2025-07-02, 10:10–10:45 (Europe/Paris), Amphitheater 122
Or how to make sure you are communicating with the right person when using an end-to-end messaging app when the security relies on public keys you fetch from a third party.
In 2023, in an effort to secure the distribution of its users public keys, WhatsApp announced Key Transparency. This aims to automatically verify a secure connection, without user interaction, such as scanning a QRCode. Similar effort have been shared by iMessage, and Proton Mail.
This talk goes over how key transparency works, how it is implemented today, and the challenges and improvements. It builds on deployed systems such as WhatsApp or Cloudflare, and on on-going standardisation efforts at IETF and C2SP.
Thibault is a research engineer working on distributed systems. He is focused on making emerging technologies interoperable with current web standards. At Cloudflare, he works on Privacy Pass, Key Transparency, and alternatives to CAPTCHA systems.