored by NSUCRYPTO, the International Olympiad in Cryptography. NSUCrypto is the unique cryptographic Olympiad containing scientific mathematical problems for professionals, school and university students from any country. Its aim is to involve young researchers in solving curious and tough scientific problems of modern cryptography. From the very beginning, the concept of the Olympiad was not to focus on solving olympic tasks but on including unsolved research problems at the intersection of mathematics and cryptography. There were more than 1900 participants from 52 countries in the first six Olympiads! The first round of the 2020 NSUCRYPTO Olympiad will be held this week on October 18th, so head over to the NSUCrypto website at https://nsucrypto.nsu.ru today to sign up and try your hand against interesting and fun cryptography puzzles!

TLS 1.3 has been widely praised as a major upgrade to the Transport Layer Security protocol responsible for securing the majority of Web traffic. But one area in which TLS 1.3 seems to be lacking is its potential for resistance to attacks that utilize quantum computing – computers that, theoretically, could factor the products of large primes and solve the discrete logarithm problem in relatively short periods of time, significantly affecting the security of TLS 1.3.

Today however, we’re discussing an interesting new paper, to be published at this year’s ACM CCS, which introduces KEMTLS: a modified version of TLS 1.3 that uses Key Encapsulation Mechanisms, or KEMs, instead of signatures for server authentication, thereby providing a sort of “post-quantum TLS”.

But what even are KEMs? Are quantum computers even a thing that we should be worried about? On the first ever episode of Cryptography FM, we’ll be hosting Dr. Douglas Stebila and PhD Candidate Thom Wiggers to discuss these questions and more.

Dr. Douglas Stebila is an Associate Professor of cryptography in the Department of Combinatorics & Optimization at the University of Waterloo in Waterloo, Ontario, Canada. His research focuses on improving the security of key exchange protocols and Internet cryptography protocols such as TLS and SSH, including the development of quantum-resistant solutions. His previous work on the integration of elliptic curve cryptography in TLS has been deployed on hundreds of millions of web browsers and servers worldwide.

Thom Wiggers is a PhD Candidate at the Institute of Computing and Information Sciences at Radboud University in The Netherlands. He is working on the interactions of post-quantum cryptography with protocols, under the supervision of Dr. Peter Schwabe, who is also a co-author of the research work that we’re going to discuss today.

Links to discussed papers:

• Post-quantum TLS without handshake signatures
• Big Other: Surveillance Capitalism and the Prospects of an Information Civilization
• Supersingular isogeny key exchange for beginners
• Clone Detection in Secure Messaging: Improving Post-Compromise Security in Practice

Music composed by Toby Fox and performed by Sean Schafianski.

Special Guests: Douglas Stebila and Thom Wiggers.

Sponsored By:

• Symbolic Software: This episode is sponsored by Symbolic Software. Symbolic Software helps you bring in the experience and knowledge necessary to design, or prove secure, state-of-the-art cryptographic systems for new solutions. We've helped design and formally verify some of the world's most widely used cryptographic protocols.

On April 19th 2022, Neil Madden disclosed a vulnerability in many popular Java runtimes and development kits. The vulnerability, dubbed "Psychic Signatures", lies in the cryptography for ECDSA signatures and allows an attacker to bypass signature checks entirely for these signatures. How are popular cryptographic protocol implementations in Java affected? What's the state of Java cryptography as a whole? Join Neil, Nadim and Lucas as they discuss.

Music composed by Yasunori Mitsuda.

Special Guest: Neil Madden.

Sponsored By:

• Symbolic Software: Dr. Kobushi's Labyrinthine Laboratory® is a puzzle game that has been described as “a combination between Pac-Man and chess”. Guide the adventurous Ayla as she attempts to rescue her dog, Falafel, from the confines of a mysterious towering laboratory deep within a solitary forest. Dr. Kobushi's Labyrinthine Laboratory combines puzzle and strategy elements with an engaging storyline full of memorable characters and biting humor.
• IACR: AfricaCrypt is an annual International Conference on the Theory and Applications of Cryptology. AfricaCrypt is a major scientific event that seeks to advance and promote the field of cryptology on the African continent. The conference has systematically drawn some excellent contributions to the field, and has seen many renown researchers deliver keynote presentations. The conference has always been organized in cooperation with the International Association for Cryptologic Research (IACR).

Links:

• CVE-2022-21449: Psychic Signatures in Java
• CVE-2022-21449 Proof of Concept — CVE-2022-21449 Proof of Concept demonstrating its usage with a client running on a vulnerable Java version and a malicious TLS server.
• Bitwarden design flaw: Server side iterations — In the aftermath of the LastPass breach it became increasingly clear that LastPass didn’t protect their users as well as they should have. When people started looking for alternatives, two favorites emerged: 1Password and Bitwarden. But do these do a better job at protecting sensitive data?
• API Security in Action — A web API is an efficient way to communicate with an application or service. However, this convenience opens your systems to new security risks. API Security in Action gives you the skills to build strong, safe APIs you can confidently expose to the world. Inside, you’ll learn to construct secure and scalable REST APIs, deliver machine-to-machine interaction in a microservices architecture, and provide protection in resource-constrained IoT (Internet of Things) environments.
• Illuminated Security News — A low-volume newsletter covering application security, applied cryptography, and identity & access management (IAM) topics. Every newsletter covers one topic in depth with links to interesting articles and podcasts from the wider community.

Wi-Fi is a pretty central technology to our daily lives, whether at home or at the office. Given that so much sensitive data is regularly exchanged between Wi-Fi devices, a number of standards have been developed to ensure the privacy and authentication of Wi-Fi communications.

However, a recent paper shows that every single Wi-Fi network protection standard since 1997, from WEP all the way to WPA3, is exposed to a critical vulnerability that allows the exfiltration of sensitive data. How far does this new attack go? How does it work? And why wasn’t it discovered before? We’ll discuss this and more in this episode of Cryptography FM.

Links and papers discussed in the show:

• Fragment and Forge: Breaking Wi-Fi Through Frame Aggregation and Fragmentation
• Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd
• Release the Kraken: New KRACKs in the 802.11 Standard

Music composed by Toby Fox and performed by Sean Schafianski.

Special Guest: Mathy Vanhoef.

Sponsored By:

• Capsule Social: At Capsule Social, Inc. we are building a platform for decentralized discourse. A place where content creators, writers, and thinkers have full ownership and control over their speech, and enjoy resilience from censorship and takedowns. Capsule Social is hiring decentralized technology engineers, and we'd be thrilled for you to apply.

Links:

• Fragment and Forge: Breaking Wi-Fi Through Frame Aggregation and Fragmentation — In this paper, we present three design flaws in the 802.11 standard that underpins Wi-Fi. One design flaw is in the frame aggregation functionality, and another two are in the frame fragmentation functionality. These design flaws enable an adversary to forge encrypted frames in various ways, which in turn enables exfiltration of sensitive data. We also discovered common implementation flaws related to aggregation and fragmentation, which further worsen the impact of our attacks. Our results affect all protected Wi-Fi networks, ranging from WEP all the way to WPA3, meaning the discovered flaws have been part of Wi-Fi since its release in 1997. In our experiments, all devices were vulnerable to one or more of our attacks, confirming that all Wi-Fi devices are likely affected. Finally, we present a tool to test whether devices are affected by any of the vulnerabilities, and we discuss countermeasures to prevent our attacks.
• Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd — We systematically analyze WPA3 and EAP-pwd, find denial-of- service and downgrade attacks, present severe vulnerabilities in all implementations, reveal side-channels that enable offline dictionary attacks, and propose design fixes which are being officially adopted.
• Release the Kraken: New KRACKs in the 802.11 Standard — We improve key reinstallation attacks (KRACKs) against 802.11 by generalizing known attacks, systematically analyzing all hand- shakes, bypassing 802.11’s official countermeasure, auditing (flawed) patches, and enhancing attacks using implementation-specific bugs.