1
00:00:00,090 --> 00:00:02,730
- Our next speaker up is Yolan

2
00:00:02,730 --> 00:00:04,980
and he actually told me
not to say his last name,

3
00:00:04,980 --> 00:00:07,260
'cause I would fuck it up, so...

4
00:00:07,260 --> 00:00:08,220
But he's gonna talk about

5
00:00:08,220 --> 00:00:11,280
some pretty cool future crypto stuff.

6
00:00:11,280 --> 00:00:14,329
So give him a round of applause.

7
00:00:14,329 --> 00:00:17,496
(audience applauding)

8
00:00:21,150 --> 00:00:23,164
- Hey, hello everybody.

9
00:00:23,164 --> 00:00:25,470
So yeah, I'm Yolan Romailler.

10
00:00:25,470 --> 00:00:27,689
I'm super happy to be here today

11
00:00:27,689 --> 00:00:32,689
to be talking about a dead
man's full-yet-responsible

12
00:00:32,850 --> 00:00:34,380
disclosure system,

13
00:00:34,380 --> 00:00:35,340
which is basically,

14
00:00:35,340 --> 00:00:39,000
or to do cool shit when
you're able to encrypt

15
00:00:39,000 --> 00:00:40,320
towards the future.

16
00:00:40,320 --> 00:00:43,320
And so I'm Yolan,

17
00:00:43,320 --> 00:00:45,420
so I'm from Switzerland,

18
00:00:45,420 --> 00:00:47,340
which is not the same as Sweden.

19
00:00:47,340 --> 00:00:49,710
So we got chocolate and cheese fungi

20
00:00:49,710 --> 00:00:53,820
and they get Ikea and
even more snow than we do.

21
00:00:53,820 --> 00:00:56,483
I'm an applied cryptographer
at Protocol Labs

22
00:00:56,483 --> 00:00:59,460
and the distributed randomness team,

23
00:00:59,460 --> 00:01:00,960
but don't worry too much.

24
00:01:00,960 --> 00:01:03,298
It won't be about math and crypto

25
00:01:03,298 --> 00:01:06,780
as in cryptography too much today.

26
00:01:06,780 --> 00:01:11,780
Some of it not too much
and yeah, let's get going.

27
00:01:12,780 --> 00:01:17,780
So I'll first do some
intro to explain to you

28
00:01:18,197 --> 00:01:19,030
what you need to know

29
00:01:19,030 --> 00:01:22,020
to really understand
what's going on later on.

30
00:01:22,020 --> 00:01:25,950
Then I'll be talking about full disclosure

31
00:01:25,950 --> 00:01:28,173
versus responsible disclosure,

32
00:01:30,000 --> 00:01:33,483
which is quite an
interesting topic in InfoSec.

33
00:01:34,620 --> 00:01:39,540
Next, we'll see, what
is time-lock encryption?

34
00:01:39,540 --> 00:01:40,830
What it means?

35
00:01:40,830 --> 00:01:41,730
It basically means

36
00:01:41,730 --> 00:01:43,890
we can encrypt something
towards the future,

37
00:01:43,890 --> 00:01:45,660
but we'll see what it actually means

38
00:01:45,660 --> 00:01:49,500
and what it enables you
to do when you have it.

39
00:01:49,500 --> 00:01:51,797
And then we'll see how to use it.

40
00:01:51,797 --> 00:01:53,470
I have a small demo

41
00:01:54,390 --> 00:01:56,610
and I'm pretty happy I'll be releasing,

42
00:01:56,610 --> 00:01:58,350
three different tools today.

43
00:01:58,350 --> 00:01:59,913
So that's pretty nice.

44
00:02:01,350 --> 00:02:02,790
And then we'll talk about

45
00:02:02,790 --> 00:02:05,883
what can go wrong when we're
talking about the future.

46
00:02:07,950 --> 00:02:12,950
So without further ado, let
me start with the preliminary,

47
00:02:13,053 --> 00:02:14,760
with a digression.

48
00:02:14,760 --> 00:02:15,813
I like these.

49
00:02:16,740 --> 00:02:18,120
I'm not going to do too many of these

50
00:02:18,120 --> 00:02:21,573
but so, do what randomness is?

51
00:02:23,730 --> 00:02:24,960
According to the dictionary,

52
00:02:24,960 --> 00:02:29,960
randomness is simply the
quality of being random.

53
00:02:30,900 --> 00:02:34,800
Great, not super useful though.

54
00:02:34,800 --> 00:02:36,510
I prefer to see randomness

55
00:02:36,510 --> 00:02:40,350
as being the quality
of being unpredictable

56
00:02:40,350 --> 00:02:42,480
or lacking any pattern.

57
00:02:42,480 --> 00:02:45,930
And that's a more useful thing to have

58
00:02:45,930 --> 00:02:49,440
when we do cryptography and
computer sciences in general.

59
00:02:49,440 --> 00:02:53,670
And so everybody usually
has some kind of intuition

60
00:02:53,670 --> 00:02:56,130
of what does random mean

61
00:02:56,130 --> 00:02:59,610
and what is random or what isn't.

62
00:02:59,610 --> 00:03:04,610
If I were to show you a binary
string of 32 characters,

63
00:03:05,370 --> 00:03:08,640
which was only ones and I told you

64
00:03:08,640 --> 00:03:12,600
this binary string was picked at random,

65
00:03:12,600 --> 00:03:14,940
I'm not sure you'd be
super convinced, right?

66
00:03:14,940 --> 00:03:16,830
Because it doesn't look random.

67
00:03:16,830 --> 00:03:20,670
Even though all binary
strings have exactly the same

68
00:03:20,670 --> 00:03:22,500
probability of being drawn at random.

69
00:03:22,500 --> 00:03:24,000
And it could actually happen.

70
00:03:24,000 --> 00:03:26,850
I tried a few days ago on my computer,

71
00:03:26,850 --> 00:03:30,540
took 15 minutes until
it was drawn at random

72
00:03:30,540 --> 00:03:33,420
when drawing random numbers constantly.

73
00:03:33,420 --> 00:03:37,290
So it can happen to have 32 character,

74
00:03:37,290 --> 00:03:40,263
all ones string when you
draw stuff at random.

75
00:03:41,400 --> 00:03:45,930
But anyway, so randomness is usually orb.

76
00:03:45,930 --> 00:03:48,480
That's something you will
hear a cryptographic say

77
00:03:48,480 --> 00:03:49,473
quite often.

78
00:03:50,340 --> 00:03:53,460
Because actually a lot of
the cryptographic schemes

79
00:03:53,460 --> 00:03:56,440
we're using nowadays
to set the web such as

80
00:03:59,040 --> 00:04:03,150
ECDSA or EdDSA and a lot of
signature schemes actually,

81
00:04:03,150 --> 00:04:06,270
but also the Diffie-Hellman
and key agreement and so on,

82
00:04:06,270 --> 00:04:08,720
are vulnerable when you have a bias

83
00:04:08,720 --> 00:04:10,590
in the randomness you're using

84
00:04:10,590 --> 00:04:13,260
and that bias can be very tiny.

85
00:04:13,260 --> 00:04:17,010
A one bit bias in a signature scheme

86
00:04:17,010 --> 00:04:20,340
can allow you a full
private key extraction,

87
00:04:20,340 --> 00:04:21,210
which is basically

88
00:04:21,210 --> 00:04:24,450
the one thing that could
happen to any crypto system.

89
00:04:24,450 --> 00:04:27,660
And so randomness is hard in general

90
00:04:27,660 --> 00:04:29,340
and to make it even harder

91
00:04:29,340 --> 00:04:30,960
when we're talking about computers,

92
00:04:30,960 --> 00:04:33,720
we're are not actually
using true randomness,

93
00:04:33,720 --> 00:04:38,100
because there is facial
as true random generators

94
00:04:38,100 --> 00:04:42,330
pulling data from actually chaotic evens,

95
00:04:42,330 --> 00:04:47,330
such as bubbles in the water
or atmospheric stuff and so on.

96
00:04:48,600 --> 00:04:51,120
But it's not what we're
usually using in a computer.

97
00:04:51,120 --> 00:04:54,300
What we use usually is a
pseudo random generator,

98
00:04:54,300 --> 00:04:56,430
which is pulling some entropy

99
00:04:56,430 --> 00:04:58,770
from whatever you've
typed on your keyboard

100
00:04:58,770 --> 00:05:00,990
from the Jitter of the network,

101
00:05:00,990 --> 00:05:03,540
but that's not necessarily super random

102
00:05:03,540 --> 00:05:06,183
and could be somehow somewhat predictable.

103
00:05:07,350 --> 00:05:11,700
And one important thing about
randomness in my opinion,

104
00:05:11,700 --> 00:05:15,840
is to recall that different
kinds of randomness.

105
00:05:15,840 --> 00:05:19,770
And so to understand what
distributed randomness means,

106
00:05:19,770 --> 00:05:23,130
because I told you I was under
distributed randomness team.

107
00:05:23,130 --> 00:05:26,940
So you must have figured my
time-lock encryption scheme

108
00:05:26,940 --> 00:05:28,840
somehow has something to do with that.

109
00:05:29,760 --> 00:05:30,690
I need to explain to you

110
00:05:30,690 --> 00:05:33,703
what are different kind of randomness.

111
00:05:33,703 --> 00:05:36,990
And the first two flavors of randomness

112
00:05:36,990 --> 00:05:39,780
we see the most often are actually public

113
00:05:39,780 --> 00:05:41,850
and secret randomness.

114
00:05:41,850 --> 00:05:46,260
Public randomness is
whenever you play the lottery

115
00:05:46,260 --> 00:05:48,750
and you see people drawing numbers

116
00:05:48,750 --> 00:05:50,643
at random on the TV.

117
00:05:51,930 --> 00:05:56,930
They are drawing random number
that is meant to be public.

118
00:05:56,970 --> 00:05:59,370
And that really just what it means

119
00:05:59,370 --> 00:06:01,140
to draw public randomness.

120
00:06:01,140 --> 00:06:04,320
It's a random number that
is meant to be public,

121
00:06:04,320 --> 00:06:06,060
secret randomness on the other hand

122
00:06:06,060 --> 00:06:08,610
is something that is meant to stay secret.

123
00:06:08,610 --> 00:06:11,910
So for example, when
you generate a PGP key,

124
00:06:11,910 --> 00:06:16,910
you are using a secret
randomness to create your key.

125
00:06:17,250 --> 00:06:19,890
Most of the time when
you connect to a website,

126
00:06:19,890 --> 00:06:21,981
you'll be connecting with TLS.

127
00:06:21,981 --> 00:06:25,680
And actually TLS is creating
ephemeral secret keys

128
00:06:25,680 --> 00:06:28,350
and generating nonces,

129
00:06:28,350 --> 00:06:31,008
number meant to be used only once

130
00:06:31,008 --> 00:06:34,320
and the Ivs, initialization
vectors, and so on.

131
00:06:34,320 --> 00:06:38,850
All of these are secrets and
they are meant to stay secret,

132
00:06:38,850 --> 00:06:42,060
but they're also often random.

133
00:06:42,060 --> 00:06:44,544
And so whenever you have a random nonce,

134
00:06:44,544 --> 00:06:45,990
it's meant to stay secret

135
00:06:45,990 --> 00:06:48,573
and that's a secret randomness, basically.

136
00:06:49,440 --> 00:06:53,733
So public randomness is nice,

137
00:06:54,600 --> 00:06:59,100
you can roll random number
and show it to everybody.

138
00:06:59,100 --> 00:07:01,864
But if I were to run a lottery now today,

139
00:07:01,864 --> 00:07:04,050
I was selling you tickets

140
00:07:04,050 --> 00:07:07,230
and then my tower Patrick was in the room

141
00:07:07,230 --> 00:07:09,210
or to win the lottery

142
00:07:09,210 --> 00:07:12,840
when I draw the random number at random,

143
00:07:12,840 --> 00:07:15,840
I think you would be
somewhat skeptical, right?

144
00:07:15,840 --> 00:07:17,910
You'd be like, "Oh, you cheated."

145
00:07:17,910 --> 00:07:19,740
And so there is a really nice notion

146
00:07:19,740 --> 00:07:21,840
of verifiable randomness.

147
00:07:21,840 --> 00:07:23,130
That basically means

148
00:07:23,130 --> 00:07:27,180
you are able to verify the
randomness was drawn properly

149
00:07:27,180 --> 00:07:29,070
and is properly random.

150
00:07:29,070 --> 00:07:31,200
And that's really useful.

151
00:07:31,200 --> 00:07:33,720
For example, if you
want to be off the hook.

152
00:07:33,720 --> 00:07:35,820
So it's actually possible

153
00:07:35,820 --> 00:07:40,820
my friend Patrick won the
luxury today, drawn at random

154
00:07:41,580 --> 00:07:44,760
because there are not too
many people in the room.

155
00:07:44,760 --> 00:07:47,190
And if I used verifiable randomness,

156
00:07:47,190 --> 00:07:48,940
you could verify I was
not cheating actually.

157
00:07:48,940 --> 00:07:50,580
And I'd be of the hook.

158
00:07:50,580 --> 00:07:52,250
So verifiable randomness

159
00:07:52,250 --> 00:07:55,230
is a very useful thing to have in general,

160
00:07:55,230 --> 00:07:57,453
when we're dealing with public randomness.

161
00:07:58,950 --> 00:08:02,193
Next, we have the notion
of distributed randomness.

162
00:08:04,410 --> 00:08:08,130
It's a difficult thing
to achieve consensus

163
00:08:08,130 --> 00:08:10,407
when you have a large system, right?

164
00:08:10,407 --> 00:08:13,320
And there are different
ways of achieving consensus,

165
00:08:13,320 --> 00:08:16,680
but it's even more difficult
if you want to draw

166
00:08:16,680 --> 00:08:19,170
a random number and
achieve chief of consensus

167
00:08:19,170 --> 00:08:23,550
among different nodes on
a given random numbers,

168
00:08:23,550 --> 00:08:24,720
without any nodes,

169
00:08:24,720 --> 00:08:28,440
being able to predict it or buy assets

170
00:08:28,440 --> 00:08:31,080
and distributed randomness

171
00:08:31,080 --> 00:08:33,558
has a few different kind of solutions.

172
00:08:33,558 --> 00:08:38,558
Actually my team is behind one of them,

173
00:08:39,600 --> 00:08:41,126
which is called drand.

174
00:08:41,126 --> 00:08:44,460
And drand is meant to be a
public randomness service

175
00:08:44,460 --> 00:08:45,540
that anybody could use.

176
00:08:45,540 --> 00:08:47,910
Just like you use NTP servers

177
00:08:47,910 --> 00:08:50,550
to sync the time on your computers,

178
00:08:50,550 --> 00:08:54,960
or just like you use
free public DNS servers

179
00:08:54,960 --> 00:08:56,935
to resolve domain names.

180
00:08:56,935 --> 00:09:00,570
So we thought the internet really needed

181
00:09:00,570 --> 00:09:05,280
a public verifiable,
distributed, randomness service.

182
00:09:05,280 --> 00:09:08,550
And that's what we tried
to create and to launch.

183
00:09:08,550 --> 00:09:13,230
So drand is basically just
software it's opensource.

184
00:09:13,230 --> 00:09:14,460
You can check it out

185
00:09:14,460 --> 00:09:18,630
and it's using pretty cool
threshold cryptography

186
00:09:18,630 --> 00:09:20,370
based on pairings,

187
00:09:20,370 --> 00:09:23,310
specifically the BLS signature scheme

188
00:09:23,310 --> 00:09:26,730
to generate randomness in
a way that's verifiable.

189
00:09:26,730 --> 00:09:30,660
And drand has actually
been deployed in practice

190
00:09:30,660 --> 00:09:32,520
by the League of Entropy,

191
00:09:32,520 --> 00:09:37,520
which is a team of 16 different
parties and organizations

192
00:09:37,800 --> 00:09:39,957
running 23 nodes.

193
00:09:39,957 --> 00:09:41,510
And the cool thing about drand

194
00:09:41,510 --> 00:09:44,220
is it's using threshold cryptography.

195
00:09:44,220 --> 00:09:47,610
So you don't need to trust
any of these parties,

196
00:09:47,610 --> 00:09:51,360
as long as you trust that there
is never a threshold number

197
00:09:51,360 --> 00:09:54,150
of malicious nodes in the network.

198
00:09:54,150 --> 00:09:57,270
And so, here I can see there
is CloudFlare Protocol Lab,

199
00:09:57,270 --> 00:10:01,140
but also universities, security companies,

200
00:10:01,140 --> 00:10:05,160
Kudelski Security, and a
lot of different parties

201
00:10:05,160 --> 00:10:07,950
that are not likely to collude.

202
00:10:07,950 --> 00:10:11,640
And so the threshold being currently 13,

203
00:10:11,640 --> 00:10:16,380
it means you can have a fairly
good trust in the network,

204
00:10:16,380 --> 00:10:20,197
not to collude and do nasty things.

205
00:10:20,197 --> 00:10:22,810
Drand has been running for two years

206
00:10:23,910 --> 00:10:25,080
by the League of Entropy

207
00:10:25,080 --> 00:10:28,650
and it's really solid
and yeah, so far so good.

208
00:10:28,650 --> 00:10:31,260
So now that we know what
distributed randomness is

209
00:10:31,260 --> 00:10:33,870
and that there is a service out there,

210
00:10:33,870 --> 00:10:36,450
providing it for anybody to use,

211
00:10:36,450 --> 00:10:41,040
we can dig into the title
of my talk, I guess.

212
00:10:41,040 --> 00:10:46,040
So you all know about full
disclosure and disclosure,

213
00:10:46,710 --> 00:10:47,543
I guess,

214
00:10:47,543 --> 00:10:49,050
but I'm still going to walk through

215
00:10:49,050 --> 00:10:52,773
the different kinds of
disclosures there are out there.

216
00:10:53,966 --> 00:10:56,310
So disclosure is basically what you do

217
00:10:56,310 --> 00:10:58,494
when you find some
vulnerability in a software

218
00:10:58,494 --> 00:11:01,290
or in a project or in a service.

219
00:11:01,290 --> 00:11:04,620
And you want to disclose
it either to the vendors,

220
00:11:04,620 --> 00:11:08,610
the creator, or the coders,
or to the public whatsoever.

221
00:11:08,610 --> 00:11:10,650
And according to OWASP,

222
00:11:10,650 --> 00:11:13,350
Open Web Application Security Project,

223
00:11:13,350 --> 00:11:18,350
there are actually three
different types of disclosures,

224
00:11:18,510 --> 00:11:19,883
but I think are they're wrong.

225
00:11:19,883 --> 00:11:21,600
There is a fourth one,

226
00:11:21,600 --> 00:11:24,870
the non-disclosure where
you just find something cool

227
00:11:24,870 --> 00:11:28,915
and decide to use it for fun
and profit or whatsoever.

228
00:11:28,915 --> 00:11:31,320
Sure, that's the way to do things.

229
00:11:31,320 --> 00:11:35,950
The other types of disclosure
or the full disclosure,

230
00:11:35,950 --> 00:11:37,500
where you find something cool

231
00:11:37,500 --> 00:11:38,640
and you're like, "Hey, listen,

232
00:11:38,640 --> 00:11:40,710
I found something cool,
here is a zero day.

233
00:11:40,710 --> 00:11:43,050
Anybody can use it and here
is the proof of concept too,

234
00:11:43,050 --> 00:11:44,040
because I'm nice."

235
00:11:44,040 --> 00:11:47,040
So you can really weaponize it directly,

236
00:11:47,040 --> 00:11:48,720
that's a way of doing things.

237
00:11:48,720 --> 00:11:50,970
Please don't do it on Fridays.

238
00:11:50,970 --> 00:11:55,233
It's really mean for the
security teams, no, truly.

239
00:11:56,460 --> 00:11:58,560
Then there is the private disclosure.

240
00:11:58,560 --> 00:12:01,620
Nowadays we have a lot
of bug bounty programs,

241
00:12:01,620 --> 00:12:04,050
which give you a reward.

242
00:12:04,050 --> 00:12:07,440
If you find a vulnerability
in somebody's product,

243
00:12:07,440 --> 00:12:09,990
but often these bug bounty programs,

244
00:12:09,990 --> 00:12:14,990
they're forbidding you
to release your findings.

245
00:12:15,660 --> 00:12:17,213
If you want the reward

246
00:12:18,120 --> 00:12:21,076
which leads to a lot
of private disclosures.

247
00:12:21,076 --> 00:12:24,030
I'm not convinced because
I'm a cryptographer.

248
00:12:24,030 --> 00:12:27,870
So I don't believe security
through AB security

249
00:12:27,870 --> 00:12:29,280
is a good thing.

250
00:12:29,280 --> 00:12:32,460
And instead, what I would prefer to have

251
00:12:32,460 --> 00:12:35,190
is a responsible disclosure, for example,

252
00:12:35,190 --> 00:12:37,950
which is basically just

253
00:12:37,950 --> 00:12:40,920
when you do private disclosure first,

254
00:12:40,920 --> 00:12:44,763
and then you say, "Hey, listen, in 30, 60,

255
00:12:46,110 --> 00:12:47,430
90 days, six months,

256
00:12:47,430 --> 00:12:50,460
I'll be releasing my findings
for everybody to look.

257
00:12:50,460 --> 00:12:52,080
So you have some time to patch,

258
00:12:52,080 --> 00:12:56,010
but a I'm still going to
release it, do a blog post,

259
00:12:56,010 --> 00:12:58,837
I don't know, go to Devcon
to present it and so on.

260
00:13:00,000 --> 00:13:04,740
And so coordinated disclosure
are actually quite used

261
00:13:04,740 --> 00:13:05,640
in the industry.

262
00:13:05,640 --> 00:13:07,083
If you look around, you
can see, for example,

263
00:13:07,083 --> 00:13:09,120
Google Project Zero,

264
00:13:09,120 --> 00:13:13,020
which is doing a lot of
vulnerability research

265
00:13:13,020 --> 00:13:15,150
and you're finding a
lot of vulnerabilities.

266
00:13:15,150 --> 00:13:19,831
And they're also always
using a hard deadline policy

267
00:13:19,831 --> 00:13:23,430
with their disclosures,
which is basically that

268
00:13:23,430 --> 00:13:27,960
you have 90 days to patch your product.

269
00:13:27,960 --> 00:13:30,300
And if you do, they will
give you an extra 30 days

270
00:13:30,300 --> 00:13:32,970
in order to be able to prep your blog post

271
00:13:32,970 --> 00:13:35,010
or your communication whatsoever.

272
00:13:35,010 --> 00:13:37,290
But if you don't patch within 90 days,

273
00:13:37,290 --> 00:13:41,970
they will release it publicly
for anybody to be aware,

274
00:13:41,970 --> 00:13:45,150
to help people protect
themselves, basically.

275
00:13:45,150 --> 00:13:48,000
And that's actually
quite effective according

276
00:13:48,000 --> 00:13:49,650
to their own metrics.

277
00:13:49,650 --> 00:13:52,144
There are only 3% of their disclosures

278
00:13:52,144 --> 00:13:57,144
that are not patched within
90 days, which is great.

279
00:13:57,450 --> 00:14:00,668
So it means most people,
most vendors out there

280
00:14:00,668 --> 00:14:04,410
are actually using their
time to patch effectively

281
00:14:04,410 --> 00:14:07,353
to patch their software.

282
00:14:08,250 --> 00:14:10,950
3% of them though are not.

283
00:14:10,950 --> 00:14:14,379
So I don't know what they do.

284
00:14:14,379 --> 00:14:18,630
Maybe they're just ignoring
the vulnerabilities whatsoever,

285
00:14:18,630 --> 00:14:20,613
but yeah, they don't patch.

286
00:14:22,050 --> 00:14:24,630
So let's recap,

287
00:14:24,630 --> 00:14:28,470
a coordinated disclosure or
responsible disclosure timeline

288
00:14:28,470 --> 00:14:30,150
basically looks like that.

289
00:14:30,150 --> 00:14:34,983
So let's say you are finding
something on January 1st,

290
00:14:35,940 --> 00:14:38,340
you take a few days, you write a report,

291
00:14:38,340 --> 00:14:41,190
you create a proof of concept whatsoever.

292
00:14:41,190 --> 00:14:42,180
Let's say, mid-January,

293
00:14:42,180 --> 00:14:46,607
you are disclosing it privately
to the affected vendor.

294
00:14:48,600 --> 00:14:51,900
Then they come back to you early February

295
00:14:51,900 --> 00:14:55,440
because the people responsible
for it were on vacation

296
00:14:55,440 --> 00:14:57,210
or they were slow at readings

297
00:14:57,210 --> 00:15:00,090
or security at mailing list whatsoever.

298
00:15:00,090 --> 00:15:01,297
And they come back to
you and they're like,

299
00:15:01,297 --> 00:15:03,660
"Oh yeah, you're right,
it's a vulnerability,

300
00:15:03,660 --> 00:15:06,030
so thank you we will patch."

301
00:15:06,030 --> 00:15:07,807
And then you could talk
to them and be like,

302
00:15:07,807 --> 00:15:11,026
"Hey, I would like to go
to death and present it.

303
00:15:11,026 --> 00:15:15,660
So all about doing a responsible
disclosure and so on."

304
00:15:15,660 --> 00:15:20,462
And you can agree on a given
release date in the future,

305
00:15:20,462 --> 00:15:23,151
maybe on May the fourth,

306
00:15:23,151 --> 00:15:24,007
you could say,

307
00:15:24,007 --> 00:15:25,500
"Hey, I'm going to release everything

308
00:15:25,500 --> 00:15:28,110
on my blog on May the fourth."

309
00:15:28,110 --> 00:15:30,870
And if they're worn, they can touch.

310
00:15:30,870 --> 00:15:34,830
And they have some time
to patch, which is nice.

311
00:15:34,830 --> 00:15:38,553
And then on May the fourth you
can release it, whatsoever.

312
00:15:39,540 --> 00:15:42,813
However, there is a small issue with that.

313
00:15:43,740 --> 00:15:48,030
I don't know if your familiar
with the notion of bus factor.

314
00:15:48,030 --> 00:15:50,040
The bus factor of a project

315
00:15:50,040 --> 00:15:52,050
is basically the number of people

316
00:15:52,050 --> 00:15:55,020
that need to be crushed by a bus

317
00:15:55,020 --> 00:15:59,553
before the project is critically impacted.

318
00:16:00,570 --> 00:16:02,940
And with a responsible disclosure,

319
00:16:02,940 --> 00:16:06,690
it's very likely you just
disclose it to the vendor

320
00:16:06,690 --> 00:16:08,460
and then you keep it to yourself

321
00:16:08,460 --> 00:16:11,816
until the agreed that panel date.

322
00:16:11,816 --> 00:16:15,693
So here, during that time to patch.

323
00:16:16,680 --> 00:16:19,560
You are actually having
a very low bus factor,

324
00:16:19,560 --> 00:16:22,950
maybe even a bus factor of one.

325
00:16:22,950 --> 00:16:25,672
And so it could be the case

326
00:16:25,672 --> 00:16:30,672
that some vendors in these three person,

327
00:16:30,720 --> 00:16:34,440
which are not patching
within the time to patch

328
00:16:34,440 --> 00:16:37,080
or actually more
malicious than we thought.

329
00:16:37,080 --> 00:16:41,640
And instead of shooting
the node at Devcon,

330
00:16:41,640 --> 00:16:46,640
they could try to actually shoot the node.

331
00:16:48,095 --> 00:16:52,170
And that's a bit annoying
because if you are careful,

332
00:16:52,170 --> 00:16:55,020
or if you wanted to prove
you found something cool,

333
00:16:55,020 --> 00:16:59,790
maybe you've published and
Twitter, a hash of your findings.

334
00:16:59,790 --> 00:17:04,790
So you publish the SHA 256 sum
of your findings on Twitter.

335
00:17:07,650 --> 00:17:09,180
And then at a later date,

336
00:17:09,180 --> 00:17:11,970
you'll release the paste bin with the text

337
00:17:11,970 --> 00:17:14,250
and anybody can verify it's the same hash.

338
00:17:14,250 --> 00:17:15,900
So anybody can check.

339
00:17:15,900 --> 00:17:18,963
You were actually the one
to have found the issue,

340
00:17:20,580 --> 00:17:22,260
on January 1st.

341
00:17:22,260 --> 00:17:24,990
Which is a nice way to do things,

342
00:17:24,990 --> 00:17:28,710
but which also mean you need
to be alive on May the fourth

343
00:17:28,710 --> 00:17:32,580
to be able to release the report, right?

344
00:17:32,580 --> 00:17:37,580
And that brings us to
the time to patch issue,

345
00:17:37,950 --> 00:17:38,821
which means somehow

346
00:17:38,821 --> 00:17:41,670
we might want to have some
kind of dead man switch

347
00:17:41,670 --> 00:17:43,860
so that if we're not there anymore,

348
00:17:43,860 --> 00:17:46,770
our findings would still be released.

349
00:17:46,770 --> 00:17:50,340
And that's a very good use
case for time-lock encryption.

350
00:17:50,340 --> 00:17:53,550
So what is time-lock encryption?

351
00:17:53,550 --> 00:17:55,380
Time-lock encryption is very simple.

352
00:17:55,380 --> 00:17:59,850
It's basically being able
to encrypt something today

353
00:17:59,850 --> 00:18:02,370
that cannot be decrypted
until a later date,

354
00:18:02,370 --> 00:18:05,373
maybe Christmas or maybe tomorrow.

355
00:18:06,600 --> 00:18:08,820
Then you can just release
it, decipher text,

356
00:18:08,820 --> 00:18:10,500
and anybody can try and decrypt it,

357
00:18:10,500 --> 00:18:11,700
it won't work.

358
00:18:11,700 --> 00:18:13,560
And tomorrow when they try again,

359
00:18:13,560 --> 00:18:15,750
it'll decrypt and it works.

360
00:18:15,750 --> 00:18:18,150
Seems a bit like magic, right?

361
00:18:18,150 --> 00:18:20,610
It's also sometimes called
time lapse encryption,

362
00:18:20,610 --> 00:18:23,610
or timed release encryption.

363
00:18:23,610 --> 00:18:25,989
These are all the same thing.

364
00:18:25,989 --> 00:18:28,380
And it has pretty cool applications.

365
00:18:28,380 --> 00:18:32,790
You could use it in auctions
to do seal bid auctions,

366
00:18:32,790 --> 00:18:35,310
for example, or you can use it also.

367
00:18:35,310 --> 00:18:36,810
I dunno if you're running a blockchain,

368
00:18:36,810 --> 00:18:39,960
but you could use it
to prevent math issues

369
00:18:39,960 --> 00:18:43,260
or you have miners trying
to grind the mining process

370
00:18:43,260 --> 00:18:45,420
to extract more value from the blocks

371
00:18:45,420 --> 00:18:47,970
that just transaction fees.

372
00:18:47,970 --> 00:18:52,505
You could use it for a cool
conditional transfer of wealth,

373
00:18:52,505 --> 00:18:56,920
which is basically you encrypt
your Bitcoin private key

374
00:18:58,200 --> 00:18:59,400
in two years.

375
00:18:59,400 --> 00:19:01,740
And if you die within the next two years,

376
00:19:01,740 --> 00:19:05,142
your children will be able
to get your private key

377
00:19:05,142 --> 00:19:06,630
in two years.

378
00:19:06,630 --> 00:19:07,620
And if you're still alive,

379
00:19:07,620 --> 00:19:12,240
you can just transfer your
Bitcoins to a new address

380
00:19:12,240 --> 00:19:14,673
and nobody can extract them anymore.

381
00:19:15,900 --> 00:19:18,540
You could also use it
for electronic voting,

382
00:19:18,540 --> 00:19:21,390
for example, if you need to write of more,

383
00:19:21,390 --> 00:19:24,960
interestingly also somewhat
related to electronic voting,

384
00:19:24,960 --> 00:19:27,660
you could use it to protect documents

385
00:19:27,660 --> 00:19:29,610
that have a known embargo your period,

386
00:19:29,610 --> 00:19:31,020
like legal documents

387
00:19:31,020 --> 00:19:33,750
that you must release
six months after the deed

388
00:19:33,750 --> 00:19:34,980
or something like that.

389
00:19:34,980 --> 00:19:37,530
It could be very useful to
do these kind of things.

390
00:19:38,580 --> 00:19:41,130
If you are attending Devcon,

391
00:19:41,130 --> 00:19:42,900
maybe you have either any ideas

392
00:19:42,900 --> 00:19:47,010
you could use it to do very
well behave drand somewhere,

393
00:19:47,010 --> 00:19:49,980
which instead of encrypting
your files forever

394
00:19:49,980 --> 00:19:52,920
would encrypt them for six months.

395
00:19:52,920 --> 00:19:55,770
If you're in a hurry and you
want them today or tomorrow,

396
00:19:55,770 --> 00:19:59,550
please pay otherwise you
just need to wait six months

397
00:19:59,550 --> 00:20:00,704
fine, right?

398
00:20:00,704 --> 00:20:04,530
I mean, I would love
more fair run somewhere.

399
00:20:04,530 --> 00:20:07,383
It's almost lapse because they do that.

400
00:20:08,520 --> 00:20:10,290
Also there is a cool paper

401
00:20:10,290 --> 00:20:11,910
that was released a few years back

402
00:20:11,910 --> 00:20:13,560
about using time-lock encryption

403
00:20:13,560 --> 00:20:17,310
to prevent emulation in antivirus.

404
00:20:17,310 --> 00:20:20,250
When an antivirus is trying
to emulate your binary

405
00:20:20,250 --> 00:20:22,770
to see if it's doing something fishy

406
00:20:22,770 --> 00:20:24,630
while you could use time-lock encryption

407
00:20:24,630 --> 00:20:29,190
so that the antivirus cannot
see what's going to happen

408
00:20:29,190 --> 00:20:30,900
when the payload get decrypted,

409
00:20:30,900 --> 00:20:33,750
because it's not the right time yet.

410
00:20:33,750 --> 00:20:35,493
These are all cool IDs.

411
00:20:36,630 --> 00:20:39,720
And actually time-lock
encryption is a pretty old ID.

412
00:20:39,720 --> 00:20:44,539
It was first proposed Tim May in 1993

413
00:20:44,539 --> 00:20:47,280
on the cipher punk mailing list.

414
00:20:47,280 --> 00:20:50,310
So for those a few who don't know Tim May

415
00:20:50,310 --> 00:20:52,260
is a pretty cool guy who actually

416
00:20:52,260 --> 00:20:55,800
was the father of the
crypto anarchist movement.

417
00:20:55,800 --> 00:20:57,153
So yeah, cool guy.

418
00:20:58,080 --> 00:21:01,740
Actually introduced the ID
along with a way of solving it,

419
00:21:01,740 --> 00:21:05,400
which was basically to give the
decryption keys to notarize,

420
00:21:05,400 --> 00:21:07,860
which is basically just trusting somebody

421
00:21:07,860 --> 00:21:11,910
with your decryption keys, not amazing.

422
00:21:11,910 --> 00:21:14,730
Three years later in 1996,

423
00:21:14,730 --> 00:21:18,600
Ron Rivest, Adi Shamir and David Wagner.

424
00:21:18,600 --> 00:21:22,020
So you might have heard
of the two first guys

425
00:21:22,020 --> 00:21:25,110
because they are behind the
RSA crypto system, I guess,

426
00:21:25,110 --> 00:21:29,730
as I proposed the proof
of work based system,

427
00:21:29,730 --> 00:21:31,830
which was called time-lock puzzles,

428
00:21:31,830 --> 00:21:33,450
where the idea is basically that

429
00:21:33,450 --> 00:21:37,740
if you can force somebody to
do a certain amount of work

430
00:21:37,740 --> 00:21:39,810
secretly under computer,

431
00:21:39,810 --> 00:21:41,970
you can make sure they
are not able to decrypt it

432
00:21:41,970 --> 00:21:45,150
before the right time has come, Right?

433
00:21:45,150 --> 00:21:46,890
And they also said in that paper,

434
00:21:46,890 --> 00:21:49,530
there are only two ways of
doing time-lock encryption,

435
00:21:49,530 --> 00:21:54,530
either using proof of work or
using trusted third parties.

436
00:21:56,130 --> 00:21:58,560
And actually I implemented it in practice

437
00:21:58,560 --> 00:22:03,510
and Ron and Rivest published
at time-lock capsule in 1999,

438
00:22:03,510 --> 00:22:06,640
which was meant to last for 35 years

439
00:22:08,160 --> 00:22:10,534
including the more low.

440
00:22:10,534 --> 00:22:11,580
So including the fact that

441
00:22:11,580 --> 00:22:13,740
computers would get faster and faster,

442
00:22:13,740 --> 00:22:16,680
it was pretty sure it was solid.

443
00:22:16,680 --> 00:22:21,210
And yeah, well, naturally,

444
00:22:21,210 --> 00:22:25,410
only 20 years later in 2019,

445
00:22:25,410 --> 00:22:29,400
the puzzle that was supposed
to take 35 years to solve

446
00:22:29,400 --> 00:22:32,223
was actually solved by
two different teams.

447
00:22:33,270 --> 00:22:35,310
One of them was actually one guy

448
00:22:35,310 --> 00:22:38,430
running the thing for
three and a half year

449
00:22:38,430 --> 00:22:41,283
on his Intel CPU.

450
00:22:42,330 --> 00:22:46,200
And even though it was
supposed to take 35 years,

451
00:22:46,200 --> 00:22:48,810
it took only a 10th of that

452
00:22:48,810 --> 00:22:52,770
because the computer were not that fast,

453
00:22:52,770 --> 00:22:56,820
not as fast as Rivest thought
they would be in 2034,

454
00:22:58,170 --> 00:23:01,359
but just the squaring process

455
00:23:01,359 --> 00:23:03,799
he was using to protect his puzzle

456
00:23:03,799 --> 00:23:07,380
was not as slow to do.

457
00:23:07,380 --> 00:23:10,350
Another thing which was
actually a collaboration

458
00:23:10,350 --> 00:23:13,830
of Ethereum Foundation,
supernational and Protocol Labs

459
00:23:13,830 --> 00:23:17,340
was able to do it in only
two months using FPGAs

460
00:23:17,340 --> 00:23:20,670
with a very low Latins doing square rings,

461
00:23:20,670 --> 00:23:22,800
which is way too fast.

462
00:23:22,800 --> 00:23:26,400
So it means using proof
of work is not amazing.

463
00:23:26,400 --> 00:23:28,320
And then there is a wall list of people

464
00:23:28,320 --> 00:23:32,010
who also did research the time-lock ID,

465
00:23:32,010 --> 00:23:35,040
and they came up with other ways to do it,

466
00:23:35,040 --> 00:23:37,784
like using Bitcoin proof of work,

467
00:23:37,784 --> 00:23:42,784
using fancy cryptography
based on obfuscation,

468
00:23:42,990 --> 00:23:45,210
using amorphic stuff.

469
00:23:45,210 --> 00:23:47,760
And all of these are really nice IDs,

470
00:23:47,760 --> 00:23:50,460
but they're not practical at all.

471
00:23:50,460 --> 00:23:52,650
So it means they are up to date,

472
00:23:52,650 --> 00:23:56,850
no practical way of doing
time-lock encryption

473
00:23:56,850 --> 00:23:58,470
beside proof of work.

474
00:23:58,470 --> 00:24:01,590
And I don't really like proof of work.

475
00:24:01,590 --> 00:24:03,210
I mean, it's burning the planet

476
00:24:03,210 --> 00:24:05,370
and it's not super nice.

477
00:24:05,370 --> 00:24:09,180
Also if you get faster out,
well, you could break it faster,

478
00:24:09,180 --> 00:24:11,310
naturally reliable.

479
00:24:11,310 --> 00:24:16,310
So that's what we were
able to actually solve.

480
00:24:17,160 --> 00:24:20,430
And so our goal here

481
00:24:20,430 --> 00:24:22,590
is to encrypt towards the future, right?

482
00:24:22,590 --> 00:24:24,030
So it would be really nice

483
00:24:24,030 --> 00:24:27,840
if we had the cryptographic
reference clutch ticking.

484
00:24:27,840 --> 00:24:30,570
I know every 30 seconds for example,

485
00:24:30,570 --> 00:24:31,477
and that you could say,

486
00:24:31,477 --> 00:24:34,773
"Okay, I'm going to encrypt
towards drand number.

487
00:24:36,206 --> 00:24:38,269
10,000 and you know drand number

488
00:24:38,269 --> 00:24:40,980
10,000 will be in two days for example.

489
00:24:40,980 --> 00:24:43,260
And that idea of a
cryptographic reference clock

490
00:24:43,260 --> 00:24:48,041
was actually already
introduced in a paper in 2017.

491
00:24:48,041 --> 00:24:51,660
And that's a pretty nice thing,

492
00:24:51,660 --> 00:24:55,800
but they never really created
a practical reference clock.

493
00:24:55,800 --> 00:24:58,410
And that's where drand comes in

494
00:24:58,410 --> 00:25:01,410
because drand is basically releasing

495
00:25:01,410 --> 00:25:03,437
random values every 30 seconds

496
00:25:03,437 --> 00:25:06,033
and it has been doing so for two years.

497
00:25:09,120 --> 00:25:10,290
I mean, if you trust,

498
00:25:10,290 --> 00:25:13,200
there is never a threshold
amount of malicious nodes

499
00:25:13,200 --> 00:25:14,033
in the network,

500
00:25:14,033 --> 00:25:17,730
you can trust, it will
be realizing randomness

501
00:25:17,730 --> 00:25:21,420
on time for the foreseeable future.

502
00:25:21,420 --> 00:25:26,220
And so what we can do now is
basically take the drand rounds

503
00:25:26,220 --> 00:25:30,330
and map them to a given
specific future time.

504
00:25:30,330 --> 00:25:35,330
And we can rely on the BLS
signatures of the drand beacons

505
00:25:35,400 --> 00:25:37,230
to do pretty cool things.

506
00:25:37,230 --> 00:25:41,310
And I told you earlier that
BLS was a pairing based

507
00:25:41,310 --> 00:25:42,930
signatures scheme.

508
00:25:42,930 --> 00:25:45,150
And pairing are really nice

509
00:25:45,150 --> 00:25:48,090
because there is also
the notion of identity

510
00:25:48,090 --> 00:25:51,810
based encryption that
is based on pairings.

511
00:25:51,810 --> 00:25:54,483
And with that, we can say,

512
00:25:54,483 --> 00:25:59,370
we want to encrypt something
towards a specific message.

513
00:25:59,370 --> 00:26:03,000
And whenever the signature
for that message is released,

514
00:26:03,000 --> 00:26:04,773
we will be able to decrypt it.

515
00:26:05,670 --> 00:26:08,850
And so that's a magic
of pairings, basically.

516
00:26:08,850 --> 00:26:12,330
So if you want the math here it is.

517
00:26:12,330 --> 00:26:16,320
So pairing is basically a
billionaire map from two groups,

518
00:26:16,320 --> 00:26:20,003
G1 one and G2, and to a target group GT.

519
00:26:20,003 --> 00:26:22,710
And I told you it's a billionaire.

520
00:26:22,710 --> 00:26:25,613
So it means that if you
take the pairing of G1

521
00:26:25,613 --> 00:26:27,983
the generator of the group G1,

522
00:26:27,983 --> 00:26:31,260
and the signature of P, a
signature of P is basically

523
00:26:31,260 --> 00:26:36,260
the secret timed message when
you are using BLS but on G2.

524
00:26:36,660 --> 00:26:39,259
If you take the pairing
of G1 the generator

525
00:26:39,259 --> 00:26:41,100
with the signature of P,

526
00:26:41,100 --> 00:26:43,020
you can actually say it,

527
00:26:43,020 --> 00:26:45,660
you know it's equal to the secret time,

528
00:26:45,660 --> 00:26:48,690
the pairing of G1 and the message.

529
00:26:48,690 --> 00:26:49,770
And that's really nice

530
00:26:49,770 --> 00:26:50,940
because anybody can compute

531
00:26:50,940 --> 00:26:53,910
the pairing of G1 on the message,

532
00:26:53,910 --> 00:26:58,080
but anybody can also compute
the pairing of the public key

533
00:26:58,080 --> 00:27:01,170
of the BLS scheme, which is PG.

534
00:27:01,170 --> 00:27:02,730
And the public key is basically

535
00:27:02,730 --> 00:27:07,380
the secret timed generator on G1 and oh...

536
00:27:12,870 --> 00:27:13,703
What happened?

537
00:27:26,400 --> 00:27:28,410
That's a bit annoying.

538
00:27:28,410 --> 00:27:30,663
It in the screens are frozen actually.

539
00:27:36,690 --> 00:27:38,823
Can I have the AV guy checking?

540
00:27:56,790 --> 00:27:57,690
So yeah,

541
00:27:57,690 --> 00:28:01,953
it seems it's completely not
displaying the right thing.

542
00:28:03,135 --> 00:28:06,270
- See it right there, it's not
updating on the big screens.

543
00:28:06,270 --> 00:28:08,793
- Yeah, the big screen
is not updating anymore.

544
00:28:15,150 --> 00:28:17,073
- So, I don't control the big screen?

545
00:28:18,231 --> 00:28:20,187
- It's whatever you're doing-

546
00:28:20,187 --> 00:28:21,213
- No, no, it's not.

547
00:28:24,840 --> 00:28:26,013
- If you look here-

548
00:28:27,902 --> 00:28:30,070
- You have to switch on here.

549
00:28:46,294 --> 00:28:48,294
- And the screen is not.

550
00:28:49,157 --> 00:28:51,393
So I think it's a backend issue.

551
00:28:54,480 --> 00:28:55,830
You can leave it like that.

552
00:28:57,930 --> 00:29:00,080
- Yeah, but I dunno
why it's not switching.

553
00:29:01,795 --> 00:29:04,610
- Reset the switch.

554
00:29:04,610 --> 00:29:06,460
- I'm not controlling the big screen?

555
00:29:07,410 --> 00:29:08,243
- No, you are.

556
00:29:13,680 --> 00:29:15,571
- Screen locked up.

557
00:29:15,571 --> 00:29:17,904
- Can you reboot the screen?

558
00:29:36,810 --> 00:29:38,480
So wait, what is it like?

559
00:29:41,280 --> 00:29:44,141
Okay, it seems to be back.

560
00:29:44,141 --> 00:29:47,460
So I'm not sure what you saw all the time,

561
00:29:47,460 --> 00:29:51,153
I mean, has it been
frozen for a long time?

562
00:29:53,400 --> 00:29:56,400
(keyboard clicking)

563
00:30:05,310 --> 00:30:07,810
- Okay, so you didn't see
any of the white slides.

564
00:30:10,590 --> 00:30:12,162
Did you see that?

565
00:30:12,162 --> 00:30:13,369
- [Audience] Yeah.

566
00:30:13,369 --> 00:30:14,520
Okay, yeah, so what I was saying

567
00:30:14,520 --> 00:30:17,910
must probably have been
very strange to you anyway.

568
00:30:17,910 --> 00:30:20,370
So that was the timeline

569
00:30:20,370 --> 00:30:22,590
when you want to encrypt
towards the future.

570
00:30:22,590 --> 00:30:23,820
And that's a really nice thing,

571
00:30:23,820 --> 00:30:28,473
or you can use drand to
map to specific rounds.

572
00:30:29,940 --> 00:30:33,510
And the nice thing is that we use pairings

573
00:30:33,510 --> 00:30:35,397
and here is the math,

574
00:30:35,397 --> 00:30:39,810
and you can check the math
or you can trust me it works.

575
00:30:39,810 --> 00:30:41,659
And this is even more math.

576
00:30:41,659 --> 00:30:43,410
Pairings are really cool.

577
00:30:43,410 --> 00:30:46,031
They allow you to do really cool shits,

578
00:30:46,031 --> 00:30:47,430
if you download the slides,

579
00:30:47,430 --> 00:30:51,000
there is even more details
at the end of the slide deck.

580
00:30:51,000 --> 00:30:53,280
Anyway, there is one problem though,

581
00:30:53,280 --> 00:30:55,800
is that we need to be able
to predict the message

582
00:30:55,800 --> 00:30:57,060
that is going to be signed

583
00:30:57,060 --> 00:30:59,850
in order to encrypt
towards a specific message

584
00:30:59,850 --> 00:31:01,167
in the future.

585
00:31:01,167 --> 00:31:04,050
And so one thing was that drand

586
00:31:04,050 --> 00:31:05,640
was using chain randomness

587
00:31:05,640 --> 00:31:09,810
where every round was actually
linked to the previous round.

588
00:31:09,810 --> 00:31:11,970
So it wouldn't work too well,

589
00:31:11,970 --> 00:31:16,470
but actually the security
assumption behind it is that

590
00:31:16,470 --> 00:31:19,170
there is never a threshold
left malicious node

591
00:31:19,170 --> 00:31:20,400
in the network.

592
00:31:20,400 --> 00:31:22,920
So we could just unchain it.

593
00:31:22,920 --> 00:31:25,140
We didn't need to have chain randomness.

594
00:31:25,140 --> 00:31:27,990
We can just sign the message,

595
00:31:27,990 --> 00:31:30,660
which is a drand number or
the hash of the drand number.

596
00:31:30,660 --> 00:31:33,810
And that will work with the
exactly same security assumption

597
00:31:33,810 --> 00:31:36,600
as we did with the previous version.

598
00:31:36,600 --> 00:31:40,290
And that has been just
actually released on desk nets

599
00:31:40,290 --> 00:31:41,850
a few weeks back.

600
00:31:41,850 --> 00:31:45,510
And it's coming to main
net in mid September.

601
00:31:45,510 --> 00:31:48,920
So there is another issue is that

602
00:31:48,920 --> 00:31:51,718
if you want to encrypt very large files,

603
00:31:51,718 --> 00:31:55,154
you can't really because
the time-lock scheme

604
00:31:55,154 --> 00:31:58,650
we came up with is only able
to encrypt small blocks,

605
00:31:58,650 --> 00:32:01,230
maybe a thousand bits up.

606
00:32:01,230 --> 00:32:05,520
So the easy way out is that
you can encrypt with AES,

607
00:32:05,520 --> 00:32:09,390
which allows you to encrypt
gigabytes and gigabytes.

608
00:32:09,390 --> 00:32:12,750
And you just encrypt the secret
key you are using with AES.

609
00:32:12,750 --> 00:32:14,880
And that's exactly what PGP does

610
00:32:14,880 --> 00:32:17,280
when you are using PGP to encrypt files.

611
00:32:17,280 --> 00:32:18,750
And so it's a really nice isolation

612
00:32:18,750 --> 00:32:21,531
whenever you need to encrypt lots of data.

613
00:32:21,531 --> 00:32:26,531
With that, we've actually
created two time-locks libraries,

614
00:32:27,300 --> 00:32:29,910
one in Go another one in TS,

615
00:32:29,910 --> 00:32:34,563
which allow you to try to
encrypt stuff today if you want.

616
00:32:36,840 --> 00:32:40,260
with deliveries, we also
are providing a CLI tool.

617
00:32:40,260 --> 00:32:43,560
If you want to, just
like you are using PGP,

618
00:32:43,560 --> 00:32:47,520
you are able to use TLE
to do time-lock encryption

619
00:32:47,520 --> 00:32:49,860
in your terminal today,

620
00:32:49,860 --> 00:32:52,653
provided you goin install on your machine.

621
00:32:54,480 --> 00:32:55,903
TLE is really easy to use.

622
00:32:55,903 --> 00:32:58,410
It's a bit it's based on AGI,

623
00:32:58,410 --> 00:33:01,590
which is a fairly nice common tool

624
00:33:01,590 --> 00:33:06,590
to do modern publicly
encryption created by Filippo.

625
00:33:08,010 --> 00:33:11,100
And we figured it might be too difficult

626
00:33:11,100 --> 00:33:14,436
for people to use a common
line tool for demo, right?

627
00:33:14,436 --> 00:33:19,436
So we came up with a JavaScript
library and a web demo.

628
00:33:19,860 --> 00:33:22,773
And so we can actually try the web demo,

629
00:33:24,360 --> 00:33:26,043
if I click the link,

630
00:33:35,670 --> 00:33:36,840
so anybody can try it.

631
00:33:36,840 --> 00:33:38,313
It works on the phone too.

632
00:33:39,360 --> 00:33:41,640
Time vault that's the name of the web demo

633
00:33:41,640 --> 00:33:45,030
is basically just a way
to encrypt your text,

634
00:33:45,030 --> 00:33:47,400
whatever text you have to encrypt

635
00:33:47,400 --> 00:33:50,610
or your vulnerability
report, if you prefer,

636
00:33:50,610 --> 00:33:52,830
and you can just choose
a time in the future.

637
00:33:52,830 --> 00:33:57,830
So let's say 5:00 PM like, 05.

638
00:34:02,173 --> 00:34:05,883
Okay, you can try to encrypt something.

639
00:34:09,935 --> 00:34:10,768
Okay.

640
00:34:12,810 --> 00:34:16,370
So if I copy paste that in the decryption,

641
00:34:18,656 --> 00:34:22,493
it should fail because it's
not yet five past five,

642
00:34:23,610 --> 00:34:26,490
but if we wait just a few extra seconds,

643
00:34:26,490 --> 00:34:27,810
it should work, right?

644
00:34:27,810 --> 00:34:31,260
Because it will be five past five.

645
00:34:31,260 --> 00:34:35,580
And so now it's five past
five, according to my screen.

646
00:34:35,580 --> 00:34:37,083
So if I try again,

647
00:34:45,360 --> 00:34:46,653
demo effect.

648
00:34:51,150 --> 00:34:54,461
Tala ah and yeah.

649
00:34:54,461 --> 00:34:57,628
(audience applauding)

650
00:34:59,070 --> 00:35:02,970
So we can see it works in practice today

651
00:35:02,970 --> 00:35:06,840
by relying on drand to
provide the randomness

652
00:35:06,840 --> 00:35:10,203
and on too quick.

653
00:35:11,160 --> 00:35:13,740
And so if you need to
use it in your project,

654
00:35:13,740 --> 00:35:16,083
or if you have cool IDs
of stuff you could do

655
00:35:16,083 --> 00:35:17,700
with time-lock encryption,

656
00:35:17,700 --> 00:35:20,490
please go ahead and use our libraries.

657
00:35:20,490 --> 00:35:23,580
You can even choose to
use your own gear network.

658
00:35:23,580 --> 00:35:25,830
If you don't trust the Legal of Entropy,

659
00:35:25,830 --> 00:35:27,687
everything is really easy to use.

660
00:35:27,687 --> 00:35:29,670
And it's actually based on cryptography

661
00:35:29,670 --> 00:35:32,741
that has been researched
since the early 2000.

662
00:35:32,741 --> 00:35:35,667
So BLS it's 2001

663
00:35:35,667 --> 00:35:37,800
and the identity based encryption system,

664
00:35:37,800 --> 00:35:40,290
we're using its 2003

665
00:35:40,290 --> 00:35:42,873
and is providing proper
security guarantee.

666
00:35:43,710 --> 00:35:46,110
Now there is just one remaining problem

667
00:35:46,110 --> 00:35:47,190
with time-lock encryption.

668
00:35:47,190 --> 00:35:48,540
So we've seen,

669
00:35:48,540 --> 00:35:51,240
there is a cool way to
provide a dead man switch,

670
00:35:51,240 --> 00:35:54,030
basically to encrypt your
vulnerability reports.

671
00:35:54,030 --> 00:35:57,440
And instead of posting the shot 256

672
00:35:57,440 --> 00:35:59,040
of your findings on Twitter,

673
00:35:59,040 --> 00:36:01,890
you could directly post
the link to your paste bin

674
00:36:01,890 --> 00:36:03,360
with a cipher text.

675
00:36:03,360 --> 00:36:04,890
And in 90 days,

676
00:36:04,890 --> 00:36:09,363
anybody could decrypt
that cipher text, right?

677
00:36:10,294 --> 00:36:11,190
So cool.

678
00:36:11,190 --> 00:36:13,620
But the problem is we're
talking about the future.

679
00:36:13,620 --> 00:36:16,680
So there could be new attacks.

680
00:36:16,680 --> 00:36:18,840
Somebody could come up
tomorrow with a new attack

681
00:36:18,840 --> 00:36:19,673
against BLS,

682
00:36:19,673 --> 00:36:22,683
and that would break all the cipher text

683
00:36:22,683 --> 00:36:27,390
that would've been encrypted
with time lock encryption.

684
00:36:27,390 --> 00:36:29,130
So it could be annoying.

685
00:36:29,130 --> 00:36:31,819
Another big issue is that BLS

686
00:36:31,819 --> 00:36:34,974
and the IBE system we're
using is actually relying

687
00:36:34,974 --> 00:36:38,700
on the discrete logarithm assumption,

688
00:36:38,700 --> 00:36:42,210
which is known to be vulnerable
to quantum computers.

689
00:36:42,210 --> 00:36:43,950
So if you want to encrypt something

690
00:36:43,950 --> 00:36:48,950
that is not meant to be decrypted
until in 30 or 50 years,

691
00:36:50,400 --> 00:36:51,977
it's maybe not a good idea.

692
00:36:51,977 --> 00:36:55,680
So don't use it to encrypt
your confessions or whatsoever.

693
00:36:55,680 --> 00:36:57,780
It could be decrypted earlier on.

694
00:36:57,780 --> 00:37:00,600
Maybe if a quantum
computers is ever built,

695
00:37:00,600 --> 00:37:04,650
that's strong enough to
break the scheme we're using.

696
00:37:04,650 --> 00:37:07,770
Also the fact that we're
relying on threshold systems

697
00:37:07,770 --> 00:37:10,170
means it's fairly solely.

698
00:37:10,170 --> 00:37:12,240
You have a good live ness properties.

699
00:37:12,240 --> 00:37:15,660
You can expect the network
to be up for a long time,

700
00:37:15,660 --> 00:37:18,930
but who knows, maybe in 10, in 20 years,

701
00:37:18,930 --> 00:37:22,170
all of the Legal of Entropy
members will be gone.

702
00:37:22,170 --> 00:37:23,003
Who knows?

703
00:37:23,003 --> 00:37:24,120
So it might be possible

704
00:37:24,120 --> 00:37:27,090
your cipher text could never be decrypted

705
00:37:27,090 --> 00:37:32,090
if you're encrypting
something for in 20 years.

706
00:37:32,280 --> 00:37:35,280
And also what about governance?

707
00:37:35,280 --> 00:37:38,130
So the problem with the
network that is meant,

708
00:37:38,130 --> 00:37:39,660
that is built with a lot of people,

709
00:37:39,660 --> 00:37:42,480
is that certainly maybe the
League of Entropy members

710
00:37:42,480 --> 00:37:44,460
could decide to stop the network.

711
00:37:44,460 --> 00:37:46,920
And then what happens
with the cipher text?

712
00:37:46,920 --> 00:37:48,750
So there is two options.

713
00:37:48,750 --> 00:37:50,190
The league could say,

714
00:37:50,190 --> 00:37:52,410
we're going to release all key material.

715
00:37:52,410 --> 00:37:55,230
So anybody can decrypt everything now,

716
00:37:55,230 --> 00:37:57,930
which is maybe not amazing.

717
00:37:57,930 --> 00:38:01,740
Or maybe the league members will say,

718
00:38:01,740 --> 00:38:03,720
will just destroy the key material,

719
00:38:03,720 --> 00:38:07,260
which means all of the cipher
text could never be decrypted

720
00:38:07,260 --> 00:38:09,540
unless a quantum computer is built,

721
00:38:09,540 --> 00:38:11,460
which could also be annoying,

722
00:38:11,460 --> 00:38:13,800
but these are really governance questions.

723
00:38:13,800 --> 00:38:17,880
So I guess the main solution
is to have two networks

724
00:38:17,880 --> 00:38:20,190
and people could choose either the network

725
00:38:20,190 --> 00:38:23,970
that is going to release all
keys if it ever goes down,

726
00:38:23,970 --> 00:38:25,560
or people could choose the network

727
00:38:25,560 --> 00:38:27,660
that is never going to release any keys,

728
00:38:27,660 --> 00:38:29,220
if it ever goes down.

729
00:38:29,220 --> 00:38:31,653
And yeah, that would work nicely.

730
00:38:32,760 --> 00:38:36,273
Finally, this work is a
team effort, actually.

731
00:38:37,167 --> 00:38:39,240
So credits goes to the drand team,

732
00:38:39,240 --> 00:38:42,000
including Nicolas Gailly
who had the initial ID

733
00:38:42,000 --> 00:38:44,396
and he also the creator of drand.

734
00:38:44,396 --> 00:38:48,840
Patrick McMlurg who was behind
all the JavaScript magic,

735
00:38:48,840 --> 00:38:52,800
Julia Armbrust who's
behind the web demo design.

736
00:38:52,800 --> 00:38:55,440
And also I want to thanks a few people

737
00:38:55,440 --> 00:38:57,240
who had very cool comments

738
00:38:57,240 --> 00:38:59,940
and who helped us with the project.

739
00:38:59,940 --> 00:39:02,640
So Justin Drake, Jason Donefeld,

740
00:39:02,640 --> 00:39:05,703
and also Ardan Labs for
helping us along the way.

741
00:39:06,960 --> 00:39:08,190
With that said,

742
00:39:08,190 --> 00:39:11,190
if you find time-lock
encryption is a critical thing

743
00:39:11,190 --> 00:39:13,183
and you would like to
help set out the network.

744
00:39:13,183 --> 00:39:15,960
The League of Entropy is
looking for new members

745
00:39:15,960 --> 00:39:19,533
in new other geographies,
especially in Asia.

746
00:39:20,550 --> 00:39:23,310
If you're used to run a
high availability service

747
00:39:23,310 --> 00:39:27,720
and you want to try to join
the league, please ping me.

748
00:39:27,720 --> 00:39:29,010
That would be nice.

749
00:39:29,010 --> 00:39:33,540
Also the drand team within
protocol lab is hiring.

750
00:39:33,540 --> 00:39:36,406
So you can also ping me if
you're interested in joining,

751
00:39:36,406 --> 00:39:39,810
or looking for Go developers,
backend developers,

752
00:39:39,810 --> 00:39:43,110
and also security professionals
like application security

753
00:39:43,110 --> 00:39:45,660
and cloud security.

754
00:39:45,660 --> 00:39:47,130
And thank you.

755
00:39:47,130 --> 00:39:49,680
If you want to see the
code it's on GitHub,

756
00:39:49,680 --> 00:39:51,720
we release it this morning.

757
00:39:51,720 --> 00:39:52,553
So it's there.

758
00:39:53,442 --> 00:39:56,067
And also stay tuned if you
want all the details about,

759
00:39:56,067 --> 00:39:57,180
how it actually works,

760
00:39:57,180 --> 00:40:00,270
under the hood we're going
to publish a pre print

761
00:40:00,270 --> 00:40:04,410
and a print in the coming two months.

762
00:40:04,410 --> 00:40:07,140
And I'm probably going to be
realizing also a blog post

763
00:40:07,140 --> 00:40:10,080
explaining all the wall
thing works next month.

764
00:40:10,080 --> 00:40:14,280
At the same time, as we'll
be launching on the main net,

765
00:40:14,280 --> 00:40:16,080
because for now it's running on test net,

766
00:40:16,080 --> 00:40:20,940
which has only six nodes, a
threshold of six instead of 13.

767
00:40:20,940 --> 00:40:23,490
So the security is not as high on test net

768
00:40:23,490 --> 00:40:26,010
as it is on main net,

769
00:40:26,010 --> 00:40:27,690
but you can already use it today,

770
00:40:27,690 --> 00:40:30,930
trade out on test net it works.

771
00:40:30,930 --> 00:40:32,196
And yeah, with that,

772
00:40:32,196 --> 00:40:37,196
I think I'm might have a few
minutes for questions, yeah.

773
00:40:50,310 --> 00:40:51,732
Yes.

774
00:40:51,732 --> 00:40:55,232
- [Audience] (Indistinct)

775
00:40:59,940 --> 00:41:04,050
- Yes, so the network is
using threshold cryptography

776
00:41:04,050 --> 00:41:06,240
and distributed key generation,

777
00:41:06,240 --> 00:41:10,860
which means the actual key
to decrypt the cipher text

778
00:41:10,860 --> 00:41:11,693
or to sign

779
00:41:11,693 --> 00:41:16,020
the beacons is never in
memory on any computers.

780
00:41:16,020 --> 00:41:19,380
But if you are able to
compromise a threshold

781
00:41:19,380 --> 00:41:21,077
amount of nodes,

782
00:41:21,077 --> 00:41:25,360
you can get the actual
secret key of the network

783
00:41:26,460 --> 00:41:31,460
and you would be able to
decrypt all future cipher text.

784
00:41:31,770 --> 00:41:33,780
That's one of the problem
with time-lock encryption,

785
00:41:33,780 --> 00:41:36,420
you can naturally recall a cipher text

786
00:41:36,420 --> 00:41:39,420
once you've released it, and
you cannot do cure rotation.

787
00:41:39,420 --> 00:41:41,670
So it's a bit difficult.

788
00:41:41,670 --> 00:41:45,000
We do key rotation for each node.

789
00:41:45,000 --> 00:41:48,300
So it means if you
compromise one node today

790
00:41:48,300 --> 00:41:52,680
and another one next week and
another one in three weeks

791
00:41:52,680 --> 00:41:53,622
and so on.

792
00:41:53,622 --> 00:41:56,430
At some point we will do a key refreshing,

793
00:41:56,430 --> 00:42:00,030
which will change the shares
of every members of the league.

794
00:42:00,030 --> 00:42:04,410
And so if you didn't
compromise enough nodes yet,

795
00:42:04,410 --> 00:42:08,992
you wouldn't be able to use
what you've got for anything.

796
00:42:08,992 --> 00:42:10,154
But yeah, the key itself,

797
00:42:10,154 --> 00:42:13,860
the actual secret key of the network

798
00:42:13,860 --> 00:42:15,840
is never properly rotated

799
00:42:15,840 --> 00:42:17,640
because it's a threshold network

800
00:42:17,640 --> 00:42:21,393
and we only do refreshing
of each nodes shares.

801
00:42:22,260 --> 00:42:23,093
Thanks.

802
00:42:24,690 --> 00:42:26,312
Yes.

803
00:42:26,312 --> 00:42:29,812
- [Audience] (Indistinct)

804
00:42:36,930 --> 00:42:39,568
- So the question is about
the quantum resistance

805
00:42:39,568 --> 00:42:43,170
of the whole thing.

806
00:42:43,170 --> 00:42:48,000
The problem with quantum
resistance is that you need scheme

807
00:42:48,000 --> 00:42:51,240
that's not relying on something
that we know is broken

808
00:42:51,240 --> 00:42:55,320
by quantum computers and BLS is relying

809
00:42:55,320 --> 00:42:58,320
on something that we know is
broken by quantum computers.

810
00:42:58,320 --> 00:43:01,380
So you would need to use
another signature schemes

811
00:43:01,380 --> 00:43:06,030
to sign the drand beacons
that is not relying

812
00:43:06,030 --> 00:43:07,200
on any assumptions

813
00:43:07,200 --> 00:43:09,030
that's already broken
by quantum computers.

814
00:43:09,030 --> 00:43:09,863
And currently

815
00:43:09,863 --> 00:43:14,863
there is no properly
threshold signature scheme

816
00:43:15,000 --> 00:43:16,680
that is quantum resistant.

817
00:43:16,680 --> 00:43:19,260
So no luck for now,

818
00:43:19,260 --> 00:43:21,240
but it's something we're looking into.

819
00:43:21,240 --> 00:43:23,190
Maybe at some point in the future,

820
00:43:23,190 --> 00:43:26,880
if the researcher scheme
to create a new network

821
00:43:26,880 --> 00:43:30,213
running on a quantum
resistance scheme, yeah.

822
00:43:33,000 --> 00:43:34,560
Oh, I think we're at time.

823
00:43:34,560 --> 00:43:38,010
So if you want to talk to me,
I'll be in the career horizon.

824
00:43:38,010 --> 00:43:40,470
You can also reach out on Twitter.

825
00:43:40,470 --> 00:43:41,460
Thanks.

826
00:43:41,460 --> 00:43:42,988
(audience applauding)