4 ms·
Video summary: - Lavabit + Silent Circle are starting a non-profit called the Dark Mail Alliance. - Planning to release an open source protocol for end-to-end
by shazow 13y ago
Video summary:
- Lavabit + Silent Circle are starting a non-profit called the Dark Mail Alliance.
- Planning to release an open source protocol for end-to-end encrypted email, along with some open source implementations. Expecting feedback from the community to drive the direction.
- Sketch of the protocol: Mail body/details is saved encrypted on some server somewhere. Encrypted XMPP message containing URI describing where to retrieve the message is sent to the recipients. Recipient clients figure out how to fetch it and decrypt it.
- The protocol is based heavily on Silent Circle's protocol. Functional proof of concept already exists.
- There will be several modes of security, default being the most secure, but allowing the user to explicitly scale down on a case-by-case basis (e.g. to abide by regulations and corporate policies).
- Sounds like it's backwards-compatible with SMTP, perhaps through gateways. It'll be explicitly marked as insecure.
- Ladar's goal is to transition Lavabit from a services company into a software company, using the free/open source business model and offer support services around it.
- The protocol will be using "new elliptic curve cryptography we [Silent Circle] developed." They're expecting the encryption methods will change over time.
- skolor 13y agoI seem to remember quite a bit of hubbub recently about how meta-data related to communication could be useful, even if you couldn't get the content of the communication. Now I see a proposal for a "Secure email", which involves giving an additional third party access to that meta-data.
- GhotiFish 13y agoThank you for the summary! >"new elliptic curve cryptography we [Silent Circle] developed." ??? is... this a good idea? I would of thought libraries for this technique abound.
- bigiain 13y agoFWIW, I suspect Phil Zimmermann from Silent Circle is one of the very few people in the world for whom that reservation probably isn't automatically correct… http://en.wikipedia.org/wiki/Phil_Zimmermann http://en.wikipedia.org/wiki/Phil_Zimmermann For the rest of us - HELL YEAH! Do not develop your own crypto!
- devx 13y agoStrange that they say "we", because in the previous interview, they said Dan Bernstein helped them to create some new 205-bit curve or something. Previously they were using the NIST curves in the SCIMP protocol. They should probably just use Curve25519, unless they think that's too overkill.
- pit 13y agoI don't know too much about cryptography, but for an asynchronous communication method like email, is there such a thing as encryption overkill? For example, does it matter whether the message takes two seconds or five seconds to decrypt/encrypt (particularly if that encryption/decryption happens in the background of your mail app)? Are there other issues as you increase the number of bits on the curve?
- indeyets 13y agoIt's still not clear if the protocol will support decentralization (private servers)
- indeyets 13y agook. I listened video and looks like it will be decentralized and it might work. we still need till they come out with protocol spec, but such thing _can_ be implemented.