Nathaniel McCallum

If you’re designing a project where security is uppermost, but you want to make it easy to use and compatible with multiple platforms (existing and future), what principles should you follow, and how do they translate into an architecture and actual code. We’ll present the 10 security design principles of the Enarx project, and discuss why they led us to where we are today: a Rust-based open source project with a WebAssembly run-time.

Other people: Mike Bursell axel simon

Increased uses of cryptography in web environments, particularly authentication, have driven a set of new RFCs: JSON Object Signing and Encryption. While these standard data formats have dominated web-based applications, they also have further applicability in a wide variety of non-web contexts. This talk will introduce you to José, a plug-able, open source C implementation of these RFCs which provides both an API for direct integration and a usable command-line interface. We will discuss the techniques that we used to keep our API usable across all the possible input parameters and show example of how you can implement José in your own infrastructure. We will also discuss some of our plans for the future, including how you can help contribute.

This talk covers an alternative to key escrows using new cryptographic techniques implemented by the Clevis (client) and Tang (server) projects.

Keeping secrets is tough. It is hard enough when you have control over the full computing chain. But now we are expected to keep secrets while storing those secrets in cloud and SaaS infrastructures. At least we can trust the network providers, right? Of course, the answer is to encrypt the data. But then how do we know who should have access to the data and when? This talk will look at the new strategies and cryptographic techniques implemented by the Tang and Clevis open source projects. Tang forgoes complex (and compromise-prone) key management infrastructures by using simple algorithms to bind data to third party entities. Clevis permits sophisticated unlocking policies that go beyond simply password management to true attributed cryptography. Come see how to integrate Tang and Clevis into your infrastructure or software project!