Vegas, Baby!

We’re throwing a party in Vegas! Someone called it SCWPodCon last year, and the name stuck. It’s sponsored by Teleport, the infrastructure identity company. Get SSO for SSH! If Thomas was here, I’m sure he’d tell you that Fly.io uses Teleport internally. Oh also there's some thing called Black..pill? Black Pool? Something like that happening in Vegas, with crypto talks, so we chatted about them a bit, plus some other stuff

SCWPodCon 2025: https://securitycryptographywhatever.com/events/blackhat

Transcript: https://securitycryptographywhatever.com/2025/07/29/vegas-baby/

Links:

- Fault Injection attacks on PQCS signatures: https://www.blackhat.com/us-25/briefings/schedule/index.html#bypassing-pqc-signature-verification-with-fault-injection-dilithium-xmss-sphincs-46362
- Another attack on TETRA: https://www.blackhat.com/us-25/briefings/schedule/index.html#2-cops-2-broadcasting-tetra-end-to-end-under-scrutiny-46143
- Attacks on SCADA / ICS protocols (OPC UA): https://www.blackhat.com/us-25/briefings/schedule/index.html#no-vpn-needed-cryptographic-attacks-against-the-opc-ua-protocol-44760
- Attacks on Nostr:  https://www.blackhat.com/us-25/briefings/schedule/index.html#not-sealed-practical-attacks-on-nostr-a-decentralized-censorship-resistant-protocol-45726
- https://signal.org/blog/the-ecosystem-is-moving/
- https://en.wikipedia.org/wiki/Nostr
- https://eurosp2025.ieee-security.org/program.html
- https://cispa.de/en/research/publications/84648-attacking-and-fixing-the-android-protected-confirmation-protocol
- https://hal.science/hal-05038009v2/file/main.pdf
- 8-bit, abacus, and a dog: https://eprint.iacr.org/2025/1237.pdf
- https://www.youtube.com/watch?v=Dlsa9EBKDGI
- https://www.quantamagazine.org/computer-scientists-figure-out-how-to-prove-lies-20250709/
- https://eprint.iacr.org/2025/118

"Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

Transcript

Copy

0:00

Yeah. In America, we just speak clear text over radio like adults. Hello. Welcome to Security Cryptography, whatever. I'm Deirdre. I'm David. I am awake. I'm awake before noon. Yay. Uh, Thomas. We've been talking way too much before we hit the record button. And how many, how many computer experts does it take to, to find the record button? Well, we found it. Yay. Once again, we would like to start out with reminding everybody that we are throwing a party slash mixer in Las Vegas during Black Hat again this year. Um, someone called. SCW Pod con last year. Um, the name has stuck. and we were told the vibes were immaculate last year, and so we're aiming for the same thing. Um, this year, uh, the event is sponsored by Teleport the infrastructure identity company that gives you SSO for SH. Um, and I. you again to Rob Picard, um, from Teleport for setting this up. Rob used to run Observer, which was our sponsor last year, but. Pivoted from consulting, ending that consulting life to just what if they became the security team for teleport? yeah, thank you to teleport. I, uh, I love teleport. I think Teleport is, uh, awesome. Uh, teleport is like the backbone of all of the SOC two stuff that we do at Fly. Um, so teleport is like, um, teleport is like an SSH server. It's a, it's a certificate based SSH system, right? So it's like a, it's like cattle fleet, SSHI mean, you can use it for a single server. It's really easy to set up and all that, but it really shines as a cattle fleet, SSH kind of deal. Um, so we're getting like, um, SSO integrated logins for all of our internal SSH stuff. This is all behind our kind of like tail scale VPN situation. So none of this is exposed to the internet, but it is our internal control system for who can, you know, get access to what, but like the really cool thing about it's, it keeps transcripts of all the SH sessions, which is a pretty handy, like if you're just trying to figure out how another engineer fixed a problem with like LVM two or something like a week ago, but B like once you have transcripts for all your estate sessions, then any of the business processes that you have in your org, um, that run through terminal commands. Like if you, uh, you know, pop an IRB for a Rails app or something like that, and that's how you add or remove groups or things like that, you now have an audit trail for it. Um, which is all SOC two auditors care about is, is there like documentation for whatever it is you do? So we, we got to knock out so much shit just because we had teleport set up. I would say like Teleport is probably the second most valuable tool, um, just in a SOC two and compliance sense. The second most valuable tool after SSO, it would, it would be the second thing I would set up after SSO if I took a security role at a big company. So Teleport awesome. We love it. We love Rob too, but we love Teleport more Yeah. And one cool thing about SSH certificates is they are not X 5 0 9. uh, yeah, I think. I think, I think only we care about that. Like, No, no, of really you, you've gotten pushback from people like as state certificates, this certificate nonsense again. No, I just get generic pushback against the concept of X 5 0 9. Exactly. Yes. Exactly. I think, think when you hear certificates, you, you start cringing internally. If you are aware of the existence of XX 5 0 9, and then you hear, no, no, no, no, no, it's not. It's a completely different thing and you're like, I love it already. See I, I'm not aware of anyone that like was going to deploy that like would not have deployed SSH certificates until they learned that it was not X 5 0 9. I don't know that that's a person that exists, but I. I, I share this sentiment completely and I feel the same way about it. And I've done an implementation of SSH certificates and been delighted by it. Right. But I think it's only a voice. So whenever I write about SSH certificates, I always write a little, you know, caveat, these aren't X 5 0 9. Right. But I think, I think only the three of US care. No, I like, I literally, it's just you tell someone, no, no, no, it's not X 5 0 9. And they like this, this sort of like cloud lifts from your soul. It's not, it doesn't have to have like a, like an actual, uh, case that has happened in real life. It's just the, the lightness of being in these kinds of certificates as opposed to the most dominant kind Tre, weren't you just saying that your name is like a Celtic myth about someone who has no lightness of being, Yeah. Um, my name is from like a story of a princess who ran off with her lover and she was trapped in a tower, married to some old king, and then the king, No different. Different, uh, and then the old king, uh, chased them down and killed her lover. And then she, she collapsed crying on top of his slain body. And the name means raging and sorrowful. The end, end of story There's a Fairport sorrow was because she thought SSH used X 5 0 9. There's also a Fairport Convention song about that too. yeah. Uh, so anyway, we're throwing a party. Teleport is sponsoring it. Thank you to Teleport Once again, the party is near the In-N-Out Burger. Um, so we can all go get In-N-Out Burger at the most impressive In-N-Out burger in the country. That is an operation there on the strip. Extremely, extremely overrated burger. It may be an overrated burger, but I'm just impressed by how many people they get in and out, uh, literally in and out of that, uh, of that physical location when like everybody is smashed. Um, and how quickly they're able to like, reproduce their, their, what some people would refer to as food. Yes. Near, it's near the in and out the event. When you register for the event, you'll find out where it is, but afterwards we tend to go to the in and out. The one time we've done this before. Cool. Uh, what we got, so Deirdre, I heard you had some life updates. Oh yeah. I'm no longer working for my former employer. I am now, uh, fund employed, but I'm also, uh, taking, taking bids for my time and energy. That you're not fun employed. You're consulting. I'm fun consulting. I'm also taking it easy on, you know, what sort of fun consulting I may be doing. So like, if something cool comes up, let me know. If not, gotta come to Deirdre with good projects and then be happy when she selects you At least for the next couple of months. And then I might get a little bit antsy and be like, hello, can I interest you in some cryptography? and you're all adults, so I'm sure you can figure out how to contact her. Yeah. I'm, I'm on the internet. You can find me there. yeah, but we're going, we're going to Vegas for, uh, other reasons besides SCW Pod Con, um, what's happening at Black Hat? I do not know what's happening at Defcon. Uh, but I have no idea what's happening at Def Gun. I think we talked last year about how much I dislike going to Def Gun. So Aw, like going to Def Con, but I think last year I was doing PQ thingies at the Crypto village and I don't, haven't been able to participate very much in this year. But for Black Hat, we've got a couple of things on the crypto track. yeah. Uh, there is, um, one talk about someone found some SCADA slash ICS protocol that's apparently called OPC uua. Um, I don't know where and how these are used or if they're internet exposed. My understanding from a bunch of research from census is that all the SCADA stuff is like exposed on port 80 80 via HTTP and not via like Modbus or something, right? You just find the admin panels, not the underlying protocols, but regardless, the underlying protocol here has a bunch of nineties, there are Crypto Vs. Which is kind of funny. Um, and padding. Oracles make Thomas happy. I mean, I just, those are fun projects and, uh, you know, fun talks like, like a, a really hardcore new side channel vulnerability. Um, is not gonna have the kind of payoff that you're hoping for in a talk or whatever. Like, it'll be meaningful cryptographically and, you know, it'll be meaningful to computer science, but it won't be like dramatic, like it won't Hollywood, whatever the application is. And this, this talk looks like there are some Hollywood vulnerabilities in it. So I, I do, I do love a Hollywood crypto vulnerability. what? How do you define a Hollywood crypto vulnerability? A Hollywood crypto vulnerability is one where you can write an exploit, where you have a random string that's rotating quickly on the screen and gradually a character at a time is revealing itself. Like in the Hollywood movies, that's not, it's not my term that's, that's tied on's term. It's a, that's a real, you, you should know this as a cryptographer because that's a real term. I, I missed that post on their blog. Uh, but no. Yeah, I, uh, that that sounds about right. I think this is something we would see in, um, what's that movie with Hugh Jackman Swordfish Yes. like, he's undergoing like torture while trying to hack into something for some reason. And there's all these graphics. Okay. It's been, it's been too long since we've had a Hollywood vulnerability and a, you know, a more recent construction probably because we spent the 2000 tens eradicating those vulnerabilities. But there, they're due a comeback now that we're doing post quantum stuff. We should find new ways to, uh, Oh yeah. I'm worried about those sort of things for this sort of reason because stuff that you haven't touched in a long time that is like, all right, fine. And now you have to go touch it and you have to shove something new shaped into it or something larger, for example.'cause all the PQ stuff is larger. And then suddenly things just kind of go, just the crack start showing, and then we have a talk there on fault injection attacks, on post quantum signatures, which is entirely you, Deirdre. Yeah. Let me go, Did you say you had no idea what was going on at Blackout? You were a viewer for Blackout. con def con, Oh, Def Gun. Okay. con, Um, this is targeting, um, verification logic. What, Yeah, just what actually is a fault, right? RSA fault injection was like a big thing, and at this point I don't actually know what a fault is and I'm kind of afraid to ask. um, it's like a way to like twiddle with everything like a random bit flip in your signature. And like you're able reveals your private key. or, or whatever you're able to cons like, and this one, you're able to construct a forgery, uh, without breaking the underlying primitive. So it's like the, the cryptographic assumptions are solid. The algorithms for signing and verifying and keygen is solid. The implementation on the surface is like solid. And then this is you trying to like, do some bit flips or some like voltage, you know, shenanigans or whatever. And you're able to like futz with the actual execution of a correct algorithm and you're able to produce a result that, uh, you know, is bad. And like in this case, it's like forgeries of signatures. Um, yeah, like. Real microcontrollers. These are, you know, things you have to be able to be aware of when you have, when those things are in your threat model. you should, I mean, like, let's think about RSA, I don't know the specifics of how this works in post quantum signatures. Um, uh, like presumably we can go to this talk and learn, um, but. Like in RSA, like a number of years ago, like five years ago or something, like everyone collectively decided, oh, we should like make sure that like we don't output an invalid signature if there's a bit flip from RSA libraries and basically double check your result. And there's a cheap way to do that without like doing all the computation and everyone added that to their RSA libraries, except apparently like Baidu, uh, um. So like some researchers at San Diego and CU Boulder were just like monitoring TLS connections for a passive tap on their campuses and just like looking for bit flips and signatures and the answer. And they found four and all of them were for Baidu because it turned out out that like everybody except Baidu had updated their libraries to like defend against this. And once you have a couple of 'em, you just like CRT out the private key. so if you want a conspiracy theory, there it is. several signatures from the same key pair, Yeah, if you have like more than one fault from the same key? pair, you can just CRT out the private key. I don't know, uh, I don't remember from the submission if this, like, if that sort of attack is leverageable or it sounds like they're just able to produce a forgery when they have direct, you know, injectable attacks against the thing that's actually doing signing or something like Yeah, it's really just RSA that has this fun property where when you do anything wrong, the private key just pops out. Well, you know, the, this not for fault injection, but you know, E-C-D-S-A has had issues with, you know, bias, nonsense and things like that. So it's, it's not just an RSA thing or, or, you know, uh, factor things based on multiplying primes together. Um, but it shows up in different ways. So like the, the way you construct the signature can really matter, um, with, uh, how you, what sort of things you're opening yourself up to, even if it doesn't, if it's not directly about fault injection or fault attacks. Um, I'm trying to see if there's a, um, if there's like a mitigation about, at least the, the Sphinx plus one, which got Sphinx Plus got turned into S-L-H-D-S-A as the FIPs the big hash signature. Yes. And everyone both loves it and you know. Not, there are people who are like, Hey, let's use S-L-H-G-S-A, uh, for TLS signatures. And some people are like, yes, I love that because I need it for reasons. And other people are like, why would you ever do this on the, uh, uh, secure internet? Uh, sorry, on the secure web. Why would you ever serve these certificates for the web? And they're like, we are not. We use TLS in other places besides the web, and it's suits us really well in those places. so some people want to use SLH-DSA, this is what everyone puts into hardware, right? Like if you have a hardware if hardware verification of like your own firmware, it tends to Yep, exactly. I'm not finding countermeasures real quick here, We will just have to go to the talk and learn. yes, yes. Uh, Tetra Yeah, so tetra is like really big in Europe, right? Like it's a big deal, like public safety protocol or whatever. Is it like what the police use or, it's, yeah, the police and military use it a lot in to like so there's like, um, there's an end to end tetra encryption thing. So the, the authors of this did a, did a, a presentation and a paper on Tetra like two years ago. Um, so this, this is the second time Tetra has been on a black hat track. Um, and like, I guess, so I don't know enough about Tetra, but I guess there's some, like I was gonna say novel constructions there, although I'm assuming it's not novel in a computer science sense. It's like novel in a, you know, internal standards came up with some random shit sense. Um, so like, and I, I guess it's like a suite of different things and there's an end-to-end protocol on it. And they broke in some ways, the end-to-end protocol. Hmm. A suite of tools We should have more to say about like, again, I think this is a really big deal in Europe and we're just being blase about it because we're Americans and have our superior American. Yeah. In America, we just speak clear text over radio like adults. Uh, okay. So they like reverse engineer out the end-to-end encryption protocol. discovered several critical zero days in the radio, in the process. Uh, additional key extraction and covert implanting vulnerabilities. Awesome. know. So when we, when we do these, um, like we're all three of us are reviewers for the the crypto tracker plaque app. And when we're reviewing these things, like you get a limited number of slots for each track, and there are a lot of black hat tracks, right? So we got more slots than I expected for cryptography this year, but there have been years where we've gotten like two, right? So there's like a knife fight at the beginning of the review thing for like, if there's any excuse to getting a talk off of your track and onto somebody else's track. Like, there's a lot of reversing in this. So maybe this isn't a cryptography talk, maybe this is a reversing talk, right? Um, like you'll, you'll take those excuses and move things to, for us it's usually either like things get moved to networking. Um, 'cause there's a lot of network cryptography. Um, or they get moved to reversing'cause there's reversing involved in it. So it does say something about this talk that it survived and stayed on our track, um, and did not get pushed to reversing despite the fact that there is, from what I understand, a pretty compelling reverse engineering story about what happened here. Also, like it's, it's actually a big thing in local politics where I am. The fact that we've, um, like the dispatch center has now encrypted all the police radio here, like just last year, which means that nobody can listen to scanners anymore and they're all very upset about it. But we voted not to encrypt, but we're like part of a three municipality thing where the other two municipalities outvoted us. So, and I have like, so that's like Motorola Star or Starcom or whatever and I have no idea how that system works. So somebody out there listening knows how the Motorola encrypted Public Safety Radio, um, stuff works and they should contact us so we can do a show and then I can look really smart in front of our village board and talk about stuff. Now, now I'm getting slightly, uh, nerd sniped about this. I assume there's some way that you could like have a, A lot of those police scanners have like a web portal, and it seems like even if the whole thing was encrypted, you could just have a web portal, then it would be like, oh, I can't use my ham radio at home Yeah, it is. It is funny to me that like, so it's a really big deal that you can decrypt police radio in Europe and here it's like it's a really big deal that they can encrypt police radio in the first place. And like, so most of my friends are like civil libertarian type people who really want transparency and are bothered by the fact that like, you know, we're encrypting and making that stuff less transparent. But when you think about it, it is fucking ludicrous that if you're like breaking into houses or whatever, you could just have a scanner with you and just like, are they coming yet? Mm-hmm. I mean, yeah, like, yeah. It seems like a non hypothetical actual public safety problem that you can like stalk the police. They'd literally be better off just using their cell phones. Yeah. And I feel like they do do that. Or at least other, you know, internal, um, law enforcement services This is why I always coordinate my law enforcement action privately over signal. But then for transparency, I add the lead editor of the Atlantic to the group chat, and that way everybody's happy. I add Jeff, and you don't really check very hard about which Jeff you're adding. Well, well played both of you. That was very smooth. You just kind of worked it right in there. Um, but yeah, this, uh, this is cryptography. It reduces, uh, a hundred eighty, a hundred twenty eight bit key to only 56 bits. There's replay, there's injection. Uh, this looks pretty cool. Uh, It's got all the good stuff. Yeah. and naster. I forgot about the Yeah, I'm, I'm really, I'm really psyched about this. I'm very psyched about, Thomas. I, feel like you're, you get all of your joy in life from finding some like. federated protocol that is more popular in Europe that does something security related, and then just like shitting on it, just like, ah, these, it's federated and it's European. I bet it sucks. I've written enough Hacker news comments that like chat, GPT can do a pretty convincing me just based on my name. Like you can ask other people to do it and it will get my technical opinions correct. Right. So I think if you asked if you, if you asked chat GBT to do a comment from Teek on Hacker News about federation. Insecure messaging protocols. It'll rattle off a pretty convincing, I'll write a better set of paragraphs, but it'll do a pretty convincing take of what I believe about. And I don't believe anything interesting. I just actually believe what Moxie, Marlin Spike said about Federating. I don't think there's much more to it than that. Right. And I'm not like a, I, I like Moxie Marlin Spike fine. He seems like a fine person, but we're not like friends or anything. But like to me, what he said about the, the, the decisions that Signal made simply made sense. And then were completely vindicated by what happened with Matrix, which is a team, like, kind of doing the best they can. Like they, they, they were, you know, they wound up in some strange places, but like, they weren't doing things for the sake of convenience. Like there are, there are signal competitors that had like more features and were easier to use and had like synchronized buddy lists and all that stuff. Right. And the reason that they were competing so favorably on usability was that they had been making every possible. Decision in favor of UX and away from security. And that's not Matrix. Matrix has taken the hard way for almost everything. right. Including upfront you're so right. The AI does an incredible version of you. I'm sorry, I just asked it like it's, oh, it's got your voice down. It's like, it's a fly.io blog post, like right here. This is bad because what it really says is that I have chat GBT voice. It's No you don't. no, no, no. You, you, you have enough material out on the public internet that's been ingested that, and the, you know, these large language models are actually quite good at the language shit. Uh, that I think that's, that's most of it. do. I look like I know what a JPEG is. Yeah. Uh, I don't think this is very European though, though either. It's, it's just yet another, um, Jack Dorsey. I don't, what's, what's the drug of choice for, for measures? Dorsey? Uh, fucking they don't do two C. What do they do? They go in the, the Ayahuasca. It's some ayahuasca inspired initiative from, from Meers Dorsey at all. definitely, it's not European, and I can tell you why at the, from the opening on Wikipedia about Noster Yeah. this is not me. This is Wikipedia. 51% of Wikipedias believe what I'm about to say, is the Noster protocol was first written in 2020 by a right wing Brazilian open source developer known by the pseudonym Fiat j. was created as a result of perceived moderation issues on Twitter. So, yes, it's awesome and everybody should be using it. And how I know that is that every time the topic of federated, secure messaging or signal comes up on Hacker News, like three people come out of the woodwork to say that everybody should be using noster. but Okay. yeah, this year at Black Hat, we have a, we have our, our response. Okay. Um, so one, what, we'll put a link in the notes, what Moxie when he was leading Signal said about federation was basically, it's hard to control all the ends of the protocol that interoperate with your secure and tend encryption privacy protocol because there's the encryption part, but there's other parts of signal to service that are about privacy, independent of the end unencrypted messaging. Quote, it's undeniable that once you federate your protocol, it becomes very difficult to make changes. that's it. Uh, signal wanted to be able to control all the ends, and they still do. This is also what WhatsApp does, but they don't move as much. They, well they do, but they're just moving and a inject, uh, AI into every little corner of your, um, of your app direction. But for Signal, they control their Android clients and their iOS clients and their desktop clients, and that means that they've been able to move pretty quickly 'cause they control all the ends of the entire protocol. When you're federated, you don't control the clients. It's this open protocol. Ostensibly, someone has to control the evolution of the protocol and as some of us who pay attention to things in the IETF or Bitcoin or any other open protocol. That's hard. It's a lot of dirty human stuff about figuring out how to come to consensus or who is controlling the definition of the protocol. And then even if you have agreement about what the protocol is, getting all the clients to update, to speak the protocol and have enough of them speak the same version of the protocol so that you get the guarantees that you need. And unfortunately, when you are trying to do this in a security setting, if you're trying to improve security, uh, with a new version, um, you may have stragglers that might be on the old version. You have to figure out what you wanna do with people who haven't upgraded yet. And if you have to worry about downgrades, if you're allowed to talk to the old version at all, because of some security issue, and on and on and on and Yeah, this has What, what? think this has happened three times with Matrix. Now the first with trying to make Matrix default encrypted, which it wasn't for a long time. For years, they had, you know, a multi-party, you know, end-to-end encrypted thing that couldn't be enabled by default.'cause a huge percentage of their clients simply didn't support it. Right. And then when I think Kenny Patterson, Yeah. no, not Kenny Patterson. The neca, the Nebu Cas are, yeah. Yeah. I, I apologize. Yes. I apologize to both of them. but like, when they totally wrecked that protocol and then trying to get. Uh, matrix transitioned from that wrecked protocol, the MLS, which they still haven't accomplished, but they could have reasonably quickly if they just controlled all the endpoints and they're like in the middle of a coordinated update for cryptographic vulnerability right now. That's gonna take a while just because they have a diversity of server implementations. Is that, is that the one we've talked, talked about in the past and they just haven't been able to push the updates to everybody yet? Or, I forget. We keep, like, I think we, we keep meaning to get, um, the people from that team on, on the show and they should, like, I, I'm, I'm rooting for them and it never sounds like we are, but I am rooting for them we had, we had the Nebuchadnezzar focus on the show. we had the Nebuchadnezzar folks on, but we haven't had Matrix on to tell their side of the story or what they're doing with it. And I think there was some ambiguity about which of the neca, the NECA vulnerabilities they were gonna address directly and which they were gonna stop gap and which things are addressed by MLS. Yeah, sure. It's decentralized and, and federated, but like their proposal for encrypted end-to-end encrypted dms was just bad by itself. This is Yeah. Yeah. So like they, um, this talk, like the Noster talk at, uh, at Black Hat was also I think like just a week ago, presented at uh, IEEE, security and privacy. So, I mean, it's, it's out there already, like some of the details on it. Um, and I'd like, I'd talk more about it, but what I really wanna do is just get somebody from the team on the show and just go through it. The noster thing. Yeah. All right. So the thing at IEE, this is bigger than just the end-to-end encrypted stuff. Oh yeah, no, it is like, it's, it's, it's like when I reviewed this, my description of this was, it, it looks almost exactly like Nebu nazar, which is like a fractal of things that could have gone wrong with a, with like a complete ecosystem of like a secure messaging system. So they, like, they found flaws in almost every component of that system and then tried to leverage them as far as they could. It seems like this is the same thing as that, like ecosystem. Yeah, the ecosystem wide, except with a much dumber protocol than what Matrix started with. Um, so I mean, this talk is my happy place, is how I would sum it up here. they had a design sketch of the end-to-end encryption, uh, for messages. Uh, and I don't have it in front of me anymore. Um, but yeah, the attack, yeah, we, we, we sort of were touching on the, the federated na nature of making be, that being makes any secure end-to-end encrypted or security based protocol, much diff difficult to maintain and maintain period control period slash evolve or improve or fix vulnerabilities or fix issues, uh, in general. Um, and this is not just, you know, noster, but basically any scenario that has federation, but. That does not necessarily mean that you have a flawed end-to-end encrypted or whatever encrypted, uh, direct messaging design that allows you to forge en quote, encrypted direct messages, um, the subtle flaws in the design event verification and link previews, allowed to forge those messages, impersonate user profiles and leak confidential messages from quote encrypted dms. yeah. I love this. Yeah, it's, it's, it's Euro s and p and it's, uh, not in the prophecies, practical attacks on Noster. I like, I like that name. Anyway, use signal is partly what we're saying. yep. No. Go to awesome crypto attacks where they in 2025 break a secure messaging system using Wait for it. CVC malleability. Yeah, Uh. that's true. Yeah. Yeah, it's a good talk. Go, go, go check it out at Black Hat when you're And if you're listening and we know you are listening to us Noster Project, uh, people come on the show and go through this talk with us. It looks really neat to. Yeah. I'm very curious about proposals for both how to do decent. Anytime someone is trying to bolt into an encrypted dms or encrypted dms onto a protocol, I'm very curious about how it goes because it's tends to be a little bit difficult to figure out the way to do it Nicely. Period. The, the best end-to-end decrypted chats are like that is the product first, like Signal WhatsApp succeeded in that they controlled all of their clients. They were originally unencrypted and then they adopted the signal protocol and they turned the entire billion plus user. Uh, to default end-to-end encrypted. And that's probably the most successful thing that I've ever seen. But, but again, the messaging was the product for noster, for Blue Sky, for, uh, things like Mastodon. I've seen proposals of how to do end to end encrypted, uh, dms on the Mastodon protocol or, or whatever the actual protocol is underneath Mastodon. Um, it's always a little tricky and one, it's bolting it onto something that, that's not, the design of the system is about messaging first, or private messaging first. Uh, but then second, there's federation involved. So I'm always curious about how these things work and evolve because it's not easy and they, they vary a lot about, you know, the, the constraints that they're trying to operate under and how they try to solve them. So anyway, okay. Let's talk about quantum factoring because. Because this podcast is biased towards, uh, quantum resistant Before we do that, before that, real quick, 'cause I was looking up the details for this Noster thing on the I, the Euro SMP thing and also on the Euro s. And p program from like last week or whatever. There is a talk on attacking and fixing the Android protected confirmation protocol. Ooh. Um, yeah, so this is like bypassing a guarantee that the, uh, the trusted execution environment makes. Um, it's a formal methods talk. They did a formal proof, and then from that the only formal methods talks I'm interested in are the ones where you formally model something and then find actual vulnerabilities. And they did. So I don't have any more details than what's in the program here, but I'm guessing that somebody who knows somebody that was in this, uh, you know, in this research team at the University of Edinburgh and then in RIA and a couple of other French places that I don't know, somebody knows one of these people and we would love to talk to you. This is how we get all of our guests, is I just do direct appeals to the world, um, for research teams that find cool crypto vulnerabilities and, uh, this is one of them. So you should also come on the show and explain to us how the a PC protocol works and how you broke it. That also at IEE. Euro s and p pretty decent crypto track this year. That's all I, that's all I got. uh, and come to Vegas. yeah, come, come to Vegas. Come to SCW Pod Con. We, we have told, told several people, like, they're like, ah, I wasn't gonna do X, Y, z, I don't like this. Y was like, you could just go fly in just for SCW Pod Con and then you do not need a black hat ticket No, you do not. This is not despite all of us having helped review, uh, submissions for the crypto track at Black Hat. This is not a Black Hat affiliated event. This is just us. You don't need any other tickets? This is just what I do for fun. Yeah. Um, quantum Factory Let's talk about quantum factoring. Speaking of things I do for fun, um, so there's this paper that went viral, um. It's called replication of quantum factorization records with an eight bit home computer and abacus and a dog, mm-hmm. um, by everybody's favorite, IETF commentary, Peter Guttman. and it makes the general point that in terms of like actual progress by, um, quantum computers factoring things, we have so far managed to not quite factor the number 35 when given the factorization as an input. Um, we've done 15, 21 and 35 basically, I mean Yes. And we've done that for a while now. And I will say, I think the best, the biggest quote, physical qubit quantum computers that we have so far are, I think we have a hundred physical qubits and recent results are showing that we have a very, very reliable high fidelity, highly error corrected, logical qubit. That we can't do operations on out. Yes. like quantum memory. Sure. We, we basically, uh, a couple of, a couple of months ago, the, the Google Compute folks showed that you can, in fact, with better algorithms for error correction, uh, make a more reliable qubit logical cubit. By adding more physical qubits to do your quantum error correction. Previously this was theorized as possible, but they kept throwing physical qubits at it and they couldn't, they couldn't. The more it's supposed to be like this, you know, nice scaling factor that like, it's not just purely linear, um, how many physical qubits you would throw at your, uh, error correction algorithm to give you, uh, a more reliable, um, uh, logical qubit. Because in terms of reliability, it's literally, the way that quantum algorithms work is by taking your logical qubits and you like put them together in a quantum circuit and you do a little thing, you do a little twiddle, and then you reconfigure them into another quantum circuit and then you, that's the next transition, and then another, and another another. And if they degrade over time, you can't do good algorithmic computations with them. So you need a high fidelity, uh, reliable, logical qubit. We have one. We finally have one very good, reliable qubit. I think it's like 10 to the negative six or whatever errors or something like that. And they're trying to get 10 to the negative nine or whatever it is. They have it, they have something very good and they think they can make it even better. But still it's just the one, it can't do much logic, quantum or digital logic, uh, with just the, just the one. So all of our quantum computers that we have so far are driving the field of quantum information and quantum computing forward, but they've still not shown any actual improvements on being able to execute Shor's algorithm, the big threat against, uh, classical asymmetric cryptography because they've all just been, you know, small. And so the, the best, the best that the quantum computers can do has basically been the same. Or worse as the best that modern digital computers can do. And this paper is just sort of like making ano, making a point of that again by using an eight bit home computer, an abacus and a dog to factor 35. Yeah, I think that there's like a valid argument about like in terms of prioritization, like is the security problem that you're really concerned with, like the fact that a quantum computer like might exist in the future versus say, um. Like, can I patch vulnerable versions of Apache, whatever that like, you know, the credit report contact, I wanna say Equifax had like an unpatched, Apache something, something, and that's why like everybody in the USS social security number leaked. Um, but like, like it's just not, it shouldn't be high on the priority list for most organizations. I was at like a post quantum thing in Maryland a few months back, and Rob Joyce, former head of, uh, of NSA Tao and maybe NSA generally, um, was there, and I did talk to him and I was like, look, who should, like, obviously the US government cares about this, but like, who should. Who should actually care about this, like, besides the US government. And his comment was basically anything that has to deal with national security systems, um, and anyone who's already worried about state level attackers should probably worry about this. And I think that's like a decent way of looking at it. Like I, again, I'm not sure that I would like even rank it above like, you know, um, getting exploited by O days or something like that. But at the same time, like, I don't know, the US government has decided isn't important and so the reason that like all of this work is happening is because the US government has decided that it needed to happen and like you, whether or not like it we ever be, are able to factor 35 and outperform Peter Gutman's, Abacus and Dog. Like, I don't know. It kind of, it doesn't matter because like the constraints that like we're working with as well. The US government has decided that this is important for this class of systems. Um, then, then, you know, the stuff that like Deirdre and I work on for work are like technology that is used in those contexts. And so we have requirements around it and we have to go solve them. Um, is that like a full employment program for cryptographers? Sort of, maybe. I don't know, but like I didn't go to the government and advocate for this and you know, I probably wouldn't have like, pushed it as the highest priority thing, but like. Arguing about, you know, we all know it's not the most practical security, uh, risk right now, but like, that, that's not what is pushing it. Like what's pushing it is we were told we have to solve it, so we're solving it. And I, I would make the argument of like, yes, if you want to be very, very kind of practical minded of like, who right now or who in the next five, 10 years has to factor in this sort of threat into their threat model. Yes. You state level, you know, national government systems, national security systems, and anyone who, uh, has to worry about state level adversaries. Okay. Uh, nation state attackers. Okay. And we can think of, you know, the, the type of organizations that can fit into those buckets. Cool. Great. Alright. Sure. I am also aware of how, uh, because of the compute capability and the kind of shared resources, uh, projects, protocols, uh, that everyone uses, um, it's not unheard of for someone to start. A business or start a project or something like that on AWS, Google Compute, Azure, whatever, whatever your compute platform may be. And then at some point you become big enough and important enough that someone starts to come after you because you be, became a victim of your own success. And then all of a sudden you didn't think, I, I just do, you know, this little app, this little service, no one really cares about me. And then five to 10 years later, no, someone big, someone cares about you for some reason. And they happen to have, uh, access to a cryptographically relevant quantum computer in their back pocket. But you didn't think about that when you started building all of your shit. If we have good, secure cryptographic defaults into our compute infrastructure, into our protocols, into our. Uh, software packages, uh, that everyone seems to kind of rely on. You don't have to worry about that. Um, and if they're efficient enough, uh, and fast enough, then you shouldn't even have to think about it. It's not even like, ah, I could use this because it's available to me. It's a little too big. It's a little too slow. Fuck it, I'm gonna go use the faster one. There will be, you know, scenarios depending on the constraints of your systems and your users that you may pick them. But if it's kind of like a tossup, like yeah, sure this is fine. I can use hybrid key agreement and it's fine. Or I can use like the, you know, the base level post quantum signature that's now being offered by my package or my compute, or my key management service or my certificate authority or whatever it is. You can just be like, yeah, sure that works fine. And you, you don't think about it and you don't have to worry about the day where you know, you become the victim of your own success and become targeted. That's kind of like the world I'm looking towards is if hopefully we can just sort of be in a world where you don't even have to think about this sort of thing and whether this is in your threat model, because there may be totally, like maybe today it's not in your threat model, but there's a possibility that it will be become part of your threat model and it'll be a lot harder for you to mitigate it when it becomes to that point and you might already be vulnerable to that sort of thing. So. Don't worry about factoring by a dog. I don't know. Yeah. I mean, complaining to the IETF is like not gonna. Make a difference here. I don't think, Okay. Yeah, yeah. Well, we're trying at the ITF I'm actually quite pleased because, uh, I was complaining that we were moving too slow, but it seems like people are moving, so maybe we aren't moving too slow. But we'll see about that in the ITF. Just to, to tie up, not on that, that paper, TLDR, yes. You can outperform or equally perform factorization of known small numbers, the same as the best quantum computers we have because they're small numbers. When the numbers get very, very big and we have an actual quantum, quantum cryptographically relevant quantum computer, uh, I'm pretty sure it's gonna be when, but like, you know, is it gonna be in time for the targets or you know, is it gonna be this kind of, you know, this catching up race forever and ever. We'll see. Um, but when the numbers get cryptographically big, that is where these algorithms are. That's where the thread is not when the numbers are this small. It's not sure's algorithm as a test for like, are the quantum computers like, good yet for small numbers? Is that's not the benchmark. It's not a relevant benchmark for like seeing like, are we there yet? Are we there yet? Are we there yet? No, it's gonna be like a stepwise. It's gonna be where are these two different like, uh, growth curves? Like, you know, it's gonna be the non quantum for a long, long time, and then all of a sudden there's this like. Boundary crossing thing where the quantum computer just completely blows it away. And the, the other classical digital computers are just, they just cannot keep up. And that's when the computers are large enough to attack these large cryptographically relevant parameter sizes. So, very good troll Peter Guttman. I am sure we'll have some sort of long-term support for classical computers. Anyway, Um, we absolutely will. And as someone reminded me the other day, um, the classical computers are key parts of making the quantum computers go. Like, how do you think they run those very important, uh, error correcting algorithms? They're run on the classical computers and it's very important that those classical computers have all the good computer software and firmware and infrastructure security. Built into them because we don't want the quantum computers to get honed because the classical computers used to make the quantum computers compute is just like open to crazy vulnerabilities because I've heard some shit and I don't like it. So just make sure you're doing good security for your quantum computers as well. Yeah. we will add the, the, the YouTube channel three Blue One Brown, which has a bunch of like math visualizations, um, like a couple weeks ago or a month ago, did a very, very good video about, um, how Shores algorithm works. And on a follow up video about how he lied about how Shores algorithm works with more details, which is like a classic math thing, right? Um, and so I highly recommend everyone go watch it because, um, he's very. I'm forgetting the person's name, but he's very, very good math communicator and he wrote his own like visualization library basically to build, um, all of these math visualization videos. He does. He has Which is now every, it used to be every math visualization or every math lecture video on YouTube was done in the style of Ca Khan Academy. Like all with people like drawing and this little like neon things on a black screen. And now every fucking math, you know, video anywhere on YouTube is now done in three Blue, one Brown style.'cause you open source that library and made a video Oh, do it. though, I, well, three boot, one Brown. Gotta start working, uh, for Khan Academy, so. Oh, for fuck's sake, Okay. We, we have to, oh, Grover's. He's okay. I was Googling shore. He did Grover's algorithm. yeah, sorry. He did a Grover's algorithm. Not This is cool. I gotta watch this. am I the only person on the internet who was not helped at all with linear algebra by the three blue one Brown videos? Like it's life changing for people. And I, I watch that. I like them fine. They like their entertainment content for me, but like I come out of that with no greater facility for actually doing anything with like iGen vectors or whatever. I took linear algebra before these videos existed this, I took linear algebra in 2006, so I I, I had a very good lecture and he wrote the book that he gave to us and I think that's the best I've ever done in a math class. At MIT was my linear algebra class, I have to, I, I have to actually do problems to learn anything, Alright. although it this one string that's mine. That's mine. What were taught by string? I taught by Strang? He was lovely. He was an excellent teacher. I did great in that class. I, this might be why Yeah. Deirdre. With the spicy opinions here. Ah, Shocking. Deirdre likes Gilbert Strang. No, but like, I think this might be why I am bored with like lattice math is because I'm like, oh yeah. It's just all like, it's the thing I did best at my MIT undergrad. I took, I took it in 2012 with some professor who looked like Tom Cruise. Um, and that's like all I remember from the class. Linear algebra is one of those things that I'm incapable of, like retaining for more than like a month. Oh no. learned it and then it just out the other ear I learned it from that, from that book and then from the Gilbert Strang YouTube series from the 1803 class. Um, which I gotta say, like you, you, you gotta watch those videos, you gotta watch them at 2.5 speed, and then towards the end of each lecture cut it back to his normal speed so he sounds chopped and screwed. It's awesome. Uh, 1803 or 1806. I think it's, it's 1806 is probably what it's, Yeah. then at some point you actually have to do math problems to learn it and like that's the part that sucks. Yes. Uh, cool. And I have to catch up. I've never seen three blue, one brown. So now I have something to, uh, to enjoy. yeah. They're great. It's. And like, especially 'cause like I have a bunch of stuff queued up for like quantum information. There's like an improvement of a, like a quantum attack algorithm. And now I like this. This will re, you know, prime my brain cash for, 'cause they have a couple of quantum quantum information videos. Cool. do we have one more thing? have one more paper, which is how to prove false statements, which you already have a video about from January, but there's like a Quanta article or something, a Pops eye article about this and people have been asking us to comment on it. Um, and so we'll just have Deirdre's proof corner and Thomas, and I'll mute and go off camera while, while Deirdre explains why this paper is not that big of a deal. um, well actually it's. It's not like the, it's not like they're, the paper was showing some sort of fundamental reorganization of like, information provability, whatever. This is specifically about Fiat Shair, the Fiat shair transform. That takes in interactive protocol sometimes, like, usually they're like a called a Sigma protocol where there's like someone that makes a commitment, or this is usually the kind of protocol that you apply for your trans transfer to. Someone makes a commitment to something like Anon or something else. They send that to another party. Uh, they, uh, make a challenge based on the commitment value, which is public, and they send the, the challenge over. And then there's a response based on the challenge and the commitment and any other information that they have to compute over. And there's usually some sort of secret value that they, the only way that they can create a, a response. That, uh, will validate what the whole protocols that they have access to the, the secret value or something like that, and then they send that over. And then the validator, which is the, the kind of responding party checks everything and checks that it all computes. Uh, and you smush all this down using a hash function or something like it, and you're able to, um, compute the challenge via the hash function of everything that comes before so that you don't need this interactive protocol anymore. Um, it just turns into a non-interactive thing. And this is how we have signatures like, sort of like E-C-D-S-A-E-C. DSAs is a kind of funny. Uh, funny bastardization of shore, uh, snore, uh, Schnare also d did, um, this lovely protocol and the, you fiat shair it and you get shore signatures. But fiat shair is very important for all of these zero knowledge proof protocols for snark protocols that everyone in kind of the zero knowledge space and a lot of cryptocurrency spaces really, really, really like, they go to town and they just throw Fiat Jamir on these big, big, big complicated protocols. And we knew that, like especially the Trail of Bits folks did a lot of work prior to this paper about like, it really, really matters of when you are taking a protocol and you are fiat shame mirroring it, that you include everything you need to include in that Fiat Shamir transform and you commit to it and use it when you're computing these challenges and everything else. And that includes. The public based parameters. All the public information that they quote adversary can see, uh, public keys, uh, the description of the protocol of like, you know, like there's a lot of data that you might, especially when you get into more complicated things like A-Z-K-V-M or something like that, or just like these much more complicated protocols than just like, uh, a signature scheme, which is basically proof of identity or like kind of proof of possession. Those are very, very simple. But once you get a lot more complicated, there's just a lot more stuff that's very important to include in your zk, uh, your fiat transform. Um, and it's easy to forget something. This paper basically was a, a dirty, dirty hack. A brilliant, dirty, dirty hack where you're, they were a, basically able to. Embed, they were able to like embed into the actual, transform the computation of, I forget if it was the, I think it was the challenge, so that they're able to prove something. They're able to prove a false statement because they're able to compute the thing inside it on the fly. And instead of it actually being, uh, computed ahead of time or deterministically or whatever, they're able, it's this convoluted, dirty, dirty hack. Um, and we'll, we'll include a link to my, uh, my edit of, of doing a deep dive on it. it is not exactly about, haha, we can just prove fake shit all the time. It is, it is an abject lesson in, um, it's hard to do fiat shair securely. The more complicated, uh, that your protocol gets and the more complicated your statements are, um. The things that are very simple, the result of v very simple fiat uh, fiat mirroring, very simple protocols, sort of the way you get signatures and very simple, kind of like zero knowledge commitment schemes or something like that. Those still seem fine. Like it's just very simple. This paper is more like, there's a lot of things you have to get right to do this securely with more complicated protocols. And it's also like, it may be a death knell for things like zero knowledge VMs, which take an arbitrary like, uh, circuit statement, like an arbitrary program, and they're trying to like prove like execution in zero knowledge. That's like the whole kind of like value statement of A-Z-K-V-M. Like you can. Run something on the fly in your virtual machine, uh, in zero knowledge and just, just prove that it executed. And that's all like correctly. And that's all you're doing. But you're accepting arbitrary program, arbitrary quote, circuit statements, uh, to the vm. And it's, it seems very clear that like an attack, like this is gonna be very, very hard to just fully mitigate in A-Z-K-V-M construction. Um, like you'll just be like whack-a-mole. You're just, it's gonna make it really, really hard to provide the value that A-Z-K-V-M theory would provide you, while also mitigating every possible like, avenue of this sort of like attack. Uh, yeah. For this paper that was, uh, written about in Quanta. We construct an explicit circuit for which we can generate an accepting proof for a false statement. And let's see, let's kind of reminds me, there's like a class of people that think imaginary numbers aren't real. Um, I mean that in the. A colloquial way and not the math way, which is definition only true. Um, because they think it's an affront to God. And so then they show you these proofs. This is like a real thing. Um, and then they show you these proofs of how like, I can't exist because like you do like square some stuff. Then you take like the half power, then you end up with something that looks like negative one equals one. And the problem with 'em is that all of these proves they're just like using the square root operator incorrectly. like then you just like end up losing a minus sign because like plus or minus or odd and then you end up with like one or negative one. And uh, yeah, that's what this reminds me of. Um, yeah. We've not broken all math, no abs absolutely not like the, the, the, the title of the paper is very good because that's what they're literally doing. They're able to construct a circuit that is, and they're able to make a proof. They're able to send it to the scheme, which has this, you know, it's not covering everything completely. And so they're able to prove something that's not true. They're able to, to produce a proof that is proving a statement. This is not in fact true. Uh, and that's, I think it's, I think it's, uh, I forget which one it's soundness, uh, or versus completeness. It's like literally you're able, soundness is like, you're, you prove everything. Yes. The proof system is truthful. So whatever it proves is true versus completeness. It's comprehensive so it can prove all truth things. So it, yeah, it breaks down this because it's producing a proof that is, uh, that validates of something that is not true. And then. I'm just going to go through their conclusion 'cause it's quite good. We find the violation of Fi, fiat shair, uh, of a standard natural protocol to be very concerning. it raises the question about whether fiat shair of other protocols is secure, is worth worthwhile to point out some specific properties of the GR based protocol that we considered in this work, which facilitated our attack. While we do not know tax protocols that do not satisfy these properties, doesn't mean these attacks don't exist. Is useful to compare the modern applications of Fiat Tamir to those originally envisioned in the eighties and nineties, specifically in the context of constructions of digital signatures. Yep. The original use was applied to very specific identification schemes. in contrast, the modern usage is intentionally designed for protocols that are to prove general purpose computations. Um, our tech leverages this in order to invoke the proof system relative. To a computation involves the computation of the fiat mirror hash function itself. Yes. As well as the polynomial commitment. Okay. So I, I remembered it right, but it was like how it's computing its challenge via the hash function of over the, you know, the circuit that they were able to able to manipulate. the G care based protocol, uh, has a key property of the prover, does not commit to the full computation trace. This is one of the most compelling features of the protocol. Unfortunately, the fact that the computation is not committed to also enables our attack, we can consider explicitly invoking the fiat mere hash function without the need to commit to the corresponding computation Trace as a natural measure for this is to ensure that the circuit family is considered, is not powerful enough to compute the hash function. This can be done in any natural computational research, but some natural ones are depth, such as an ARI arithmetic circuit or potentially algebraic degree, uh, yada, yada, yada. We emphasize that, well, we do not know how to attack protocols that places common measures. Whether or not they, they're actually secure is enough. A question. Oh, we lost David. David's been having, uh, recording issues. Yeah, he, he, he gave us a command, which is plug the event and end the episode. okay. So yeah, we can't prove arbitrary false statements. Uh, this attack was very, a very clever, cute hack, uh, uh, against a very particular protocol. But the protocol itself has a kind of weakness that is both attractive. I forget why. Uh, it's probably more efficient or, or something like that, but also is open up to this vulnerability, um, because you're not actually committing to the entire like thing you're going to compute. And therefore when the quote attacker hands you a thing to compute, that includes in it. The thing that computes. The challenge, a KAA hash function, it's able to like, it's able to just turn it on its head and prove something false, produce a proof of a statement that's actually false. Um, it is mitigatable, but it's unclear if it's mitigatable period for protocols like this. And also how much mitigating this sort of vulnerability will affect things like CK VMs or other arbitrary, uh, computing in zero knowledge. Um, but that's it. It's very relevant for ZK people and people who care about fi Jamir. And don't worry, don't worry about it. and with all that, having being said, I would like to, uh, recommend everybody to come out to Vegas, to the SEW PO event, where the vibes last year were immaculate. Mm-hmm. And with that, because David asked me to, I have ended the episode. Bye. Security Cryptography Whatever is a side project from Deirdre Connolly, Thomas Ptacek, and David Adrian. Our editor is Nettie Smith. You can find the podcast now online at scwpod and the hosts online at durumcrustulum, at tqbf, and at davidcadrian. You can buy merch online at merch dot securitycryptographywhatever dot com. If you like the pod, give us a five star review wherever you rate your favorite podcasts. Also now we're on YouTube, with our faces, our actual human faces, human faces, not guaranteed on YouTube. Please subscribe to us on YouTube if you'd like to see our human faces. Thank you for listening,