EB119 – Adam Gibson: A New Kind Of Auditing - Cryptographic Proof Of Online Accounts

Transcript

[Music] this episode of epicenter Bitcoin is brought to you by Ledger now accepting pre-orders for The allnew Ledger blue Developer Edition a Bluetooth and NFC touchscreen Hardware signing device learn more about The Ledger blue at Ledger wallet.com and use the discount code epicenter to get 10% off your first order and by the Gtech blockchain contest if you have an idea for a blockchain related project make sure you apply for your chance to win Awards worth 50,000 go to epicenter bitcoin.com Gtech that's gtec to learn more about

Gtech and how you can apply hi welcome to epicenter Bitcoin the show which talks about the Technologies projects and people driving decentralization and the global cryptocurrency Revolution my name isest and I'm Maher Roy today we have a very we have a slightly offbeat topic for our listeners most of you must have heard uh of the problem with oracles the fundamental problem of how we can put financial data in in trustless blockchains and it turns out there's a very interesting uh solution to the problem of oracles but it it depends on a technology called TLS

notary so we are going to interview Adam Gibson from the TLs notary project about what TLS notary is and what are the kinds of applications with blockchains they're very interesting so let's uh so do do check out the application section but before that let's have an introduction from Adam Adam a bit about your background please hi yeah so um I got interested in Bitcoin um probably late 2012 early 2013 and uh very rapidly after that became interested in the this kind of uh mythical Beast the decentralized exchange of Fiat to bitcoin which you know arguably can't exist but there was endless debates about it back then um also perhaps you want to know a little bit about my background but I I

I'm maths and physics is my training but I've been a teacher software engineer and so on but anyway so to come back to this topic of uh how how I got interested in this uh so starting around May 2013 uh myself and another guy online called Dan Smith uh um and well it was us two originally um started looking for ways in which we could use uh ssltls uh as a possible cryptographic solution to that problem of Fiat Bitcoin uh exchange and another guy whose online handle is Oak Pacific kind of joined us a few months later and we've been working on it a long time and and some

time around mid 2015 I guess you could say we kind of finished in a sense that we now have what is now called TLS notary and we found that as you just mentioned it could be applied in a number of other contexts as well based around this idea of using a a cryptographic proof of a of a web page let's say so could you explain uh very briefly what the big picture concept behind tless notary is what allows it to do sure so I thought maybe I could give a a simple example a practical example where it might apply um something that that struck me uh maybe one or two years ago um here in laia where I live is that I had to go to

a government office to uh provide proof of my um uh income or or savings to provide a a financial proof um and as is often the case in this kind of situation you know you go to the government office and they've got a very old kind of bureaucracy and they want some kind of form or or piece of paper to prove something so I what I did was I simply uh uh printed out I think it might have been a PDF or an HTML page from my internet banking uh printed on paper took it into the the government office and the guy looked at it and sort of nodded his head and say yeah this is obviously correct right so obviously you have got that money or that uh income or whatever uh and obviously that's

ridiculous because anyone can print anything they like on paper with any kind of letterhead uh so that's an example where it would be useful to have a digital signature right because the the that's the main application of a digital signature is that um somebody can have a public key out there in the world and it can be used to attest to the fact that they actually made this statement so that's called a non-repudiable um statement in the sense that as long as the public key of that uh organization is known then if the signature verifies against that public key it's cryptographic proof now uh there aren't many of it's surprising in a way I mean it might be surprising or

might not that there are many um big public institutions whether they be Banks or government uh offices that don't actually provide digital signatures for the various statements that they you know attest to for their citizens or customers um so in a way TLS notary is an i an idea where we're trying to sort of fill that gap of situations where digital signatures are not being provided but yet you still want cryptographic proof that a certain Authority um gave you uh that statement um so yeah I'll stop there yeah and I find that's such a telling example I'll give you a bit of uh bit little story when I when I talk about blockchains to

really just people that have no idea I often use this very type of example of taking paper taking information coming from one database which is say your bank or your um maybe perhaps your landlord giving you like proof of residency and uh a government office which it where there's inputs of data and you're essentially the transport layer and The Trusted party to make sure that all the information coming from one set of data one one output databases essentially and going into the other while you're the trusted uh third party to verify those and also the transport layer so basically you're playing the role of an API between the various outputs of data uh like you know your bank uh know your

landlord maybe like the tax office and stuff like that and bringing it over to some lady behind a desk and a glass window who then does risk analysis human API yeah yeah risk analysis and then allows you to stay in a country for another year and since I stay live in France I I'm confronted with this type of example like all the time so uh that's a really interesting example and I guess TLS TLS notary is a much simpler uh way of being able to prove outputs of data from one system and being able to bring it into another uh I guess we're blocked CHS might make the where blockchains might come in handy there is providing the transport layer um that would effectively just allow both entities to to share pieces of data and and have trust in in that in in the data

that's provided um so yeah just a little little aside there uh but but I really like that example so let's um let's perhaps talk about uh TLS uh because I mean for me personally I EXC excuse me but I I work in web Technologies and for some reason I still thought we were using SSL I don't know why I mean we talk about SSL certificates pretty pretty much all the time absolutely and I was so surprised when I started really digging into what TLS and SSL was that actually SSL doesn't exist anymore since it's like the early 2000s oh it does it does exist but uh right but it's not the right uh call it so um let's uh could you explain you know in in a in simple

terms what TLS is and what it allows to do essentially because we use it all the time right okay so first let's briefly deal with that SSL TLS confusion for those who still have a confusion about it um just think of SSL as the old version of TLS they're actually the same technology TLS 1.0 is in a sense SSL 4.0 um now uh what is TLS so the basic idea is you want to talk uh it's it's really a way of using public key cryptography to enable uh encrypted Communications between clients and servers it's very much designed in that client server model so obviously the web server is what we're talking about here

and uh the problem is that you you want to provide not just encryption well let's put it this way you don't just want the data being transferred between the client and the server to be confidential but you also want it to be authenticate authenticated and have integrity so um let's let's just go through like uh High very high level picture of what TLS does for those who don't know so you start with the client uh generating some secret data this is going to be like the the key or keys for the session then he wraps up that secret data uh in using public key encryption so that's something I think most people know what that means I'll assume you do so he's encrypted the the

secret data and he sent it to the server and the public key he's encrypted it to is um let's say in crew terms is the certificate of the web server um actually it's like the public key is signed by a certificate Authority but let's just say right so the client sends the secret data to the web server encrypted so that only he the client and the web server know that secret data then when they both have that secret data what they do is they kind of mung it up a little bit and they generate a string of bytes and they're both doing that same generation on both sides so they both generate the same bytes and then they chop those bytes up into sections and they use each of those sections of bytes as keys for the

encryption process that they're going to do when they you know when the client says his get request and the and the web server sends back his HTML page or whatever they're going to be using some encryption Keys now you might ask well why didn't they just use the public key encryption at the beginning to send the get request well the main answer is that public key encryption is slower um both in you know encrypt and decrypt operations and signing operations and so on so you you want to use what we call symmetric encryption for the actual data transfer uh symmetric encryption is just where the encryption and the decryption key are the same so if I if I can just sort of recap the you're using uh public private key encryption to send the

initial piece of data that will allow you to generate these symmetric keys that then then we are used for uh encoding and decoding messages that's right and I should probably mention that this point that that that bit of data that secret data you send at the start is called the preaster secret because we're we're going to refer to that later um the other thing to bear in mind at this stage is that it's not just the uh encryption decryption Keys we need it's also something called a Mac key and Mac here means message authentication code and the reason we need a message authentication code is to come back to what I said at the beginning we don't just provide confidentiality we just don't just say oh it's enough that the somebody sniffing the wire can't read

the data we also don't want them to be able to modify it because if they can modify it there's a whole set of very clever attacks they can do which can really screw things up so what we do is we append a Mac which you could think of like a check sum or like a hash to the end of each block of data that's get getting sent between the two parties and that Mac is actually generated from something called hmac and so hmac is a hash function that's something I think most people listening to this would be familiar with uh h ma is a hash function but it's keyed so instead of saying suppose the data is hello instead of uh sending the hash of hello we send the hash of 1234 hello where 1234 is the secret Mac key what that means is that

the only person who could generate that hmac is the person who had that secret one two 3 4 it's not enough to know the data you have to know the secret key too so because only the server has the hmac key the client knows that when he receives a block of encrypted data with this hmac he knows it came from the server so so just to summarize what what we say we said public key encryption to send the secret cross then symmetric encryption to send data back and forth and the data is authenticated using hmax at the end of each block which function like check sums that's that's a really great explanation and and and uh and the reason you use symmetric encryption to recap is because public key encryption

is expensive and you don't want to use it for every piece of communication you send over the wire that's right yeah exactly yeah now now in essence like had public key encryption being used to send each block of data over the over the internet then um suppose when I connect to my bank the bank is also sending me the data about my balance and it is signing with its with like with it private key and anyone else can verify that uh this data that the bank sent me well well be careful because because there's different things here right there's public key encryption and public key signing so um first of all if we were to do the whole process with public key

public Key Systems only we would need um a public key from both sides now actually uh ssltls does provide client side certificates so a client can send a certificate to a server if they want to authenticate themselves but it's interesting that almost nobody uses that system in real life because we want the client to be ultra lightweight uh stateless just client just comes along pings goes away that's it client's even Anonymous in some cases of course not if you have a login but that's that's another matter and also um the other one point I wanted to make on that is yeah it could be that the server could be sending signatures with each block of data uh and in fact Sergio larner made a a similar suggestion to that on the TLs working group uh um email list uh maybe

last year sometime but uh you know the question is do do people like do people from the server side actually want that because it's it's kind of heavy do they want to provide non-repudiable so to remind you the case of when I'm at the the office I wanted you know a non-reputable signature that nobody could say afterwards oh that wasn't me right do do servers actually want to provide non-reputable signatures on every single block of data they send to their clients I don't know it's a complicated question in some cases they might in some cases they might not let's take a short break so we can go to Paris I stopped into lame ojb coin situated in the heart of paris's startup scene and I met with Eric Ledger CEO to talk about The Ledger Nano The Ledger Nano is a Bitcoin Hardware wallet based

on a secure element it is on a USB form factor that you plug directly inside your computer and it will manage all your private Keys the signature of transaction will be done inside the secure element thus never revealing the private keys to the host computer it is compatible with our own Ledger wallet CH app which you can also use for multi signature with cop or coin kite and a large range of third party application such as melium electrum green bits green address and so on the Nano also exists as a cool bracelet wearable so you can always wear proudly your Bitcoins on

your wrist the lger Nano is an easy to use Hardware storage option which doesn't compromise on security if you want to get a secure set up for storing your Bitcoins go to Ledger wallet.com and use the offer code epicenter to get 10% off your order we'd like to thank Ledger for their support of epicenter Bitcoin so in essence today we are in a state where we are receiving data from various different servers but uh once say I receive data from from some some server maybe it's a government server I can look at the data B and I can look at the properties of data but I can't take that data to you and convince you that this is true for example I'll receive something from a government server that

I was born in I don't know 1985 so I I can be convinced of that data but if I it's not possible for me to go to you and convince you that I was actually born in 85 and that the government told has certified this because our U the government hasn't actually signed that statement using using its private key exactly exactly what happened was uh you and the and the government website uh were using a a kind of repudiable signature hmac is like a signature but it's repudiable because it because although you know it's real if you give it to me I'm going to look at it and say right what what were the keys

for this for this session you give me the encryption keys and the hmac keys right I can decrypt it that that seems to work right the hmacs seem to check and then I'll say but hang on uh how do I know you didn't just create all of this data all the keys all the web pages the whole thing just out of out of whole cloth and the only way you could answer that is if you could prove to me what the the the secret keys were that were used in the session but they were encrypted to the to the government website's private key so I mean I don't know maybe there's some weird way you could get the government involved to prove that it was real but then that's kind of begging the question because then you're asking the government anyway so so the data is repudiable yeah so

it's between the two parties the client server everything's absolutely kosher cryptographically speaking but as far as anyone else is concerned it could all just be made up and so just before we go a bit deeper into TLS notary specifically can you talk about some of the vulnerabilities that uh TLS specifically can can fall subject to well um wow that's that's a kind of a huge topic right I suppose there are many but what are the some of the most common ones that we a lot a lot of the ones that that have popped up over the last few years and maybe even going back to sort of 2000 when when when tls1 started um are to do there's a couple of different classes of of problems one of them is related to export Cipher Suites

uh and this is all about the fact that the US government actually wanted it to be weak so there were there were all these kind of Legacy systems or Legacy let's say elements of the protocol that used slightly weaker encryption standards in them and and and and there've been attack based on fallbacks because you have to kind of negotiate which version you're going to use so that's that's one class uh another class is what's sometimes called padding Oracle attacks which which is where you because of the the kind of standardization of the format uh if if it's possible to kind of ping the server a lot of times look at the the encrypted data and you can kind of um slowly but surely glean individual bits of information but the those padding Oracle

attacks they got a lot of kind of coverage but I think in practice they weren't very realistic because maybe I shouldn't say that but it just seems that way to me because you a lot of them involved actually pinging servers like a million times um there I'm trying to think of the other ones there are whole whole oh yeah the the other sort of area of attack I think has been based around extensions to the protocol because being like any protocol sort of designed by committee it has lots of different bits and pieces that get tacked on um for example I think the heart bleed of vulnerability that got a lot of play for very good reason because it's was a very serious vulnerability was based on dtls which was this kind of

um I actually forget now what was dtls about but anyway it was an extension to the protocol it wasn't the core protocol uh so but that is a huge topic and I I can't class myself sufficiently expert to give you a talk about that I'm afraid right okay no that's uh it's interesting and and I suppose also some higher level problems related to C certificate authorities and oh of course you know that whole that whole can can you give just sort of a sort of brief explanation of what what that problem looks like oh well the way I see it I mean maybe other people don't agree with me is that certificate Authority model is just appalling I mean it's a terrible idea right because you have the incredibly centralized um entities that

uh are farming out certificates and effectively giving um you know being in charge of deciding who is actually who on the internet but it depends what you mean really if you mean what are the kind of um cryptographic vulnerabilities in it or or what are the kind of systemic vulnerabilities in it because I mean my experience is on my browser I go and I look at the list of CA and I see you know 20 not 20 maybe 200 different certificate authorities from all around the world I have no trust in them whatsoever I've actually gone and deleted a lot of them from my browser because I don't I know I don't need them but any one of them just have H happening to uh have some systemic failure within their company or or or or

whatever could result in you you know thinking you're logging onto your bank when you're logging on to a hacker's website so one level you can see it's pretty and yeah and yeah I must say of course in reality that is the system that works that is the system that bought brought public key cryptography to the world it isn't being used outside of that I mean nobody's using gpg you know so it swings and roundabouts I guess that was a really good introduction to to TLS notary which is basically a communication protocol on top of uh top of the web TLS you mean not TS sorry TLS not TLS notary now what TLS notary is doing is it's kind of extending TLS in order to make uh

Communications verifiable so when Mah communicates with Adam Mah gets the ability with TLS notary to prove to Sebastian that it did receive something coming from ad that he did receive something coming from Adam right so uh just walk us through like how how TLS notaries are able to achieve this all right so earlier we were discussing the scenario where um let's say you got a web page from your government and uh it was all correct and you gave it to me and I said well hang on um how do you how do I know this is real you could have made up the web page right you could have but in order to if you wanted to generate the whole kind of network

traffic you would have had to generate like Network packets or well teeress records let's put it at that level you would had had to generate a series of TLS records that were encrypted and had hmax on them just as I described earlier and you would have had to give it to me and I I could have looked at it and I would have said right I need the keys you give me the keys and then my problem is how do I know those keys are real yeah so um how about this as a proposed alternative in order to achieve what you just said how about um and what was I thinking oh yeah so suppose so in the scenario you described I think you have Sebastian as the auditor and you as the client and me as the server let's just

call them auditor the person who wants to check it client and server like normal client server yeah just keep the names clear all right so um how about this scenario the auditor generates um the what I called before the premaster secret which means that effectively he's generating all the secret Keys he's generating the secret data he's giving it to the auditor gives it to the client the client then sets up a normal TLS connection with the server does the business uh page comes back and then the client gives the page to the auditor that that should work right the auditor is then gets proof that the date is real

yeah yeah yeah the auditor gets the proof because he has generated the secret and the client use the auditor generated secret for the communication but then that also opens up the client to being defrauded by the auditor very good okay is that the case why um because the client has to trust the auditor completely in order to generate the secret yeah it's not obvious but it is true what you're saying think about the I don't know if you've ever heard the the phrase man in the middle have you heard that phrase yes but but let's let's have an explanation of that then yeah it's it's it's actually an interesting discussion we had this discussion early on um I guess it was late 2013 early 2014 we had this discussion in when working on it because

yeah you could do it like that and um for example you you could well anyway let's just explain man in the middle yeah so he the auditor has all the secrets so what that means is the auditor can step between the client and the server and can um he can modify the traffic he can send because he knows the the the secrets you know what I should at this stage explain the separation of the secrets so I said earlier there's a pre-master secret it gets split into four or more sub Secrets there's a complicated process but let's just say the there's the client encryption key and the client Mac key I think we've already explained what

encryption and Mac keys are and then there's the server encryption key and the server Mac key so if if the auditor steps in between the client and the server what he can do is uh taking the server's uh response suppose the server's response says uh $100 for hair and what he can do is uh edit it because he's got the server Mac key he can create not only something that's encrypted correctly but also something that authenticates correctly and give it to the client so the client no longer has any assurance that what he's receiving from his uh web server is accurate and I suppose in that scenario that that scenario is really bad because also it could go the other way where um the the auditor could step in take the

client's request and modify it and or read it and so on and so forth well read it's okay because we want him to audit this particular thing but but generally speaking you don't want man in the middle you want to have the full scenario where the client is assured that only he and the server are talking to each other let's say that so sorry I should continue so so we've established a that it's not good enough to just give someone a page because they could have made it up B it's not really good enough for the auditor to just have all the secrets because he could then step in between and modify the the communication so tless notary is trying to to avoid both of those problems um so what does it do well the key to it there are two key uh tricks to it the first one is

this um the preaster secret is converted into the the Four Keys that I just mentioned in a in a complicated process involving something called a pseudo random function but it's a special kind of pseudo random function that's designed specifically for TLS and um so part of that complicated process obviously I won't explain all of it it' take too long but part of that complicated process that transfers the premaster secret into these what we call expanded Keys client encryption key client Mac key server encryption server Mac part of that process is is uses what's called uh exor or zor you know exor it's a simple uh logical operation which takes bits so you give um you get the exclusive or of two

bits and um what the the process does is it takes two um within this prf it takes two strings of bytes and it zores them together and I'm G I'll give you an example so suppose I had the string of of bytes ABC D and you had the string of bytes efgh right and we know that the output that we want is the zor of ABCD with efgh so that would mean literally the a gets zor with uh what was it e b gets zor with f c gets zor with G and D gets zor with h so it operates like bite by bite in this sense actually bit by bit

but effectively the same thing so that creates an interesting opportunity because if you've got the efgh and I've got the ABCD I can take the ab and just give you the ab and you can take that ab and zor it with your EF and you can get the correct output for the first half you see right whereas I can withhold the CD you don't have the CD you only have the the GH at the end so you're not going to get the the second half of the output you've only got the first half so that's what we exploit in in TS notary what we do is we say right we've got the first half of the pre-master secret let's say we're the auditor you've got the second half of the preaster secret and although there's a lot of other complications in

the middle basically we're going to give you the bits that you need in order to create the client encryption key the client Mac key and the server encryption key key but we're going to withhold bit for the server Mac key maybe we should just stop and think for a moment what's the significance of that why is it particularly useful to just withhold the server Mac key right because the Mac key remember is for authentication authentication so what it means is that you can because you've got the server encryption key you can create a server a page that looks like it's encrypted by the server M but the difference is you can't create a a Mac that authenticates that page MH so now at this stage uh you as the client have

uh everything you need to do the processing with the server you you've got the client encryption key and the client Mac key so you create your get request let's say you're getting an HTML page you encrypt it and you append your Mac you send it to the server the server is absolutely nothing unusual right but when you get back the serers response you can de well we'll come back to this but you can decrypt it but you can't authenticate it and you also can't authenticate it to me the auditor MH so now we have the next problem because if you receive a page from the server which is encrypted and and you can decrypt it correctly nevertheless you shouldn't really use that page why not because it is not authenticated

right well rather you haven't it is actually authenticated but you can't authenticate it because you don't have the Mac yeah yeah so you've got this page sitting on your disc or sitting in memory but you don't actually know it's from the server because it's not authenticated as being from them so what we do is we use a commitment we take that server response and we hash it just using any hash function like shy 56 we send the hash to the auditor now as you know the properties of hash functions that the auditor is just seeing a meaningless hash he doesn't actually know the data yet but by receiving that hash first when he then sends us back the server uh uh Mac key for us to authenticate our server response and and verify it's

genuine then we can give him the page and it has to match the hash that we sent earlier do you see yeah sorry this is a bit complicated but I'm doing my best to go through it so do do you see the point the the the the S we're in this kind of delicate dance where the the the auditor doesn't want to give the Mac key to the client immediately because then he can fabricate a page but at the same time the client needs the Mac key to authenticate the page and know it's real other it could be like some hacker just sending him a page that's you know well it's let's just say so we're in that sort of delicate dance there so the way we deal with that is is with a commitment we send a commitment of the page we send a hash of the page to the

to the auditor the auditor doesn't get our page yet but he gets a hash of it then when we send it later after we do have the server Mac key then the the auditor just checks the hash matches the page has been sent if it doesn't then the client is playing around so that way both Ides get what they want I don't want to I've got a couple of questions I guess more on the technical side and the Practical side of it uh right uh I I think I understood how that works um I will have to listen to it again though to really be sure about about understanding everything it's very complicated it's very comp especially when you're you know not really familiar with you know hm and and all this kind of stuff um but one thing that um and perhaps perhaps this

addresses this but how if if I'm the auditor the auditor is the person you're giving the information to and who wants to verify that the information does come from a trusted from from a source that has uh been authenticated and created the data um if I'm the auditor how do I verify this am I am I the like I'm not trusting certificate authorities to say like this is the actual website well you are you are I absolutely are because you're trusting the public the public key you're in the same trust model as the client was originally right where the client goes to mybank.com Tom his only assertion is that well the browser very looked at the ca list and traced the signature down and see that this is correct public we're using the

certificate uh we're trusting the certificate Authority so yes AB well whatever if that if that model is broken then you're still sort of vable to that but you're trusting the certificate and and and having authentication that the exchange of data that happened between those two parties well you can you can trust that that data has been authenticated well let me let me go to my next question then how does a the auditor uh what what are the practical ways for an the auditor to verify that the exchange of data that happened between the server and the audit uh and the client sorry rather uh is is authenticated and and and correct and so that's what I right so that's that's

kind of what that whole process does but maybe it's not obvious why it does that but no practically how does he do like if you send me send a page PDF or a from your bank how do I check it yeah yeah so so let's say we're talking about the what we might call plain vanilla TLS notary which is where we're doing an interactive protocol what's happening is the two sides the audit sorry the auditor and the client are both generating the preaster secret together they're generating half of each I'll come on to that in a minute because it's a very critical technical Point how that works but they generate it together so they have to pass um uh a couple of messages to each other during handshake during the TLs handshake again I haven't got time to go through that but that's you can imagine there's a

handshake um once that's set up then the client uh sends his request the server response comes back and this is the critical point at that point the client sends a hash of the server response to the auditor the auditor stores that hash then the auditor sends the remaining material back to the client so the client now has the full set of Secrets then the client is back to a full TLS security model he verifies that the page is correct and then he sends that let's say HTML page to the auditor the auditor then has uh the HTML page and the hash when I say HTML page it's the whole server response and the hash and he can verify the hash matches okay because he yeah so but so I guess so the

one one question I want to ask there is or perhaps one thing that needs to be made clear is that this only works with sort of classic vanilla HTTP requests where data is sent it wouldn't work with say a page that has uh subsequent requests like Ajax uh coming back or or Json process absolutely absolutely I want to well I don't want to say absolutely it's impossible but at the moment that doesn't work and I I want to sort of mention that as as one of the list list of problems but there's just one little more kind of section I have to fill in otherwise anyone listening to this knows that knows what I'm talking about is going to say that's absolute nonsense so I have to explain this one more point which is um in order for all of that stuff that I just described to

work you you you have to have the pre-master secret at the start right and here we've got two parties instead of one party usually the client generates just using a you know devu random or whatever on his machine he generates some random bytes actually 48 46 bytes and he sends them across to the server and and and then we're off but what we need to do here is we need to have the preaster secrets split somehow in order for that exor trick that I mentioned earlier to work so the way it's done is using RSA key exchange so um I I said earlier that we use public key encryption to wrap the the secret um sometimes we use Diffy Helman there there's more than one way to do it but if we use RSA key exchange we can exploit a feature of RSA which is that

it has a homomorphism now now what that's a fancy word what it really means um to keep it simple is that if you take the RSA of one number and the RSA of another number then their product is equal to the RSA of their product in other words if you took RSA of 2times RSA of three then that would be equal to to the RSA of six now doing RSA like that is is completely unsafe so people don't do that it's called textbook RSA it's it's appalling to even think of using that as an encryption technique but uh what people usually do is they stick extra random padding bites into their RSA messages in order to prevent uh this from being a problem but here we can actually use it as as a positive because what we can do is take the two premaster secret halves the auditor has

one half and the um the client has another half and with bit of fancy algebra we can still get the effect of the fact that them multiplying together gives us the exact format that we want to send across to the server and still have it be safe in that it has random padding so I mentioned all that I think it's an important although highly technical there a very important detail because that's the only way this could work we need to have the two parties the client and the auditor have some um some of the secret data separately so that we can get this final result of at the end of the process yes uh the the client can have some of the keys but not all of them and I want to note also that the the the auditor doesn't have any of the

keys which is very important technical feature as well today's magic word is auditor a u d t o r head over to let bitcoin.com to sign in enter the magic word and claim your part of poiser reward [Music] so so so let me let me back up and kind of have have like a top top view summary of of this so in in a normal in in a normal TLS connection this is without TLS notary uh there's the client and the server so you know Mah and Adam M is the client Adam is the server right and then

Mah has two Secrets the client has two Secrets the client encryption key and the client Mac key the encryption key is used to encrypt the Mac key is used to create something like a signature but it's not really a signature it's just it's not really a signature but it's something which allows me to create a piece of data and Adam to be sure that that piece of data was actually created by mahair it's something like a signature but not a signature it's something different so me has these two keys something to encrypt with and something to create this kind of rough signature with and on the other you can call it a check sum if you want check Su sorry yeah like a check sum right yeah or let's use the proper term for it Mac yeah yeah and and and then and then on

symmetrically on the other side Ser the server Adam also has these two pairs of Secrets uh the server encryption key and the server Mac key by the way both sides have all four Secrets oh both sides yeah both sides both sides have all all four secrets we could do the whole thing with just one pair of Secrets just an encryption key and a Mac key but there's a technical reason I won't go into why it's better to have two pairs okay so both both sides have all pairs and that's how we are communicating yeah the the problem is like once we have a communication like this it is impossible for me to prove to Sebastian that Adam sent something to me because because Sebastian will ask the question how do I know that these four secrets are

actually the correct ones right so in this case what TLS notary is doing is U it is somehow restricting the power of the client uh so when when the client is actually communicating you give him not all the four Secrets but just three of them and one of them is uh the uh the client does not have one of the secrets and only the combination of auditor and client so Mah and Sebastian has the in combination the fourth secret yeah let's say it's I think the best way to understand it because it is confusing is that the auditor is withholding the data necessary for that fourth secret that the auditor is not withholding that secret he doesn't have

it because if he did that would be a security problem he's withholding the data necessary to create that secret and and and because because the auditor is withholding this this data so there's there's a point in the communication where auditor is withholding this data so then the client which is mAh receives the communication and first of all he creates a hash of the communication like the whole communication sends it to the auditor so the me doesn't have the fourth Secret at this point yeah when he sends the hash the audit sends some data that allows me to calculate the fourth secret you've got it you've got it right and now once I have all the four Secrets I can send the auditor the data and well the first thing the first thing is once

you have all four Secrets you're back to vanilla TNS TLS you can because you you've got your full security model let's say and so then you can read that you can read the web page right because that's actually the next thing that happens is that the the client suppose you're using our browser um add-on you would just like look at the web page at that point you say okay that's that's all right yeah yeah and then and then the auditor so from mayor's perspective now it now this is like a normal TLS connection but from the auditor's perspective what has happened is uh the auditor knows that during some part of the communication Mah did not have all of the secrets yet he sent me a hash of of of the

communication so in in some ways uh me uh I have proof that since Mah did not have all of the secrets yet he sent me a correct hash that this must be the the data pattern he received from the yeah from the Ser the effect of send yeah let's say the effect of sending the hash is to fix the server response isn't it you can't change it after that and so it's fixed before you have the data that you would need if you were going to forge it so you can't forge it without being exposed as a liar because because if you try to forge it you need to have the server Mac to make a a valid forgery right so it's fixing it in advance it's

it's called a a commitment is the kind of general idea of how to do these things yeah okay Sebastian any any any questions on on this so I want to come back to really just the the Practical side how how do you how do we verify this is there a tool is there and and how do we create these notaries can we talk about that the the browser plugin that you've developed yeah absolutely but I think it might be better if you don't mind it if if I just list it doesn't need to take long but there's there's three or four very important limitations to this and then and then it'll make more sense in context how we use it so so the first limitation is um is that it only applies to TLS 1.0 and 1.1 and that is quite a serious maybe

the most serious limitation because at some point they will no longer be supported uh we might be able to create a new version I don't know I that's a huge topic uh so that's one very important limitation the other limitation is the um the fact that you were mentioning uh Sebastian which is that the uh if you have like let's say a dynamic page you you've got a lot of different server um client requests and server responses all kind of mingled up there and we can't really get this commitment uh feature that we were talking about in that context now although that's a very serious restriction and it means that this system only works for certain kinds of web pages uh on the other hand that is a restriction that might conceivably there

might be a way to get round it it might be possible at some point with some extra engineering to to to get around that but that's that's an open question okay uh other restrictions it's restricted to RSA key exchange and again this is an example where we're working with something which is kind of the old version of TLS it's still out there in the wild it's still supported by most servers but at some point in the future it won't be so again you know it might require some new new technique to to solve that um those were the I think the three main oh yeah the fourth main restriction is kind of maybe we've mentioned it but it's just one server response now that's fine if you're just pinging an API and you're just getting one API response but if somebody wanted to audit a whole stream of web pages

that would be a problem right so um well I mean I say it would be a problem it's probably the least significant of those four limitations because you know obviously you could just go back and do it again uh those are limitations so I wanted to really emphasize those limitations because I don't want people to think this is some magic fairy dust right because I've seen people saying things like oh wow de that solves everything but it really doesn't okay it's very restricted but you know still practically could be useful in certain contexts so yeah let's get on to practical applications I agree um so do you want me to give an example of how it might be used in practice yeah how would it be used cuz there's a there's a browser plugin which the Name Escapes Me can you explain how that works page

signer sure so P right page signer um so we set this up I guess around the end of 2014 because we were thinking well you know people want to actually use this how do how is it how can we make it easy to use and the idea is uh well no let me not talk about the the theoretical idea you want the practicals so the practicals is um you can there's a a plugin I think for uh Firefox and chrome yeah not I think definitely for Firefox and chrome and it's basically set up so that you can just literally click uh you go to a web page let's say you go to some uh private message page or some uh yeah just some official web page uh one one amusing one is I I I I verified my teacher certificate so

because actually the the the UK government has a kind of a a website for that so I went and I clicked a button on on the you know the toolbar and what it does is it then reloads the page um under the hood it sets up a whole new TS session for that page page uh reloads it and it gets represented to you now when you when the page is represented to you you'll see it's you'll often see there's some like weird formatting loss because all it's doing is just dumping the first server response so if it's like get index.html it's just literally giving you that uh so and we we want people to understand that so we have a button and you can click and you'll see oh here's the actual raw server response uh and so at that point it will

create a file called aop pgsg file which is just a binary dump of all the relevant data including a signature and what's going on behind the hood there is in order to make it um simple uh I had the idea maybe we should have something like a blind notary server in other words okay yeah you can do an audit with an auditor but you'll have to do that in real time and we we have developed that and you can do that but that's kind of in um inconvenient for most people right interactive protocol with an auditor so what we do is we say right there's a blind notary server out there it doesn't know anything it doesn't know the secrets it doesn't know uh you know there's no login or password or money involved or credentials or anything all it does is

it just generates half a preaster secret pings it over to you waits for a hash and when it gets a hash it signs your response so then anyone can see that that blind notary server has signed you know using this TLS notary protocol uh that web page and the immediate response people have when they when they hear suggestion is well then what about the Trust In The Blind notary server you've got another point of trust in the in the environment there and that's absolutely true but we did um obviate that or alleviate that problem very significantly by using what's called an AWS Oracle now I suspect it's going to be a bit too much to go into like the details of act technology now so so so this this is basically what you're saying is auditing

as a service where yeah that that's that's TS notary as a service yeah yeah so what you have set up is kind of auditing as a service where I so if if I the service provider I can set up an auditor as a service business and I become the service provider what that allows you to do is let's say you are you the user I don't know Alice and you you are going to a certain web page and you want to prove to the world that you got certain data from that web page then you can contact me take my services and then have some kind of of of digital proof that you did get some data from from and that's a

that's the business model many business people in across the world can set up auditing as a service and maybe Alice she doesn't trust just one auditor or and she can do this with like many different auditing as a service companies and then have like very concrete proof of having receive something from a web page yeah it's interesting point I mean it's a it's a business only in as much as there's any trust involved in it um if you try and set up the machine as an Oracle and let me let me give you like the 5sec version of the AWS Oracle idea it's just a machine which is untampered even by its owner okay um it does still require that you trust that Amazon's AWS service works as

intended so it's a trust point with Amazon but basically we set up the machine so that it can't be um tampered it can only be shut down that's all you can do uh so in that sense it wouldn't really be a business model I mean I know as you say there are indeed already business models like that uh I know of a few companies that are sort of based around like notorized that's the idea I mean you can argue whether it's true or not but yeah so I think Sebastian's question was what's the user experience like right right so like like you have this video on your website our listeners can check it out this uh it's uh it's a video

about PID signer and it's like it shows a set of steps people can do in order to generate a certificate of having received a certain page yeah so just explain to us what the user experience is like okay yeah so um if your plan is to get a an let's say an objective proof that you were delivered a certain web page at a certain time let's say for example you're a Trader on I don't know bit finex or something right and you want to prove that you had a thousand Bitcoins in your account um and you can't get bit finex to actually you know well they shouldn't really it's considered private so so what you could do is you could load up your your account page and you could just once

you've installed page sign you could just click the button um on the on the toolbar and as I said before it will load briefly it takes just I don't know 1 to 5 Seconds it doesn't take long maybe maybe 10 seconds it reloads and usually you'll see it reload without formatting I think I already said and so at that point what you have is a file and if you want obviously this is something you have to very carefully consider yourself as an individual you can share that file with a third party well that file is effectively is proof as long as you believe that the AWS Oracle page signer Oracle is set up correctly it is proof that that page was in fact delivered by bitfinex up to you actually trusting bitfinex is public key and you know if

you're sufficiently technical you can check the public key in the file corresponds to the one that your browser reports for bitfinex uh that's actually something you can and I've done that yeah so does that give an idea of how page signer at least might be used in practice Yeah so I've actually tried page signer and it was super easy to install like I mean the the whole TLS notary concept seems complicated but like page signer was like just a breeze to install and I ended up generating proofs of having visited many websites and I oh very good yeah yeah and I have these proofs and I can you know I was thinking of putting one of them on Twitter you know hey look hey look I do own five Bitcoin you know right right exactly yeah you could brag couldn't you yeah yeah I I was like yeah I mean yeah

I mean as if you've tried it then you've probably seen that you know occasionally I mean it always comes up looking a bit weird the page right some and sometimes it just doesn't work at all I mean if if the page is very very Dynamic you might not be able to get certain data so that's one thing I should caution people it's it's not it's what the important point there is if you're ever going to use it please make sure it works before you use it and the other thing you have to be really careful about if you're dealing with sensitive data is that there could be cookies involved because this is an entire server response and in some cases server deliver cookies with the uh with the page so you should you should um look at the kind of response you're getting I mean it depends if it's

not likely to be an issue that's fine uh we do very strongly advise people you know log out right if you're going to if you're going to get proof of a certain page that's fine but then afterwards immediately log out so that that session cookie is no longer valid it just depends on the application but be careful it's not just like everything's easy right let's take a short break to talk about the Gtech blockchain contest Gtech the German Tech entrepreneurship Center is a new center in Berlin for entrepreneurship and they want to support exciting projects happening in this space so that's why they're running a blockchain contest together with rwe which is one of the largest energy companies in Europe and glomus a foundation supporting

entrepreneurship you can participate by submitting your idea for your project and win up to $50,000 in free grant money that's Equity free you just take the money and do what you want with it uh anybody can apply whether you're an early stage startup and perhaps you just have an idea blossoming idea and uh or you can apply if you've already raised funding and are well on your way to becoming the next uh multi-billion dollar company and anybody can apply whether you're in Berlin and Siberia in Shanghai or in San Francisco there's no geographical descriptions and anybody who applies can win up to 12 months of free office space in Berlin uh free mentoring legal support Etc of course that's totally optional if you want to stay in Siberia and work on your

blockchain startup you can also do that the application deadline is March 31st so make sure you submit your idea as soon as possible you can learn more about the contest and apply by going to epicenter bitcoin.com Gtech that's gtec and we hope you'll win we hope you'll make it to Berlin to collect your money and that we'll get to hang out in person now we would like to thank uh GTE rwe and Globus for their support of EP Center Bitcoin so so let's get into how uh how you can build oracles using it and specifically um for our listeners there's there's this very interesting startup called ores which is based out of London uh by an Italian guy called

Thomas bertani and what he has done is he has used TLS notary in order to make a provably honest Oracle an on an oracle that has proof that let's say uh let's say there's a smart contract that needs The Ether to US Dollar exchange rate every every every hour then uh that smart contract can get the ether to Ether to USD exchange rate and also a proof that the Oracle is not lying about that exchange rate could you explain how Thomas built it what's the what's the design behind this well the simple answer to that is no I can't explain how how how Thomas uh built it I I don't have a huge amount of knowledge

about it um obviously I I chat with him from time to time on various venues but um I think it's really interesting what he's doing he's all I all I do know is he's using a combination of ethereum with obviously for the contract with IPS ipfs for the storage and TS notary is one uh way he's using to uh provide the kind of Oracle effect the proof effect the objective proof effect for example I know when he started out he was he was using as a test case Woolf from alpha which kind of an interesting example because Woolf from alpha you know you can get various kinds of knowledge out of it so he could just ping their API uh TLS motorized the the the the API response and so you know you can imagine toy examples like weather and so on

currency and uh but I I know in recent months he's been really kind of moving forward with it I've seen some examples on his his website very impressive um things like YouTube and I don't actually know how it works with the YouTube thing but anyway I only know in general terms right the general idea is that uh he's he's using uh a page signer style notary server I think he might have moved from our original page signer server which was up for like N 9 to 10 months without going down which we're quite happy about he's moved from that I think he's built his own one but it's the same basic design I mean all of our stuff is open source I think he's built his own uh AWS server using the same model but whether

it's his or ours it doesn't matter the basic idea is when you uh use that you're going to generate a a proof like a pgsg we call it proof which can then be distributed it can be put on ipfs or or whatever uh yeah sorry I can't really give you many details about orac so so basically like it's oriz is a service that gets that can fetch information from like like Google's uh Google's API old from Alpha's API or in the future maybe Bloomberg's API yeah and then it can give this information to the smart contract but using TLS noty it can also certify that it actually did fetch this data from Google and that it is not

lying when it says this this comes from Google and then the smart contract can basically take this data from different services and maybe average that data out and have a really good trustworthy source of data it's it's not decentralized but it's it's high throughput and it's it it is trustless to a to a certain degree I'm glad you mentioned that because maybe I don't know how much longer we've got but that's one thing I really forgot to mention I think is really interesting is when I when I wrote a blog post about this I wrote you can think of TLS notary either as a stop gap or as a disintermediation and the stop Gap part is obvious like if you don't have digital signature there's tier lless

notary but the disintermediation part is something that's really fascinated me for a long time like if you use let's say Bloomberg like you mentioned if you use Bloomberg to get your financial data the trust relationship is really interesting because if you're just pinging their API and they don't even know who you are and they're this huge multi-billion dollar company and you're just like nobody yeah it's not decentralized it's using trust point but it's using it in a way that they're not interested in it at all and similarly with this Amazon a AWS Oracle idea we set up this silly little server it's just it's tiny right on Amazon AWS it doesn't hold any money it's not important to anybody Amazon doesn't care about it but you can use it as long as

you're reasonably small you can use it without them caring and yet you're kind of leveraging the trust in Amazon without their permission or involvement um there's a lot of like that I think are very interesting uh yeah so yeah so so what you're saying is it's like orass is a tiny company but it can it can it can leverage the trust network of Bloomberg saying hey we getting that this this data from this company that's been in 20 years in the business and you can trust them for good data but like we can provide as a small company the same quality of data as them by using TLS notary and that allows yeah I I would look it like imagine do you wanted to use TLS notary

to to validate a a $50 million contract well you wouldn't really want to do that because um what so I don't really mean TS I mean page signing you can do TS notary like from person to person as an interactive protocol without any trust in any other parties apart from the the public key of the server right but if you use this kind of lightweight service model then you can you can kind of Leverage trust in Amazon as long as the the the let's say the value of what you're doing is relatively low and also they don't really know about it either they they don't know that you're using it like that so this these are the kind of trust models we're playing with I think so before we uh wrap up here uh this has been a really fascinating

discussion can you tell us where people can learn more about TS notary perhaps install the page signer uh uh extension or even contribute to the to the project sure absolutely uh so TLS notary.org is the is the website um there's uh there's a a link a link there to page sign and you can just install it pretty easily um in terms of contributions uh we we tend to hang out a lot on IRC at the TLs not- chat channel on free node uh there's obviously the GitHub repository which is github.com notary there are several sub repositories uh please do you know read the white paper and give any comments if you have on on the actual sort of

underlying technological ideas uh but that's it really yeah cool anywhere else you want to send you want to send people or uh no no that's fine if you want to contact any of us uh you can you can see our contact details on the contacts page on the website so just just go to the website it's all there really yeah okay great well thanks Adam for coming on and being a guest on our show it was fasing discussion I mean personally I it is it is a little bit over my head technically speaking I'm going to have to listen to that again and really to really get the the grasp of how TLS works because it is an important protocol that we use I would be amazed I would be amazed if you found that easy to understand it took me years so you know all right well thanks

again for coming on and to our listeners thank you for uh tuning in to epicenter Bitcoin once again we release episodes of epicenter Bitcoin every Monday of course we're part of the uh let stock Bitcoin Network you can go to let talk bitcoin.com to find a whole bunch of shows about Bitcoin blockchains cryptocurrencies all kinds of interesting stuff um you can get epicenter Bitcoin on YouTube at youtube.com/ epicenter BTC if you're interested in watching the videos other if you want the audio version you can get that on iTunes SoundCloud or anywhere where you get your podcasts of course if you want to leave us a tip you can do that by tipping the tip address in the show description and if you're interested in getting one of these t-shirts you can always leave us an iTunes review and send us an email at shower bitcoin.com and we'll send one

out to you so thanks so much and we look forward to me back next week [Music] n