New ways of ahieving peer-to-peer encryption

["Anders Rundgren" <anders.rundgren@telia.com>]

New ways of ahieving peer-to-peer encryption

Using a standard PKI text book, you achieve confidential communication by distributing your public [encryption] key to other parties from which you want to receive sensitive information.  The problems associated with this approach are numerous:

• Automatic lookup of encryption keys do not scale well and is poorly supported by client software which makes this scheme depend on out-of-band distribution of keys except in limited communties
• Without a key-backup scheme in place there is a huge risk that you (the recipient) will be unable to decipher old messages which in some cases may lead to irrecoverable loss of data, not to mention help-desk issues
• The confidentially only applies to the message payload; the identity of the recipient (you) is still transmitted in clear

Due to this, transport encryption like offered by TLS has become considerably more important for mass-deployment of confidential communication.

 

Question: Why not then use TLS for e-mail?   Although that indeed would be nice, TLS does not work satisfactory in a classic e-mail scenario where messages are relayed from server to server which breaks the encryption at each relay station.

 

On-Line changes everything

 

However, completely outside of the regular computer security community, new messaging schemes involving on-line connections have begun to flourish.  Some of these schemes, most notably Skype, offer full end-to-end encryption without relying on statically generated and distributed encryption keys.  My guess is that this system alone has a magnitude more users than all S/MIME encryption users put together.

 

An interesting thing is that Skype users are completely unaware of the encryption, they just take it for granted (or don't care at all) as it is the only available mode of operation.  In a Skype session you do not only have confidential voice communication, you may also exchange confidential documents (files).

 

It appears that the on-line paradigm, which already have had a major impact on how you interact with other people, will likely also make a similar dent in the world of applied cryptography.

 

Anders Rundgren