Invited Speakers

At SSR 2022 we will have the pleasure of two invited speakers.

Luca De Feo

Bio

Luca De Feo received his PhD from École Polytechnique (France) in 2010, with a thesis on computer algebra and computational number theory. He then joined Université de Versailles (France) in 2011 as Assistant Professor, where he kept working on computer algebra and cryptography. He is currently employed at IBM Research, where he works on post-quantum cryptography and related topics.

On the (in)security of ElGamal in OpenPGP

Think you know ElGamal encryption? Think twice.

We uncover vulnerabilities in the OpenPGP ecosystem stemming from confusion about the definition of ElGamal encryption (and the lack of an unequivocable standard). The first vulnerability leads to practical plaintext recovery in a limited number of cases. The second one, combined with side-channel leakage we found in some popular OpenPGP libraries, leads to feasible key recovery, in relatively rare cases.

We hope that these attacks, that we dub "cross-configuration", serve as a cautionary tale for standards designers. Cryptographic algorithms, even when they may appear very simple, hide a great deal of complexity in the choices of parameters and data representation. While an instantiation may appear to be safe in isolation, the interaction of two incompatible instantiations may lead to a security disaster, which can only be avoided by a carefully written standard.

Joint work with Bertram Poettering and Alessandro Sorniotti.

Mallory Knodel

Bio

Mallory Knodel is the CTO at the Center for Democracy & Technology in Washington, DC. She is a member of the Internet Architecture Board, the co-chair of the Human Rights and Protocol Considerations research group of the Internet Research Task Force, co-chair of the Stay Home Meet Only Online working group of the IETF and an advisor to the Freedom Online Coalition. Mallory takes a human rights, people-centred approach to technology implementation and cybersecurity policy advocacy. Originally from the US, she has worked with grassroots organisations around the world. She has used free software throughout her professional career and considers herself a public interest technologist. She holds a BS in Physics and Mathematics and an MA in Science Education.

Security and privacy in the public interest: Singing to the choir

Security and privacy standardisation introduces tensions that impact the public interest. This invited talk discusses how protocol designers and public interest advocates can together confront the discordant effects of security and privacy features by placing people at the center of technology design. For the sake of balance, there is a work in progress framework based on a paper that outlines the detrimental effects to the public interest of more private DNS lookups: Internet research becomes opaque, service provision consolidates, abuse mitigation is harder, accessibility features break, and even risks of internet shutdowns and censorship become greater. And yet it is in the public interest and the interest of standards communities to properly research and mitigate these tensions so as to remove barriers to the ubiquitous adoption of strong privacy and security techniques.