Explore CONIKS, an innovative end-user key verification service designed for integration into end-to-end encrypted communication systems, presented at USENIX Security '15. Learn how this system addresses key challenges in user key verification, eliminating the need for global third-party monitors and enabling efficient self-monitoring of key bindings. Discover how CONIKS allows users and providers to collectively audit for non-equivocation while maintaining privacy by concealing usernames and total user counts. Delve into the technical aspects of CONIKS, including its approach to trust establishment, consistency verification, and efficient checks through "summaries." Understand the main security properties, privacy challenges, and performance metrics that make CONIKS a practical solution for bringing key transparency to end users in encrypted communication systems.
Overview
Syllabus
Intro
E2E Encrypted Communication Today
Unsolved: How do users establish trust?
Out-of-Band Trust Est. = Unintuitive
Trust Est. by the Provider - Better?
Malicious Provider can Equivocate
Pros/Cons of Existing Trust Establishment
Ideal Trust Establishment Properties
Existing Approach: Verifying Correctness
Our Approach: Verifying Consistency
Solution: CONIKS
CONIKS - Registering a Key
CONIKS-Learning a User's Key
Strawman Consistency Checks: Verify All Bindings
CONIKS: Efficient Checks thru "Summaries"
CONIKS - Main Security Properties
1. Expected Bindings incl. in STR - Auth Paths
1. Checking Inclusion - Verify Auth Path
2. Non-Equivocation - STR History
2. Non-Equivocation - Clients see same STRS
2. Checking Non-Equivocation - Cross-Verification
Privacy Challenges in CONIKS
Main Performance Questions
CONIKS' Performance is Practical!
Conclusion
Taught by
USENIX
