encryption

Tom Caputi presents the design of native encryption for ZFS at the OpenZFS Developer Summit, including design decisions and how authentication uses checksum fields.

Moxie Marlinspike speaks at Next Generation Threats 2014 about the challenges of encrypted communication and how Signal addresses them. He also draws on American action movies as narrative for secure communications.

Apple security head Ivan Krstic gives a Black Hat 2016 talk on iOS security, covering HomeKit, Auto Unlock and iCloud Keychain. He explains key hierarchies and how data can stay safe even in adversarial clouds.

Moxie Marlinspike's BlackHat 2011 talk examines weaknesses of SSL and the certificate authority system and proposes Convergence, a decentralized notary approach with trust agility.

A Google Tech Talk by Steve Weis that introduces modern cryptography and its use in practice and at Google. It covers proofs of security and security definitions and a special topic. HN commenters treat it as a talk on verifiable electronic voting.

Mike Hearn's talk at the 2012 London Bitcoin Conference on the future of Bitcoin, new applications and rebuilding the banking system. He covers lesser-known protocol features such as contracts, escrow and scripting.

Bob Beck of OpenBSD describes the first month of LibreSSL, the fork aimed at cleaning up OpenSSL, including oddities found in the code base and why it was cleaned rather than audited cryptographically.

Kim Nilsson presents his investigation into how Mt. Gox was hacked and mismanaged, tracing the finances and the missing bitcoins. It was given at the 2017 Breaking Bitcoin meetup.

Moxie Marlinspike's DEF CON 19 talk on the weaknesses of SSL and the certificate authority system. He explains how CA trust became a problem and proposes an alternative that removes the CA oligopoly without reducing security.

Andreas Antonopoulos explains how to tell Bitcoin-style blockchains from corporate blockchain hype. He argues the goal should be de-banking everyone rather than banking the unbanked.

Moxie Marlinspike's Black Hat talk presenting sslstrip, which defeats SSL in practice by intercepting the http-to-https redirect.

Peter Rizun and Andrew Stone present results of tests running 1 GB blocks on a Bitcoin test network at Scaling Bitcoin Stanford. The talk argues for big-block scaling and discusses its consequences.

Daniel J. Bernstein and Tanja Lange survey recent highlights in post-quantum cryptography at 35C3, covering the NIST competition, network protocol experiments, and broken candidates.

Brian Warner, author of magic-wormhole, presents the tool at PyCon 2016. He explains how a few secret words let two computers securely transfer files, covering the cryptography (NaCl, SPAKE2) and library use.

Bob Beck of OpenBSD gives a BSDCan 2014 talk on the first month of LibreSSL, the OpenSSL fork. He explains why they forked, what they removed, and examples of the problems found in the OpenSSL code base.

Rob Pike presents Upspin at Gopherfest 2017, an experimental framework for naming and sharing files and data securely and uniformly across a global namespace. It is a project written in Go rather than about Go.

Troy Hunt argues that even static, non-secret websites need HTTPS, demonstrating attacks such as injected content and China's Great Cannon. It accompanies his blog post of the same name.

Joe Grand recounts being hired to hack a Trezor One hardware wallet and recover $2 million of cryptocurrency. He describes three months of experimentation, voltage glitching, failures and high-stakes attempts with only one chance to get it right.

Ivan Krstic's Black Hat talk on Apple platform security, including the Find My design that uses elliptic curve key diversification to locate offline devices privately. It also covers hardware features such as the T2 chip and secure boot hardening.

The fail0verflow team (bushing, marcan, sven) present console hacking at 27C3, covering Wii, Xbox 360 and PS3 exploits. They explain how the PS3 was cracked after Sony removed Other OS.

Moxie Marlinspike's 36C3 talk examines why distributed and decentralized technology is hard to build into consumer products, from the perspective of developing Signal. It argues that ecosystems move slowly and federation causes problems.

Scott Arciszewski's DEF CON 26 Crypto and Privacy Village talk critiquing the JOSE standards (JWT, JWS, JWE) and showing how to design cryptographic tokens more safely.

David Mazieres presents the Stellar Consensus Protocol at Google, introducing federated Byzantine agreement. The model lets participants choose whom to trust rather than assuming fixed membership.

Dan Callahan presents Mozilla Persona, a decentralized, cross-browser authentication system that removes site passwords, at PyCon 2013. He explains how the protocol works and how to add it to a Python site.

The fail0verflow 27C3 talk on breaking PS3 security, covering how Sony's implementation failed, including its ECDSA mistakes.

Andreas Antonopoulos argues that money has a fourth function beyond store of value, medium of exchange and unit of account, which is as a system of control. He covers the history of money and why it does not flow freely.

Ian Miers' Devcon4 talk on failures in on-chain privacy for Bitcoin and Ethereum. It covers attacks on transparent and decoy-based schemes, including how Monero-style privacy can be eroded over repeated transactions.

A Real World Crypto 2017 talk by a Google engineer on using private set intersection to match ad views with in-store purchases. It describes privacy-preserving matching that avoids exposing personal transactions.