Key Transparency: A Cryptography Milestone at RWC 2024

The Real-World Cryptography (RWC) 2024 conference featured a strong emphasis on key transparency, a vital area in modern cryptography. Certificate Transparency, a system for logging X.509 certificates used for HTTPS, received the prestigious Levchin Prize, recognizing its significant impact on web security.

• The Levchin Prize acknowledges key innovations in cryptography that have real-world applications.
• The award highlights the importance of transparency in securing web infrastructure and mitigating threats like Certificate Authority attacks.

Exploring Modern Transparency Logs in Cryptography

The concept of transparency logs, introduced by Certificate Transparency, has evolved to be more abstract and reusable across various applications. At RWC 2024, Filippo Valsorda presented a talk on the evolution of transparency logs and their potential for broader adoption in various scenarios.

• Transparency logs act as append-only lists that provide a global view of recorded events. This ensures accountability and verifiability.
• Valsorda highlighted the use of transparency logs for key transparency, including the Go Checksum Database for Go module versions, demonstrating the versatility of the technology.

WhatsApp Key Transparency: Ensuring Secure Messaging

Key transparency plays a critical role in end-to-end encryption for secure messaging, preventing man-in-the-middle attacks by allowing users to verify the authenticity of public keys. At RWC 2024, WhatsApp shared its implementation of key transparency using CONIKS and SEEMless technologies.

• CONIKS uses sparse Merkle Trees to map phone numbers to public keys while maintaining privacy.
• SEEMless ensures that the sparse Merkle Tree contains a complete history of past public keys for a given phone number, preventing key spoofing.
• WhatsApp’s implementation utilizes Verifiable Random Functions (VRFs) to enhance privacy, ensuring only WhatsApp can hash phone numbers into Merkle Tree coordinates.

Privacy Enhancing Technologies: Protecting User Identity

The RWC 2024 conference addressed the crucial need for privacy enhancing technologies, particularly in the context of user identity on the internet. Anonymous credentials offer a potential solution to address concerns about centralized identity management and user tracking.

• Anonymous credentials allow users to present subsets of their credentials without revealing their complete identity, balancing privacy with functionality.
• The Levchin Prize was awarded to Jan Camenisch and Anna Lysyanskaya for their work on efficient anonymous credentials schemes.
• The use of zero-knowledge proofs, particularly zk-SNARKs, is gaining traction in anonymous credential systems, enabling flexible and extensible solutions.

STIR/SHAKEN: A Privacy Concern in Phone Call Security

STIR/SHAKEN is a protocol designed to combat robocalls and caller ID spoofing. However, at RWC 2024, Josh Brown and Paul Grubbs highlighted potential privacy implications of STIR/SHAKEN.

• STIR/SHAKEN’s reliance on intermediaries for signature generation can lead to the sharing of caller ID information with off-path services, raising privacy concerns.
• Non-repudiable caller IDs in call logs can make call data leaks more sensitive, as the data can be validated using cryptographic evidence.
• Researchers are working to enhance STIR/SHAKEN’s privacy by incorporating techniques like blind signing and deniable signatures.

Post-Quantum Messaging: Secure Communication in the Quantum Age

The rise of quantum computing poses a threat to current cryptography, as quantum computers could potentially break widely used encryption algorithms. RWC 2024 discussed advancements in post-quantum cryptography, particularly in the context of secure messaging.

• Apple’s iMessage PQ3 implementation uses lattice-based cryptography, specifically Kyber, for post-quantum key exchange and encryption, aiming to protect against “harvest now, decrypt later” attacks.
• Signal Messenger’s PQXDH uses a similar approach, with a focus on formal verification and code-based proofs to ensure security.
• The conference explored various post-quantum non-interactive key exchange (NIKE) schemes, including Swoosh, which offers promising performance but faces potential vulnerabilities in the face of recent quantum algorithms for solving LWE problems.

Watermarks for Language Models: A Cryptography-Based Approach

The RWC 2024 conference featured a talk on a cryptography-based approach to watermarking language models (LLMs) to distinguish AI-generated content from human-generated content.

• The proposed watermarking scheme aims to add subtle noise to AI responses without affecting quality, making it verifiable.
• The work emphasizes undetectability, ensuring an adversary cannot easily detect and remove the watermark.
• The approach aims to address the challenge of post-hoc detection schemes, which often fail to accurately classify AI-generated content.

Real-World Cryptography Challenges: Weak Fiat-Shamir Attacks and Video-Based Cryptanalysis

The conference also explored real-world cryptography challenges, highlighting vulnerabilities in Fiat-Shamir constructions and the rise of video-based cryptanalysis.

• Quang Dao presented research on weak Fiat-Shamir attacks, showcasing vulnerabilities in various zero-knowledge proof (ZKP) implementations, emphasizing the importance of careful implementation details in Fiat-Shamir constructions.
• The RWC 2024 featured a talk on video-based cryptanalysis, showcasing the vulnerability of cryptographic systems to side-channel attacks using readily available cameras and even LEDs on connected devices, underscoring the need for robust side-channel protection.