Computer Scientists at the University of Wuppertal Research Smart Encryption Methods
In the project "Foundations of Secure Storage for Encrypted Instant Messaging", the research team is targeting security gaps in instant messaging services such as WhatsApp, Threema and Signal: While the encryption of transmitted data - also called "data in transit" - is considered cryptographically very strong by modern techniques, the storage of sent messages on the phone or as a backup in the cloud - the so-called "data at rest" - is still a weak point and thus a potential point of attack. Attackers could use it to bypass and undermine the strong guarantees provided by in-transit encryption and ultimately gain access to the data. The researchers therefore want to investigate how the strong security properties that have already been achieved for "data in transit" can also be transferred to "data at rest". "This would significantly strengthen the security of modern instant messaging procedures," says Dr Davies, a member of staff at the IT Security and Cryptography department and an expert in cryptographic storage of data.
The "Foundations of Smart Encryption" project is about investigating "Smart Encryption", a novel class of encryption methods based on so-called "Smart Contracts". "A smart contract, in turn, is based on blockchain technology. All relevant information and conditions are stored on this blockchain and the contract is automatically executed when the conditions are met. However, the data stored in smart contracts is always publicly visible at first," says Jager. Smart encryption methods can be used to develop contracts in which not all data is visible and correspondingly encrypted data can only be decrypted if the contract specifies it through certain criteria, resulting in numerous possible applications. One such application is time-based encryption, where data is securely encrypted until a specified time and then immediately freely accessible to everyone. This makes it possible to send confidential data "into the future", which can be used in digital auctions with secretly placed bids, for example. "In classical auctions, a corrupt auctioneer could open the secretly placed bids in advance and communicate these bids to third parties. Time-based encryption replaces the auctioneer and guarantees that the bids remain securely encrypted until the end of the auction and only decrypt themselves afterwards almost by themselves" explains Prof. Jager. Dr. Kakvi, who also works at Prof. Jager's Chair of IT Security and Cryptography, mentions another concrete application: "We also consider the case of 'Accountable Lawful Interception': Encrypted messages that can only be decrypted by an authority if a judge digitally signs a search warrant for it." This warrant would contain restrictions to ensure that the authority can only decrypt certain data. "For example, 'All messages from Alice to Bob sent in September 2021'. However, it is not possible for the authority to decrypt data that does not comply with the warrant, for example messages from third parties or messages from Alice to Bob from other time periods," Dr. Kakvi explains.
In contrast to other approaches to make encryption accessible to authorities, Smart Encryption has much less potential for abuse, according to the expert. "IT security experts and civil rights activists have been discussing such procedures with politicians for a long time," says Prof. Jager. "We are generally very critical of cryptographic backdoors because of their immense potential for abuse. An absolute minimum requirement is that it is transparent and unforgeable, i.e. 'accountable', to trace when an authority has accessed which data. In the project, we will investigate whether and under what conditions this is possible at all. The results of the group should contribute further well-founded arguments to this discussion in the future.
