Um, as you said, my name is Benedict and I am a full stack job developer from Oslo, Norway.

Still Europe.

And today I'm gonna share with you what I learned.

Ah, so far about encryption.

And that, more importantly, key management when it comes to encryption on my quest to figuring out how to make a privacy first.

Um period, Uh, period tracker or menstrual cycle tackle the checker.

It depends on the world.

But where do you use?

Um I hope I can help lower the bar when it comes to encryption s so that maybe you also will use encryption in your next side Proud project and maybe later at work.

But first, we'll have some story time.

For years and years, I've been able to keep consumer Benedicta away from developer Benedicta Consumer Benedicta has been using APS, and service is like most regular users.

You know, I have nothing to hide.

And if I did like, I just don't have the time but then to care about it.

But then, um, this winter Ah, the first kind of major league that health APS and especially menstrual cycle trackers were leaking data to Facebook through Facebook analytics.

And later, just couple of weeks ago a new report came out where they're potentially sharing that data with other people.

Ah, some companies selling it and some using it for Reacher research, which is a good cost.

But it's still something we need to know about as a consumer when we make choices.

So Benedicta developer Benedicts and Consumer Benedict had to have a little talk.

Ah, because, um, right after this leak came out, my period tracker Clue, which is one of the nicer ones, sent me this email.

And it says that on Lee, a few people have access to the tools we use to look into the data basis and that that's the point for consumer Benedict Ah realized you know what developer Benedict has always known and that's this data is just there in plain text.

I mean, it's in the database and somebody needs to have access to that database, and it could be any of you.

It could be me, could be in my friend from university and with some types of data that could just be, you know, very awkward conversations are not like trying to pretend that I haven't seen the data s o for me.

Kind of hit home or personally when I started thinking about that same area then, kind of like the big data scenario.

Um, so in the back of my mind, I've always felt like the's APS have been very invasive.

They're very detailed.

They don't care about Only when my period is.

It's like how much and for how long.

And like all these kinds of weird questions, and my friend has been single for months.

She's tired of getting the The question every day is like, Have you had sex?

No, not yet.

Um, And like, there's been, like, this thing in the back of my mind like, Why are they so invasive?

And I've realized, of course, it's because they're going to use this data, um, for something else.

So they need a certain kind of detailed level.

So my idea of making so in the back of my mind, I've always wanted to make, um, less invasive and less detailed after would fit, um, fit my cycle better.

And I thought if I was ever gonna make this, I need to learn how to shield myself from my user's data.

I want to be one of those can't be evil acts.

I don't wanna be the one Don't be Evil s.

So I sat down and I did what any sane developer reduced that I made the proposal that got me on the stage today saying, stating, I'm gonna learn what I need to learn to make a privacy First app.

So that's what I did.

Um, and also, while I was, like, inhaled the site, same developer do as well.

While I was protesting ating finishing these slides, I actually took a stab at making the app s.

So it's called Powell and I launched it on product tenders, a very minimal version.

And on the same day that new leak came out.

So, you know, could think that I actually had an agreement with these journalists because it was just hours after I released Palin on product and the supporting the tension has been Really it's blown.

My mind, like people are really interested.

They really want such a nap.

So I've decided to just keep focusing on actually making the app and will try to launch on March 8th 2020.

For those you don't know what that day is.

It's the International Women's Day.

Um, so I'm happy to say it seems like privacy is becoming more mainstream and people are getting interested in knowing where their data is going.

And also maybe, um, having a say in where it's going before ago into encryption.

I just need to think Geoffrey is not Geoffrey from one password.

It was really hard trying to find information on this topic from, ah, Web app perspective.

There's a lot of more theoretical knowledge, but the only real luck riel content I found on how the full flow of a Web application goes.

It's, um it's ah, this security white paper by, um, Jeffrey, who works at one password, which is a great app.

So if you wanna look into it more after my talk, which is very introductory, you should try to read this white paper and I'm a nube.

I just learned this, and I'm gonna trying to explain how to use encryption algorithms.

I will not go into how they actually work on you.

Will should not try to make your own encryption.

That is something that will take about 20 years to be able to do if you're going to do it on the state secret level.

Yeah, You first need your PhD in about 15 years of experience and then you're allowed to make encryption.

So that's and not for us.

And I would not go through all the attack factors ever looked more into How would you actually do it?

Because that's what I found lacking.

So, um, I'm actually, um I have a master of computer science, and I remember talks about encryption, but I feel like I know a way wave.

Thio knew too little about it.

Ah, and I'm still, as I said in all of the people making encryption algorithms, but we're going to go and look at how to use them and especially key management.

As I realised, using algorithm using the encryption algorithms are fairly easy.

But what to do about all the keys we're going to get into?

So this is a basic, um, encryption algorithm, our encryption flow.

Ah, you have your plain text and you have a key and then encrypted on what comes out is called cipher or cipher text, and then to get their plain text back, your reverse it through your description, your decryption algorithm, One of the things that I spent on embarrassingly long amount of time to figure out This, uh, what is this key?

It's usually just drawn as a key the same way I did.

Ah, and I was like this key.

It's, you know, the start of magical thing.

But it turns out it's a very long sequence of characters, um, on.

But you use different algorithms to make them for specific.

You generate them for specific algorithms.

But basically they're just long, random strings of characters.

Um, and it turns out that ran them long.

Random strings of character is really important in encryption.

And so they even have a word for it called entropy.

And because if you have something that's easy to guess, then the whole thing would fall apart.

Then you would just guess the key or guess the password, um, and encryption would fall apart.

Mmm.

And if you now you know very off a script Developers, if you're thinking, Ah, math random right now, then that is not a true random algorithm.

That's something called a pseudo random.

They gives you pseudo random values, but what we need is a crypto cryptographic lee strong random values.

Therefore showing a code example we're going to look at than analogy that's often used in the crypt a world away To think about encryption is how we secure our belongings by locking them into our house on Lee.

Somebody with the correct key can unlock the door and get ahold of your belongings.

The big difference, though, is we look something inside.

Well, with the Crip shin, we actually transform your belongings so the furniture would no longer be there.

It would be something different.

But we're still going to use this, um, analogy, because it's used a lot, and it's easier than like transforming things into different substance matter.

So luckily for us, um, the browsers now come with bed crypto I p I embedded.

So we don't have to do any crypto stuff ourselves as we should not do.

Um, and the first thing we need to do is make that key that we saw in our encryption algorithm and before we can make the key, we need to decide on what encryption algorithm to use.

And from what I've gathered, this is the algorithm.

We want the advanced encryption standard with Gallows Contra mode s.

We start by generating a key for that algorithm, and here we say that we want to link to be 256 256.

But it could just as well be 100 and 28th.

And Jeff Jeffrey, from one password has a long blood post about it, not really being that it's not that much more secure with the 250 bit encryption, as it's called as 100 and 28 bit encryption.

It's like going from infinity to infinity, he says.

But but for the user's they they like the sound of 256 over 100 and 28.

It just sounds more secure.

It sounds better.

So I found that also in a security, there's a lot of disability issues, and it's not only like the hard science that they might want you to believe in, you read most of their literature.

So we have the key.

Um, now we're gonna encrypt our little note, and, ah, some people might notice we're not allowed to work on strings.

We have to make Buff Bevers, which I find quite annoying cause that's not something I usually do.

Ah, in my day to day work eso as well as this on the diagram, we input the key and the note and out we get a cipher.

Ah, and but there's another thing here.

In addition, it's called, um, it's insulation installation in in the victor.

Um, because, um um to counter against something called cipher attacks that I don't totally understand.

We need a different random value.

A swell.

But we could save that together with our cipher text, because it does not have to be secret.

And we generated here with that cryptographic safe, random value generator.

So it has to be a unique for every piece of data you encrypt, but it doesn't have, but it doesn't have to be secret.

And to get a note back with the decrypt using the same installation vector key, Victor, the key.

And we have our cipher test text.

We get, um, the buffer back, and then we make it into our string again.

So that was basic encryption.

We generated the key, the red key.

We encrypted our data, and then we decrypted our data again.

So I was very pleased with myself, and I got this far in my exploration.

But I quickly realized that there's a lot more, uh, more to it.

I was a left closer to those two circles than the AO.

So I'm going to try now to walk you through how we generate keys.

And when we use what key to to hopefully make you better equipped to read, Uh, they read, um, content around encryption.

We're going to start start by just assuming everything is in your client or mobile phone or your, um, your laps up on.

It's easy peasy.

We just save our cipher text of the local storage.

But where do we keep the key?

So this is our first encounter with key management.

If we stored the key together with our cipher text, then you know there wouldn't have been much point in encrypting Ah at all.

So let's go back to our house on in this scenario.

We're gonna look at the way to do this, so it's a little bit of a stretch, since we would probably not do this with houses in real life, but just bear with me.

So in this scenario, we're looking at um, where would actually just like hide the key next to the house?

Some people would do that for convenience.

You maybe it would be under the flowerpot on the veranda, or like a secret spot under the stairs.

Something like that.

It's convenient, but it's not really recommended because anybody could get in your house if they found the key.

So therefore, you decide to get one of those key boxes that are more popular now, especially with Airbnb for you.

Pop your key into key Box, and then you set a code on the key books.

And in this way you can access only you can access the key with something you remember, not something that's stored anywhere.

So for to do this, um, we can we can we can do this and that code as well.

Um, we can import a key buy from a password, um, on with this function called importante, and we want to use the password based key derivation function, too.

We asked the reason for their password and then which transformed the password into a key by using this function.

And then again, we have to encode our strengths and using that password key.

We can derive a key, and as the name implies, it's really good at making keys from passwords.

But since you stood still like, his passwords are often E.

C two guests than something we generate randomly.

We also need a truly random key, and we add that, and we call it the salt.

So this function derived keys determine the mist deterministic, meaning that as long as he prided with same salt in the same password, the output will be the same, so we can generate it again and or derive it again and again.

And in our case so far, we would have to save that salt together with our cipher text so it doesn't provide.

Um, the password provides us with some extra security, but the salt is not giving us much extra right now, but laid around, we will see how the salt can shine.

So let's get back to our house there.

We only had the key luck with the pass code on it, so we need to get one of those key boxes that has ah, code and a lot of regular luck.

I don't think those exist that that's what we're getting, and then we take that salt or that key for the regular lock, and we put that one under the flowerpot.

So to get in, we need to find the key that we've hidden very secretly under the flower.

But and we need to remember our code.