SlideShare a Scribd company logo
End to End Encryption
Why it matters
The example of email communications
Thomas Seropian
How does email work?
• Your inbox is hosted on an email server
• These servers are inter-connected
• Email messages are stored and processed
in clear text (or not?)
• You are connecting to these using Wi-Fi,
your ISP, and network cables
End to End Encryption in 10 minutes -
The internet is not a safe place
• Lots of computers connected together
• Using protocols designed in the 70s, by
scientists and military
• Expected to be used by max 1000 users
• No security implemented by design
• Imagine 100 people gatecrashing a house
party with no locks on the doors!

Recommended for you

x.509-Directory Authentication Service
x.509-Directory Authentication Servicex.509-Directory Authentication Service
x.509-Directory Authentication Service

Defines a framework for authentication service using the X.500 directory.It is the Repository of public-key certificates,Based on use of public-key cryptography and digital signatures.

directory authenticationauthentication service
Email security
Email securityEmail security
Email security

Electronic mail security requires confidentiality, authentication, integrity, and non-repudiation. Privacy Enhanced Mail (PEM) and Pretty Good Privacy (PGP) provide these security services for email. PEM uses canonical conversion, digital signatures, encryption, and base64 encoding. PGP provides authentication via digital signatures and confidentiality through symmetric encryption of messages with randomly generated session keys. Secure/Multipurpose Internet Mail Extensions (S/MIME) also supports signed and encrypted email to provide security.

Transport layer security (tls)
Transport layer security (tls)Transport layer security (tls)
Transport layer security (tls)

Transport Layer Security (TLS) is a protocol that ensures privacy between communicating applications and their users on the Internet. When a server and client communicate, TLS ensures that no third party may eavesdrop or tamper with any message. TLS is the successor to the Secure Sockets Layer (SSL).

transport layer securityinternettls
You are receiving a postcard
• Can your mailman read your postcards?
• Can the van driver read your postcards?
• Can your neighbours access your PO box?
• Can they ask your landlord for a key, forge
one?
• Can they give it to a private detective?
• Is the sender the person they claim to be?
Emails V Postcards
• Email address = Personal Post Box
• Email message = Postcard
• Email servers = Post office
• Wi-Fi / ISP = Mail Van Drivers
Threats Diagram
• Communication security over a network
• Encrypting communications on a network
(previously called SSL)
• The van driver cannot access the content
in the mail bag (but your mailman can)
• Gmail & Facebook provide TLS (HTTPS)
however …
Transport Layer Security

Recommended for you

Rc4
Rc4Rc4
Rc4

The document discusses cryptographic algorithms and keys. It describes the RC4 algorithm which uses a key stream to encrypt plaintext into ciphertext. It involves initializing a state array S with permutations, then generating a pseudo-random key stream by swapping array bytes based on the key and indices i and j. The key stream is then combined with plaintext to produce ciphertext. The document also mentions SSL and provides several references on RC4, WEP attacks, and cryptographic algorithm breakdowns.

rc4stream cipherrivest cipher 4
Encryption ppt
Encryption pptEncryption ppt
Encryption ppt

Encryption is the process of encoding messages or information so that only authorized parties can read it. There are two main types of encryption: symmetric key encryption which uses the same key to encrypt and decrypt, and asymmetric key encryption which uses a public key to encrypt and a private key to decrypt. While symmetric encryption is faster, asymmetric encryption is more secure since it does not require sharing the same key. Encryption is widely used to provide authentication, privacy, integrity, and accountability of data.

SSL And TLS
SSL And TLS SSL And TLS
SSL And TLS

SSL and TLS provide end-to-end security for applications using TCP. They operate at the transport layer and provide services like data encryption, message integrity, and client/server authentication. The key components are the handshake protocol for negotiating encryption parameters and exchanging keys, the record protocol for fragmenting and encrypting application data, and alert and change cipher spec protocols for signaling errors and key changes. Common algorithms include RSA and Diffie-Hellman for key exchange, RC4, 3DES and AES for encryption, and MD5 or SHA for hashing. Sessions define a connection's cryptographic settings while connections are the actual data streams.

ssltlssecurity at transport layer
Threats Diagram
End-to-End Encryption
• Put your postcard in a safe and send the safe
via email
• Each safe has a special lock that only you
and your recipient can trigger
• You need to exchange keys in order to send
messages to each other
• Anyone without the key is unable to open it
Each user has a pair of keys.
• Public Key : to be shared with recipients
• Private Key : to be kept in a safe place. No
one else has access to it
Threats Diagram

Recommended for you

Random number generators
Random number generatorsRandom number generators
Random number generators

This is a briefing about Random Number Generators. Random Number Generators are important in the data center because of their role in cryptography. This briefing introduces Random Number Generators, types of Random Number Generators including TRNG and PRNG, and a visual example of "randomness." http://boblandstrom.com

random number generatorsdata centerdata center consultant
Secure Socket Layer (SSL)
Secure Socket Layer (SSL)Secure Socket Layer (SSL)
Secure Socket Layer (SSL)

SSL is an internet protocol for secure exchange of information between a web browser and a web server.

handshake protocolhttpsrecord protocol
Encryption
EncryptionEncryption
Encryption

This presentation discusses various aspects of data encryption. It defines data encryption as mathematical calculations and algorithms that transform plain text into ciphertext. It then covers the main types of encryption, distinguishing between symmetric encryption which uses the same key for encryption and decryption, and asymmetric encryption which uses different public and private keys. The presentation also explains some common encryption methods like the Data Encryption Standard and public key cryptosystems.

End to End Encryption in 10 minutes -
Why is this important
• Protecting against cyber threats
• If an attacker gains access to your inbox,
they cannot read your messages
• Protecting personal privacy from
increasing surveillance systems
• Your recipient knows you are the genuine
sender (your key is private)
E2EE in the news
• Whatsapp rolling out E2E encryption for 1
billion users
• Snowden was using PGP to communicate
with Laura Poitras and The Guardian
Thank you for your time
• Questions, comments?
• Contact me
– thomas@seropian.io
– PGP Key : 0xfc944ab6
• Slides
– http://seropian.io/assets/files/e2ee.pdf

Recommended for you

Mail server
Mail serverMail server
Mail server

A mail server is a computer that handles email delivery. It implements the client and server portions of SMTP to reliably transfer messages between servers using TCP port 25. A mail server stores users' incoming emails in their mailboxes and queues outgoing messages to be sent. The major components of electronic mail systems are user agents for composing/reading mail, mail servers for message storage and transfer using SMTP, and protocols like POP3 and IMAP for users to access their mailboxes.

PUBLIC KEY ENCRYPTION
PUBLIC KEY ENCRYPTIONPUBLIC KEY ENCRYPTION
PUBLIC KEY ENCRYPTION

Public key cryptography uses key pairs - a public key and a private key - to encrypt and decrypt messages. The public key can be shared widely, while the private key is kept secret. This allows users to securely share encrypted messages without having to first share secret keys. Common applications of public key cryptography include public key encryption and digital signatures.

Classical Encryption Techniques
Classical Encryption TechniquesClassical Encryption Techniques
Classical Encryption Techniques

The document discusses classical encryption techniques, including symmetric encryption which uses the same key for encryption and decryption. It describes ciphers like the Caesar cipher which substitutes letters by shifting the alphabet, the monoalphabetic cipher with one substitution table, and the polyalphabetic Vigenère cipher which uses multiple substitution alphabets. The document also covers the Playfair cipher which encrypts letters in pairs using a 5x5 keyword matrix, and discusses cryptanalysis techniques for breaking classical ciphers.

Further reading
• Security In A Box
• EFF’s Security Self Defense
• Digital First Aid Kit
• CPJ’s Journalist Security Guide

More Related Content

What's hot

Https presentation
Https presentationHttps presentation
Https presentation
patel jatin
 
Simple Mail Transfer Protocol
Simple Mail Transfer ProtocolSimple Mail Transfer Protocol
Simple Mail Transfer Protocol
Ujjayanta Bhaumik
 
Electronic mail security
Electronic mail securityElectronic mail security
Electronic mail security
Dr.Florence Dayana
 
x.509-Directory Authentication Service
x.509-Directory Authentication Servicex.509-Directory Authentication Service
x.509-Directory Authentication Service
Swathy T
 
Email security
Email securityEmail security
Email security
Indrajit Sreemany
 
Transport layer security (tls)
Transport layer security (tls)Transport layer security (tls)
Transport layer security (tls)
Kalpesh Kalekar
 
Rc4
Rc4Rc4
Encryption ppt
Encryption pptEncryption ppt
Encryption ppt
Anil Neupane
 
SSL And TLS
SSL And TLS SSL And TLS
SSL And TLS
Ghanshyam Patel
 
Random number generators
Random number generatorsRandom number generators
Random number generators
Bob Landstrom
 
Secure Socket Layer (SSL)
Secure Socket Layer (SSL)Secure Socket Layer (SSL)
Secure Socket Layer (SSL)
Samip jain
 
Encryption
EncryptionEncryption
Encryption
Nitin Parbhakar
 
Mail server
Mail serverMail server
Mail server
Jazib Amjad
 
PUBLIC KEY ENCRYPTION
PUBLIC KEY ENCRYPTIONPUBLIC KEY ENCRYPTION
PUBLIC KEY ENCRYPTION
raf_slide
 
Classical Encryption Techniques
Classical Encryption TechniquesClassical Encryption Techniques
Classical Encryption Techniques
university of education,Lahore
 
Block cipher modes of operation
Block cipher modes of operation Block cipher modes of operation
Block cipher modes of operation
harshit chavda
 
Pgp pretty good privacy
Pgp pretty good privacyPgp pretty good privacy
Pgp pretty good privacy
Pawan Arya
 
3 public key cryptography
3 public key cryptography3 public key cryptography
3 public key cryptography
Rutvik Mehta
 
Transport Layer Security (TLS)
Transport Layer Security (TLS)Transport Layer Security (TLS)
Transport Layer Security (TLS)
Arun Shukla
 
Public Key Cryptography
Public Key CryptographyPublic Key Cryptography
Public Key Cryptography
Gopal Sakarkar
 

What's hot (20)

Https presentation
Https presentationHttps presentation
Https presentation
 
Simple Mail Transfer Protocol
Simple Mail Transfer ProtocolSimple Mail Transfer Protocol
Simple Mail Transfer Protocol
 
Electronic mail security
Electronic mail securityElectronic mail security
Electronic mail security
 
x.509-Directory Authentication Service
x.509-Directory Authentication Servicex.509-Directory Authentication Service
x.509-Directory Authentication Service
 
Email security
Email securityEmail security
Email security
 
Transport layer security (tls)
Transport layer security (tls)Transport layer security (tls)
Transport layer security (tls)
 
Rc4
Rc4Rc4
Rc4
 
Encryption ppt
Encryption pptEncryption ppt
Encryption ppt
 
SSL And TLS
SSL And TLS SSL And TLS
SSL And TLS
 
Random number generators
Random number generatorsRandom number generators
Random number generators
 
Secure Socket Layer (SSL)
Secure Socket Layer (SSL)Secure Socket Layer (SSL)
Secure Socket Layer (SSL)
 
Encryption
EncryptionEncryption
Encryption
 
Mail server
Mail serverMail server
Mail server
 
PUBLIC KEY ENCRYPTION
PUBLIC KEY ENCRYPTIONPUBLIC KEY ENCRYPTION
PUBLIC KEY ENCRYPTION
 
Classical Encryption Techniques
Classical Encryption TechniquesClassical Encryption Techniques
Classical Encryption Techniques
 
Block cipher modes of operation
Block cipher modes of operation Block cipher modes of operation
Block cipher modes of operation
 
Pgp pretty good privacy
Pgp pretty good privacyPgp pretty good privacy
Pgp pretty good privacy
 
3 public key cryptography
3 public key cryptography3 public key cryptography
3 public key cryptography
 
Transport Layer Security (TLS)
Transport Layer Security (TLS)Transport Layer Security (TLS)
Transport Layer Security (TLS)
 
Public Key Cryptography
Public Key CryptographyPublic Key Cryptography
Public Key Cryptography
 

Viewers also liked

Review on Whatsapp's End to End encryption and Facebook integration
Review on Whatsapp's End to End encryption and Facebook integrationReview on Whatsapp's End to End encryption and Facebook integration
Review on Whatsapp's End to End encryption and Facebook integration
Govindarrajan NV
 
End-to-end encryption explained
End-to-end encryption explainedEnd-to-end encryption explained
End-to-end encryption explained
Todd Merrill
 
WhatsApp security
WhatsApp securityWhatsApp security
WhatsApp security
Javi Hurtado
 
Encryption for Everyone
Encryption for EveryoneEncryption for Everyone
Encryption for Everyone
Coastal Pet Products, Inc.
 
Encryption: It's For More Than Just Passwords
Encryption: It's For More Than Just PasswordsEncryption: It's For More Than Just Passwords
Encryption: It's For More Than Just Passwords
John Congdon
 
Gregor kopf , bernhard brehm. deniability in messaging protocols
Gregor kopf , bernhard brehm. deniability in messaging protocolsGregor kopf , bernhard brehm. deniability in messaging protocols
Gregor kopf , bernhard brehm. deniability in messaging protocols
Yury Chemerkin
 
Secure Communication
Secure CommunicationSecure Communication
Secure Communication
Koen Van Impe
 
Dublin Core Application Profile for Scholarly Works KE
Dublin Core Application Profile for Scholarly Works KEDublin Core Application Profile for Scholarly Works KE
Dublin Core Application Profile for Scholarly Works KE
Julie Allinson
 
Social Media on Exchange
Social Media on ExchangeSocial Media on Exchange
Social Media on Exchange
Cyprien Lomas
 
Publicidad inteligente
Publicidad inteligentePublicidad inteligente
Publicidad inteligente
shesys
 
Dcap Ja Progmeet 2007 07 05
Dcap Ja Progmeet 2007 07 05Dcap Ja Progmeet 2007 07 05
Dcap Ja Progmeet 2007 07 05
Julie Allinson
 
7 trends to be aware of for learning spaces
7 trends to be aware of for learning spaces7 trends to be aware of for learning spaces
7 trends to be aware of for learning spaces
Cyprien Lomas
 
Sword Bl 0903[1]
Sword Bl 0903[1]Sword Bl 0903[1]
Sword Bl 0903[1]
Julie Allinson
 
fiesta de gala
fiesta de galafiesta de gala
fiesta de gala
elcanga
 
Second Life Brown Bag
Second Life Brown BagSecond Life Brown Bag
Second Life Brown Bag
Cyprien Lomas
 
Radically Open Cultural Heritage Data on the Web
Radically Open Cultural Heritage Data on the WebRadically Open Cultural Heritage Data on the Web
Radically Open Cultural Heritage Data on the Web
Julie Allinson
 
Dublin Core Application Profile for Scholarly Works Slainte
Dublin Core Application Profile for Scholarly Works SlainteDublin Core Application Profile for Scholarly Works Slainte
Dublin Core Application Profile for Scholarly Works Slainte
Julie Allinson
 
SWAP : A Dublin Core Application Profile for desribing scholarly works
SWAP : A Dublin Core Application Profile for desribing scholarly worksSWAP : A Dublin Core Application Profile for desribing scholarly works
SWAP : A Dublin Core Application Profile for desribing scholarly works
Julie Allinson
 
Web CT as a Catalyst
Web CT as a Catalyst Web CT as a Catalyst
Web CT as a Catalyst
Cyprien Lomas
 
Sword Or2008 Julieallinson
Sword Or2008 JulieallinsonSword Or2008 Julieallinson
Sword Or2008 Julieallinson
Julie Allinson
 

Viewers also liked (20)

Review on Whatsapp's End to End encryption and Facebook integration
Review on Whatsapp's End to End encryption and Facebook integrationReview on Whatsapp's End to End encryption and Facebook integration
Review on Whatsapp's End to End encryption and Facebook integration
 
End-to-end encryption explained
End-to-end encryption explainedEnd-to-end encryption explained
End-to-end encryption explained
 
WhatsApp security
WhatsApp securityWhatsApp security
WhatsApp security
 
Encryption for Everyone
Encryption for EveryoneEncryption for Everyone
Encryption for Everyone
 
Encryption: It's For More Than Just Passwords
Encryption: It's For More Than Just PasswordsEncryption: It's For More Than Just Passwords
Encryption: It's For More Than Just Passwords
 
Gregor kopf , bernhard brehm. deniability in messaging protocols
Gregor kopf , bernhard brehm. deniability in messaging protocolsGregor kopf , bernhard brehm. deniability in messaging protocols
Gregor kopf , bernhard brehm. deniability in messaging protocols
 
Secure Communication
Secure CommunicationSecure Communication
Secure Communication
 
Dublin Core Application Profile for Scholarly Works KE
Dublin Core Application Profile for Scholarly Works KEDublin Core Application Profile for Scholarly Works KE
Dublin Core Application Profile for Scholarly Works KE
 
Social Media on Exchange
Social Media on ExchangeSocial Media on Exchange
Social Media on Exchange
 
Publicidad inteligente
Publicidad inteligentePublicidad inteligente
Publicidad inteligente
 
Dcap Ja Progmeet 2007 07 05
Dcap Ja Progmeet 2007 07 05Dcap Ja Progmeet 2007 07 05
Dcap Ja Progmeet 2007 07 05
 
7 trends to be aware of for learning spaces
7 trends to be aware of for learning spaces7 trends to be aware of for learning spaces
7 trends to be aware of for learning spaces
 
Sword Bl 0903[1]
Sword Bl 0903[1]Sword Bl 0903[1]
Sword Bl 0903[1]
 
fiesta de gala
fiesta de galafiesta de gala
fiesta de gala
 
Second Life Brown Bag
Second Life Brown BagSecond Life Brown Bag
Second Life Brown Bag
 
Radically Open Cultural Heritage Data on the Web
Radically Open Cultural Heritage Data on the WebRadically Open Cultural Heritage Data on the Web
Radically Open Cultural Heritage Data on the Web
 
Dublin Core Application Profile for Scholarly Works Slainte
Dublin Core Application Profile for Scholarly Works SlainteDublin Core Application Profile for Scholarly Works Slainte
Dublin Core Application Profile for Scholarly Works Slainte
 
SWAP : A Dublin Core Application Profile for desribing scholarly works
SWAP : A Dublin Core Application Profile for desribing scholarly worksSWAP : A Dublin Core Application Profile for desribing scholarly works
SWAP : A Dublin Core Application Profile for desribing scholarly works
 
Web CT as a Catalyst
Web CT as a Catalyst Web CT as a Catalyst
Web CT as a Catalyst
 
Sword Or2008 Julieallinson
Sword Or2008 JulieallinsonSword Or2008 Julieallinson
Sword Or2008 Julieallinson
 

Similar to End to End Encryption in 10 minutes -

Email Security : PGP & SMIME
Email Security : PGP & SMIMEEmail Security : PGP & SMIME
Email Security : PGP & SMIME
Rohit Soni
 
E-mail and Encryption
E-mail and EncryptionE-mail and Encryption
E-mail and Encryption
hey4ndr3w
 
20 security
20 security20 security
20 security
abiy2004
 
Cryptography
CryptographyCryptography
Cryptography
Nicholas Davis
 
Cryptography
CryptographyCryptography
Cryptography
Nicholas Davis
 
SSL/TLS 101
SSL/TLS 101SSL/TLS 101
SSL/TLS 101
Chul-Woong Yang
 
SSL/TLS 101
SSL/TLS 101SSL/TLS 101
SSL/TLS 101
Chul-Woong Yang
 
PGP.ppt
PGP.pptPGP.ppt
PGP.ppt
ssuserec53e73
 
Pgp
PgpPgp
Email security
Email securityEmail security
Email security
SultanErbo
 
Email security - Netwroking
Email security - Netwroking Email security - Netwroking
Email security - Netwroking
Salman Memon
 
Email
EmailEmail
Email
venkig2
 
Pki & Personal Digital Certificates, The Key To Securing Sensitive Electr...
Pki & Personal Digital Certificates, The Key To Securing Sensitive Electr...Pki & Personal Digital Certificates, The Key To Securing Sensitive Electr...
Pki & Personal Digital Certificates, The Key To Securing Sensitive Electr...
Nicholas Davis
 
Pki & personal digital certificates, the key to securing sensitive electronic...
Pki & personal digital certificates, the key to securing sensitive electronic...Pki & personal digital certificates, the key to securing sensitive electronic...
Pki & personal digital certificates, the key to securing sensitive electronic...
Nicholas Davis
 
Outlook and thunderbird ii
Outlook and thunderbird iiOutlook and thunderbird ii
Outlook and thunderbird ii
BanukaVidusanka
 
Help! I am an Investigative Journalist in 2017
Help! I am an Investigative Journalist in 2017Help! I am an Investigative Journalist in 2017
Help! I am an Investigative Journalist in 2017
Gabor Szathmari
 
CRYPTOGRAPHY AND NETWORK SECURITY- E-Mail Security
CRYPTOGRAPHY AND NETWORK SECURITY- E-Mail SecurityCRYPTOGRAPHY AND NETWORK SECURITY- E-Mail Security
CRYPTOGRAPHY AND NETWORK SECURITY- E-Mail Security
Jyothishmathi Institute of Technology and Science Karimnagar
 
#OSSPARIS19 - TLS for dummies - MAXIME BESSON, Worteks
#OSSPARIS19 - TLS for dummies - MAXIME BESSON, Worteks#OSSPARIS19 - TLS for dummies - MAXIME BESSON, Worteks
#OSSPARIS19 - TLS for dummies - MAXIME BESSON, Worteks
Paris Open Source Summit
 
[POSS 2019] TLS for Dummies
[POSS 2019] TLS for Dummies[POSS 2019] TLS for Dummies
[POSS 2019] TLS for Dummies
Worteks
 
Topsec Service Infographic
Topsec Service InfographicTopsec Service Infographic
Topsec Service Infographic
Gary Fleming
 

Similar to End to End Encryption in 10 minutes - (20)

Email Security : PGP & SMIME
Email Security : PGP & SMIMEEmail Security : PGP & SMIME
Email Security : PGP & SMIME
 
E-mail and Encryption
E-mail and EncryptionE-mail and Encryption
E-mail and Encryption
 
20 security
20 security20 security
20 security
 
Cryptography
CryptographyCryptography
Cryptography
 
Cryptography
CryptographyCryptography
Cryptography
 
SSL/TLS 101
SSL/TLS 101SSL/TLS 101
SSL/TLS 101
 
SSL/TLS 101
SSL/TLS 101SSL/TLS 101
SSL/TLS 101
 
PGP.ppt
PGP.pptPGP.ppt
PGP.ppt
 
Pgp
PgpPgp
Pgp
 
Email security
Email securityEmail security
Email security
 
Email security - Netwroking
Email security - Netwroking Email security - Netwroking
Email security - Netwroking
 
Email
EmailEmail
Email
 
Pki & Personal Digital Certificates, The Key To Securing Sensitive Electr...
Pki & Personal Digital Certificates, The Key To Securing Sensitive Electr...Pki & Personal Digital Certificates, The Key To Securing Sensitive Electr...
Pki & Personal Digital Certificates, The Key To Securing Sensitive Electr...
 
Pki & personal digital certificates, the key to securing sensitive electronic...
Pki & personal digital certificates, the key to securing sensitive electronic...Pki & personal digital certificates, the key to securing sensitive electronic...
Pki & personal digital certificates, the key to securing sensitive electronic...
 
Outlook and thunderbird ii
Outlook and thunderbird iiOutlook and thunderbird ii
Outlook and thunderbird ii
 
Help! I am an Investigative Journalist in 2017
Help! I am an Investigative Journalist in 2017Help! I am an Investigative Journalist in 2017
Help! I am an Investigative Journalist in 2017
 
CRYPTOGRAPHY AND NETWORK SECURITY- E-Mail Security
CRYPTOGRAPHY AND NETWORK SECURITY- E-Mail SecurityCRYPTOGRAPHY AND NETWORK SECURITY- E-Mail Security
CRYPTOGRAPHY AND NETWORK SECURITY- E-Mail Security
 
#OSSPARIS19 - TLS for dummies - MAXIME BESSON, Worteks
#OSSPARIS19 - TLS for dummies - MAXIME BESSON, Worteks#OSSPARIS19 - TLS for dummies - MAXIME BESSON, Worteks
#OSSPARIS19 - TLS for dummies - MAXIME BESSON, Worteks
 
[POSS 2019] TLS for Dummies
[POSS 2019] TLS for Dummies[POSS 2019] TLS for Dummies
[POSS 2019] TLS for Dummies
 
Topsec Service Infographic
Topsec Service InfographicTopsec Service Infographic
Topsec Service Infographic
 

Recently uploaded

一比一原版(ucb毕业证书)英国伯明翰大学学院毕业证如何办理
一比一原版(ucb毕业证书)英国伯明翰大学学院毕业证如何办理一比一原版(ucb毕业证书)英国伯明翰大学学院毕业证如何办理
一比一原版(ucb毕业证书)英国伯明翰大学学院毕业证如何办理
taqyea
 
一比一原版(uom毕业证)曼彻斯特大学毕业证如何办理
一比一原版(uom毕业证)曼彻斯特大学毕业证如何办理一比一原版(uom毕业证)曼彻斯特大学毕业证如何办理
一比一原版(uom毕业证)曼彻斯特大学毕业证如何办理
taqyea
 
Quiz Quiz Hota Hai (School Quiz 2018-19)
Quiz Quiz Hota Hai (School Quiz 2018-19)Quiz Quiz Hota Hai (School Quiz 2018-19)
Quiz Quiz Hota Hai (School Quiz 2018-19)
Kashyap J
 
一比一原版(hull毕业证书)英国赫尔大学毕业证如何办理
一比一原版(hull毕业证书)英国赫尔大学毕业证如何办理一比一原版(hull毕业证书)英国赫尔大学毕业证如何办理
一比一原版(hull毕业证书)英国赫尔大学毕业证如何办理
taqyea
 
一比一原版(ubc毕业证书)英属哥伦比亚大学毕业证如何办理
一比一原版(ubc毕业证书)英属哥伦比亚大学毕业证如何办理一比一原版(ubc毕业证书)英属哥伦比亚大学毕业证如何办理
一比一原版(ubc毕业证书)英属哥伦比亚大学毕业证如何办理
taqyea
 
Founders Of Digital World Social Media..
Founders Of Digital World Social Media..Founders Of Digital World Social Media..
Founders Of Digital World Social Media..
jom pom
 
Megalive99 Situs Betting Online Gacor Terpercaya
Megalive99 Situs Betting Online Gacor TerpercayaMegalive99 Situs Betting Online Gacor Terpercaya
Megalive99 Situs Betting Online Gacor Terpercaya
Megalive99
 
一比一原版澳洲巴拉特大学毕业证(utas毕业证书)如何办理
一比一原版澳洲巴拉特大学毕业证(utas毕业证书)如何办理一比一原版澳洲巴拉特大学毕业证(utas毕业证书)如何办理
一比一原版澳洲巴拉特大学毕业证(utas毕业证书)如何办理
taqyea
 
一比一原版(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证如何办理
一比一原版(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证如何办理一比一原版(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证如何办理
一比一原版(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证如何办理
taqyea
 
一比一原版(爱大毕业证书)英国爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)英国爱丁堡大学毕业证如何办理一比一原版(爱大毕业证书)英国爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)英国爱丁堡大学毕业证如何办理
taqyea
 
一比一原版(greenwich毕业证书)英国格林威治大学毕业证如何办理
一比一原版(greenwich毕业证书)英国格林威治大学毕业证如何办理一比一原版(greenwich毕业证书)英国格林威治大学毕业证如何办理
一比一原版(greenwich毕业证书)英国格林威治大学毕业证如何办理
taqyea
 
Massey University degree offer diploma Transcript
Massey University degree offer diploma TranscriptMassey University degree offer diploma Transcript
Massey University degree offer diploma Transcript
ubufe
 
Lincoln University degree offer diploma Transcript
Lincoln University degree offer diploma TranscriptLincoln University degree offer diploma Transcript
Lincoln University degree offer diploma Transcript
ubufe
 
PSD to Wordpress Service Providers in 2024
PSD to Wordpress Service Providers in 2024PSD to Wordpress Service Providers in 2024
PSD to Wordpress Service Providers in 2024
Bestdesign2hub
 
一比一原版(lu毕业证书)英国拉夫堡大学毕业证如何办理
一比一原版(lu毕业证书)英国拉夫堡大学毕业证如何办理一比一原版(lu毕业证书)英国拉夫堡大学毕业证如何办理
一比一原版(lu毕业证书)英国拉夫堡大学毕业证如何办理
taqyea
 
一比一原版(city毕业证书)英国剑桥大学毕业证如何办理
一比一原版(city毕业证书)英国剑桥大学毕业证如何办理一比一原版(city毕业证书)英国剑桥大学毕业证如何办理
一比一原版(city毕业证书)英国剑桥大学毕业证如何办理
taqyea
 
Book dating , international dating phgra
Book dating , international dating phgraBook dating , international dating phgra
Book dating , international dating phgra
thomaskurtha9
 
一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理
taqyea
 
一比一原版(bristol毕业证书)英国布里斯托大学毕业证如何办理
一比一原版(bristol毕业证书)英国布里斯托大学毕业证如何办理一比一原版(bristol毕业证书)英国布里斯托大学毕业证如何办理
一比一原版(bristol毕业证书)英国布里斯托大学毕业证如何办理
taqyea
 
very nice project on internet class 10.pptx
very nice project on internet class 10.pptxvery nice project on internet class 10.pptx
very nice project on internet class 10.pptx
bazukagaming6
 

Recently uploaded (20)

一比一原版(ucb毕业证书)英国伯明翰大学学院毕业证如何办理
一比一原版(ucb毕业证书)英国伯明翰大学学院毕业证如何办理一比一原版(ucb毕业证书)英国伯明翰大学学院毕业证如何办理
一比一原版(ucb毕业证书)英国伯明翰大学学院毕业证如何办理
 
一比一原版(uom毕业证)曼彻斯特大学毕业证如何办理
一比一原版(uom毕业证)曼彻斯特大学毕业证如何办理一比一原版(uom毕业证)曼彻斯特大学毕业证如何办理
一比一原版(uom毕业证)曼彻斯特大学毕业证如何办理
 
Quiz Quiz Hota Hai (School Quiz 2018-19)
Quiz Quiz Hota Hai (School Quiz 2018-19)Quiz Quiz Hota Hai (School Quiz 2018-19)
Quiz Quiz Hota Hai (School Quiz 2018-19)
 
一比一原版(hull毕业证书)英国赫尔大学毕业证如何办理
一比一原版(hull毕业证书)英国赫尔大学毕业证如何办理一比一原版(hull毕业证书)英国赫尔大学毕业证如何办理
一比一原版(hull毕业证书)英国赫尔大学毕业证如何办理
 
一比一原版(ubc毕业证书)英属哥伦比亚大学毕业证如何办理
一比一原版(ubc毕业证书)英属哥伦比亚大学毕业证如何办理一比一原版(ubc毕业证书)英属哥伦比亚大学毕业证如何办理
一比一原版(ubc毕业证书)英属哥伦比亚大学毕业证如何办理
 
Founders Of Digital World Social Media..
Founders Of Digital World Social Media..Founders Of Digital World Social Media..
Founders Of Digital World Social Media..
 
Megalive99 Situs Betting Online Gacor Terpercaya
Megalive99 Situs Betting Online Gacor TerpercayaMegalive99 Situs Betting Online Gacor Terpercaya
Megalive99 Situs Betting Online Gacor Terpercaya
 
一比一原版澳洲巴拉特大学毕业证(utas毕业证书)如何办理
一比一原版澳洲巴拉特大学毕业证(utas毕业证书)如何办理一比一原版澳洲巴拉特大学毕业证(utas毕业证书)如何办理
一比一原版澳洲巴拉特大学毕业证(utas毕业证书)如何办理
 
一比一原版(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证如何办理
一比一原版(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证如何办理一比一原版(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证如何办理
一比一原版(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证如何办理
 
一比一原版(爱大毕业证书)英国爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)英国爱丁堡大学毕业证如何办理一比一原版(爱大毕业证书)英国爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)英国爱丁堡大学毕业证如何办理
 
一比一原版(greenwich毕业证书)英国格林威治大学毕业证如何办理
一比一原版(greenwich毕业证书)英国格林威治大学毕业证如何办理一比一原版(greenwich毕业证书)英国格林威治大学毕业证如何办理
一比一原版(greenwich毕业证书)英国格林威治大学毕业证如何办理
 
Massey University degree offer diploma Transcript
Massey University degree offer diploma TranscriptMassey University degree offer diploma Transcript
Massey University degree offer diploma Transcript
 
Lincoln University degree offer diploma Transcript
Lincoln University degree offer diploma TranscriptLincoln University degree offer diploma Transcript
Lincoln University degree offer diploma Transcript
 
PSD to Wordpress Service Providers in 2024
PSD to Wordpress Service Providers in 2024PSD to Wordpress Service Providers in 2024
PSD to Wordpress Service Providers in 2024
 
一比一原版(lu毕业证书)英国拉夫堡大学毕业证如何办理
一比一原版(lu毕业证书)英国拉夫堡大学毕业证如何办理一比一原版(lu毕业证书)英国拉夫堡大学毕业证如何办理
一比一原版(lu毕业证书)英国拉夫堡大学毕业证如何办理
 
一比一原版(city毕业证书)英国剑桥大学毕业证如何办理
一比一原版(city毕业证书)英国剑桥大学毕业证如何办理一比一原版(city毕业证书)英国剑桥大学毕业证如何办理
一比一原版(city毕业证书)英国剑桥大学毕业证如何办理
 
Book dating , international dating phgra
Book dating , international dating phgraBook dating , international dating phgra
Book dating , international dating phgra
 
一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理
 
一比一原版(bristol毕业证书)英国布里斯托大学毕业证如何办理
一比一原版(bristol毕业证书)英国布里斯托大学毕业证如何办理一比一原版(bristol毕业证书)英国布里斯托大学毕业证如何办理
一比一原版(bristol毕业证书)英国布里斯托大学毕业证如何办理
 
very nice project on internet class 10.pptx
very nice project on internet class 10.pptxvery nice project on internet class 10.pptx
very nice project on internet class 10.pptx
 

End to End Encryption in 10 minutes -

  • 1. End to End Encryption Why it matters The example of email communications Thomas Seropian
  • 2. How does email work? • Your inbox is hosted on an email server • These servers are inter-connected • Email messages are stored and processed in clear text (or not?) • You are connecting to these using Wi-Fi, your ISP, and network cables
  • 4. The internet is not a safe place • Lots of computers connected together • Using protocols designed in the 70s, by scientists and military • Expected to be used by max 1000 users • No security implemented by design • Imagine 100 people gatecrashing a house party with no locks on the doors!
  • 5. You are receiving a postcard • Can your mailman read your postcards? • Can the van driver read your postcards? • Can your neighbours access your PO box? • Can they ask your landlord for a key, forge one? • Can they give it to a private detective? • Is the sender the person they claim to be?
  • 6. Emails V Postcards • Email address = Personal Post Box • Email message = Postcard • Email servers = Post office • Wi-Fi / ISP = Mail Van Drivers
  • 8. • Communication security over a network • Encrypting communications on a network (previously called SSL) • The van driver cannot access the content in the mail bag (but your mailman can) • Gmail & Facebook provide TLS (HTTPS) however … Transport Layer Security
  • 10. End-to-End Encryption • Put your postcard in a safe and send the safe via email • Each safe has a special lock that only you and your recipient can trigger • You need to exchange keys in order to send messages to each other • Anyone without the key is unable to open it
  • 11. Each user has a pair of keys. • Public Key : to be shared with recipients • Private Key : to be kept in a safe place. No one else has access to it
  • 14. Why is this important • Protecting against cyber threats • If an attacker gains access to your inbox, they cannot read your messages • Protecting personal privacy from increasing surveillance systems • Your recipient knows you are the genuine sender (your key is private)
  • 15. E2EE in the news • Whatsapp rolling out E2E encryption for 1 billion users • Snowden was using PGP to communicate with Laura Poitras and The Guardian
  • 16. Thank you for your time • Questions, comments? • Contact me – thomas@seropian.io – PGP Key : 0xfc944ab6 • Slides – http://seropian.io/assets/files/e2ee.pdf
  • 17. Further reading • Security In A Box • EFF’s Security Self Defense • Digital First Aid Kit • CPJ’s Journalist Security Guide

Editor's Notes

  1. Let me explain to you how E2EE is working, and why it does matter. I will take email communications as example but the concept is the same wether we talk about encryption on mobile phone apps (such as Whatsapp) and servers communications.
  2. First a reminder on how emails are working. Your inbox is hosted on a server (could be Gmail, you corporate infrastructure of your own server) These servers are communicating with each other (using standards protocols – you might have heard of SMTP). Your emails are processed by all sort of algorithms and you are connecting to them using your local ISP, your corporate network or the local coffee shop.
  3. Here is a visual illustration. You are sending a message to your receipient, connecting to Gmail using your wifi and local ISP. Your recipient connects to his mailbox from his end using the same way.
  4. At this stage, it is also important to remind you that Internet is not a safe place. Internet as we know it relies on protocols which were designed in the 70s by a bunch of scientists and military who were expected maximum 1000 people to use it. They had no idea about adding security by default. 40 years later, 3 billions people are using the same protocols. Imagine a hundred people crashing a house party with no locks on the door. You may want to be careful  Let’s have a look more specifically at emails communications
  5. Imagine you are receiving a postcard from a friend. What security threats can we think of? How can you make sure your mailman does not read your postcard? How can you make sure the truck driver does not open the mailbag? How can your make sure your neighbours/someone else, don’t pick the lock to get access to your private post box? How can you guarantee the sender is who they claim to be? These real life situation can be found very similar equivalent online.
  6. Sending emails is like sending postcards.
  7. Let’s go back to our illustration As you can see threats can come at any point of the email chain. A the server level and any node of the transport chain. Using no protection, anyone snooping on your Wi-Fi or at your ISP level can read your emails at anytime. Who can see it??? Network administrator on the local Wi-Fi System administrator / Government at ISP level System administrator / Hacker at the Email server level
  8. Since the late 90s, additional protocols have been put in place to help safe guard the Internet. TLS for transport layer security (formerly known as SSL) ensure encryption between 2 points of the network, in our case the user and their email inbox. Basically truck drivers are not able to open mails while transporting big bags but your providers still can. For example Gmail and Facebook provide full HTTPS but can still read your messages. Here is another illustration, green arrows are popping out.
  9. So here is another illustration. With TLS all the communications betweem user and email servers are secure. However anyone who gains access to the sender or the recipient inbox can read their emails.
  10. E2EE brings an additional layer of encryption. E2EE is equivalent of putting your message in a locked safe and sending the safe by email. This safe can olny be open by keys that only you and your recipient own. Anyone else won’t be able to open it. For example only you and your recipient can read encrypted emails, Gmail cannot..
  11. Any user who want to send encrypted messages has 2 keys. A public one and a private one. Alice wants to send an encrypted message to Bob. Alice asks Bob’s public key. Alice uses her private key and Bob’s public key to close the lock. Bob uses his private key to open it. Anyone else without Bob’s private key cannot read it.
  12. Now it is all green everywhere.
  13. And here is an example of an encrypted email.
  14. If you are using whatsapp you may have noticed that they deployed E2EE for their application. Also, if you followed NSA snowden leaks news a couple of years ago, you may have heard that he was using the exact same type of encryption.
  15. Thank you for your time. My practical exercise will consist of creating each of us a pair of key and send encrypted messages. Let me know if you have any question. B