Signal's Post-Quantum PQXDH, Same-Origin Policy, E2EE in the Browser Revisted
Nov 7, 2023
auto_awesome
Signal rolled out post-quantum resilient protocol; Intercepting Jabber TLS; Same-origin policy debate; Secure message formats; E2EE challenges in browsers.
01:19:05
AI Summary
AI Chapters
Episode notes
auto_awesome
Podcast summary created with Snipd AI
Quick takeaways
Signal enhances protocol with Kyber pre keys for post-quantum resilience.
Same-origin policy limitations challenge web security design logic.
Proposal for isolated app bundles as centralized web security solution.
Deep dives
Introducing Kyber pre keys to mitigate quantum attacks on Signal's protocol
Signal recently updated their protocol by adding Kyber pre keys to their triple Diffie-Hellman key exchange to address potential quantum attacks. This enhancement aims to prevent adversaries with sufficient quantum computing power from compromising the security of Signal's encrypted messages. The update was rigorously reviewed and analyzed using Proverif and crypto vera to ensure its effectiveness in mitigating store into Crip Later attacks.
Challenges with the existing web security model
The discussion delves into the limitations of the same origin policy and the concept of cross-origin leaks within web security. Challenges around defending against such leaks while emphasizing supply chain security are raised, questioning the effectiveness and logic behind the web security model's design choices. The conversation also explores potential solutions like isolated storage and the need for a more robust security framework.
Exploring solutions for stronger web security
The conversation transitions to brainstorming potential solutions for strengthening web security, including the concept of isolated app bundles managed through secure stores. The idea revolves around having a centralized platform akin to app stores, specifically tailored for web technologies. The goal is to streamline app distribution, updates, and security validations to address the shortcomings of current web security models.
The utility of signal's post quantum key exchange update
The episode further highlights the significance of Signal's post quantum key exchange update, integrating Kyber pre keys to bolster cryptographic security against potential quantum threats. This proactive measure aims to fortify the signal protocol's resistance to quantum computing attacks, ensuring the continued integrity and confidentiality of encrypted communications on the platform.
Issues Discovered in Triple Diffie-Hellman Key Exchange Scheme
The podcast episode delves into the formal modeling of the signal, revealing potential vulnerabilities in the Triple Diffie-Hellman key exchange protocol. The discussion highlights the significance of encoding ambiguity issues, particularly in adapting the protocol for post-quantum security. It underscores the complexity of combining classical cryptography with post-quantum elements and how the formal model exposed security concerns like potential ambiguous public key confusion.
The Challenges of Secure Message Encodings and Formats
Another key point addressed in the podcast is the importance of secure message encodings in cryptographic protocols. The conversation touches on the significance of formalizing secure message formats and encodings to prevent parsing issues and ambiguity in transmitting cryptographic data. The paper called Comparse is suggested as essential reading for protocol implementers to understand the formal notions behind designing secure message encodings.
We're back! Signal rolled out a protocol change to be post-quantum resilient! Someone was caught intercepting Jabber TLS via certificate transparency! Was the same-origin policy in web browers just a dirty hack all along? Plus secure message format formalisms, and even more beating of the dead horse that is E2EE in the browser.