Key Points

References

Reference_description_with_linked_URLs_______________________	Notes______________________________________________________________

Key Concepts

Encryption Key Management

TLS encryption for TCP sessions

IP Layer encryption methods - IPSEC

The primary encryption method used at the IP layer is IPsec (Internet Protocol Security), which utilizes various symmetric encryption algorithms like AES, Triple DES, and Blowfish to encrypt data packets at the network layer, providing secure communication over IP networks; it also includes authentication mechanisms to verify data integrity.

Key points about IPsec encryption:

Encryption algorithms:
IPsec supports a variety of encryption algorithms, including AES (Advanced Encryption Standard) which is widely considered the most secure option today.
Key management:
"Internet Key Exchange (IKE)" protocol is used to securely negotiate and establish shared secret keys between communicating devices before encryption can occur.
Modes of operation:
IPsec can operate in two modes:
Tunnel mode: The entire IP packet is encapsulated and encrypted.
Transport mode: Only the payload within the IP packet is encrypted.
Authentication header (AH):
In addition to encryption, IPsec can utilize an authentication header to verify the integrity of the packet and prevent tampering.

AWS on IPSEC Protocol

Secure Messaging Concepts

Secure Messaging Protocols

Quic Protocol for secure messaging

Potential Value Opportunities

Potential Challenges

RCS Test Messages Not fully secure

While RCS (Rich Communication Services) does use some encryption methods like Transport Layer Security (TLS) to protect messages in transit, it is not considered a fully secure, end-to-end encrypted protocol by default, meaning carriers and potentially governments could access message content if they wanted to; therefore, it is not completely secure in the strictest sense.

Key points about RCS and encryption:

No native E2EE:
The core RCS protocol itself does not have built-in end-to-end encryption, which is the highest level of security for messaging.
Google's approach:
Google has implemented its own encryption on top of RCS using the Signal protocol, but this only works when both users are using Google Messages and have RCS chat enabled.
Carrier access:
As RCS is a carrier-based technology, service providers could potentially access message content if they wanted to.

Google on RCS chats security

Google RCS is proprietary but now fully encrypted protocol - 2024

Passkeys for Security

why use passkeys and how do passkeys for enhanced security work with examples - FIDO 2 model

https://www.dashlane.com/blog/what-is-a-passkey-and-how-does-it-work

Passkeys are used to replace traditional passwords with a more secure login method that relies on a user's device's biometric authentication (like fingerprint or facial recognition) or PIN, essentially eliminating the risk of password breaches by storing sensitive credentials directly on the user's device instead of on servers, making them significantly more secure and user-friendly; for example, when logging into a banking app with a passkey, you would simply scan your fingerprint instead of typing a password, preventing phishing attempts where someone might try to steal your password through a fake website.

How Passkeys Enhance Security:

Device-based Authentication:
Passkeys are tied to the user's device and require biometric or PIN verification to access accounts, meaning even if a hacker gets your passkey data, they cannot use it without physically accessing your device and authenticating with your biometrics.
No Password Storage:
Unlike traditional passwords, passkeys are not stored on servers, so even if a server is compromised, user credentials are not exposed.
FIDO Standard:
Passkeys are built on the FIDO (Fast Identity Online) standard, which ensures compatibility across different platforms and devices, allowing users to sign in with the same method regardless of the website or app they are using.
Phishing Resistant:
Since passkeys rely on device-based authentication, they are significantly more resilient to phishing attacks where users might be tricked into entering their credentials on a fake website.

Example Scenarios:

Logging into a banking app:
Instead of typing a password, you simply scan your fingerprint or use facial recognition to authenticate with your passkey.
Accessing a website on a new device:
When you try to log in to a website on a new phone, you can use your existing passkey by scanning your fingerprint on the new device, eliminating the need to create a new password.
Multi-factor Authentication (MFA):
Passkeys can often function as a form of MFA by combining your device-based authentication with an additional security layer like a notification on your phone.

Key Points about Passkeys:

Wide Adoption:
Major tech companies like Apple, Google, and Microsoft are actively integrating passkey support into their operating systems and browsers.
User Experience:
Passkeys aim to provide a more seamless login experience for users by eliminating the need to remember and manage complex passwords.
Future of Authentication:
With their enhanced security features, passkeys are widely considered the future of passwordless authentication.

MFA with SMS text codes is not secure

Government Issues New iPhone, Android 2FA Warning—Stop Using SMS Codes Now. - Forbes 241222

a mandate to “use only end-to-end encrypted communications… such as Signal or similar apps.” Users are urged to use apps that are “compatible with both iPhone and Android operating systems, allowing for text message interoperability across platform,” ruling out Google Messages and iMessage.

2FA/MFA is clearly an absolute as well. This needs to be “FIDO phishing-resistant authentication,” which means something linked to authenticated user hardware allowing for some physical form of authentication. “Where feasible, hardware-based FIDO security keys, such as Yubico or Google Titan, are the most effective; however, FIDO passkeys are an acceptable alternative.”

Hardware-based FIDO security keys, also known as physical security keys or hardware tokens, are external devices that allow passwordless logins. They connect to endpoint devices using USB, NFC, or Bluetooth. Some examples of hardware-based FIDO security keys include:

YubiKeys: A popular example of a hardware-based FIDO security key
Hideez Keys: A popular example of a hardware-based FIDO security key
Solokeys: A popular example of a hardware-based FIDO security key

Other types of FIDO security keys include:

USB-based keys: These keys are versatile and connect to devices' USB ports for authentication.
NFC-enabled keys: These keys provide contactless authentication with NFC-enabled devices.
Bluetooth security keys: These keys enable wireless authentication and are useful for devices without USB ports.

When choosing a FIDO security key, you can consider things like: hardware-based security features, user experience, and certification and compliance requirements.

Not all applications and websites support security keys as a form of authentication.However, many major platforms, including Google, Facebook, Dropbox, and GitHub, support them

Other advice includes locking phones, SIMs and carrier services (such as voicemail) with a PIN wherever available. “This PIN is required for logging into your account or completing sensitive operations, such as porting your phone number—a critical step in countering SIM-swapping techniques.”

FIDO passkeys

FIDO (Fast Identity Online) passkeys are a type of authentication method that use public-private key cryptography to improve online security. They can take many forms, including:

A hardware security key
A passkey registered to a website on your browser
A smartphone with built-in biometric capabilities
Synced passkeys, which are shared across multiple devices
Hardware-bound passkeys, which are stored in dedicated hardware devices

Here are some examples of how FIDO passkeys work:

Sign in: The user receives a prompt to sign in with a passkey.
Authentication: The user completes a local authentication method using biometrics, a local PIN, or by touching their FIDO Security Key.
Verification: The client device sends the signed challenge back to the service, which verifies it with the stored public key and signs the user in.

FIDO passkeys are considered phish-resistant because of their cryptographic communication protocols and the fact that they must be registered with the authenticating service.

Browser not supported