End-to-End Encryption in Elixir with Ockam

Machines, within distributed applications, operate by exchanging messages with cloud services and other remote machines. Secure, private, and trustworthy connected applications must protect these messages from eavesdropping, tampering, and forgery.

Ockam is a suite of open source programming libraries and infrastructure that make it simple for applications to dynamically create end-to-end encrypted, mutually authenticated, granularly authorized, lightweight secure channels that protect messages, end-to-end — from their source to their destination.

This enables secure communication between application layer entities that are not directly connected by simple point-to-point transport connections. En-route encrypted messages can travel over multiple transport layer connections and can be stored in message queues, databases or caches for asynchronous, end-to-end protected communication between entities that may not be online at the same time.

In this talk, we’ll dive into the design of Ockam’s Elixir libraries and the protocols they implement to provide end-to-end secure and private communication.

Transcript

1. End-to-End Encryption in Elixir with Ockam Mrinal Wadhwa CTO, Ockam mrinal
2. Verb Subject Object Allow / Deny
3. Action Subject Resource Allow / Deny
5. The operating environment of a typical application looks like this. Internet Infra Network Machine Application
6. The operating environment of a typical application looks like this. Internet Application Cloud / Data Center / Home / Hospital / Factory … VPC / Kubernetes / NAT / Edge / No-IP wireless / Industrial VM / Container / K8s Pod / Rack Server / IoT 
 Industrial / Embedded / Edge Device
7. Distributed applications work by sending each other messages across networks, over the Internet. Internet Infra Network Machine Application Internet Infra Network Machine Application Data, Commands, Acknowledgments, Configuration & Software Updates
8. To be secure both sides must check incoming messages for integrity and authenticity. Internet Infra Network Machine Application Internet Infra Network Machine Application Message Integrity & Authenticity Sender Identi fi cation & Authentication Authorization There is a complex set of cryptographic protocol guarantees that go into delivering those checkmarks.
9. To ensure user privacy and to protect business data both sides must have control of data con fi dentiality and access. Internet Infra Network Machine Application Internet Infra Network Machine Application Message Integrity & Authenticity Sender Identi fi cation & Authentication Authorization Con fi dentiality There is a complex set of cryptographic protocol guarantees that go into delivering those checkmarks.
10. Internet Infra Firewalls / VPN / TLS termination Machine Application Internet Infra Machine Application Traditional approach is to check our message guarantees at network boundaries. Firewalls / VPN / TLS termination
11. Internet Infra VPN Internet Infra VPN But network boundaries typically have hundreds of machines and thousands of applications within them.
12. Internet Infra VPN Internet Infra VPN All code in both networks must have no weaknesses for an application developer’s work to be secure.
13. Lab 1 Lab 2 Lab 500 Cloud AZ 1 Cloud AZ 2 Data Center 1 Data Center 2 All code in all deployment networks must have no weaknesses for an application developer’s work to be secure.
14. Lab 1 Lab 2 Lab 500 Cloud AZ 1 Cloud AZ 2 Data Center 1 Data Center 2 Gateways Event Streams Pub/Sub Queues All code in all deployment networks and all service provider networks must have no weaknesses for an application developer’s work to be secure. This also violates the principle of least privilege
15. Goal: Dependable, Trustworthy, Reliable applications To build a secure and private application that can be trusted by users and customers - we need to minimize the chances (vulnerability surface) of someone tricking our application into doing something undesirable. Big vulnerability surface is bad. Tiny vulnerability surface is good.
16. End-to-End Encrypted, Mutually Authenticated, Secure Channels enable granular authorization decisions at the application layer.
20. Sender: • Needs to know the route to a destination, makes that route the onward_route of a new message • Makes its own address the the return_route of the new message Replier: • Makes return_route of incoming message, onward_route of outgoing message • Makes its own address the the return_route of the new message
26. Sender: • Needs to know the route to a destination, makes that route the onward_route of a new message • Makes its own address the the return_route of the new message Hop: • Removes its own address from beginning of onward_route • Adds its own address to beginning of return_route Replier: • Makes return_route of incoming message, onward_route of outgoing message • Makes its own address the the return_route of the new message
35. Initiator Responder app echoer 4000
39. Initiator Responder app echoer 4000
40. Middle Responder h1 echoer 4000 Initiator app 3000
45. Middle Responder h1 echoer 4000 Initiator app 3000
46. Initiator Responder Shared Secret Shared Secret M1 M2 M3 M4 M5 The shared secret is then used as a key in Symmetric Key Cryptography to maintain con fi dentiality and integrity of application data. Application Data - Authenticated Encryption The entities involved use Public Key Cryptography to authenticate each other and agree on a shared secret. Authenticated Key Exchange
47. Middle Responder h1 echoer 4000 Initiator app 3000
52. Middle Responder h1 echoer 4000 Initiator app 3000
53. Middle Responder h1 echoer 4000 Initiator app 3000
54. Middle Responder Forwarder echoer 4000 Initiator app 3000
59. Middle Responder Forwarder echoer 4000 Initiator app 3000
65. Mrinal Wadhwa CTO, Ockam mrinal github.com/ockam-network/ockam github.com/ockam-network/ockam/tree/develop/examples/elixir/get_started All code examples from this talk: