We have Sarah Harvey (@worldwise001 on Twitter) to talk about SOC2, what it means, how to get it, and if it's important or not. The discussion centers around two blog posts written by Thomas:

• SOC2 Starting Seven: https://latacora.micro.blog/2020/03/12/the-soc-starting.html
• SOC2 at Fly: https://fly.io/blog/soc2-the-screenshots-will-continue-until-security-improves/

Transcript:
https://securitycryptographywhatever.com/2022/10/16/SOC2-with-Sarah-Harvey/

Links:

• Tailscale recent post on getting SOC2’d: https://tailscale.com/blog/soc2-type2/
• SSO Tax: https://sso.tax
• David’s previous job: https://getnametag.com
• David's other startup: https://censys.io
• Thomas works at https://fly.io

"Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

This episode got delayed because David got COVID. Anyway, here's Nate Lawson: The Two Towers.

• Steven Chu: https://en.wikipedia.org/wiki/Steven_Chu
• CFB: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Cipher_feedback_(CFB)
• CCFB: https://link.springer.com/chapter/10.1007/11502760_19
• XXTEA: https://en.wikipedia.org/wiki/XXTEA
• CHERI: https://cseweb.ucsd.edu/~dstefan/cse227-spring20/papers/watson:cheri.pdf

Transcript:
https://securitycryptographywhatever.com/2022/09/29/nate-lawson-ii/

Errata:

• Pedram Amini did in fact do Pai Mei

"Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

We bring on Nate Lawson of Root Labs to talk about a little bit of everything, starting with cryptography in the 1990s.

Transcript:
https://securitycryptographywhatever.com/2022/09/09/nate-lawson-part-1/

References

• IBM S/390: https://ieeexplore.ieee.org/document/5389176
• SSLv2 Spec: https://www-archive.mozilla.org/projects/security/pki/nss/ssl/draft02.html
• Xbox 360 HMAC: https://beta.ivc.no/wiki/index.php/Xbox_360_Timing_Attack
• Google Keyczar HMAC bug (reported by Nate): https://rdist.root.org/2009/05/28/timing-attack-in-google-keyczar-library/

Errata

• HMAC actually published in 1996, not 1997
• "That was one of the first, I think hardware applications of DPA was, was, um, satellite TV cards." Not true, they first were able to break Mondex, a MasterCard smart card

"Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

Are the isogenies kaput?! There's a new attack that breaks all the known parameter sets for SIDH/SIKE, so Steven Galbraith helps explain where the hell this came from, and where isogeny crypto goes from here.

Transcript:
https://securitycryptographywhatever.com/2022/08/11/hot-cryptanalytic-summer-with-steven-galbraith/

Merch: https://merch.scwpodcast.com

Links:

• https://eprint.iacr.org/2022/975.pdf
• https://eprint.iacr.org/2022/1026.pdf
• https://ellipticnews.wordpress.com/2022/07/31/breaking-supersingular-isogeny-diffie-hellman-sidh/
• GPST active adaptive attack against SIDH: https://eprint.iacr.org/2016/859.pdf
• Failing to hash into supersingular isogeny graphs: https://eprint.iacr.org/2022/518.pdf
• https://research.nccgroup.com/2022/08/08/implementing-the-castryck-decru-sidh-key-recovery-attack-in-sagemath/
• Kuperberg attack via Peikert: https://eprint.iacr.org/2019/725.pdf
• SQISign: https://eprint.iacr.org/2020/1240.pdf
• (Post recording)  Breaking SIDH in polynomial time:
  https://eprint.iacr.org/2022/1038.pdf

"Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

Adam Langley (Google) comes on the podcast to talk about the evolution of WebAuthN and Passkeys!

David's audio was a little finicky in this one. Believe us, it sounded worse before we edited it. Also, we occasionally accidentally refer to U2F as UTF. That's because we just really love strings.

Transcript:
https://securitycryptographywhatever.com/2022/08/11/passkeys-with-adam-langley/

Links:

• GoogleIO Presentation
• WWDC Presentation
• W3C WebAuthN
• Adam's blog on passkeys and CABLE
• Cable / Hybrid PR
• CTAP spec from FIDO
• Noise NKPSK
• DERP

Don't forget about merch! https://merch.securitycryptographywhatever.com/

"Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

Side channels! Frequency scaling! Key encapsulation, oh my! We're talking about the new Hertzbleed paper, but also cryptography conferences, 'passkeys', and end-to-end encrypting yer twitter.com DMs.

Transcript:
https://securitycryptographywhatever.com/2022/06/17/hertzbleed/

 Links:

• Hertzbleed Attack | ellipticnews (wordpress.com)
• https://www.hertzbleed.com/hertzbleed.pdf
• https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3920031

Merch: https://merch.scwpodcast.com

"Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

The US government released a memo about moving to a zero-trust network architecture. What does this mean? We have one of the authors, Eric Mill, on to explain it to us.

As always, your @SCWPod hosts are Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@davidcadrian).

Transcript:
https://securitycryptographywhatever.com/2022/06/10/omb-zero-trust-memo-with-eric-mill/

Links:

• OMB Memo
• Executive order on cybersecurity 
• PIV card 
  • Derived PIV
• BeyondCorp
• HSTS Preloading
  • .gov preloading 
• Neither Rain, Nor Snow, Nor MITM
• EDR memo
• Technology Transformation Services (TTS)
• Is it Christmas?

"Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

We talk about Tink with Sophie Schmieg, cryptographer and algebraic geometer at Google.

Transcript:
https://securitycryptographywhatever.com/2022/05/28/tink-with-sophie-schmieg/

Links:

• Sophie: https://twitter.com/SchmiegSophie
• Tink: https://github.com/google/tink
• RWC talk: https://youtube.com/watch?t=1028&v=CiH6iqjWpt8
• Where to store keys: https://twitter.com/SchmiegSophie/status/1413502566797778948
• EAX mode: https://en.wikipedia.org/wiki/EAX_mode
• AES-GCM-SIV: https://en.wikipedia.org/wiki/AES-GCM-SIV
• Deterministic AEADs: https://github.com/google/tink/blob/master/docs/PRIMITIVES.md#deterministic-authenticated-encryption-with-associated-data
• Thai Duong: https://twitter.com/XorNinja
• AWS-SDK Vuln: https://twitter.com/XorNinja/status/1310587707605659649

"Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

Live from Amsterdam, it's cancellable crypto hot takes! A fun little meme, plus a preview of the Real World Crypto program!

Transcript:
https://securitycryptographywhatever.com/2022/04/12/cancellable-crypto-takes-and-real-world-crypto/

Links:

Tony's twete: https://twitter.com/bascule/status/1512539700220805124
Real World Crypto 2022: https://rwc.iacr.org/2022
Merch! https://merch.scwpodcast.com

Find us at:
https://twitter.com/scwpod
https://twitter.com/durumcrustulum
https://twitter.com/tqbf
https://twitter.com/davidcadrian

"Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

We're back! With an episode on lattice-based cryptography, with Professor Chris Peikert of the University of Michigan, David's alma mater. When we recorded this, Michigan football had just beaten Ohio for the first time in a bajillion years, so you get a nerdy coda on college football this time!

Transcript:
https://securitycryptographywhatever.com/2022/03/12/lattices-and-michigan-football-with-chris-peikert/

Slides: https://web.eecs.umich.edu/~cpeikert/pubs/slides-qcrypt.pdf

Links:

He Gives C-Sieves on the CSIDH: https://eprint.iacr.org/2019/725
Lattice-based Cryptography: https://cims.nyu.edu/~regev/papers/pqc.pdf
NIST PQC Competition: https://csrc.nist.gov/Projects/post-quantum-cryptography
The 2nd Bar Ilan Winter School on Cryptography Lattice- Based Cryptography and Applications: https://www.youtube.com/playlist?list=PL8Vt-7cSFnw2OmpCmPLLwSx0-Yqb2ptqO
A Decade of Lattice Cryptography: https://eprint.iacr.org/2015/939.pdf

Find us at:
https://twitter.com/scwpod
https://twitter.com/durumcrustulum
https://twitter.com/tqbf
https://twitter.com/davidcadrian

"Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)