index.org

PGP integration with CISC

A little bit of background

PGP

• Pretty Good Privacy.
• Provides cryptographic privacy and authentication for data communication.
• Web of trust: users act as CA.

JVSS

• Joint Verifiable Secret Sharing.
• Can generate threshold digital signature in a distributed way.

Random shared secret generation

Assuming $n$ signers and a threshold of $t$.

• Each signer serves the role of the ‘dealer’
• Produces $n-$ shares secret, send share to others.
• Every other signers verifies that the dealing has been made correctly.

⇒ allows to detect cheaters

• When everyone has played the ‘dealer’ role, each signer combines the $n$ shares into a global secret.

Setup phase

• Creation of a long term shared secret.
• Will be used for every signing round.
• Signature created can be checked against it.

Signing phase

• Creation of a short term shared secret.
• Combined with long term secret.
• Generate a valid signature if at least $t$ signers.

CISC

• CISC identity SkipChain.
• Goal: provide a simple and secure identity management service.

Architecture

Skipchain

Problem:
Using PGP with more than one device…

What we want:

• Being able to sign and decrypt message from any device.
• Not losing everything when a device is compromised.

Same key on every device?

• We can sign and decrypt from any device!
• But…
• If one device is lost, the key is lost…
• All the trust gained is lost!

Sub-keys

• Linked to a master key, same trust level.
• Signing resolved!
• In case of device loss, revocation of the sub-key.
• Decryption becomes problematic…
• What if there is a man-in-the-middle (freeze attack)?

Using skipchains

• Latest valid key is placed in the skipchain
• Trust displaced in the skipchain.
• Can define a maximum epoch for the block.
• Solves the freeze attack!
• But…
• Interlocutor needs to know how the skipchain works.

Our solution: CISC and JVSS

• Split our PGP key on a cothority using secret sharing and JVSS:
  • Have one global public key, sent to PGP servers.
  • Each conode only has a share of the key.
• Use CISC to manage the list of authoritative devices.

Signing and Decryption

• Everything done using publicly available key.
• Signature will appear to be signed by it.
• Encryption can be made with it.
• We can make a signing/decryption request from any device.

Device loss and freeze attack

• In case of device loss, revoke its access to CISC.
• Attacker can temporarily sign/decrypt.
• Key is not affected at all.
• Also use maximum epoch for solving freeze attack.

Interoperability

• Public key made available as usual.
• Following skipchain only needed for added security (freeze attack).

Implementation in Cothority

Reality check

• Impossible with current implementation of JVSS to bring own key.
• Threshold decryption not present in dedis/crypto.

Interfacing OpenPGP and dedis/crypto

package openpgp

• Straightforward using OpenPGP implementation of golang/x/crypto.
• Able to create valid OpenPGP signature, public and private keys packet.

JVSS protocol and JVSS service

package jvss

• Separation of the JVSS protocol in two parts.
• Setup protocol:
  • Creates a shared secret and a public key.
  • Sends to the service its secret share.
• Signing protocol:
  • Initialized with previously created shares.
  • Makes round of signing using the shares.
• Service allows to save/load shares.

Adding everything to the CISC application

package cisc

pgp setup

pgp sign

Benchmark

Signing time with number of hosts

Scaling with number of clients (16 hosts)

From last slide:

• With 32 clients and an interval of 15 seconds, round takes less than 15 seconds.
• We can make around 4 signatures/minute × 32 clients ≅ 130 signatures/minute.
• 130 signatures/minute × 60 minutes/hour × 24 hours/day ≅ 200’000 signatures/day.
• Average EPFL user sends 10-20 mails per day.
• We can provide all EPFL (15’000 people) decentralized and secure e-mail.

What’s left to be done

• Splitting user’s key with JVSS.
• Threshold decryption.

Questions?