[00:00.600 --> 00:01.740]  Hello.
[00:03.480 --> 00:05.720]  So, who likes crypto here?
[00:07.360 --> 00:13.240]  Yeah, I thought that would be... Who's confident that they know how to do it right?
[00:15.020 --> 00:18.660]  Who's confident that they always do it right?
[00:21.780 --> 00:26.360]  Okay, so I want to start off by talking about some security BS.
[00:26.940 --> 00:31.760]  And here, what we mean by security BS, of course, is before Snowden.
[00:33.340 --> 00:40.960]  Now, Snowden and the Snowden papers aren't responsible for everything that has changed in security over the past three years.
[00:41.200 --> 00:44.020]  But they've been a catalyst for a lot of other stuff as well.
[00:44.140 --> 00:49.120]  And I want to briefly fill you in on how our changing...
[00:49.120 --> 00:54.180]  how our thought as an industry has changed over the past few years.
[00:54.880 --> 00:57.220]  Biggest change is the ATT&CK model.
[00:57.960 --> 01:09.840]  Traditionally, our ATT&CK model has been the wiretap, the guy in the van with the speakers, with the headphones, listening in to your conversation.
[01:10.900 --> 01:19.540]  Targeted, maybe targeting tens, thousands, maybe tens of thousands, but, you know, concentrating on the really suspicious folk.
[01:19.540 --> 01:21.980]  You know, folk who attend HOPE conferences.
[01:23.960 --> 01:26.300]  So, this has been our ATT&CK model.
[01:27.340 --> 01:28.880]  And, of course, it's still there.
[01:29.100 --> 01:33.520]  It's still a valid ATT&CK model, but it is no longer the only one we're looking at.
[01:34.180 --> 01:40.540]  The new ATT&CK model that is occupying a lot of our time is mass surveillance.
[01:41.220 --> 01:48.440]  And the thing here is that if you look at that CCTV camera, well, you know, it's pretty easy to evade.
[01:49.600 --> 01:54.100]  You know, all you need to do is just go around the corner or put a hoodie on or whatever.
[01:54.100 --> 01:57.860]  But the thing is that it isn't just the one camera.
[01:58.620 --> 02:10.040]  It's the cameras everywhere, all feeding into a central database, all linking, all knowing.
[02:10.840 --> 02:25.900]  And that's a different ATT&CK model because the types of cryptography that you would use to defend against this ATT&CK model don't necessarily help when you're looking at this model and vice versa.
[02:27.600 --> 02:33.700]  So, one of the changes in our thinking has been we're no longer saying that bad security is no security.
[02:34.520 --> 02:37.620]  And this kind of like it went out a while ago.
[02:37.760 --> 02:55.560]  I mean, the idea here is that if you give somebody something that you say it is secure and it isn't, they will trust it, and then they will do things that they wouldn't do anyway, like play Pokemon Go, stick all their usernames and passwords onto their phone,
[02:56.100 --> 03:02.640]  bank online without checking the certificates of the bank that they're going to, and all those other things they do.
[03:03.600 --> 03:17.300]  When Trusted Computing Group was starting off, I kind of made myself unpopular and kind of got thrown out of the room after I said, you know what, you've got the wrong name because MS-DOS is trusted.
[03:18.940 --> 03:20.840]  What you want is trustworthy.
[03:21.600 --> 03:24.340]  But they'd already printed the T-shirts, so...
[03:25.560 --> 03:31.580]  So, we're no longer saying make it absolutely perfect or don't do it at all.
[03:32.280 --> 03:34.980]  Opportunistic security is now a good thing.
[03:34.980 --> 03:43.420]  If we can do unauthenticated encryption, even though we know we're vulnerable to a man-in-the-middle attack, do it, because that is better than nothing.
[03:44.700 --> 03:47.880]  Before Snowden, we used to be going around saying, encrypt your data.
[03:48.040 --> 03:50.820]  It's really important to encrypt your data end-to-end.
[03:51.000 --> 03:52.400]  That's what's really important.
[03:52.620 --> 03:54.100]  And, of course, that still is important.
[03:54.300 --> 03:55.400]  But you know what?
[03:56.240 --> 04:01.120]  As General Hayden said, we kill people on metadata.
[04:02.260 --> 04:07.260]  So, end-to-end email encryption is good, but it isn't sufficient.
[04:08.020 --> 04:16.220]  You want to pair up that end-to-end security, if you have it, with transport layer security to protect the routing information.
[04:16.480 --> 04:27.540]  Because the to, the from, all that routing information in an email packet, you can't encrypt that end-to-end, or else the mail system doesn't know where to deliver the message.
[04:28.200 --> 04:35.600]  But that information is leaking data that is just as privacy-sensitive as the content.
[04:37.220 --> 04:43.400]  In the past, we used to be telling people, it's really important that you secure, support the new algorithms coming out.
[04:43.900 --> 04:49.100]  And, you know, back when SHA-2 was agreed, I was going around saying, hey, we've got to get SHA-2 out there.
[04:49.100 --> 04:53.320]  You know, we lost MD-5, you know, SHA-1 might be next.
[04:53.560 --> 04:56.100]  And people said, oh, no, we'll do it when we...
[04:56.100 --> 05:01.060]  So, anyway, they waited until SHA-1 started to come under attack.
[05:01.080 --> 05:05.380]  And then we did it all in a panic, as we usually do.
[05:05.800 --> 05:11.880]  So, supporting new algorithms is good, but that doesn't give you any more security.
[05:12.580 --> 05:26.440]  The reason that you support new algorithms in your application is so that when we have to change to a new application, to a new algorithm, your application isn't going to be one of the ones that is holding us back.
[05:27.180 --> 05:31.180]  It's just so that you're not the person who's going to be the block.
[05:31.820 --> 05:36.340]  You are not going to give any more security from deploying that new algorithm.
[05:36.340 --> 05:40.820]  The way that you get more security is you take out the rubbish ones.
[05:41.380 --> 05:57.320]  And if you look at some of the crypto stacks recently, you will see that MD-2, MD-4, MD-5, IDEA, all these garbage ciphers from the 1990s that were put in because they were a good idea, are no longer there.
[05:57.520 --> 06:03.120]  And that's good because you get better security from not using the bad stuff.
[06:04.840 --> 06:11.520]  Now, in the past, we used to say that open-source is better than commercial because it can be reviewed.
[06:12.120 --> 06:27.200]  And then in the wake of Heartbleed, we came across a slight unpleasant fact that just because somebody could review software doesn't necessarily mean that they want to spend their time doing it.
[06:27.980 --> 06:44.260]  And in particular, when you have these open-source software projects, it can be kind of difficult to say to somebody, no, I don't want to add your heartbeat code for DTLS into the main trunk because, you know, who's going to use it?
[06:45.800 --> 06:53.420]  And so these things tend to become, well, repositories of things that maybe were a good idea at the time.
[06:53.420 --> 06:58.980]  So, yes, open-source is better... has better possibility.
[06:59.640 --> 07:06.900]  But it's really important that when you're looking at open-source, you're looking and seeing what is their review process?
[07:07.280 --> 07:08.420]  Do they have one?
[07:08.840 --> 07:12.160]  Don't just trust something because it is open-source.
[07:12.440 --> 07:15.320]  Do like the BSD folk have been doing for 20 years.
[07:15.540 --> 07:18.320]  Check that your code is actually right.
[07:18.320 --> 07:22.840]  Have a rigorous review process and audit it and document it.
[07:23.240 --> 07:32.000]  And the other thing we found out from Heartbleed was, oh, we had all these people maintaining open SSL and nobody was being paid.
[07:33.240 --> 07:42.220]  And that was kind of sad when you thought about the fact that, you know, a trillion dollars a year in Internet commerce is depending upon that software base.
[07:42.220 --> 07:44.100]  You know, pay people.
[07:44.700 --> 07:50.140]  You know, if you want accountability from an engineer and you're not paying them, well, something's wrong.
[07:53.000 --> 07:58.940]  Now, obviously, nobody ever told people that you had to trust people or that it was good to trust people.
[07:58.960 --> 08:03.700]  But if you want to use any piece of software, you're trusting somebody.
[08:05.240 --> 08:09.960]  You know, okay, you can go off there and you can check the fingerprint is right.
[08:10.080 --> 08:11.380]  But, you know, is the fingerprint right?
[08:11.480 --> 08:12.400]  Is the signature right?
[08:12.920 --> 08:18.780]  At some level, you're always putting some degree of trust in somebody when you use software.
[08:20.000 --> 08:28.160]  And so this has been something that we've just kind of like tolerated as one of those things that, you know, it's just a fact of life that you just can't do anything about.
[08:29.080 --> 08:34.620]  Since Snowden, what we've been saying is, okay, yes, we understand that we have to trust people.
[08:35.500 --> 08:37.660]  But we don't have to trust them blindly.
[08:38.340 --> 08:50.000]  And we have to look into ways that we can audit what they're doing so that if they turn out not to be trustworthy, we have ways of working out, well, what other code did they touch?
[08:50.140 --> 08:51.820]  What other projects were they on?
[08:52.260 --> 08:55.360]  What other things might they have been sabotaging?
[08:56.560 --> 09:03.800]  And so another piece that has changed, and this has changed kind of like in the past five months for me.
[09:04.960 --> 09:08.180]  And I've been in the crypto business now for 25 years.
[09:10.660 --> 09:15.360]  And, you know, in that time, you know, we still, I'm still working on trying to secure the web.
[09:15.860 --> 09:17.340]  I might get there sometime.
[09:19.080 --> 09:22.640]  And in all that time, quantum has always been 20 years in the future.
[09:23.700 --> 09:26.940]  And it's always been something that, well, we'll have to worry about someday.
[09:28.920 --> 09:30.700]  Well, that's stopping happening.
[09:31.740 --> 09:35.480]  The recent advances in quantum computing are quite significant.
[09:36.660 --> 09:41.880]  Google now have a five qubit quantum computer on the web that you can go and play with.
[09:42.700 --> 09:46.680]  There's rumors of quantum computers above 10 qubits.
[09:47.580 --> 09:52.220]  This is starting to get to the point where it is worrying me and it is worrying my colleagues.
[09:52.540 --> 09:56.960]  And we're starting to look at, yes, there is...
[09:56.960 --> 09:59.420]  It's not going to come immediately.
[10:00.200 --> 10:07.100]  You know, we've still got 10 years or whatever before this is going to be a serious attack that might damage us.
[10:07.100 --> 10:08.320]  But you know what?
[10:08.480 --> 10:12.380]  It takes us 10 years to develop the next generation of security systems.
[10:12.560 --> 10:16.340]  So this is now an active development.
[10:16.480 --> 10:25.500]  This is something that we're now looking at now to see what can we do to make the web PKI and web security robust against quantum computer attack.
[10:27.780 --> 10:34.300]  Okay, so that's the change in the attitudes that has happened in the wake of Snowden.
[10:34.300 --> 10:41.620]  What I want to turn to now is what those changes have caused to happen in the standards area.
[10:41.920 --> 10:45.700]  I mostly work in the standards organizations.
[10:45.700 --> 10:50.480]  I've worked in W3C, OASIS, CAB Forum.
[10:50.940 --> 10:52.780]  I've done some work in Anti-Phishing Group.
[10:53.280 --> 10:58.020]  These days, I'm mostly working in the IETF, the Internet Engineering Task Force.
[10:58.260 --> 11:01.880]  And also, it's partially its sister organization, the IRTF.
[11:02.600 --> 11:12.580]  So, one of those little bits of data that we got from the Snowden papers, we discovered a project called Bull Run.
[11:13.280 --> 11:21.560]  And what Bull Run was was $250 million a year to sabotage my work and my colleagues.
[11:21.900 --> 11:22.700]  It was just me.
[11:22.800 --> 11:27.360]  I mean, like, you know, you could just go around to my house with the Maserati folks, you know.
[11:28.300 --> 11:32.180]  You know, but one of the things...
[11:32.180 --> 11:36.060]  So, we were looking around for specifications that might have been compromised.
[11:37.540 --> 11:39.660]  And, yes, we all have our theories.
[11:41.260 --> 11:45.680]  Sometimes it's hard to distinguish incompetence from malice.
[11:46.480 --> 11:56.960]  But one of the ones we're fairly certain was a deliberate act of sabotage was this random number generator that was foisted on NIST by the NSA.
[11:57.440 --> 12:08.000]  And then the NIST folk paid $10 million to RSA to include the elliptic curve pieces into their new toolkit.
[12:08.680 --> 12:13.840]  Oh, and by the way, you'll make dual E, C, D, A, B, R, B, G the default random number generator.
[12:14.820 --> 12:16.760]  And the thing is, well, it's complicated.
[12:16.900 --> 12:34.520]  But if you really understand what's going on with elliptic curves and you kind of, like, squint at the protocol, it turns out that the person who generated the parameters for the elliptic curves could generate a set of parameters in such a way that they,
[12:34.800 --> 12:48.700]  as the person who generated it and nobody else, would be able to see little bits of entropy leaking from the random number generator seed every time a nonce was created or it was used for any other purpose.
[12:48.700 --> 12:52.300]  And so this is kind of like what we call a bad thing.
[12:55.420 --> 13:01.720]  So, as a result, we've changed our attitude to the value of randomness.
[13:02.440 --> 13:12.500]  Traditionally, when we were generating elliptic curves, we thought, oh, you generate the random curves and you do the randomness in a way that everybody knows is good, everybody agrees with sound.
[13:12.660 --> 13:15.200]  And so you have the brain pool curves and various other curves.
[13:15.740 --> 13:22.920]  And these days that doesn't cut it because, you know what, if I wasn't there actually at the ceremony, how can I vouch for it?
[13:23.040 --> 13:24.460]  I don't know what went on.
[13:24.720 --> 13:28.920]  So what we need is not a situation where the curves are generated randomly.
[13:29.320 --> 13:39.940]  We need a rigid construction so that everybody who's using these curves knows that, well, nobody had an advantage in generating them.
[13:39.940 --> 13:45.480]  There is nobody who has a back door that anybody else could have.
[13:45.740 --> 13:53.940]  And so the two curves that came out of that, you'll probably be seeing them in pretty much all ITF protocols going forward.
[13:54.240 --> 14:01.000]  Curve 25519, which is the one that Dan Bernstein has been banging on again about for a decade now.
[14:01.000 --> 14:04.800]  And curve 448, which is a high security one.
[14:05.180 --> 14:13.080]  Curve 25519 gives you a work factor of 2 to the power 128, which is generally considered to be high security.
[14:13.500 --> 14:21.700]  And curve 448 gives you better than 2 to the power 256, which is generally considered as completely insane security.
[14:22.340 --> 14:25.380]  I always use the completely insane security.
[14:26.480 --> 14:34.680]  So these are faster than our current RSA curve, crypto, and they're more secure.
[14:35.100 --> 14:39.960]  Unless somebody creates a quantum computer, in which case they become less secure and we have to...
[14:41.970 --> 14:45.690]  Okay, so another thing that's on the agenda is TCP Inc.
[14:45.690 --> 14:58.350]  So this is basically the idea of TLS is you have an authenticated channel to some other party and you use that as your... in place of a Unix socket, you have a secure socket.
[14:58.590 --> 15:00.030]  It used to be called SSL.
[15:00.610 --> 15:11.650]  TCP Inc is the same idea, but instead of authenticating the crypto, we just do unauthenticated encryption.
[15:11.650 --> 15:19.490]  And this is something that can be dropped into any protocol stack and it can happen transparently without anybody noticing.
[15:19.990 --> 15:21.470]  Why would we do that?
[15:21.610 --> 15:33.710]  Well, this is not as good security as you get from TLS, but it is something that can be dropped into a protocol stack and be done pervasively so everything is encrypted.
[15:34.550 --> 15:40.110]  And if everything is encrypted, that is a good deterrence against mass surveillance.
[15:40.990 --> 15:50.970]  Although, if they were really interested in one party and wanted to make a targeted surveillance of that party, they can do a man-in-the-middle attack and they can get hold of the data.
[15:52.870 --> 15:57.970]  This isn't going to protect you from that, but it does get to protect you against the...
[15:57.970 --> 16:01.910]  We have this massive more...
[16:01.910 --> 16:09.010]  We're collecting every packet on the Internet into and holding it from now to kingdom come.
[16:09.270 --> 16:10.910]  It does protect you against that.
[16:12.570 --> 16:13.610]  DNS privacy.
[16:13.770 --> 16:14.730]  Now, this is an interesting one.
[16:14.850 --> 16:18.470]  All the information on the DNS is public.
[16:19.390 --> 16:22.390]  At least, if you're not behind... not doing split DNS.
[16:22.390 --> 16:24.350]  So, all that data is public.
[16:24.910 --> 16:31.130]  Why do we need to encrypt the communications with the DNS resolver?
[16:31.690 --> 16:43.070]  Well, the answer is, although the data that I'm retrieving isn't public, the data that I choose to receive is.
[16:43.070 --> 16:53.470]  Because if you look at my DNS lookups, you can see I've gone to CNN.com, Salon.com, TalkingPointsMemo, AngryLiberals.com, and so on.
[16:53.650 --> 17:00.010]  You can make a very good and precise profile of what I am and what my politics are.
[17:00.190 --> 17:06.410]  And if you're living in a country like Iran or Turkey or whatever, that is not a good thing.
[17:08.850 --> 17:10.330]  Certificate transparency.
[17:10.330 --> 17:18.990]  The idea of certificate transparency is to be able to know what certificates certificate authorities are issuing.
[17:19.650 --> 17:33.330]  And so the idea is whenever the certificate authority issues a certificate in the future, they will take the certificate and they will enroll it in this linked timestamp or blockchain, if you like.
[17:33.330 --> 17:37.890]  And this linked timestamp will continue on and on and on.
[17:38.090 --> 17:49.030]  And so if the certificate authority has issued a cert and not enrolled it in CT, then they've broken some promise somewhere.
[17:49.230 --> 17:50.110]  Something is wrong.
[17:50.370 --> 18:04.450]  If they enroll a certificate for a site that they shouldn't have issued a certificate for, we know that that CA has either made a goof or they've been breached.
[18:04.750 --> 18:08.330]  So it's a way of auditing the certificate authorities.
[18:09.270 --> 18:25.270]  The thing that makes it interesting to me about the transparency is that transparency is a form of audit, but unlike traditional computer audits, I mean, every CA, I work for CA, Commodore is a CA, you know, we've been audited every year that we've been operating.
[18:25.690 --> 18:33.610]  But those audits depend upon information that is private that we can't necessarily give you or you can't necessarily come and check.
[18:34.690 --> 18:40.590]  You know, you can't come and check to see how many tiers of security we have between ourselves and the private keys.
[18:40.650 --> 18:42.930]  You've got to trust ourselves and our auditors on that.
[18:42.930 --> 18:51.410]  With transparency, you've got an audit mechanism that allows anybody to audit the CA from public data alone.
[18:51.610 --> 18:52.710]  And that's powerful.
[18:54.110 --> 19:12.170]  And finally, well, this is something that isn't quite there yet, but for the past 15 years, I've been trying to persuade the people who write the OpenPGP spec and the people who write the S-MIME spec that, you know, VHS versus Betamax, not a good thing.
[19:12.710 --> 19:17.770]  If we want to have everybody using encrypted mail, we should have convergence.
[19:18.870 --> 19:21.370]  And I'm not the only person who's thought that.
[19:21.890 --> 19:33.930]  When I was principal scientist at VeriSign and my friend John Callas was CTO at PGP, we used to regularly have meetings and try and work out to see how we could try and get the camps together.
[19:33.930 --> 19:36.290]  Well, things have changed.
[19:36.810 --> 19:43.570]  It used to be when I went to the various camps, the feedback was, oh, we do not want to do that.
[19:43.690 --> 19:44.630]  We're not going to do it ever.
[19:45.770 --> 19:55.310]  I've just come back from ITF Berlin where the feedback was, well, we're all for it, but we just don't think that the other people are, which is progress.
[19:57.130 --> 20:02.710]  We might get to convergence this decade or the next.
[20:04.970 --> 20:05.410]  Okay.
[20:06.190 --> 20:07.070]  Another thing...
[20:07.070 --> 20:19.250]  Now, this isn't really something that's one particular protocol, but something that's starting to creep in across the ITF, and it's the bridge to what I'm going to be talking about in the second half of my talk, and that is usability.
[20:20.730 --> 20:23.710]  A couple of months ago, I had an epiphany.
[20:24.870 --> 20:32.630]  Whenever you have instructions for how the user is going to configure something, that's wrong.
[20:33.890 --> 20:35.310]  Instructions are bad.
[20:35.830 --> 20:37.210]  Because you know what?
[20:38.530 --> 20:41.750]  Users are really bad at following instructions.
[20:42.910 --> 20:46.510]  Computers are really good at following instructions.
[20:46.510 --> 20:59.930]  So, if you're giving your user instructions that don't have decision points, necessary decision points, that the user has to make, well, you're making work for the user.
[21:00.210 --> 21:04.170]  You should turn those instructions into code.
[21:04.170 --> 21:08.390]  That should be done for the user, by the computer.
[21:09.230 --> 21:12.630]  We shouldn't be using users as computers.
[21:13.150 --> 21:16.610]  And that's the founding principle of the mathematical mesh.
[21:23.080 --> 21:31.800]  So, this is a project I've been working on for three years, and it took this form about six months after the last HOPE conference.
[21:31.940 --> 21:34.360]  I was trying to make email security...
[21:35.280 --> 21:40.660]  I was trying to make secure email just as easy to use as regular email.
[21:40.800 --> 21:44.100]  And I thought that would be the way that we could get everybody using end-to-end email.
[21:45.420 --> 21:47.640]  And then I was told, well, you know what?
[21:48.020 --> 21:49.180]  That's not going to work.
[21:49.940 --> 21:55.640]  And so, now we've got a new plan, which is, we're going to make the computers easier to use.
[21:56.440 --> 21:58.780]  And also, we're gonna dump some security on people.
[21:58.940 --> 22:01.960]  But, we're gonna make computers easier to use.
[22:02.440 --> 22:07.280]  And we're gonna make them easier to use by taking away the need to learn how to configure them.
[22:08.280 --> 22:13.580]  Before I get too far, because, you know, I know there are a lot of free software, open software folk here.
[22:13.800 --> 22:17.120]  And, you know, yes, this is all open-source.
[22:17.120 --> 22:19.840]  It's all under an MIT license.
[22:19.840 --> 22:24.260]  It's all available on GitHub and SourceForge.
[22:24.440 --> 22:26.340]  All the specifications are open.
[22:26.740 --> 22:32.600]  They're submitted as ITF draft under NoteWell, which means that the IPR incumbencies have been sorted.
[22:32.920 --> 22:41.220]  There is one IPR encumbrance that I'm aware of that's a third-party that expires in about 18 months, but that's not at the core.
[22:41.380 --> 22:43.600]  And we're using JSON and HTTPS.
[22:44.440 --> 22:53.640]  And yes, the other thing that you're probably worried about, yes, my employer does have a way that they think they might be able to make money from this, but that is a long way in the future yet.
[22:53.940 --> 22:58.020]  The reason that I got my ticket to come here was, yeah, we're hiring.
[23:01.440 --> 23:03.320]  So, what's the mathematical mesh?
[23:03.540 --> 23:08.340]  Well, most people in this audience have probably experience of using open PGP.
[23:09.040 --> 23:14.240]  And the mesh is kind of like an open PGP key pair on steroids.
[23:14.520 --> 23:29.500]  Instead of it being just an application key that you're going to use, this is a... a mathematical mesh profile is something that potentially can stay with you your whole life long.
[23:30.100 --> 23:32.760]  So, you create this profile.
[23:32.880 --> 23:36.840]  The profile has a fingerprint that looks a bit like an open PGP key.
[23:37.480 --> 23:47.620]  If the open PGP group agree with me and my commit, they may well be open PGP for V5 keys.
[23:48.660 --> 23:51.580]  So, they have... you have a fingerprint of this profile.
[23:51.780 --> 23:57.640]  And every device, every application that you're going to use is going to be bound to this profile.
[23:58.200 --> 24:16.980]  And when a device has been bound to this profile, it's going to mean that that device will automatically inquire all the configuration data, all the security data that that device needs to interact with your applications and do so securely.
[24:17.880 --> 24:19.740]  So, what does it look like in practice?
[24:20.520 --> 24:20.980]  Okay.
[24:21.140 --> 24:26.920]  Well, if you've never been to a crypto course, if you've ever been to one of the... you've met Alice.
[24:27.640 --> 24:30.600]  So, Alice here wants to use the mesh.
[24:30.800 --> 24:37.280]  And she's got a laptop that's her main computer that she's been using for several years now.
[24:37.500 --> 24:41.980]  She's got email configured on it, but she's never done that end-to-end encryption stuff.
[24:43.780 --> 24:45.480]  It's just how it came.
[24:46.180 --> 24:51.040]  She's also got a brand new tablet, but that's still in the box.
[24:51.180 --> 24:53.180]  You know, it's not being... it's not being configured at all.
[24:53.700 --> 25:00.120]  So, the first thing she does is she configures a mesh profile for herself using MeshMan.
[25:00.340 --> 25:05.800]  And that is a profile now that has... is on her laptop.
[25:06.680 --> 25:19.680]  And as part of that process, she's... she's created PGP keys, SMine keys, SSH keys, and keys for pretty much everything else she might need to use.
[25:19.900 --> 25:25.780]  And all that has happened without Alice needing to say anything more than, her, yeah, I'd like that stuff.
[25:27.360 --> 25:34.200]  So, at this point, she's got her profile on her laptop, but she's not got it on her iPad.
[25:35.000 --> 25:40.000]  And if you think about it, in the modern world, we all have large numbers of devices.
[25:40.180 --> 25:47.500]  Particularly, yeah, mobile devices... this is the first laptop that I've had that has lasted four years.
[25:48.980 --> 25:53.280]  You know, mobile devices are kind of like consumable things.
[25:53.420 --> 26:00.940]  And we have a laptop, an iPad, you have your phone, your watch, your desktops.
[26:01.200 --> 26:04.560]  You know, people have a lot of personal computer devices.
[26:04.940 --> 26:07.140]  And that's before we get into Internet of Things.
[26:07.940 --> 26:22.020]  So, we need to have mechanisms that allow people to use all these disparate devices and connect them up to some sort of profile, some sort of gestalt that allows them to interact and act as that person's computers.
[26:22.320 --> 26:26.920]  So, the way that Alice does this is she's going to use a portal.
[26:27.140 --> 26:31.600]  And a mesh portal is basically a bit like an MIT key server.
[26:33.500 --> 26:34.540]  It's a bit different.
[26:34.780 --> 26:37.380]  It's got more features I'll come in in a moment.
[26:37.520 --> 26:42.980]  But the point is that she chooses a portal and she has an account on that particular portal.
[26:44.260 --> 26:50.380]  So, she's created an account at the portal and uploads her profile to that portal.
[26:50.560 --> 26:55.520]  Now, if you notice, her profile here was red and her profile there is black.
[26:55.820 --> 26:58.000]  Well, what's going on?
[26:58.100 --> 26:59.540]  Well, this is red-black security.
[27:00.320 --> 27:04.380]  On her laptop, her profile is unencrypted.
[27:05.020 --> 27:15.420]  So, her laptop has access to all the application configuration data, all the cryptographic keys or whatever that she needs to use that device.
[27:16.120 --> 27:18.560]  We don't want to put that stuff in the cloud.
[27:18.560 --> 27:20.520]  Well, we don't want to put it unencrypted in the cloud.
[27:20.580 --> 27:31.760]  So, we encrypt it using strong encryption in such a way that the mesh and the portal never have the ability to decrypt Alice's information.
[27:32.460 --> 27:41.700]  However, when Alice connects up her iPad or tablet or whatever, we decrypt it again.
[27:42.580 --> 27:59.320]  And underneath the mesh, there's a whole series of cryptography that is making that happen and making it happen in a robust and provable fashion so that people can look at the code and be sure that what they're doing is right.
[28:00.920 --> 28:04.980]  The mesh involves a lot more cryptography than traditional PKI's.
[28:05.140 --> 28:15.000]  When I was working on the web PKI, the original web PKI, the original first CA had chains of three public key pairs.
[28:15.400 --> 28:16.800]  And that was a long chain.
[28:17.580 --> 28:21.700]  Web PKI these days, you may be talking about four or five key pairs.
[28:22.760 --> 28:29.100]  The mesh, just generating this little key application, we're generating about 40 keys.
[28:29.880 --> 28:36.660]  And the reason that we do that is that we're looking to do absolute best practices on Alice's behalf.
[28:37.000 --> 28:41.260]  So, we want to have isolation of the cryptography from one application to another.
[28:41.460 --> 28:44.220]  We want to have isolation by function.
[28:44.220 --> 28:48.060]  So, you never have a key that is used for encryption and decryption.
[28:48.200 --> 28:49.320]  They're always separate.
[28:49.640 --> 28:54.780]  You always have separate keys for authentication, encryption, and signature.
[28:56.480 --> 29:01.600]  So, there's a lot of stuff going on that would take me a lot more than the time I've got it allowed.
[29:02.040 --> 29:05.680]  So, what I'm going to show you here is what it would take for Alice to generate the profile.
[29:07.280 --> 29:09.120]  There is a GUI client.
[29:09.620 --> 29:16.460]  However, trying to explain what's going on with the GUI client is a bit hard because it consists of a button that says, yes, I want to be secure.
[29:18.860 --> 29:23.920]  So, there's also a line mode client that gives a bit more of an explanation.
[29:24.960 --> 29:30.960]  So, she starts MeshMan and she says, okay, I want to create a new personal profile.
[29:31.440 --> 29:37.180]  There is no reason why a user can't have more than one personal profile.
[29:38.100 --> 29:42.120]  Please don't try it at the moment because those code paths are not being tested.
[29:44.000 --> 29:53.600]  You know, in the future, I could well imagine that people would want to have separate profiles to create isolated identities and have pseudonymity and whatever.
[29:54.160 --> 29:57.980]  Obviously, you can always do that, but let's just start off with the simple.
[29:58.400 --> 30:11.440]  So, she gives it... she says, I'm creating a new personal profile, gives it the desired account name at the portal that she's chosen.
[30:11.860 --> 30:17.000]  And mesh.prismproof.com is the only one that is up there right now.
[30:17.160 --> 30:19.440]  And actually, it's down at the moment because I'm here at the conference.
[30:20.740 --> 30:25.540]  And it comes back and gives her the fingerprint of the profile that's created.
[30:25.840 --> 30:29.740]  It's also said, oh, yeah, I worked out that you were on a Windows 10 device.
[30:30.340 --> 30:37.700]  Because, you know, there is actually a switch in the line mode that allows you to describe the device you're on for later use.
[30:37.800 --> 30:45.860]  But if you don't specify it, well, the code drovels through your computer and works out something sensible.
[30:47.500 --> 30:49.760]  Most software knows what it's running on.
[30:50.920 --> 30:53.640]  Okay, so we generated a profile with a key.
[30:54.520 --> 30:56.140]  Populate it with a mail profile.
[30:56.140 --> 30:59.480]  We just say, okay, mesh man slash mail.
[30:59.480 --> 31:02.260]  And here's the mail account that I want you to secure.
[31:02.460 --> 31:03.260]  And that's all.
[31:04.020 --> 31:08.120]  If you don't specify any mail account, it will secure all of them.
[31:08.920 --> 31:16.340]  And notice that it's found that there are two clients on the machine, Windows Live Mail and Outlook.
[31:16.480 --> 31:18.100]  It just secured both of them.
[31:18.440 --> 31:22.140]  And by the way, it configured it for S-MIME and at PGP.
[31:22.360 --> 31:26.960]  I mean, like, why do we give people choices when they can have both?
[31:27.480 --> 31:29.420]  You know, you can have country and western.
[31:32.360 --> 31:36.620]  Now, you see there that it says S-MIME and it's given the CAs comodo.com.
[31:37.920 --> 31:45.140]  Well, right now, it's hard-coded to comodo.com because we're the only people that are operating the other side of things.
[31:45.280 --> 31:49.300]  And actually, it's not in the distribution code because I can't depend upon it being there.
[31:49.460 --> 31:54.220]  But there will be a way of getting a certificate from us, obviously.
[31:54.460 --> 31:57.660]  And there will be a way of getting certificates from anybody else.
[31:58.540 --> 32:01.140]  So this isn't an attempt to get lock-in.
[32:02.740 --> 32:06.320]  But it's just a way of getting... an easy way of getting that certificate.
[32:07.200 --> 32:07.720]  Okay.
[32:07.880 --> 32:08.780]  Now, that's mail.
[32:08.960 --> 32:14.540]  But the thing about secure mail is there's no value in secure mail unless everybody else is secure mail.
[32:14.680 --> 32:16.340]  So you don't get a network effect.
[32:16.840 --> 32:25.840]  In order to get... and a problem with network effects is that before you got a network, network effect means chicken and egg.
[32:25.840 --> 32:35.180]  So to get my system started, I've got to have some value that this infrastructure will deliver to a new user on day one.
[32:35.380 --> 32:45.140]  And so the obvious new value add to any user is to have a mechanism for storing usernames and passwords for websites.
[32:45.600 --> 32:49.080]  And that's what I was hoping to demonstrate.
[32:49.080 --> 32:54.000]  However, events in the Middle East have overtaken my dev team.
[32:54.200 --> 32:54.460]  Sorry.
[32:55.620 --> 33:01.220]  So to populate a web username and password, we use Meshman again.
[33:01.720 --> 33:02.880]  Meshman slash web.
[33:02.940 --> 33:04.280]  And now it's created a profile.
[33:07.340 --> 33:11.380]  There's a default personal profile.
[33:12.000 --> 33:14.820]  Don't make the person type if you don't have to.
[33:15.040 --> 33:16.340]  We can store it on the machine.
[33:17.160 --> 33:17.680]  Okay.
[33:17.980 --> 33:20.440]  And then we're just adding a username and password.
[33:20.440 --> 33:32.540]  And obviously this is something that the team is integrating into a version of Chrome so that then you'll be able to use the password manager in your daily life.
[33:32.700 --> 33:49.180]  And the thing is that as with any good password manager, you add a password on one site, on one machine, and it's now available to all the other machines that you've got bound to that Mesh profile.
[33:49.620 --> 33:51.240]  And so all that's automated.
[33:51.540 --> 34:02.000]  Unlike the other systems that are out there, we're not using clunky symmetric key cryptography and passwords to unlock the data.
[34:02.000 --> 34:04.040]  We're using public key cryptography.
[34:05.160 --> 34:19.440]  So this isn't... the only way that you can... you can't defeat this by breaching the portal or the Mesh because the data that's stored in the portal and the Mesh isn't actually encrypted in a way that can be brute force.
[34:19.600 --> 34:26.800]  The only way to decrypt this data is if one of Alice's devices gets lost and you can extract the keys.
[34:28.040 --> 34:36.260]  So the Mesh then is a virtual store for configuration information that includes credentials and keys and passwords and so on.
[34:36.420 --> 34:51.080]  But also includes for the mail, we're including the inbound and outbound mail server, the configuration of that mail server, and all that other information that Alice would want the mail client to know.
[34:51.700 --> 34:57.700]  And because the Mesh manager can have code in there to say, okay, let's see if they've got TLS enabled.
[34:57.960 --> 35:01.680]  Let's force that connection over TLS because we know it's always there.
[35:02.100 --> 35:10.300]  The Mesh manager can do it better than Alice can do it from the information resources that are generally available to.
[35:10.720 --> 35:12.600]  It's application agile.
[35:13.020 --> 35:18.500]  So in principle, there's no reason why you can't put any crypto application you want in there.
[35:18.860 --> 35:22.720]  At the moment, we're looking at the mail, web, and SSH.
[35:23.100 --> 35:25.980]  Also network configuration stuff.
[35:26.280 --> 35:32.580]  And of course, end-to-end email by your choice of systems.
[35:33.040 --> 35:35.120]  But it isn't a trusted service.
[35:35.800 --> 35:41.640]  So the Mesh can't be breached because the Mesh isn't offering confidentiality to anybody.
[35:42.500 --> 35:51.960]  We use end-to-end encryption to provide our confidentiality guarantee, not trust in the provider of the Mesh portal.
[35:53.320 --> 35:57.800]  Okay, so I've shown you so far how you can configure the Mesh for one device.
[35:58.000 --> 35:59.720]  How do we add in more devices?
[36:00.640 --> 36:06.440]  Well, this is basically just your standard two-way authentication.
[36:06.800 --> 36:12.760]  When we created the profile, we got a password.
[36:13.080 --> 36:14.940]  So we got a fingerprint.
[36:15.360 --> 36:21.720]  When we start the process of connecting a new device, we see that fingerprint come back again.
[36:21.840 --> 36:29.180]  So we give it the portal account that we want to connect to, and it comes back and tells us the profile name.
[36:29.340 --> 36:35.200]  So we check the two fingerprints match, and it gives us the fingerprint for the device profile it's just created.
[36:35.580 --> 36:41.560]  And it's found that this is the iPad Pro 15-inch that's only available now to people who are friendly with Apple.
[36:42.300 --> 36:47.220]  And then on the second device, on the... So now we go to the administration device.
[36:47.360 --> 37:04.280]  This is just any old device that Alice has, but it's one where she's said, this is a device that I want to actually do management of Mesh profiles on, which is probably different from, you know, in the ultimate, I want the Mesh to have all my devices,
[37:04.480 --> 37:08.020]  including the light bulbs and light switches connected to my Mesh profile.
[37:08.400 --> 37:12.920]  I do not want my Mesh light bulb to be configuring my profile.
[37:13.160 --> 37:13.940]  No, thank you.
[37:15.000 --> 37:22.380]  And so we ask the Mesh to tell us what pending connection requests there are.
[37:22.740 --> 37:25.200]  And here we see, okay, there's one for this.
[37:25.400 --> 37:27.620]  It's trying to connect to our regular profile.
[37:28.000 --> 37:35.180]  And here's the device device fingerprint and bit of information.
[37:35.180 --> 37:37.200]  We check the two fingerprints are the same.
[37:37.500 --> 37:39.620]  And then we tell it to accept.
[37:40.000 --> 37:41.880]  And now that's published to the net.
[37:42.500 --> 37:45.680]  And then this device is now connected.
[37:46.080 --> 37:51.840]  And we can go back to that other device, ask for a status, and it'll tell us it is connected.
[37:52.200 --> 37:59.060]  And once it's connected, that new device has access to all the connected applications.
[37:59.940 --> 38:11.460]  So now I didn't show you, obviously, you probably want to have infrastructure in there that allows you to say, okay, this is a tablet, I'm going to give it emails access, but I'm not going to give email access to my toaster.
[38:12.160 --> 38:16.440]  But that made the demo a bit too complicated.
[38:16.860 --> 38:24.280]  So once it's connected, it's got all the keys and all the capabilities for the applications it has been authorized for.
[38:25.380 --> 38:27.940]  And this is giving us automated security.
[38:28.080 --> 38:29.880]  And automated security is better security.
[38:31.040 --> 38:32.320]  Because you know what?
[38:32.480 --> 38:40.500]  If you're going to do security right, you've got to do it really consistently and do everything right.
[38:40.680 --> 38:43.860]  And most people are really bad at that.
[38:44.380 --> 38:48.080]  And computers are really, really good at it.
[38:48.280 --> 38:56.580]  So automating security, security, taking the pain away from security allows us to get secure by default for starters.
[38:57.000 --> 39:13.140]  It also allows us to automatically choose the highest level of security that's available and do all this separation of keys function by device that normally every crypto person knows they should do, but very few people do.
[39:13.960 --> 39:20.660]  And boy, when I tried to do it by hand for SSH, gosh, it was so painful.
[39:21.780 --> 39:27.260]  And it's automatically refreshing that crypto on a monthly basis or whatever.
[39:27.540 --> 39:43.160]  Or if you take a device away, in that you can have a rule in the Mesh Profile Manager that says, when you remove a device from a profile, automatically rekey every application that that device had access to.
[39:45.200 --> 40:02.460]  So when I started sharing this to people at MIT, Dave Clark, who's the guy who invented the end-to-end principle and TCP and was in with all that good stuff, his first response was, oh, can you make it work for SSH?
[40:03.340 --> 40:03.980]  SSH.
[40:03.980 --> 40:08.180]  Because the thing about SSH is, you know, every system manager uses SSH.
[40:08.620 --> 40:12.360]  Hands up in the room if you're a system manager using SSH.
[40:13.740 --> 40:24.060]  Now, keep your hand... take your hands down if you have multiple keys for your SSH client.
[40:24.660 --> 40:27.980]  So I don't mean... I mean, every SSH host.
[40:28.140 --> 40:29.980]  Yes, I think maybe two.
[40:30.500 --> 40:32.720]  You know, every SSH host has separate keys.
[40:32.920 --> 40:46.460]  But if you're logging... if you're using SSH to log into your servers from your laptop and your desktop and your tablet, you should have a separate private key for each one of those.
[40:46.800 --> 40:55.720]  Because if you don't and you lose the laptop or it is taken from you at an airport, then TSA now have access to all your stuff.
[40:56.800 --> 40:59.500]  Why... and, you know, everybody knows they should do this.
[40:59.780 --> 41:01.620]  Why don't most people do it?
[41:01.700 --> 41:05.320]  Well, doing it right is really, really painful.
[41:05.900 --> 41:10.960]  And the only way that... the only people that I know that do it right have scripts to do it.
[41:11.540 --> 41:14.680]  And now you have the problem of, well, are the scripts right?
[41:15.100 --> 41:16.360]  Have they been audited?
[41:16.660 --> 41:17.700]  Is that a hole?
[41:17.920 --> 41:24.740]  Well, hopefully the mesh will be a set of audited scripts that everybody can use and share.
[41:26.480 --> 41:27.040]  Okay.
[41:27.360 --> 41:35.860]  So, I showed you these fingerprints and, yeah, that's not really consumer grade usability, is it?
[41:36.540 --> 41:40.940]  So let's make it a bit easier for the user to remember their fingerprint.
[41:42.160 --> 41:54.120]  PGP, the original... PGP phone had a system called PGP Word, where you took every byte and it changed... they had a dictionary of 512 words.
[41:54.500 --> 42:05.400]  Well, the English language has 30,000... well, the English language has 400,000 words, but we can take a subset of 32,000 words, and we can encrypt 15 bits at a time.
[42:05.980 --> 42:13.140]  So here we have these first ones go to spoon, belt, and do the rest.
[42:13.320 --> 42:18.400]  And we can come up with a much more memorable version of that fingerprint.
[42:18.680 --> 42:20.820]  Spoon, belt, wooden, cow, medicine, insult.
[42:21.100 --> 42:25.800]  And you notice that all the words are over three characters.
[42:25.800 --> 42:31.200]  That is very deliberate, because then what you can do is to add in a bit of steganography.
[42:31.560 --> 42:32.180]  Oh, but what?
[42:33.100 --> 42:35.020]  Oh, damn!
[42:40.550 --> 42:42.570]  This is the difference between theory and...
[42:48.580 --> 43:01.380]  Well, yeah, let's talk about correct battery staple later, because he... yes, unfortunately, Randall has some extremely misguided thoughts about how long it takes people to break passwords these days.
[43:02.120 --> 43:06.420]  It doesn't take... he's often about five orders of magnitude.
[43:07.340 --> 43:14.840]  There's some folk with bitcoin cracking hardware, and they're just cracking bit... they can do windows passwords in seven hours.
[43:15.860 --> 43:18.240]  Exhausted brute force of the entire space.
[43:19.700 --> 43:26.200]  Okay, so there's your word fingerprint, which is something that hopefully we'll get to do in the future.
[43:27.900 --> 43:30.940]  You know, it works, but, you know, that's not internationalizable.
[43:32.040 --> 43:33.760]  Graphical fingerprints would be even better.
[43:33.900 --> 43:41.580]  If we could find a corpus of a million copyright-free images, then we could do the same trick with images.
[43:42.120 --> 43:48.320]  And then all you need to do is to see, oh, are these... is this sequence of pictures the same on both machines?
[43:48.700 --> 43:49.900]  Uh, yes.
[43:50.100 --> 43:50.440]  Okay.
[43:50.660 --> 43:51.300]  Yes, it's me.
[43:51.540 --> 43:59.980]  And hopefully, uh, after you've seen these sequence of pictures, you know, a few times, you know, you're going to remember that sequence of pictures fairly quickly.
[44:00.820 --> 44:01.340]  Okay.
[44:02.100 --> 44:09.340]  So, uh, one other piece that's in the phase one of the mesh is I do actually have an escrow feature.
[44:10.180 --> 44:15.480]  And the reason for this is not because I particularly like Louis Free and co.
[44:16.400 --> 44:43.920]  The reason for this is if you want to use this infrastructure for drive encryption, for data encryption, for document encryption, if you're encrypting static data under an encryption key, you have to have a way of assuring the users of that system that there is absolutely no way that they're going to lose their data because it cannot be decrypted.
[44:44.920 --> 44:49.080]  And so, we do have an escrow mechanism built in.
[44:49.420 --> 44:51.700]  It is enabled by default.
[44:52.020 --> 44:57.080]  You can disable it on an application-by-application basis if you choose.
[44:57.400 --> 45:00.000]  And it uses Shamir secret sharing.
[45:00.220 --> 45:06.200]  So, this is the usual thing of here we've just done a three out... a two out of three share.
[45:06.420 --> 45:10.020]  So, we created three recovery blobs.
[45:10.220 --> 45:19.580]  Any two of those recovery blobs can be used to recover the decryption key that was used to encrypt the private keys.
[45:19.580 --> 45:25.980]  The encrypted private keys are encrypted in AES 256 and are living on the mesh.
[45:26.580 --> 45:33.580]  So, yes, we did put in an escrow system because if you want to do stored data encryption, you would better.
[45:35.480 --> 45:35.960]  Okay.
[45:36.100 --> 45:41.640]  So, that's where the mesh... that's the focus of the mesh development right now.
[45:44.580 --> 45:46.900]  We've been looking at just one portal.
[45:47.120 --> 45:49.360]  Well, what happens when... you know, what is a portal?
[45:49.480 --> 46:02.060]  Well, a mesh portal, it could be a commercial portal like the PGP key servers are, or it could be... sorry, it could be free like the PGP key, or it could be a commercial one run by a CA.
[46:02.660 --> 46:06.320]  And it's maintaining a linked timestamp of all the published data, you know, blockchain.
[46:06.980 --> 46:09.260]  And it may be a member of the MetaMesh.
[46:09.760 --> 46:10.920]  What's the MeshMesh?
[46:11.020 --> 46:18.160]  Well, that's basically a bunch of portals that have agreed to share all these... their information with a common timestamp.
[46:18.660 --> 46:31.120]  And what that means is that, say Alice has enrolled her profile on one portal, and that portal either stops doing business or says, oh, well, it was free.
[46:31.740 --> 46:37.940]  You know, I've given you the crack, and now the price is... It's like ICANN.
[46:38.000 --> 46:41.300]  You know, those domain names used to be $10 each, and now it's a quarter of a million.
[46:44.640 --> 46:46.760]  So, we get profile mobility out of this.
[46:46.900 --> 46:49.200]  Alice uploads her profile to one portal.
[46:51.440 --> 47:07.280]  And that can have public information about her email and so on.
[47:07.420 --> 47:11.040]  And now Bob is trying to send Alice an email.
[47:11.280 --> 47:13.240]  She can fish that information out.
[47:13.900 --> 47:17.960]  There's a long... There's an hour-long talk about how that works.
[47:18.640 --> 47:25.820]  So, what we're looking to do in the phase three of the Mesh is that portal becomes a trust broker.
[47:26.260 --> 47:30.420]  And so Alice is one... So, Bob's wanting to send a message to Alice.
[47:31.340 --> 47:36.760]  She can... He can ask the portal, what's the best way of sending this message?
[47:36.960 --> 47:39.140]  Or Alice can say, I want to send a message to Bob.
[47:39.560 --> 47:41.940]  What security protocols does Bob accept?
[47:42.660 --> 47:44.320]  What key should I use for Bob?
[47:44.540 --> 47:48.740]  And so the portal can become a curator of trust for Alice.
[47:49.340 --> 48:02.700]  So, the way that I see the CA business going in the future is, instead of people paying to get credentials, and using the credential being free, I would like to see the model flip.
[48:03.220 --> 48:05.920]  So, maybe the credentials become free.
[48:06.080 --> 48:07.380]  Maybe they become lower cost.
[48:07.500 --> 48:19.980]  But the people who are depending upon the credentials, they're the ones who pay, so that then the trust curator is directly accountable to the person who is paying them.
[48:20.680 --> 48:34.120]  And so, no more of this problem with the web PKI, where the web browsers are trying to choose CAs on the basis of a set of trust criteria that have to fit everybody who uses the web.
[48:35.460 --> 48:36.740]  So, one last bit.
[48:39.580 --> 48:42.740]  This is great stuff, but it isn't stuff that I invented.
[48:43.100 --> 48:48.600]  Matt Blaze, who was emceeing this track earlier, and his team at AT&T invented it.
[48:49.720 --> 48:53.540]  We also have a new application, which is Mesh Recrypt.
[48:53.880 --> 48:57.680]  And what this does is, it's a refinement on encryption.
[48:58.000 --> 49:03.760]  So, traditional symmetric key encryption, you use the same key to encrypt and decrypt.
[49:03.900 --> 49:04.120]  Okay?
[49:04.440 --> 49:05.380]  Everybody knows that.
[49:06.240 --> 49:11.380]  Public key encryption created a revolution because we use two keys.
[49:11.380 --> 49:15.780]  We have one key to encrypt and a second key to decrypt.
[49:15.960 --> 49:20.540]  So, only the person with the decryption key can decrypt the data.
[49:21.380 --> 49:21.960]  Great.
[49:22.740 --> 49:33.760]  With re-encryption, I can have one key to encrypt data, a second key to re-encrypt data, and a third key to decrypt.
[49:34.020 --> 49:36.260]  Okay, why would you want this and what's going on?
[49:36.260 --> 49:55.440]  Well, what's going on is, when the key, when the data is being re-encrypted, the party that's doing that has the ability to convert a message from encrypted under one person's key to another person's key, but does not have the ability to decrypt the message.
[49:56.280 --> 50:01.120]  And that is something that we can use in applications like mail.
[50:01.700 --> 50:29.700]  So, if we want to do end-to-end mail, and we want to have it so that Alice can read her mail end-to-end on her phone, on her laptop, or whatever, we can have... she can upload re-encryption keys to a mail server, so the mail server can re-target her messages to a particular device she's reading the mail on without giving the server,
[50:29.880 --> 50:33.620]  which is probably at Google or Yahoo or whatever, the ability to decrypt.
[50:34.700 --> 50:41.160]  It is really, really great stuff, and we have been ignoring it for 20 years, which is too long.
[50:41.700 --> 50:58.240]  So, the other thing that's great with this is you can use it for content rights management, so that you can encrypt documents like PowerPoint or Word or whatever, so that they're encrypted so that only people who are authorized to use a particular security label can read them.
[50:59.780 --> 51:02.140]  Yes, I do have a post-quantum story.
[51:03.480 --> 51:32.800]  Basically, if you give everybody these mesh profiles, and they have crypto, crypto, well, we go from a situation where only the server has crypto to a situation where the client and the server has crypto, and so part of the plan Z for post-quantum computing is we're going to work out some way of nudging some Kerberos-type keying in there so that we could use that if everything else blew up.
[51:34.880 --> 51:40.720]  Quantum computing is going to destroy all known forms of public key cryptography that we're using today.
[51:41.100 --> 51:43.860]  It doesn't completely destroy symmetric key.
[51:44.000 --> 51:46.320]  It just halves the effective key length.
[51:46.920 --> 51:49.440]  So, this will be an in-case-of-needs system.
[51:50.420 --> 51:53.580]  All the data, you can access it through my website.
[51:53.580 --> 52:01.780]  I'm known as PHB, and you can get it from my website, prismproof.org, and there you find the specification in the drafts.
[52:01.880 --> 52:03.800]  The code is currently in C Sharp.
[52:04.500 --> 52:13.560]  There has been a C version in the past, but we're using code synthesizers to generate it, and this code synthesizes just a little bit out of step.
[52:14.360 --> 52:28.980]  And there's a command line tool and a GUI, and because it's all in C Sharp and Microsoft made the C Sharp core open-source recently, yay, you should be able to run it on everything eventually.
[52:28.980 --> 52:30.140]  Thank you very much.
[52:34.870 --> 52:37.550]  So, I think we've got some time for questions.
[52:41.260 --> 52:41.780]  Hi.
[52:42.000 --> 52:47.780]  First, I'd like to say I think mathematical mesh is awesome and solves a lot of things that I think need to be solved.
[52:48.200 --> 52:57.360]  I have a question that gets back to something you were talking about earlier, when you mentioned curve 25519 and EC curve parameters.
[52:58.360 --> 53:07.420]  So, my experience in going to crypto conferences has been that there are very few people out there who actually understand how curve parameters are generated.
[53:07.900 --> 53:12.740]  I'd say maybe 200 on Earth could explain it, you know, without first taking a course.
[53:13.460 --> 53:13.640]  Yeah.
[53:13.640 --> 53:16.580]  Is this something you've observed, and do you have any ideas on like fixing that?
[53:16.700 --> 53:21.420]  This is the reason that this was done in the IRTF, not the IETF.
[53:21.800 --> 53:24.560]  So, we did get the heavy hitters there.
[53:25.240 --> 53:28.880]  We had the top people from Microsoft and IBM, the NSA.
[53:29.380 --> 53:32.100]  We had Dan Bernstein come down a couple of times.
[53:32.720 --> 53:34.560]  We spent two years on it.
[53:35.360 --> 53:38.500]  I mean, like, I don't... I'm not a number theorist.
[53:38.880 --> 53:46.500]  I don't claim to understand any of this, but we did get the people in the room who do.
[53:46.680 --> 53:51.040]  So, I mean, like, of all the systems, those are the ones that I'm confident of.
[53:51.240 --> 53:58.140]  Well, I mean, my point is more like, you know, say everybody in the audience wants to verify that these were properly generated.
[53:58.480 --> 53:58.560]  Oh, okay.
[53:58.560 --> 54:01.780]  I'm not sure how many people here could, you know, through no fault of their own.
[54:01.780 --> 54:06.660]  I'll see if I can pull out the link and put it on my website.
[54:06.960 --> 54:12.980]  But Dan Bernstein has a really awesome presentation that explains elliptic curve.
[54:13.140 --> 54:17.360]  And it's an hour, but it's the best one for explaining elliptic curve.
[54:17.520 --> 54:20.280]  And hopefully, that will give you some confidence.
[54:21.040 --> 54:21.120]  Nick?
[54:23.080 --> 54:26.380]  So, I have a question about the escrow system that you described.
[54:26.380 --> 54:28.400]  you're using a Shamir sharing.
[54:28.600 --> 54:32.060]  Who gets the shards in the mathematical mesh?
[54:32.440 --> 54:33.340]  Uh, the user.
[54:33.600 --> 54:35.600]  The user gets all the shards?
[54:35.720 --> 54:35.880]  Yes.
[54:36.060 --> 54:37.100]  And they get all of them together?
[54:37.480 --> 54:37.960]  Absolutely.
[54:38.320 --> 54:38.520]  Okay.
[54:38.640 --> 54:45.120]  I mean, like, if you wanted to layer on something else so that they didn't feel free, but, uh, yeah.
[54:45.360 --> 54:50.060]  Have you considered any sort of time release, uh, like a backdoor key?
[54:51.080 --> 54:51.560]  Uh...
[54:51.560 --> 54:55.560]  In terms of the user requiring the original key in order to stop the release?
[54:57.800 --> 55:03.280]  It's a good idea, but, uh, at this point, uh, I'm just trying to get the system running.
[55:03.460 --> 55:03.660]  Okay.
[55:04.020 --> 55:09.900]  So, I mean, like, uh, that's the sort of thing that I think that, uh, I mean, I'm, I've got my reference code.
[55:10.340 --> 55:16.320]  If you want to take my specs or the, uh, C stuff and generate something else, please do.
[55:16.520 --> 55:18.940]  I mean, like, it's, it's an open-source thing.
[55:19.200 --> 55:20.420]  So, yeah.
[55:20.600 --> 55:22.000]  Feel free to fork my code.
[55:22.120 --> 55:22.220]  Yeah.
[55:22.340 --> 55:22.560]  Thank you.
[55:22.940 --> 55:23.300]  Okay.
[55:23.420 --> 55:24.860]  I've been, I've, I've got the hook.
[55:25.100 --> 55:26.620]  So, uh, uh, thank you very much.
[55:26.620 --> 55:26.720]  Thank you very much.
[55:27.020 --> 55:27.480]  Thank you very much.