Privacy is Personal, Not Political: Layered Defense with Perfect Forward Security

Presented at ToorCon San Diego 16 (2014), Oct. 25, 2014, 4 p.m. (50 minutes)

There is an overwhelming amount of surveillance in the Internet realm. We created secure channels so that nobody can read our personal communications - not only during the conversation, but also any time after it. But any entity can make an attempt at monitoring, recording, and attacking communications retroactively. The threat of retroactive decryption is to open Pandora’s Box, containing the personal traffic of millions of people - and it has created a strong push for an extra layer of security for electronic communications. A great deal of this focus has been on the DHE ciphersuites in TLS, enabling Perfect Forward Security. This talk will look into how Forward Security can be used to protect online communication, but covering much more than TLS. Besides explaining the groundwork, the difference been Forward Security and Perfect Forward Security, and exploring mechanisms outside any individual protocol - this talk will explore its use and how to enable it in protocols you have deployed in your network today. This presentation will cover a simple explanation, real life applications, advantages, and implementation of Perfect Forward Security in different protocols like TLS, Off-the-record (OTR) Messaging, Secure Shell (SSH), Wireless Protected Access II Protocol (WPA2-EAP-PWD), and Virtual Private Networks (VPNs). Additionally, it will model a generic electronic communication protocol and find out how Forward Security can be implemented in it along with confidentiality and integrity. The takeaway of this presentation will be in understanding why Perfect Forward Security is worthwhile and how you can enable forward secrecy in an abstract protocol, covering historical mechanisms, and newer ratcheting protocols. The audience will also right away know where Prefect Forward Security is in TLS, SSH, VPN Protocols, IPSEC, WPA2, and OTR, and how they can enable it.


Presenters:

  • Pratik Guha Sarkar
    Pratik Guha Sarkar is a Security Engineer at iSEC Partners. At iSEC, Pratik works in the areas of web application/web services security, practical cryptography, mobile security and client/server testing. He is interested in cryptography, privacy, security, photography, and traveling. Pratik has previously presented at security conferences such as OWASP Appsec. He is located corporeally in New York City.

Similar Presentations: