Abstract

Everyone is talking about “cloud computing”, a marketing term for “renting time on someone else’s computers on the internet”. While the cloud is great from an efficiency point of view, it is a potential security nightmare: applications have to blindly trust cloud providers that they will preserve the integrity of the data and prevent unauthorised access. Data breaches and compromises of cloud providers are a serious risk.

End-to-end encryption allows us to avoid having to blindly trust the servers. An early example is PGP /GnuPG encrypted email, which never went mainstream, but more recent secure messaging apps like WhatsApp, Signal and iMessage have shown that it is feasible for millions of people to use end-to-end encryption without being security experts.

How do these protocols actually work? In this talk, we will give a friendly introduction to secure messaging protocols — to understand the threats against which they defend, and how cryptographic operations are combined to implement those defences in the protocol. If you have ever wondered what “forward secrecy” means, how key exchange works, or how protocols can ensure you’re communicating with the right person (not an impostor like a “man in the middle”), this talk will clear things up.

We will give a dramatic live performance of security protocols, guaranteed to make a dry subject interesting!