Kevin Lewi

applied cryptography @Meta

[Thibault @thibmeu]

Cloudflare is now verifying WhatsApp Key Transparency proofs as a way to help ensure public keys integrity. Details are in the blog https://t.co/QQzI1TJJB8

[Kevin Lewi @_klewi]

@matthew_d_green Potential hardware flaws which if exploited could give attackers access to... a *super* talkative personal assistant that has access to your phone's data / messages / notes / photos...?

[Kevin Lewi @_klewi]

@dfaranha @hdevalence @zmanian @str4d Ristretto255 hash-to-curve is used in OPRFs which is used in OPAQUE which is used in encrypted backups for WhatsApp and Messenger E2EE

[Kevin Lewi @_klewi]

We've made our library publicly available in the hopes that other encrypted messaging apps looking to deploy key transparency to a large user base can do so more easily -- https://t.co/7b0g6j57Bs

Open to PRs and general feedback!

[Kevin Lewi @_klewi]

AKD (WhatsApp's key transparency library) was recently audited by NCC Group.

Thanks to Elena Bakos-Lang, @gerald_doussot, Kevin Henry, @BearSSLnews, and others for the great work on this!

[NCC Group North America InfoSec @NCCsecurityUS]

New Blog: Public Report – WhatsApp Auditable Key Directory (AKD) Implementation Review https://t.co/CpWHITKxMH

[henry 🌘 @hdevalence]

under-remarked in this Apple announcement is the fact that for the first time in a decade or more, there is now an aspect in which Signal is behind the state of the art in secure messaging.

huge congrats to the team, it’s a massive leap forward!

https://t.co/HjDjefHQs1

[Kevin Lewi @_klewi]

@hdevalence @kryptoklob In WhatsApp we also have this! Plus an open-source repo (https://t.co/7b0g6j57Bs) with the ability to publicly audit our append-only proofs (of consistency)

[Kevin Lewi @_klewi]

Oh wow, key transparency is coming to iMessage? 🤯

https://t.co/07ehYOdzlN

[Kevin Lewi @_klewi]

@dionyziz @WhatsApp Yes, that’s right. The server needs to be trusted during binary distribution (and app install-time). Efforts like binary transparency, and ways to allow clients to recompile the binary given its source code, would help to make this assumption more realizable in practice…

[Kevin Lewi @_klewi]

@dionyziz @WhatsApp IIRC a question came up during my visit around whether or not an implementation of E2EE should actually be considered E2EE if it is not open-source. It was out of scope for my talk at the time, but perhaps it is in scope for twitter 😄

[Kevin Lewi @_klewi]

@dionyziz @WhatsApp Hi! Our threat model for key transparency is, roughly speaking, “untrusted server” but “trusted client device”.

Apologies if I directly dismissed your question during the presentation, as I certainly didn’t intend to come across that way!

[Kevin Lewi @_klewi]

@sweis @deanpierce We also need to assume that there isn't a copy of the signing key on these HSMs stored anywhere else. Presumably they need this in order to provision more Orbs, but this also means that if it were to leak, adversaries could sign anything they want...

[Sergey Gorbunov @sergey_nog]

There will be 1000 write-ups criticizing the technology, approach, or distribution of @worldcoin. In fact, it's pretty easy to do this for any person with crypto/security background. + You'll get a lot of media attention.

But I think it's important to take a step back, imagine the potential of what if this actually works, understand the technical limitations, and see how we can solve one problem at a time. The project is still in the early phases of development.

After browsing the docs for a few hours (they're very good for an early-stage project), here're a few low hanging recommendations to the team.

* Make the audits public. Seems there were two audits done by Nethermind & Least Authority. The audits are not public yet. https://t.co/uxL8wFTIEA

* Run public security contests and bug bounties. e.g., using @immunefi and @code4rena.

* Clearly state the assumptions. In any crypto/security system, it's important to understand the roots of trust. The assumptions should be of the form: "We trust that (a) the Orb is not compromised, (b) the PKI around the Orb is secure, (c) the ZK proof by Groth16 is secure, (d) the user's device storing the key is secure, etc."

* State the assumptions around the Orb. e.g., The Orb generates an iris code of length X such that for all scans of all Orbs of the same person, the Hamming distance between any two pairs of scans is < Y, and for all pairs of iris scans that belong to different people, the Hamming distance is greater than Z.

* It wasn't clear to me where the iris data is stored and not stored. Make that very explicit. Which devices / services have access to the full iris data vs its fingerprint? Is the fingerprint lossy or cryptographically secure? [i.e., no info about the pre-image, the iris sequence itself, can be extracted from the public info (statistically) vs its protected using crypto and holds private under some crypto assumptions].

* Anticipating a backlash of academic papers breaking the protocol, pro-actively engage with them. e.g., create research grants for folks to write a paper breaking some part of the protocol && suggesting a way to fix and improve it.

* Start an open-source research / development program for alternatives to the Orb hardware implementation.

cc @mnovendstern, @sama , @chriswaclawek

[Esha Ghosh (she/her) @EshaGhosh87]

Excited to announce the 1st Workshop on Cryptography Applied to Transparency Systems (CATS)! Nov 30, 2023, co-located with ACM CCS in Copenhagen. Submissions due Sept 1. More details here: https://t.co/syvz0ZyH2Y

[Kevin Lewi @_klewi]

@winterdeaf @kientuong114 Unfortunately not yet... but hopefully soon!

[Kevin Lewi @_klewi]

There's some neat behind-the-scenes crypto involved to link WhatsApp E2EE sessions across devices... without QR codes!

[WABetaInfo @WABetaInfo]

📝 WhatsApp beta for Android 2.23.14.18: what's new?

WhatsApp is rolling out a feature to link your account to WhatsApp Web by using your phone number, and it's available to some beta testers!

https://t.co/J5CX096Oub

[Kevin Lewi @_klewi]

@kostascrypto @backaes Sounds like C2PA (https://t.co/1UlVagMSwx).

Also reminds me of this RWC 2023 talk by @TrishaCDatta that you might be interested in: https://t.co/yMC6JD7Txi

[Kevin Lewi @_klewi]

@matthew_d_green The definition of MPC went from

"two or more parties compute a joint function on their private inputs"

to

"a protocol in which parties interact with each other in some way"

🤦‍♂️

[Kevin Lewi @_klewi]

@kostascrypto @backaes &gt; Twitter and FB should not allow plain (unsigned) screenshots.

🤔