Re: [saag] PQC in ZRTP (RFC6189) and hybrid KEM

[Jon Callas <[e-mail]>]

> On Nov 23, 2021, at 08:20, Eric Rescorla <[e-mail]> wrote:
> 
> I think at this point we have fairly strong evidence that of in-band confirmation of SAS codes is fairly subject to impersonation via modern voice synthesis techniques.
> 

I don't quite know how to respond because on the one hand, yeah, deep fakes are only going to get better but it's not like that's a problem unique to ZRTP.

This is a place where I've always diverged with my co-authors, and think that the SAS isn't really as cool as they think it is.

However, when one argues against the SAS, there are a number things to keep in mind, because their over-enthusiasm for it tends to distort how to think about it.

In my opinion, the best thing about ZRTP is not the SAS, but its key continuity aspects. Key continuity between calls lets you know a useful thing: that the end point you're talking to now is the same endpoint you were talking to before. Regardless of how you verify the authentication with SAS or whatever, we know this from the cryptography.

This is subtle, because you can verify a call at the beginning. Or you can talk with someone and then decide you want to verify. Or you can end the call, call them back, and then verify. This flexibility makes the attacker's job a lot harder. They can't just spoof the authentication and go away, the spying infrastructure they create has to be brought up and kept active throughout a *history* of calls. This means especially that a deep-faked attacker has a hard job ahead of them.

Another thing to remember is that the SAS doesn't *have* to go through the voice channel. My co-authors, in their enthusiasm, can distract someone from using another mechanism. Sure, if the only thing you have is a voice line and nothing else, it's fine. That's not a MUST, though, it's a MAY. You can use whatever texting system you have (even SMS) with a high degree of security because it's out-of-band from the voice. I know that last flourish I made about SMS is going to annoy some people, so yeah! Use your favorite MLS messenger to send the thing securely. That works too. However, unless you verified *that* transaction by reading off its fingerprint through an out-of-band channel, then it's just as insecure as the ZRTP connection or even the SMS.

And this brings me to the last bit. The reality is that people don't verify connections. Humans just plain suck at that. I can't remember the last time I verified a Signal safety number. Most people I now kinda joke about them, especially in long-standing group chats where someone seems to be getting a new phone all the time.

It's important that we not fall into the security nihilism of saying that verification is hard, therefore this thing is worthless. The verification problem exists throughout most of our systems, not just ZRTP. I probably use a dozen WebRTC sessions a week that never really verify themselves, and for all we know have some totally YOLOed self-signed cert underneath, if anything at all.

The SAS is nice. It's cute. It's got value to it, just not what its proponents are so enthusiastic about. Key continuity is much better because it places a burden on an attacker. And in the real world, we seem to do just fine with a gazillion protocols that don't verify their trust anchors, or create a turtle-tower that extends out of sight.

	Jon