[00:01.470 --> 00:01.940]  Hello.
[00:02.240 --> 00:03.280]  We're running a little late, of course.
[00:03.880 --> 00:05.760]  I'm Richard Cheshire, the Cheshire Catalyst.
[00:06.950 --> 00:09.620]  And as usual, we have a few announcements before the sessions.
[00:10.080 --> 00:15.420]  First of all, please put your own cell phones on mute or vibrate.
[00:15.700 --> 00:17.940]  And if you have them vibrate, it's going to be interesting places.
[00:19.230 --> 00:23.780]  We'd like to let you know that there will be music this evening.
[00:24.280 --> 00:32.420]  At 10 o'clock, I'm told there's a pretty entertaining fellow who was here last night and could use a wider audience, and it should be quite interesting.
[00:35.340 --> 00:36.820]  I've got the cell phones out of the way.
[00:37.900 --> 00:42.140]  And I'm hearing feedback, so let me give audio a little more to work with here.
[00:43.020 --> 00:45.540]  Now is the time for the Quick Brown Fox to bring all the beer to the party.
[00:46.100 --> 00:46.500]  There we go.
[00:47.640 --> 00:52.540]  Last Monday morning, I woke up to the BBC World Service on my public radio station, as I usually do.
[00:53.220 --> 01:00.500]  At the time, Dan Damon of World Update was interviewing our next speaker, Nadim Kobeissi.
[01:01.200 --> 01:06.480]  And they were talking about making encryption easier to use.
[01:07.260 --> 01:08.810]  And that is the subject of his talk.
[01:09.230 --> 01:10.090]  Nadim, thank you.
[01:17.200 --> 01:17.480]  Hello.
[01:17.860 --> 01:18.800]  Thank you very much for coming.
[01:19.740 --> 01:23.000]  Can I please get the slides going on at the big screen right there?
[01:23.000 --> 01:24.460]  Yeah, I think we're working on that.
[01:25.040 --> 01:25.400]  Okay.
[01:26.400 --> 01:26.740]  Alright.
[01:27.940 --> 01:28.300]  So...
[01:31.740 --> 01:32.100]  Hmm.
[01:32.500 --> 01:40.080]  I've got to go to the other...
[01:40.960 --> 01:41.320]  Oh.
[01:41.920 --> 01:42.760]  Yeah, I'll get the password.
[01:55.350 --> 01:58.430]  Is it okay if we wait to start a talk until I have the slides?
[01:59.450 --> 01:59.990]  Thank you.
[02:00.250 --> 02:01.450]  If it's not going to take that long.
[02:09.940 --> 02:10.360]  Can I plug it in?
[02:10.680 --> 02:11.040]  Yes.
[02:11.040 --> 02:14.020]  I can plug it out and plug it back in if you prefer.
[02:15.720 --> 02:16.520]  It's VGA.
[02:27.730 --> 02:30.210]  Did you know that cats use their tails for balance?
[02:33.090 --> 02:34.070]  That's actually what we're going to do.
[02:34.170 --> 02:36.010]  I'm just going to say cat facts until the thing starts.
[02:36.270 --> 02:41.670]  So, did you know that cats can climb up but not down due to the curving of the claws?
[02:42.410 --> 02:45.850]  Did you know that cats purr at a frequency that helps with bone healing?
[02:46.350 --> 02:48.190]  Did you know that...
[02:48.870 --> 02:50.050]  No, they're bone healing.
[02:52.410 --> 02:54.170]  They're very selfish, I have to say.
[02:54.810 --> 03:02.050]  Did you know that in ancient Egypt when a cat died, the family owning the cat would shave their eyebrows in mourning?
[03:03.250 --> 03:13.310]  Did you know that also in ancient Egypt, a Roman soldier once killed a cat by mistake and was killed by the villagers of that ancient Egyptian village in revenge of the cat?
[03:14.630 --> 03:17.230]  Did you know that ancient Egypt was badass and awesome?
[03:20.910 --> 03:23.610]  The aesthetics were actually really amazing as well, I have to say.
[03:23.610 --> 03:28.190]  It's really cool stuff like the geometry and math and hieroglyphics.
[03:28.350 --> 03:28.990]  It's really great.
[03:29.830 --> 03:33.550]  Did you know that my slides today are not on...
[03:38.340 --> 03:41.900]  Did you know that cats can jump up three times their own height?
[03:43.880 --> 03:48.080]  Did you know that cats can move each ear independently from the other ear?
[03:49.940 --> 03:51.460]  Like radar ears.
[04:04.160 --> 04:05.020]  Ted, are you...
[04:05.640 --> 04:06.840]  Wait a second, I think I got it.
[04:07.020 --> 04:07.360]  Are you ready?
[04:19.490 --> 04:19.850]  Great.
[04:20.310 --> 04:21.270]  It was something coming.
[04:22.790 --> 04:23.150]  Excellent.
[04:23.590 --> 04:24.670]  Well, thank you very much for waiting.
[04:25.110 --> 04:26.250]  Why did this fall all of a sudden?
[04:28.050 --> 04:29.090]  Thank you very much for waiting.
[04:29.850 --> 04:33.230]  So, it's been two years since I gave a talk at HOPE.
[04:33.710 --> 04:36.350]  It makes sense, given that HOPE is held every two years.
[04:37.410 --> 04:39.190]  And it's very nice to see you all.
[04:39.330 --> 04:42.230]  It's very nice to give another talk here.
[04:42.830 --> 04:45.310]  So much has changed in the past two years.
[04:45.570 --> 04:48.630]  It feels like such a long time ago.
[04:49.090 --> 04:51.970]  So long ago, as a matter of fact.
[04:52.670 --> 04:54.710]  It feels like the dinosaur age.
[04:54.790 --> 04:57.970]  And this is where we have to start in this talk.
[04:58.130 --> 04:58.590]  It's kind of...
[04:58.590 --> 05:01.430]  So, this talk is kind of two halves.
[05:01.650 --> 05:05.150]  And the first half is a butchered version of a talk that I gave at Google Montreal recently.
[05:06.410 --> 05:08.990]  About how usable cryptography has progressed in the browser.
[05:09.590 --> 05:13.670]  And the second half, I'm releasing a brand new encryption software called Minilock.
[05:13.990 --> 05:15.430]  Which I've been working on for a while.
[05:15.590 --> 05:16.570]  And I have very high hopes for.
[05:17.330 --> 05:18.390]  Everything will be released today.
[05:18.610 --> 05:19.670]  And I hope you'll check it out.
[05:19.770 --> 05:21.950]  And I'll talk about it in detail in the second half of the talk.
[05:22.110 --> 05:23.110]  I think it's promising stuff.
[05:26.070 --> 05:28.930]  In 2012, when we had dinosaurs and cavemen.
[05:29.890 --> 05:31.890]  Apparently not together, according to modern science.
[05:33.750 --> 05:39.790]  Browsers were conceived as not an environment that was, you know, good for cryptography.
[05:39.890 --> 05:42.150]  It was an environment that was in fact hostile for cryptography.
[05:42.450 --> 05:48.330]  What was blamed were many things that are legitimate things to blame at that time in 2012.
[05:48.730 --> 05:51.690]  You had the malleability of the JavaScript runtime.
[05:52.050 --> 05:57.050]  Which meant that when you wrote an application in JavaScript, which was the language of the web, the language that you used to make these things.
[05:57.810 --> 06:03.050]  You were writing a piece of software in a language that generally...
[06:03.710 --> 06:04.750]  This is kind of distracting.
[06:04.950 --> 06:05.690]  Can we close the door?
[06:06.230 --> 06:07.170]  If there is a door?
[06:08.610 --> 06:09.610]  Sorry about that.
[06:13.890 --> 06:15.750]  Try and bring this a little bit closer.
[06:18.050 --> 06:18.410]  Thanks.
[06:23.340 --> 06:23.700]  Great.
[06:24.500 --> 06:25.020]  All right.
[06:25.680 --> 06:34.080]  So there was the fact that when you wrote an application in JavaScript, you were writing something in a runtime environment that was very malleable.
[06:34.340 --> 06:44.760]  You wrote a piece of security software that was supposed to handle your data, and you wrote it in an environment where code could change at any moment, where new code could be injected, where there was no stability in what exactly you were running, or how it was running,
[06:44.840 --> 06:46.600]  or whether it was being affected by other stuff.
[06:46.600 --> 06:53.280]  And so this was not really the best scenario for programming stuff in the browser, or for programming cryptography software in general.
[06:53.800 --> 07:12.120]  The other thing that was really bad was the lack of low-level or system-level programming access, which means that to do cryptography stuff, to do encryption applications, you have to have access to certain things in the system, meaning you have to be able to generate securely random numbers,
[07:12.280 --> 07:16.740]  pseudo-random numbers, which means that you have to be able to generate numbers that are fairly unpredictable.
[07:17.500 --> 07:22.320]  So this is hard to do for computers, because computers are deterministic machines.
[07:22.600 --> 07:24.160]  They can't behave randomly.
[07:24.820 --> 07:28.240]  So the way this is solved is that you use things...
[07:28.240 --> 07:31.960]  you measure elements of the computer that are hard to predict.
[07:32.080 --> 07:39.440]  For example, the current temperature, the current speed of the hard drive spinning, the current usage of the hard disk, the network usage, and other things.
[07:39.440 --> 07:40.940]  And so this is what operating systems do.
[07:41.060 --> 07:55.020]  They combine all this stuff together, and they use it as the basis to then pass it as the source of entropy to a pseudo-random number generator, which is an algorithm that is fit to generate data that is uniformly indistinguishable from random.
[07:55.460 --> 08:00.420]  And so this is not something that you can do with JavaScript, because it's probably the highest-level language we have right now.
[08:00.540 --> 08:02.060]  It doesn't have low-level system access.
[08:02.300 --> 08:07.700]  Another thing that you cannot do is wipe memory, access the RAM directly.
[08:07.700 --> 08:15.040]  And this is important because if you are storing your encryption keys in the computer's memory, you want to be able at some point to wipe those keys and not let them there.
[08:15.340 --> 08:17.380]  And so in JavaScript, you have to rely on the garbage collector.
[08:17.500 --> 08:19.540]  You have to rely on the JavaScript parser itself.
[08:19.640 --> 08:22.140]  So for example, Google Chrome's V8 parser to do that.
[08:22.260 --> 08:27.540]  I think it does that if you delete a variable, which is great, but you don't have that certainty.
[08:27.980 --> 08:31.320]  So these are problems with JavaScript and doing cryptography in JavaScript.
[08:32.280 --> 08:40.980]  There was another problem which related to the fact of how the browser fetched and presented content and web applications.
[08:43.080 --> 08:50.380]  When you download Tor, or when you download an application, you download it and you install it once, it works great, and there's nothing else that you need to do.
[08:50.980 --> 09:02.800]  When you download a web application, like for example, Twitter, or Facebook, or Slack, you download it and you re-download it every time you open the website to use the application.
[09:03.080 --> 09:06.880]  Even though the application remains fairly similar with some minor changes.
[09:07.060 --> 09:17.360]  Because these web applications developed on a platform where the original intention for that platform was for it to be used to deliver websites.
[09:17.360 --> 09:21.060]  And so they are being delivered, even though they are not really websites, they're more full feature than that.
[09:21.280 --> 09:22.640]  They're still being delivered as websites.
[09:23.540 --> 09:33.080]  And so the rhetoric and understanding specifically of the code delivery problem was really bad.
[09:33.320 --> 09:43.300]  So code delivery, the problem existed because, you know, every time you're being served this website over and over again, every time you access the website, there's a chance that the code can be poisoned, that the code can be changed, that you could be targeted,
[09:43.440 --> 09:46.560]  served a malicious version of the code every time you open the website.
[09:47.280 --> 09:49.100]  Apps that you download don't have that problem.
[09:49.260 --> 09:55.980]  If you download Tor, it's signed by the Tor developers, there's a signature that verifies the authenticity of the program that you're downloading and installing on your computer, and it's fine.
[09:56.700 --> 09:58.880]  And so, okay, why not use SSL?
[09:59.120 --> 10:07.840]  So this was the most popular response to why not use SSL to deliver JavaScript cryptography applications in 2012.
[10:08.000 --> 10:09.040]  It is a terrible response.
[10:09.260 --> 10:11.780]  So it says, yes, you can use SSL.
[10:11.920 --> 10:16.540]  It's harder than it sounds, but you can safely transmit JavaScript crypto to a browser using SSL.
[10:16.560 --> 10:22.060]  The problem is, having established a secure channel with SSL, you no longer need JavaScript cryptography.
[10:22.220 --> 10:23.440]  You have real cryptography.
[10:23.800 --> 10:30.160]  So this is really annoying because of two big reasons.
[10:30.340 --> 10:54.200]  First, the author is assuming that deploying SSL is so difficult that people would rather write a JavaScript crypto system and deploy that in order to avoid going to Gandhi.com, buying a certificate for $12, and then installing it, or even, you know, I bet it's easier to get a certificate by hacking a certificate authority than it is by actually writing a JavaScript crypto system,
[10:54.600 --> 10:57.120]  which, you know, quite frankly, is done quite frequently.
[10:57.120 --> 11:01.100]  If the government of Syria can do it, I mean, trust me, I'm from the region, they're not very smart over there.
[11:01.100 --> 11:07.440]  And it's, it's, it's, it's really, it's really something, I mean, for that to be the rhetoric in 2012.
[11:07.840 --> 11:19.520]  And so, the other thing, and the more important thing, is that the author is ignoring that we're not developing JavaScript crypto systems in order to replace SSL.
[11:19.840 --> 11:22.020]  JavaScript crypto can provide end-to-end encryption.
[11:22.440 --> 11:23.480]  SSL cannot do that.
[11:23.660 --> 11:30.200]  SSL provides encryption between the server and the client, which is wonderful, great for banking, great for Facebook, and so on, but not good enough for many uses.
[11:30.200 --> 11:43.040]  And so JavaScript crypto can do something that legitimately is impossible to accomplish with the HTTPS protocol, as it is used in the general application and in the intended use case, at the very least.
[11:43.500 --> 11:54.940]  So, I think I'm right in saying that in 2012, no one saw the value of JavaScript cryptography, even though JavaScript cryptography was shifting from the language of the web to the language of everything.
[11:54.940 --> 12:03.560]  If you've looked at any of Douglas Quackford's work on analyzing JavaScript as a language, specifically his book, JavaScript The Good Parts, JavaScript is a beautiful programming language.
[12:04.440 --> 12:08.300]  I'm a person who has looked into Go and other languages as well.
[12:08.940 --> 12:10.540]  It's a matter of preference.
[12:10.540 --> 12:27.600]  But there is a subset of JavaScript that makes it portable and it is in fact becoming, whether you like it or not, the language that is, you know, bringing a lot of user experiences and the most user experiences to the most devices and the most platforms today.
[12:28.780 --> 12:35.200]  And even in that context, people thought that, hey, doing JavaScript, doing cryptography in that environment wasn't worth it or it was too dangerous and so on.
[12:35.260 --> 12:39.820]  And we shouldn't be working on to improve it, which is nonsense, which is, which is, which is not.
[12:40.120 --> 12:50.440]  It's like, it's like, it's, it's, it's, it's quite comparable to just saying that you'd rather believe that the earth is flat instead of just progressing and understanding what lies beyond that.
[12:50.440 --> 12:52.460]  Because this is really what we're supposed to be doing.
[12:52.640 --> 12:53.740]  This is really what we're supposed to be progressing.
[12:53.940 --> 13:01.760]  And if we went from the point where we had punch cards in the eighties and we have amazing MacBooks today, we can come to the point where we have JavaScript cryptography that works.
[13:03.380 --> 13:11.880]  So in 2013, as you can see, agriculture was invented and people were very two dimensional and yes.
[13:12.180 --> 13:12.360]  Okay.
[13:12.500 --> 13:14.860]  So 2013, things progressed a little bit.
[13:15.800 --> 13:17.400]  This is the only slide about Cryptocat.
[13:17.400 --> 13:23.660]  So I started working on Cryptocat then and so the Cryptocat was the test bed for that sort of thing.
[13:24.660 --> 13:26.480]  The test bed in quite a universal sense.
[13:27.140 --> 13:35.400]  It was even, you know, a lot of its development was that it could be a test case for a crypto API that the W3C was working on.
[13:35.700 --> 13:39.640]  And there's actually a test case specifically for Cryptocat in that, like a, like, not a test case.
[13:39.720 --> 13:45.440]  It's called a user scenario in the API, like specifically for that kind of like encrypted chat app.
[13:45.440 --> 13:57.460]  And so in order to make this encrypted chat app in the browser, which was meant to make encrypted chat accessible, fun, you know, all over the place using the browser because it is the most universal platform.
[13:57.680 --> 14:02.200]  We had basic needs in 2013 in order to achieve that.
[14:02.520 --> 14:07.380]  These basic needs were secure cryptographic primitives such as, you know, AES.
[14:07.380 --> 14:13.420]  We need to have a AES library, SHA-2 library for hashing, public key generation library.
[14:13.640 --> 14:27.620]  We needed to have secure pseudo-random number generation, which I mentioned is very hard in JavaScript because you can't access low-level APIs necessary or low-level system access necessary in order to obtain the random numbers that you need in a secure way.
[14:27.760 --> 14:29.640]  And also we need to solve the problem of code delivery.
[14:29.640 --> 14:31.200]  So all the problems I mentioned earlier.
[14:33.820 --> 14:45.100]  Also, you had, you know, some finicky things, you know, public key cryptography, especially if you're talking about Diffie-Hellman or RSA, requires numbers that are much larger than 64-bit floating point numbers.
[14:45.240 --> 14:49.900]  And JavaScript simply cannot handle that, which is true for most scripting languages, including Python and Ruby, as far as I know.
[14:50.920 --> 14:55.260]  So we got a third-party library for that, and we are maintaining it now ourselves.
[14:55.520 --> 14:56.360]  It's actually not so bad.
[14:57.460 --> 15:03.220]  We also had to solve the problems of computationally expensive key generation.
[15:03.520 --> 15:10.840]  So even JavaScript right now is faster than Python and Ruby, but still kind of slow for stuff like doing DSA, which is always slow, really.
[15:11.280 --> 15:18.660]  So there was a new technology at the time called Web Workers, which meant that we could do virtual multi-threading in JavaScript.
[15:18.660 --> 15:22.580]  And you can do stuff in the background, and that was great, because then you don't crash the user interface.
[15:22.720 --> 15:25.460]  You do it in the background, and then you have a separate thread.
[15:25.620 --> 15:27.020]  It's also good from a security perspective.
[15:27.280 --> 15:29.620]  And then you return the key, and it progresses.
[15:31.400 --> 15:34.560]  So multiple maturing libraries, actually, were starting to appear.
[15:35.580 --> 15:38.880]  The Professor Dan Bonet at Stanford University...
[15:40.200 --> 15:44.860]  I should probably plug in his online crypto classes right now, because they're really good, and you should take them.
[15:44.920 --> 15:45.600]  You can take them for free.
[15:47.400 --> 15:51.900]  He was working with his students on developing the Stanford University JavaScript Crypto Library.
[15:52.100 --> 15:56.200]  There was also Crypto.js, and OpenPGP.js, and all those libraries that were really maturing.
[15:56.860 --> 16:00.660]  And, you know, if you look at the code inside those libraries, this is something I want to show.
[16:00.760 --> 16:15.460]  Because when you say to a lot of people, especially if they've been working as programmers for a long time, if you say, you know, programming cryptography in JavaScript, if they don't have experience in JavaScript, it's like telling them programming cryptography in Macromedia Flash,
[16:15.760 --> 16:17.380]  or programming cryptography in Visual Basic.
[16:17.980 --> 16:19.780]  Which is... it can be a bit scary.
[16:20.220 --> 16:31.960]  But here, who can tell me which of these pieces of code is a round of AES from the Stanford JavaScript cryptography library, and the other piece of code is a round of AES from the OpenSSL implementation of AES?
[16:32.680 --> 16:35.420]  I apologize for having OpenSSL code on my slide.
[16:36.020 --> 16:41.440]  But, you know, as you can see, I mean, I can barely tell them apart.
[16:41.660 --> 16:45.780]  I mean, I can't even with great certainty tell them apart right now, because I made those slides a long time ago.
[16:47.380 --> 16:48.400]  They're quite similar.
[16:48.900 --> 16:54.540]  You know, and unfortunately, you know, I don't want this to be the most overly optimistic talk.
[16:54.540 --> 17:01.260]  So this is an example of a bug in JavaScript crypto, because JavaScript as a language doesn't have strong typing.
[17:01.380 --> 17:02.020]  It has weak typing.
[17:02.260 --> 17:09.320]  So you can define a variable as a number, and then next thing you know, it becomes a string, and then it becomes an object, and then it becomes a boolean.
[17:09.560 --> 17:13.720]  You know, just like random, you know, it's very dynamic and cool.
[17:13.840 --> 17:18.400]  You can write things quick, but also it's, you know, very annoying if you're trying to make stable software.
[17:18.400 --> 17:26.940]  So here we, in this bug, I mistook decimals for bytes, and instead of generating 32 bytes, I generated 32 decimals.
[17:27.280 --> 17:37.760]  And this was a huge problem and weakened security of the application tremendously, and it was entirely due to a property of JavaScript, which needs to change.
[17:37.900 --> 17:39.360]  It's a terrible property of JavaScript.
[17:40.200 --> 17:44.280]  If JavaScript is indeed to catch the mainstream that it's, you know, catching.
[17:45.160 --> 17:46.260]  Either way, I guess.
[17:46.260 --> 17:50.900]  So in terms of security randomness, there was a lot of work there done too.
[17:52.620 --> 17:57.800]  There was an API introduced by the W3C called window.crypto.getrandomvalues, which was really nice.
[17:58.160 --> 18:06.020]  And it meant that you can just get a call from the browser, taps into devviewrandom, gets you as many random bytes as you want, and you're done.
[18:06.480 --> 18:07.040]  Problem solved.
[18:07.780 --> 18:11.800]  It took Firefox, especially, a long time to get this in their browser.
[18:12.020 --> 18:15.660]  But Chrome had it from very early on.
[18:15.660 --> 18:20.560]  And Opera, interestingly, in Opera, math.random is cryptographically secure.
[18:21.700 --> 18:22.880]  Not a lot of people know this.
[18:23.000 --> 18:27.680]  And the reason I know this is because I went and I spoke to the Opera engineer, who, it's not documented anywhere.
[18:27.920 --> 18:31.420]  This changed in Opera 15, because Opera 15 is now based on Chrome.
[18:31.780 --> 18:33.560]  And so it's basically whatever Chrome does.
[18:33.560 --> 18:36.500]  But before Opera 15, math.random was cryptographically secure.
[18:37.620 --> 18:39.200]  Which was, you know, quite cool.
[18:41.200 --> 18:42.020]  Code delivery.
[18:42.320 --> 18:55.940]  So in code delivery, as you probably know if you've used my software, Chrome has led a revolution in the terms of how you can deliver and install and basically package and deploy web applications.
[18:56.620 --> 19:00.720]  Chrome is doing revolutionary, incredible work in packaged apps.
[19:00.920 --> 19:03.120]  Which they developed, I think, starting for Chrome OS.
[19:03.980 --> 19:04.060]  Right?
[19:04.580 --> 19:08.360]  And so Chrome OS could, you know, you could get apps for Chrome OS.
[19:08.500 --> 19:10.540]  And they would run in your browser and it would be great.
[19:10.760 --> 19:16.300]  But also, because you can install these apps on Chrome OS, you can also install them on Chrome and browser on Mac, Linux, and Windows.
[19:16.300 --> 19:24.720]  And if you use Chrome recently, did you notice how Chrome now adds a little thing to your start menu or to your dock that's like a square with other squares inside?
[19:24.920 --> 19:25.700]  It's like an app launcher.
[19:26.480 --> 19:37.020]  So this is like, Chrome is like expanding its reach to be able to give you apps on your computer, which are universal web applications that run on any computer from the beginning.
[19:37.200 --> 19:46.500]  And this model lets you deliver updates that are code signed, lets you deliver, you know, it has a very strict sandbox.
[19:46.840 --> 19:51.660]  The sandbox that it has effectively eliminates cross-site scripting attack surfaces.
[19:52.520 --> 19:56.100]  It makes it very difficult to manipulate the runtime.
[19:56.460 --> 19:59.320]  It removes a lot of dangerous functions.
[19:59.820 --> 20:03.000]  And it also prohibits the running of inline code.
[20:03.660 --> 20:12.520]  And so, you know, in some cases, this model actually has benefits over desktop apps because of the immense sandboxing that Chrome does.
[20:13.400 --> 20:17.020]  The security benefits that Chrome gives sandbox apps, packaged apps are amazing.
[20:17.800 --> 20:28.140]  There's such a separation that you have to break out of that sandbox, and then break out of Chrome, and then into the operating system for you to get a privilege escalation, unless I'm mistaken.
[20:28.380 --> 20:29.480]  I hope I'm not mistaken on that.
[20:30.580 --> 20:33.280]  I have a guy that I trust on security issues in the front.
[20:33.420 --> 20:34.100]  That's what I was pointing to.
[20:34.200 --> 20:34.380]  Anyway.
[20:35.280 --> 20:41.220]  And when it comes to the operating system, you can just, you know, go straight out of LibPurple, for example, and into the U.S.
[20:41.420 --> 20:43.260]  So, that's a big difference.
[20:44.020 --> 20:46.060]  And so, this is what happened last year.
[20:46.340 --> 20:50.080]  This year, things are getting, you know, more modern.
[20:50.840 --> 20:51.880]  People are here.
[20:52.640 --> 20:54.100]  Cars, carts, okay.
[20:54.600 --> 21:01.980]  So, the W3C started working on the Web Crypto API a long time ago, but this year, it's getting ready.
[21:01.980 --> 21:06.840]  The Web Crypto API is actually giving us native cryptographic primitives in the browser.
[21:07.680 --> 21:09.440]  And this is a solid chance.
[21:09.560 --> 21:20.040]  This is our big chance to mitigate a lot of side channel attacks, such as timing attacks, and have a solid set of primitives and functions that people can use to deploy cryptography, primitives and applications anywhere.
[21:20.560 --> 21:23.760]  And so, there's a couple of problems with that.
[21:25.300 --> 21:35.920]  This is my personal opinion as a member of that team, is that I think it's lacking a couple of modern algorithms, such as Curve 25509, which I'll discuss in detail soon.
[21:36.200 --> 21:47.000]  And also, key storage APIs, so that when you generate a key in your browser, you can store it for later use securely, not use local storage or cookies or something ridiculous.
[21:52.360 --> 22:09.140]  Anyway, so I was recently informed by my friend who works there that actually Microsoft is contributing to the W3C Web Crypto API and is looking to solve the first problem, which is including more modern algorithms such as Curve 25519 in the API.
[22:09.140 --> 22:11.480]  I take this to be true.
[22:11.700 --> 22:13.420]  If it's true, that's great.
[22:13.740 --> 22:14.320]  Awesome.
[22:15.140 --> 22:21.200]  So, another interesting thing that happened in 2014, especially quite recently, is a sudden acceptance of JavaScript cryptography.
[22:22.440 --> 22:25.140]  It became the case in the past month or two.
[22:25.500 --> 22:31.160]  Google published their own extension for PGP in the browser with their own JavaScript cryptography library out of nowhere.
[22:31.900 --> 22:35.740]  Microsoft published the Microsoft JavaScript cryptography library out of nowhere.
[22:36.300 --> 22:47.760]  Tai Duong, which is a security researcher that, from my understanding, had been kind of lukewarm about the idea of JavaScript cryptography, published a well-quoted blog post called Why JavaScript cryptography is useful.
[22:48.300 --> 22:52.100]  This is like... I didn't even know what was going on.
[22:52.480 --> 22:56.920]  It was really like this couple of weeks of sudden huge acceptance of JS Crypto.
[22:58.360 --> 23:04.120]  I've been working on JS Crypto for a long time, and trust me, in 2012, this was not what people were saying about JS Crypto.
[23:04.120 --> 23:16.320]  But it's great, because it means that the field is, you know, maturing to the point to be accepted by people who have experience and sort of, like, are erudite in the field, which is great.
[23:18.120 --> 23:24.320]  So, one last thing about this whole JavaScript crypto Star Wars saga before I move on to introducing Minilock.
[23:26.400 --> 23:28.800]  The problem of weak typing is annoying.
[23:29.120 --> 23:36.460]  I want ECMAScript, which is the JavaScript specification, like the blueprint for JavaScript, I want the next version of it to have optional strong typing.
[23:36.860 --> 23:39.520]  So, you can type, you know, var k equal 5, great.
[23:40.040 --> 23:43.600]  Or you can type var number k equal 5, also great.
[23:44.160 --> 23:45.220]  But then, you know, both will work.
[23:45.300 --> 23:48.960]  But the second one will give you an error if you do k equal 5 plus meow.
[23:49.740 --> 23:53.460]  You know, if you do... generally, if you do that in JavaScript, you'll get a string that's 5 meow.
[23:53.940 --> 23:56.580]  But you should not get that.
[23:56.580 --> 23:58.880]  You should be able to have typesetters.
[23:59.060 --> 24:04.660]  I think this is... something like that is coming in ECMAScript 7, which is years and years ahead of us.
[24:04.740 --> 24:05.980]  ECMAScript 6 is barely done.
[24:07.060 --> 24:09.240]  But this is something I would like to see happen one day.
[24:10.200 --> 24:17.040]  What I'm introducing today, that being said, given this history, is my new usable encryption software.
[24:17.240 --> 24:22.700]  I would like, in so far as I'm able to, to innovate on file encryption and sharing.
[24:23.520 --> 24:26.840]  And I want to make it universally accessible, which has always been a theme of my work.
[24:27.220 --> 24:29.800]  So I would like to introduce to you today, Minilock!
[24:30.100 --> 24:32.460]  File encryption software that does more with less.
[24:34.000 --> 24:36.600]  So, let's take a look at file encryption today.
[24:37.640 --> 24:42.020]  The current status for file encryption, the main contender, really, is PGP.
[24:42.780 --> 24:47.320]  And I assert that I can do better than PGP in a lot of ways, if not in every way.
[24:47.520 --> 24:49.420]  Which is a big assertion, but I think I can back it up.
[24:50.660 --> 24:53.280]  If not from the beginning, then hopefully within the next year.
[24:53.400 --> 24:54.880]  But I think I have something to show today.
[24:56.220 --> 25:02.440]  The main use case of PGP that Minilock is interested in, the main use case is email, as we all know, but also file attachments.
[25:03.660 --> 25:15.840]  And with that comes the classic public key management of PGP, which is that you have keys, and you exchange large public keys, key servers, trust-based fingerprint authentication.
[25:16.380 --> 25:18.180]  I'm sure all of you know this story.
[25:18.760 --> 25:20.560]  Also, we have this.
[25:20.940 --> 25:22.320]  I don't know what happened there.
[25:22.500 --> 25:28.760]  So, I had a slide about that, but then I replaced it with question marks, because this is the extent of my knowledge regarding TrueCrypt.
[25:29.600 --> 25:32.160]  I'm not really... I don't know what happened there.
[25:33.540 --> 25:35.260]  But let's go back to PGP.
[25:38.000 --> 25:40.800]  So, key management is awful.
[25:41.280 --> 25:42.080]  Let's go through the steps.
[25:42.080 --> 25:46.800]  You have to generate the keys, saving them on your disk with a passphrase.
[25:47.140 --> 25:51.100]  You share the public keys via email or via key server or via your website.
[25:51.540 --> 25:52.220]  Lots of ways.
[25:52.900 --> 25:58.420]  And you can... then you store them using like your GPG or like a user interface for managing those keys.
[25:58.780 --> 26:02.960]  You can authenticate the fingerprints, you know, and so on and so forth.
[26:02.960 --> 26:05.160]  I'm sure a lot of you here know the story.
[26:05.360 --> 26:09.560]  And if you don't know the story and it sounds atrociously tedious, then you are correct.
[26:11.780 --> 26:12.580]  This sucks.
[26:13.680 --> 26:20.620]  Or perhaps I should say something less, you know, or something more discerning than that.
[26:20.740 --> 26:24.520]  Maybe I should say this is not convenient and we can do a lot better.
[26:27.520 --> 26:29.380]  So, let's break this down into steps.
[26:29.700 --> 26:31.020]  Step one, generating the keys.
[26:31.240 --> 26:33.240]  Step two, saving them on disk with a passphrase.
[26:33.920 --> 26:36.320]  Step three, sharing the keys via email.
[26:36.320 --> 26:40.660]  And step four, storing other people's keys, authenticating via fingerprints and managing those keys.
[26:42.020 --> 26:46.180]  So, with Minilock, there is no key storage and no key files whatsoever.
[26:48.040 --> 26:50.440]  Minilock starts by asking you for a passphrase.
[26:50.580 --> 26:52.440]  And it uses this to generate your key identity.
[26:53.760 --> 27:01.300]  If you go on any computer that has Minilock installed and available, you enter that same passphrase and you obtain the same persistent key identity.
[27:01.840 --> 27:05.860]  If that is ringing some alarm bells, I'll explain how I'm doing this safely or hopefully safely in a bit.
[27:06.720 --> 27:08.120]  Nothing is ever stored anywhere.
[27:10.200 --> 27:14.520]  And so, instead of public keys, Minilock uses Minilock IDs.
[27:15.080 --> 27:18.140]  Minilock IDs are shareable public keys that are 44 characters long.
[27:18.440 --> 27:19.720]  So, here's my Minilock ID.
[27:19.920 --> 27:21.260]  Please send me nice photos of cats.
[27:21.460 --> 27:23.820]  I'll crypt it to my Minilock ID later when you can use the software.
[27:25.980 --> 27:28.280]  You can fit this key inside half a tweet.
[27:28.280 --> 27:29.520]  You can fit inside a text message.
[27:29.620 --> 27:30.120]  This is huge.
[27:30.300 --> 27:33.120]  This key is so small that it acts as its own fingerprint.
[27:33.560 --> 27:36.520]  You don't even need a fingerprint to authenticate the key.
[27:36.720 --> 27:37.880]  The key is tiny.
[27:38.180 --> 27:41.300]  You can just authenticate it on site by looking at it.
[27:43.320 --> 27:49.700]  And it's much easier to share than a giant, you know, begin PGP public key list and PGP.
[27:50.000 --> 27:53.360]  It's, you know, a bit more practical.
[27:53.980 --> 27:57.300]  So, the user flow of Minilock is also exceedingly simple.
[27:57.740 --> 28:04.040]  You enter your passphrase on a Minilock-capable computer and you get your Minilock ID, which is always the same.
[28:05.580 --> 28:08.920]  And then you can send files to people using their ID.
[28:09.180 --> 28:09.800]  You get their ID.
[28:09.900 --> 28:10.560]  You encrypt the file to them.
[28:10.580 --> 28:11.140]  You send it to them.
[28:11.300 --> 28:13.760]  And you can receive files sent to you using your ID.
[28:14.820 --> 28:17.060]  So I should mention, Minilock doesn't send the files.
[28:17.240 --> 28:18.240]  Minilock encrypts the files.
[28:18.340 --> 28:19.900]  You have to send them via email attachment or something.
[28:19.900 --> 28:24.720]  So, but once you encrypt the file, you can put it on USB drive, send it via email attachment, whatever you want.
[28:25.340 --> 28:27.400]  And, you know, it's safe to send it that way.
[28:29.000 --> 28:35.160]  So this, you know, clearly, I think, I hope you can see that this model, if successful, would suck a lot less.
[28:35.580 --> 28:37.780]  There is no private key storage or key management.
[28:39.480 --> 28:44.960]  There's no managing giant keys, because Minilock keys are so small, as I said, they're their own fingerprint, they're tweetable.
[28:46.400 --> 28:48.800]  Minilock also comes with another bunch of nice features.
[28:49.400 --> 28:52.120]  The interface is easy to use, something I've always focused on.
[28:52.900 --> 28:57.960]  You can encrypt files, you don't have to send your files, you can encrypt files for your own use, and then decrypt them later.
[28:58.140 --> 29:02.640]  So, for example, you can encrypt a file, put it on Dropbox, get it off Dropbox again later, decrypt it for yourself.
[29:03.320 --> 29:07.060]  And it runs on any computer, because it is based on the Chrome packaged apps model.
[29:08.520 --> 29:19.760]  More nice features, you can send a file, you can encrypt it for multiple recipients, 10 people, 20 people, and there's almost no performance decrease or file size increase when you do that.
[29:20.120 --> 29:23.440]  It doesn't take longer, and it doesn't make the file bigger.
[29:24.040 --> 29:27.880]  It takes like a few microseconds longer, it makes it a few kilobytes bigger, but that's about it.
[29:29.220 --> 29:31.920]  So, the Minilock IDs of recipients are anonymized.
[29:31.920 --> 29:42.980]  So, it means that if you receive a file, that is a Minilock encrypted file, and you decrypt it, and it was sent to multiple recipients, you cannot know the identity of the other recipients it was sent to.
[29:43.520 --> 29:51.820]  And also, if you get a Minilock file that was not sent to you, you don't know the identity of any recipient.
[29:52.320 --> 29:55.680]  So, you can't know that the file was sent to you until you try to decrypt it.
[29:56.160 --> 29:59.940]  And so, all the recipients are anonymized, even from each other.
[30:00.780 --> 30:01.620]  It's pretty fast.
[30:01.780 --> 30:03.980]  I'll be demoing it and you can see how fast it is.
[30:04.100 --> 30:07.520]  I think the current speed is 18 megabytes per second for decryption.
[30:08.340 --> 30:11.560]  Decryption is slightly faster because you don't need to generate the authentication code.
[30:11.700 --> 30:14.600]  But it's about that fast.
[30:15.940 --> 30:17.580]  It retains the file name on decryption.
[30:17.700 --> 30:21.380]  So this is something I'm very surprised to see no other software, as far as I know, does.
[30:21.540 --> 30:22.280]  PGP doesn't do it.
[30:25.460 --> 30:28.380]  You encrypt a file and then you change the file name to something.
[30:28.520 --> 30:30.380]  So you encrypt secretdocument.pdf.
[30:30.540 --> 30:35.000]  And then you don't want to send someone a file called secretdocument.pdf.encrypted.
[30:35.640 --> 30:38.960]  So you change it to catphotos.pdf.
[30:39.140 --> 30:42.780]  And then when you decrypt it, the name will still be catphotos.pdf.
[30:42.880 --> 30:43.460]  It'll just be decrypted.
[30:43.560 --> 30:49.220]  So with Minilock, when you decrypt the file, it'll take back its original file name.
[30:49.300 --> 30:50.100]  So that's kind of cool.
[30:50.200 --> 30:51.880]  It's very good from a usability perspective.
[30:52.540 --> 31:07.840]  And best of all, I'm very happy to be able to say this, Minilock has a peer-reviewed design specification and is being released as fully audited software, thanks to Cure53, the auditing team, and the Open Technology Fund who helped me prepare for the audit.
[31:09.500 --> 31:11.340]  I want to do this right.
[31:11.760 --> 31:17.000]  I'm releasing it with a fully peer-reviewed design document that explains how things work.
[31:17.160 --> 31:18.460]  The code is audited.
[31:18.460 --> 31:25.060]  There is a unit test kit which can simulate the entire user flow with randomized use cases.
[31:25.240 --> 31:28.780]  It can generate random scenarios and simulate the usage of Minilock throughout.
[31:29.100 --> 31:34.460]  And you can also run, atomically, parts of Minilock independently as their own thing.
[31:34.660 --> 31:39.700]  So you can, you know, simulate specifically key derivation or specifically encryption or specifically decryption.
[31:39.880 --> 31:46.740]  And this unit test kit really helps maintain the sanity of the code throughout and it's gonna be included with the product as it all launches.
[31:48.760 --> 31:52.060]  So, Minilock, you can also plug it into your application.
[31:53.080 --> 31:55.640]  The specification is designed to be very simple and highly portable.
[31:55.900 --> 32:00.040]  So you can, it comes with the full design documents, specifications, tests, and reference.
[32:00.240 --> 32:02.760]  And your app can be Minilock ready or Intel inside.
[32:03.000 --> 32:03.240]  I don't know.
[32:04.720 --> 32:07.940]  Basically, you can make your app capable of handling Minilock documents easily.
[32:08.700 --> 32:10.760]  And I hope to see libraries that do that, actually.
[32:11.500 --> 32:13.080]  There's already one for JavaScript, clearly.
[32:14.140 --> 32:16.640]  So, everything will be released today, right after the talk.
[32:16.940 --> 32:20.360]  And it will all be open, free software under the AGPL v3 license.
[32:20.680 --> 32:23.580]  But first, how do the internals work?
[32:23.980 --> 32:25.840]  How does this, how am I doing this?
[32:28.340 --> 32:31.480]  So, there's a big reliance on elliptic curve cryptography.
[32:32.040 --> 32:33.740]  Specifically, Tweet and ACL.
[32:33.740 --> 32:36.080]  I think it's called Tweet salt, but I'm not sure.
[32:36.240 --> 32:37.460]  I'll just pronounce it Tweet and ACL.
[32:39.520 --> 32:41.560]  So, I'll be talking about Tweet and ACL.
[32:41.760 --> 32:45.200]  Also, there's a, there are specific mechanisms that are quite nuanced.
[32:46.040 --> 32:49.860]  In order to evaluate the strength of passphrases and suggest strong passphrases.
[32:50.420 --> 32:51.920]  And then there's a script for key derivation.
[32:52.540 --> 32:56.640]  So, Tweet and ACL is really what makes this all possible.
[32:56.880 --> 32:58.320]  And really an amazing project.
[32:58.320 --> 33:05.720]  I think it started as, I think, I think, I even think that when Dan Bernstein had this conversation with Matt Green.
[33:06.060 --> 33:10.340]  And when the inspiration for Tweet and ACL was there.
[33:10.540 --> 33:12.120]  They didn't know how amazing it would be.
[33:12.340 --> 33:15.660]  This is a cryptography library that can do key, public key generation.
[33:16.680 --> 33:20.460]  Encryption, decryption, authenticated, authentication.
[33:21.040 --> 33:22.980]  Generate random, random bytes.
[33:23.180 --> 33:23.680]  All of that.
[33:23.800 --> 33:25.220]  It fits inside a hundred tweets.
[33:25.520 --> 33:25.960]  It's tiny.
[33:25.960 --> 33:31.440]  It can do, it's written by Dan Bernstein, which is a very reputable cryptographer from the University of Chicago.
[33:31.640 --> 33:33.020]  I'm sure most of you know who he is.
[33:34.660 --> 33:39.580]  And it's a library that offers all those features inside an API that's very hard to get wrong.
[33:39.860 --> 33:45.560]  And it's meant to be, in his own words, the world's first auditable high security cryptography library.
[33:45.740 --> 33:47.020]  And this is all the crypto code.
[33:47.300 --> 33:48.280]  It's a hundred tweets.
[33:48.700 --> 33:51.580]  And it offers us all these functions in an accessible interface.
[33:53.360 --> 33:59.380]  So, this really, you know, having this library that was really so small and so focused on auditability.
[33:59.660 --> 34:04.320]  Offering the interfaces for Curve25519 for public key generation.
[34:04.480 --> 34:05.640]  AccessAlsa20 for encryption.
[34:05.940 --> 34:11.080]  And Poly1305, which is an authentication mechanism for encrypted data based on AES.
[34:11.940 --> 34:16.420]  So, let's start with Curve25519, the first part of the interface.
[34:17.720 --> 34:26.960]  Which is really great because it's the part of the interface that not only allows us to have the tiny mini-lock IDs, which are really small and shareable, but also is insanely fast for key generation.
[34:26.960 --> 34:30.340]  It is, in fact, you know, it's incomparably fast.
[34:30.440 --> 34:40.760]  If you want to generate keys of similar security between Curve25509 and Diffie-Hellman or RSA, there's no contest.
[34:41.180 --> 34:42.500]  It's incredibly much faster.
[34:42.660 --> 34:44.620]  It takes milliseconds to do public key.
[34:44.780 --> 34:46.240]  I don't even need to run it in a web worker.
[34:46.420 --> 34:50.560]  It's so fast to generate public keys, to generate key pairs.
[34:50.560 --> 34:58.480]  So, Curve25519 brings us to probably the most interesting part of mini-lock, which is key derivation.
[34:59.320 --> 35:02.960]  As you can see, this is a graph that explains the key derivation process.
[35:03.540 --> 35:07.700]  You start with the user entering a passphrase all the way to the left.
[35:08.460 --> 35:12.060]  So, users enter the passphrase for unlocking mini-lock.
[35:12.720 --> 35:14.700]  The passphrase is evaluated for entropy.
[35:14.960 --> 35:16.440]  The threshold is 100 bits.
[35:17.620 --> 35:23.080]  If the entropy evaluation fails, we detect that this is not a good enough passphrase.
[35:23.260 --> 35:24.540]  We follow the red arrow.
[35:25.040 --> 35:25.680]  And it goes to...
[35:25.680 --> 35:27.540]  Mini-lock suggests a passphrase for you.
[35:27.940 --> 35:32.060]  And then it goes back to, you know, entering... you enter that passphrase.
[35:32.140 --> 35:33.420]  If you get it right, you go to S-crypt.
[35:33.520 --> 35:38.000]  And then, after the S-crypt key derivations, you get to deriving the Curve25519 key pair.
[35:38.500 --> 35:39.340]  So, let's start.
[35:39.800 --> 35:44.060]  I'm going to go through every one of those steps, step by step, and explain in detail how every one of them works.
[35:44.820 --> 35:47.320]  So, first we start with entering the passphrase.
[35:48.260 --> 35:56.060]  Optimally, we want to map 32 bytes of entropy from the passphrase into the 32-byte size of the Curve25519 private key.
[35:56.440 --> 35:57.700]  Optimally, this is what we want to do.
[35:58.020 --> 36:04.960]  However, having a passphrase that has 32 bytes of entropy, 256 bits of entropy, is not practically feasible.
[36:04.960 --> 36:10.080]  No human on Earth will be happy with that passphrase using it.
[36:10.960 --> 36:13.820]  So, this is why, really, we have this step.
[36:13.980 --> 36:17.880]  This is really probably the most important and tricky step of the entire process.
[36:18.620 --> 36:28.680]  So, using a method by Dropbox called ZXZVBN, and also other methods, we measure the user's passphrase as entropy.
[36:28.680 --> 36:32.720]  Now, Minilock suggests a long, unique passphrase that makes sense only to you.
[36:32.940 --> 36:35.820]  For example, a memory from your childhood, or something like that.
[36:36.040 --> 36:36.940]  It has to be unique.
[36:37.080 --> 36:37.780]  It has to be long.
[36:38.080 --> 36:43.520]  And it will be evaluated alongside a giant dictionary to detect words and patterns that are frequent.
[36:43.820 --> 36:46.780]  It will be evaluated for length, for entropy, in a lot of ways.
[36:47.540 --> 36:49.200]  Clearly, this cannot be perfect.
[36:49.560 --> 36:53.240]  But this is why the standards are high.
[36:53.240 --> 36:56.360]  So, less than 100-bit entropy passphrases are not allowed.
[36:56.780 --> 37:03.360]  Which means that if you enter a passphrase smaller than, like, that doesn't pass the entropy checks, basically, Minilock will refuse to work completely.
[37:03.540 --> 37:04.320]  It's impossible.
[37:04.660 --> 37:10.500]  Minilock will not allow you to encrypt or decrypt files if you do not enter a passphrase that matches its specifications.
[37:10.960 --> 37:13.420]  So, there have been some complaints.
[37:13.820 --> 37:20.240]  When I passed this thing around earlier, was that 100 bits are not enough because it's not 256 bits or 128 bits.
[37:20.240 --> 37:27.000]  If you really think that 100 bits of entropy are not enough for a passphrase, you might not exactly know what you're talking about.
[37:28.260 --> 37:32.040]  It's really, I think, the NIST standard is 112 bits.
[37:32.840 --> 37:36.720]  Anything above 100 bits has a gigantic key space for a passphrase.
[37:36.900 --> 37:44.180]  And also, I'll be talking about S-crypt, which actually helps complexify what it takes to derive those, to map that key space.
[37:44.460 --> 37:48.640]  Which makes 100 bits of entropy even more lucrative for that kind of scenario.
[37:48.640 --> 37:54.980]  But in that case, if you fail to enter 100 bits of entropy, Minilock will construct a suggested passphrase.
[37:55.520 --> 38:05.000]  The suggested passphrase step happens, which is that Minilock will ship with a dictionary of 58,110 most used English words.
[38:05.280 --> 38:10.680]  And it will take that dictionary, take seven random words from it, and give them to you.
[38:10.680 --> 38:16.340]  This gives us... it's basically 111 bits of entropy.
[38:16.740 --> 38:20.040]  And that every single passphrase generated using that method will have 111 bits of entropy.
[38:21.580 --> 38:28.300]  Because 58,110 to the power seven is almost equal to... or I think slightly larger than two to the power 111.
[38:29.500 --> 38:43.800]  So, this is just a screenshot from a recent paper from Princeton University researcher Joseph Bono and also Stuart Schechter.
[38:44.120 --> 38:44.420]  Sorry.
[38:44.720 --> 38:45.660]  I'm sorry, Stuart.
[38:46.280 --> 38:46.720]  Okay.
[38:47.940 --> 38:50.920]  Regarding helping people memorize secure passphrases.
[38:50.920 --> 38:55.380]  The threshold for that paper is 56-bit secrets.
[38:56.060 --> 38:58.180]  And this is considered to be good enough for passwords.
[38:58.260 --> 38:59.420]  I don't think that's good enough for passwords.
[38:59.420 --> 39:02.480]  Especially when you're doing file encryption, where the stuff is static.
[39:03.060 --> 39:08.960]  So, this is why I think we can work on making it harder to map the key space.
[39:09.440 --> 39:09.840]  Specifically.
[39:09.980 --> 39:11.040]  This is, I think, a big challenge.
[39:11.220 --> 39:22.120]  Because if you have a key space that you can surmise will be between 100 and 128 bits, then you can say that you have a key space of 128 bits.
[39:22.260 --> 39:28.840]  So, 128 bits, potentially, is actually the entire key space of AES 128.
[39:29.100 --> 39:30.180]  The standard mode of AES.
[39:30.560 --> 39:32.860]  It's supposed to be, you know...
[39:32.860 --> 39:36.360]  Mapping 128 bits is basically like mapping the entire AES key space.
[39:36.560 --> 39:37.320]  It's not feasible.
[39:37.700 --> 39:42.140]  However, we can work on making it even less feasible by using S-Script.
[39:42.760 --> 39:46.260]  So, S-Script provides memory-hard key derivation.
[39:46.260 --> 39:56.420]  Which means that, unlike other key derivation methods, such as SHA-512, like a PBKDF with SHA-512, or B-Crypt, S-Script requires RAM.
[39:56.980 --> 39:59.820]  It requires memory to derive the keys.
[40:00.020 --> 40:03.240]  And it uses memory-intensive processes to derive the keys.
[40:03.600 --> 40:10.800]  Which means that you can't build a GPU cluster to crack, at least with current technology, to crack those keys.
[40:11.220 --> 40:13.820]  Generally, you can build a GPU cluster that hashes real quick.
[40:13.820 --> 40:21.100]  And that's how you can build a GPU cluster that makes it easier for you to crack PBKDF SHA-512 keys.
[40:21.500 --> 40:27.980]  But, because S-Script is memory-hard, not CPU-hard, the key derivation process is a different challenge.
[40:27.980 --> 40:35.260]  So, first we get a SHA-512 hash of the passphrase, and the hash goes through 2 to the 17 rounds of S-Script, which is quite a lot.
[40:35.460 --> 40:57.960]  And I think this complexifies the key process to the degree where, actually, it will be more complicated, or more intensive, than mapping the entire 128-bit key space of AES, than to map 128-bit key space, or even 112-bit key space, through 2 to the power 17 rounds of S-Script.
[40:59.800 --> 41:05.460]  And once that is done, we derive the curve 25519 key pair, which is then used.
[41:05.760 --> 41:15.840]  You know, you have the key pair, you extract 32 bytes from the final S-Script result, that's the private key, and then you have the Minilock ID, which is the base64 encoding of the public key.
[41:15.840 --> 41:16.940]  Very simple.
[41:17.940 --> 41:18.020]  Very simple.
[41:18.020 --> 41:22.840]  So, that's all for key derivation, which leaves us with the file encryption format, specifically.
[41:23.600 --> 41:31.740]  So, the file is actually not encrypted with your key pair, with your curve 25519 public key and secret key.
[41:31.740 --> 41:35.640]  The file is encrypted symmetrically, using a random key.
[41:35.820 --> 41:41.920]  So, you generate a random 32 bytes, unique for every file, and you encrypt the file using it.
[41:42.320 --> 41:51.440]  And then that random 32 bytes that you use, the file key, is encrypted asymmetrically, once for every recipient, so it's pairwise, and then stored in the header.
[41:53.480 --> 42:00.060]  And that header is then encrypted, you know, is then what is decrypted to obtain that key and then to decrypt the rest of the file.
[42:00.700 --> 42:03.860]  Both encryption methods are authenticated encryption methods, I should mention.
[42:05.360 --> 42:09.020]  So, the file encryption format header looks something like this.
[42:09.640 --> 42:16.160]  You have the place where the header begins, and then you have the sender ID, identifying who the sender is, which is necessary.
[42:16.160 --> 42:20.040]  And then you have, like, a header info for recipient A, and a header info for recipient B.
[42:20.140 --> 42:21.380]  This is assuming we have two recipients.
[42:21.700 --> 42:24.300]  And then the header ends, and you have the ciphertext.
[42:25.400 --> 42:31.520]  So, clearly the most interesting part of this is this part, the A and B header part.
[42:31.740 --> 42:33.040]  So, what does this look like?
[42:34.140 --> 42:40.900]  So, here we have an encrypted copy of the file key, encrypted to recipient A's public key.
[42:40.900 --> 42:45.820]  We also have the file nonce, the nonce used to decrypt the file, and also the file name, which is preserved.
[42:46.040 --> 42:52.980]  And so, we encrypt this multiple times, using multiple nonces, don't worry about that, to multiple people.
[42:53.520 --> 42:57.180]  And then the header recipients are anonymized.
[42:57.400 --> 43:03.720]  We replace the identity of the recipient with the nonce, in fact, used to encrypt that particular header.
[43:06.980 --> 43:10.280]  So, the recipient actually has to attempt to decrypt every part of the header.
[43:10.420 --> 43:15.340]  And if he obtains an authenticated decryption on one part of the header, they know that they are the intended recipient.
[43:16.420 --> 43:31.300]  And so, the general usage of this system is that you get a passphrase, enter the passphrase, share your Minilock IDs with friends, and then, your friends have your Minilock IDs, you can tweet it on your Twitter feed, or you can send it via email, via text,
[43:31.400 --> 43:31.740]  and so on.
[43:31.880 --> 43:33.460]  Put it in your email signature, it's tiny.
[43:34.340 --> 43:40.280]  You can encrypt any files using your friends' Minilock IDs, and then they can decrypt files sent to you.
[43:40.520 --> 43:43.040]  And the interface, in fact, is very simple and usable.
[43:44.140 --> 43:49.020]  And, in fact, it's designed in a way that makes it very difficult for the user to do things that are wrong.
[43:49.020 --> 43:53.980]  It's designed to be a step-by-step thing where you can't make, or it's very difficult to make mistakes.
[43:54.440 --> 43:56.520]  So, the UX part is studied.
[43:57.080 --> 43:59.000]  And so, let's do a demonstration.
[44:02.820 --> 44:03.480]  All right.
[44:03.960 --> 44:05.260]  So, I'm going to...
[44:15.300 --> 44:15.820]  Okay.
[44:18.420 --> 44:19.680]  So, I'm going to open Chrome.
[44:20.960 --> 44:22.320]  Open my apps.
[44:23.000 --> 44:24.060]  Open Minilock.
[44:25.360 --> 44:26.840]  So, this is Minilock.
[44:26.840 --> 44:30.600]  So, encrypt and decrypt files from any computer using your Minilock key.
[44:30.780 --> 44:31.520]  That's what it says here.
[44:31.700 --> 44:34.620]  Send your Minilock ID to friends so they can encrypt files to you.
[44:34.800 --> 44:36.240]  Your key must be completely unique.
[44:36.380 --> 44:37.780]  Anyone with the same key can impersonate you.
[44:38.040 --> 44:39.060]  So, let's enter a bad key.
[44:39.400 --> 44:41.080]  Like, I am a cat.
[44:41.500 --> 44:43.020]  It will say, the key is too weak.
[44:43.340 --> 44:44.220]  Help me pick a key.
[44:44.620 --> 44:45.700]  So, it doesn't let you in.
[44:46.920 --> 44:47.580]  More advice.
[44:47.740 --> 44:50.040]  Having a long, unique key is very important for using Minilock.
[44:50.140 --> 44:51.840]  Try using a phrase that makes sense only to you.
[44:51.840 --> 44:53.820]  So, here we have...
[44:53.820 --> 44:54.700]  Gleanings hoaxers.
[44:54.880 --> 44:56.900]  Releasable possible inhabits glancing recklessness.
[44:57.140 --> 44:59.460]  Which sounds like the ramblings of a paranoid schizophrenic person.
[44:59.920 --> 45:01.040]  So, let's generate something else.
[45:01.540 --> 45:03.480]  You can keep generating until you get something that you like.
[45:03.720 --> 45:04.820]  That you feel attached to.
[45:05.860 --> 45:08.280]  Or you can enter a key, you know, for that particular purpose.
[45:08.480 --> 45:09.180]  Let's just use this one.
[45:11.900 --> 45:13.920]  And this will be your Minilock key forever.
[45:15.040 --> 45:17.080]  Unless you decide to get a new ID, of course.
[45:17.080 --> 45:18.200]  So, here we go.
[45:18.480 --> 45:19.560]  This is our Minilock ID.
[45:19.940 --> 45:20.960]  I can just tweet this right now.
[45:21.740 --> 45:24.560]  And this is where I can put the files to encrypt or decrypt.
[45:25.020 --> 45:26.460]  So, I'm going to...
[45:26.460 --> 45:32.360]  In order to show you the speed of Minilock, I've selected a file for this demonstration that is a 70 megabyte file.
[45:32.400 --> 45:33.140]  So, it's slightly large.
[45:34.600 --> 45:38.540]  It's a cartoon file for adventure time.
[45:39.900 --> 45:40.900]  I'm glad you like the show.
[45:41.040 --> 45:42.760]  It's one of my favorite shows, if not my favorite show.
[45:42.960 --> 45:46.440]  This is the episode where they go to Mars and Abraham Lincoln is the king of Mars.
[45:46.440 --> 45:47.840]  Which is really weird.
[45:48.360 --> 45:48.740]  Anyway.
[45:49.460 --> 45:50.480]  So, you can drag this.
[45:50.600 --> 45:51.520]  It's actually my favorite episode.
[45:51.980 --> 45:53.220]  So, you can drag this here.
[45:53.900 --> 45:54.540]  It says drop it.
[45:54.700 --> 45:55.120]  Drop it.
[45:55.320 --> 45:55.660]  It reads it.
[45:56.060 --> 45:59.740]  And so, here you enter the Minilock IDs of recipients.
[46:00.060 --> 46:01.860]  Clearly, you can add as many recipients as you want.
[46:02.560 --> 46:03.240]  You can...
[46:03.240 --> 46:05.320]  I'm going to choose to encrypt it to myself this time.
[46:06.560 --> 46:08.740]  And I'm going to save it with a random file name.
[46:09.720 --> 46:10.760]  So, just click.
[46:11.080 --> 46:13.760]  As you can see, 70 megabytes fly by very quickly.
[46:14.400 --> 46:15.100]  There we go.
[46:15.520 --> 46:16.460]  We get the file.
[46:16.640 --> 46:17.280]  We can save it.
[46:18.220 --> 46:20.180]  It's being saved in my downloads folder right now.
[46:20.740 --> 46:21.500]  So, here it is.
[46:21.620 --> 46:22.960]  As you can see, the file name has changed.
[46:23.380 --> 46:24.660]  So, we're going to...
[46:24.660 --> 46:27.620]  And so, basically, you just send this file to the other person.
[46:27.780 --> 46:29.060]  So, I encrypted it to myself.
[46:29.220 --> 46:31.540]  So, basically, let's say I sent it to the other person who is myself.
[46:31.920 --> 46:33.800]  To decrypt the file, it's super simple.
[46:34.380 --> 46:34.720]  Drag.
[46:35.380 --> 46:35.560]  Whoops.
[46:36.400 --> 46:36.760]  Drag.
[46:37.020 --> 46:37.200]  Drop.
[46:38.140 --> 46:38.500]  Boom.
[46:39.160 --> 46:39.880]  It's decrypting.
[46:41.840 --> 46:42.400]  And...
[46:42.400 --> 46:42.800]  It's done.
[46:43.980 --> 46:44.540]  Save.
[46:45.840 --> 46:47.720]  How different is that from PGP?
[46:48.000 --> 46:49.020]  How different is it, really?
[46:51.740 --> 46:52.300]  So...
[46:55.680 --> 46:56.380]  Thank you.
[47:00.290 --> 47:03.530]  So, as you can see, I can watch my cartoon again.
[47:04.630 --> 47:05.610]  Everything is preserved.
[47:08.530 --> 47:10.050]  I swear, I don't even...
[47:10.050 --> 47:11.950]  At one point, they have like a space odyssey scene.
[47:11.950 --> 47:12.910]  He likes...
[47:12.910 --> 47:13.250]  He...
[47:13.250 --> 47:14.010]  He goes like...
[47:14.010 --> 47:15.050]  Where is it?
[47:16.510 --> 47:16.970]  No.
[47:17.350 --> 47:17.490]  Wait.
[47:17.890 --> 47:17.990]  Wait.
[47:18.950 --> 47:18.970]  Wait.
[47:19.650 --> 47:20.190]  Okay.
[47:20.550 --> 47:20.710]  Sorry.
[47:21.830 --> 47:22.370]  Yeah.
[47:22.510 --> 47:22.650]  Okay.
[47:24.470 --> 47:25.010]  Yes.
[47:25.410 --> 47:25.750]  Thank you.
[47:26.850 --> 47:27.390]  Okay.
[47:28.130 --> 47:29.870]  So, going back to this thing.
[47:30.570 --> 47:30.890]  All right.
[47:30.990 --> 47:31.370]  It's working.
[47:31.570 --> 47:31.670]  Great.
[47:32.210 --> 47:33.250]  So, the demonstration is done.
[47:33.530 --> 47:36.750]  So, I'm very happy to be able to do this.
[47:37.130 --> 47:41.050]  Minilock is released from the beginning as audited, peer-reviewed software.
[47:41.050 --> 47:41.750]  Ready for use.
[47:41.990 --> 47:50.770]  This was not the case with CryptoCAD, which took years to be audited and developed from a state of a bedroom project to something that is fully specified and peer-reviewed and so on.
[47:50.870 --> 47:54.290]  I'm releasing this with a design specification with a...
[47:54.290 --> 48:00.070]  So, the audit report actually is being currently edited by the auditing team and will be released on Monday or Tuesday.
[48:00.570 --> 48:01.090]  So, soon.
[48:01.370 --> 48:12.950]  But, it was a very optimistic audit report because the code of Minilock is really clean and as I mentioned, the libraries and methods that I use are made with the priority of being auditable.
[48:13.570 --> 48:14.630]  And the code is...
[48:14.630 --> 48:15.790]  Every method is documented.
[48:16.010 --> 48:17.250]  Every method is very cleanly written.
[48:17.550 --> 48:20.170]  I wrote this project because...
[48:20.170 --> 48:25.170]  I wrote this project as if the world's most discerning cryptographer was standing behind my back with a whip.
[48:25.170 --> 48:26.730]  Like, I...
[48:26.730 --> 48:29.130]  That's the mindset I was writing it in for...
[48:29.130 --> 48:31.670]  And I really wanted the code to be...
[48:31.670 --> 48:34.170]  Which is not really that different from my life generally, but...
[48:35.330 --> 48:38.050]  Now that I think about it, but it's...
[48:38.670 --> 48:47.570]  I wanted to write this in a way that gives you a great project that is mature with a code base that you can read through quickly and easily from day one.
[48:47.730 --> 48:49.690]  And this is what I want to present.
[48:51.070 --> 48:53.810]  So, I'm not releasing it yet on the Chrome Web Store.
[48:53.810 --> 48:56.450]  Even though I think it's in a position to be released there.
[48:57.710 --> 48:59.570]  Since it is, in fact, audited and so on.
[49:00.030 --> 49:05.070]  But I'm giving a two-week test period to everyone present here and everywhere in the world.
[49:05.430 --> 49:06.310]  To go on GitHub.
[49:07.310 --> 49:10.350]  And you have two weeks to give feedback.
[49:10.630 --> 49:11.510]  It's a request for feedback.
[49:11.630 --> 49:12.370]  A request for commentary.
[49:13.430 --> 49:14.010]  Break it.
[49:14.150 --> 49:14.690]  Improve it.
[49:14.830 --> 49:15.450]  Do whatever you want.
[49:15.570 --> 49:16.270]  You have two weeks.
[49:16.750 --> 49:22.650]  And after those two weeks, I'll release a, you know, beta version for the Chrome Store so people can start using it.
[49:22.650 --> 49:24.690]  You can clearly compile it and use it yourself.
[49:27.410 --> 49:30.230]  So, please go to the GitHub and go to the website.
[49:30.510 --> 49:34.490]  Read the documentation and contribute to this project and try to make it better.
[49:34.690 --> 49:39.090]  Because as I'm sure you saw, this is a new standard for file encryption.
[49:39.370 --> 49:40.790]  File encryption has never been this usable.
[49:41.110 --> 49:42.370]  It has never been this convenient.
[49:42.590 --> 49:45.790]  It has never been something that you can actually do the way I just did it.
[49:45.790 --> 49:49.430]  And I really, you know, I really think I'm onto something here.
[49:49.570 --> 49:50.630]  And I think you should help me.
[49:50.750 --> 49:54.570]  I think I'm doing something in a way that's very legitimate.
[49:54.810 --> 49:56.590]  In a way that's very respectable.
[49:56.910 --> 50:01.110]  And I want you to make the software better.
[50:01.410 --> 50:05.390]  So that we can have this awesome thing that I just showed you in a way that's universal for everyone.
[50:07.210 --> 50:09.070]  So, it will be released as a Chrome app.
[50:10.050 --> 50:12.850]  Other platforms like, for example, Firefox, perhaps soon.
[50:13.390 --> 50:17.890]  But let's just focus on one platform for now because it makes, you know, let's progress slowly.
[50:20.330 --> 50:24.590]  So, it being released on Chrome means that it runs on Chrome OS, Windows, Mac and Linux, anyway.
[50:25.370 --> 50:28.810]  And as I said, there was a two-week test period before the App Store release.
[50:28.970 --> 50:33.310]  It's not being released on App Store, but you know, it's that kind of like quote-unquote term to use for that.
[50:34.230 --> 50:38.470]  So, thank you very much for your time and for listening while I present my research.
[50:39.830 --> 50:40.230]  Thanks.
[50:47.400 --> 50:53.420]  It's always a pleasure to be part of the security community and the computer hacker community and the cryptography community.
[50:53.640 --> 50:59.200]  And so, you will be able to get the code and documentation on this website, minilock.io.
[50:59.420 --> 51:03.700]  If you go to it right now, it's not going to work because I still need to push the button that launches the thing.
[51:03.840 --> 51:07.780]  So, as soon as I unplug, I'm going to go on this table and push the button and then it will work.
[51:08.920 --> 51:09.980]  Oh, yes, yes.
[51:10.480 --> 51:20.000]  There is a Q&A and demo and everything else session for minilock happening right now at Noisy Square, which is downstairs.
[51:20.860 --> 51:22.960]  And you can come and we can go through it together.
[51:22.960 --> 51:23.900]  We can do whatever you like.
[51:23.900 --> 51:28.940]  I'm there and I'm ready to assist you in explaining this cool stuff.
[51:28.940 --> 51:30.720]  So, please come to Noisy Square.
[51:30.940 --> 51:31.840]  It's on the mezzanine.
[51:32.080 --> 51:34.160]  It's the one with all the inflatable couches.
[51:34.560 --> 51:37.960]  I swear, I inflated half of those couches myself and it was really annoying.
[51:38.320 --> 51:39.740]  So, please come sit on them.
[51:39.740 --> 51:42.520]  Thank you very much again for this opportunity.
[51:42.840 --> 51:43.340]  Thank
[51:50.340 --> 51:53.500]  you very much again for this opportunity.
[51:53.500 --> 51:53.560]  And this is the second one.