Tag: signal

Apple Upgrades iMessage With PQ3 Quantum Computer-Resistant Encryption Protocol

Apple is introducing a new cryptographic protocol for iMessage that is designed to protect users from sophisticated attacks using quantum computers. The new encryption protocol could safeguard users from scenarios where encrypted data has been stored, only to be decrypted using a quantum computer at a later date. iMessage is the second messaging platform known to introduce support for quantum-security cryptography — Signal’s PQXDH protocol was introduced last year — while adding another layer of security to protect users if keys are compromised.

The company detailed the development of the new PQ3 protocol for iMessage on Wednesday, ahead of its deployment on supported iPhone, iPad, Mac, and Apple Watch models. PQ3 is a quantum-resistant cryptographic protocol designed to protect conversations from being compromised by attackers with quantum computers in the future, according to Apple.

Traditional public key cryptography — used in secure messaging services like WhatsApp, iMessage, and Signal — protect users from powerful computers using difficult mathematical problems. However, powerful quantum computers are said to be capable of solving these problems, which means that even though they don’t currently exist, they can be used to compromise encrypted chats in the future.

Apple also highlights another challenge posed by quantum computers — the “Harvest Now, Decrypt Later” scenario. By storing vast amounts of encrypted data available today, capable attackers can gain access to the data at some point in the future once a powerful enough quantum computer is capable of breaking the traditional encryption used to protect those messages.

iMessage will join Signal in using quantum-resistant cryptography
Photo Credit: Apple

 

iMessage is the second messaging platform to add support for quantum-security cryptography. Last year, Signal — widely considered the gold standard in encrypted messaging — announced it was rolling out a new PQXDH protocol that would protect users from quantum computers. Apple says that its PQ3 encryption protocol goes one step further than PQXDH by changing post-quantum keys on an ongoing basis — this limits the number of messages that can be exposed if the keys are compromised.

The new PQ3 post-quantum encryption protocol is designed to protect users from existing and future adversaries and will be introduced from the start of a chat, according to Apple. It would need to be combined with the company’s existing encryption, with a hybrid design that means attackers would need to defeat both the traditional encryption and the post-quantum primitives used to protect iMessage conversations.

In order to protect users in case an encryption key is compromised, Apple says that a new post-quantum key is transmitted periodically (instead of with every message), to keep the size of these encrypted messages in check, while allowing users to access the service even in poor network conditions.

The new PQ3 protocol has been reviewed by the company’s Security Engineering and Architecture (SEAR) teams. It has also been reviewed by a team led by Professor David Basin, head of the Information Security Group at ETH Zürich, as well as Professor Douglas Stebila from the University of Waterloo. The company also says that it also contracted a third-party security consultancy independently assessed the PQ3 source code, and found no security issues, according to the company.

Apple says that the upcoming updates to iOS 17.4, iPadOS 17.4, macOS 14.4, and watchOS 10.4 will bring support for PQ3, and iMessage conversations on supported devices will automatically start to use the new quantum-security protocol to encrypt messages sent and received on the platform. All supported conversations will be upgraded to the post-quantum encryption protocol this year, according to the company.

Affiliate links may be automatically generated – see our ethics statement for details.

Check out our Latest News and Follow us at Facebook

Original Source

Apple Opposes UK Push to Bypass End-to-End Encryption, Says It Will Remove iMessage and FaceTime: Report

Apple has strongly opposed a move by the British parliament to amend an act that would allow the government to order messaging services to weaken the encryption that protects their users. The Cupertino company said it will not compromise the end-to-end encryption that it offers to its iMessage users for one country. UK lawmakers are looking to weaken encryption of messaging services in an attempt to catch criminals, as part of proposed amendments to an existing law.

The Online Safety Bill, which contains proposed amendments to the Investigatory Powers Act (IPA) 2016, has reached the UK parliament for consideration and the government has started a consultation process that will take eight weeks to conclude. One of the proposed amendments will involve requiring services like iMessage and Signal to install technology that will monitor child sexual abuse material (CSAM) on their platforms.

Apple has submitted a detailed, nine-page long note arguing that this demand from the UK government would violate the promise of privacy that it gives to its users, according to a BBC report.

The proposed changes include backdoors into encrypted messaging apps, along with asking companies to reveal details about any new security features they might be planning to deploy to their respective platforms. It is worth noting that creating a backdoor for law enforcement or other forms of lawful interception would also create vulnerabilities that could be misused by hackers and cyberciminals.

Apple has additionally said that it was not willing to weaken its security measures for users globally, specifically for one country.

The iPhone-maker has threatened to remove support for iMessage and FaceTime in the UK, if the government pushes through with the proposed changes to the IPA Act.

Meredith Whittaker, the president of the Signal messaging app was quick to retweet BBC’s report on the issue, applauding Apple’s stern stance against the demands of the UK government.

Previously, Whittaker has also reacted in a manner similar, stating that Signal would rather walk away from the UK, then agree to the proposed changes.

Meta-owned WhatsApp has also opposed the UK’s request to let officials snoop on WhatsApp users’ conversations that are currently protected by end-to-end encryption.

The UK government’s eight-week-long consultation process will take into account the views of the industry. The Home Office responded to the BBC stating that the IPA Act was created to protect the public from “criminals, child sex abusers and terrorists” and that “no decisions have yet been made” while referring to the consultation that is part of the review process.

Will the Nothing Phone 2 serve as the successor to the Phone 1, or will the two co-exist? We discuss the company’s recently launched handset and more on the latest episode of Orbital, the Gadgets 360 podcast. Orbital is available on Spotify, Gaana, JioSaavn, Google Podcasts, Apple Podcasts, Amazon Music and wherever you get your podcasts.
Affiliate links may be automatically generated – see our ethics statement for details.



Check out our Latest News and Follow us at Facebook

Original Source

WhatsApp, Signal Oppose UK Move to Force Companies to Break End-to-End Encryption

WhatsApp and other messaging services have united to oppose Britain’s plan to force tech companies to break end-to-end encryption in private messages in its proposed internet safety legislation.

Meta-owned WhatsApp, Signal and five other apps signed an open letter saying the law could give an “unelected official the power to weaken the privacy of billions of people around the world”.

Britain’s Online Safety Bill was originally designed to create one of the toughest regimes for regulating platforms such as Facebook, Instagram, TikTok, and YouTube.

The proposals were watered down in November, when a requirement to stop “legal but harmful content” was removed to protect free speech, and instead the focus was put on illegal content, particularly related to child safety.

The British government said the bill in “no way represented a ban on end-to-end encryption, nor would it require services to weaken encryption“.

But it wants regulator Ofcom to be able to make platforms use accredited technology, or try to develop new technology, to identify child sexual abuse content.

The letter signatories said this was incompatible with end-to-end encryption, which enables a message to be read only by the sender and recipient.

“The bill provides no explicit protection for encryption, and if implemented as written, could empower Ofcom to try to force the proactive scanning of private messages on end-to-end encrypted communication services – nullifying the purpose of end-to-end encryption as a result and compromising the privacy of all user,” they said.

The bill poses an “unprecedented threat to the privacy, safety and security of every UK citizen and the people with whom they communicate around the world, while emboldening hostile governments who may seek to draft copy-cat laws”, they said.

A British government spokesperson said: “We support strong encryption, but this cannot come at the cost of public safety.

“Tech companies have a moral duty to ensure they are not blinding themselves and law enforcement to the unprecedented levels of child sexual abuse on their platforms.”

© Thomson Reuters 2023

Affiliate links may be automatically generated – see our ethics statement for details.

Check out our Latest News and Follow us at Facebook

Original Source

OTT Communication Services Should Be Licensed, Compensate Telcos for Data Traffic, COAI Says

Telecom operators’ body COAI on Tuesday made a strong pitch for OTT (over-the-top) communication services to directly compensate telcos for data traffic they are driving onto the networks, as it advocated a licensing and light-touch regulation framework for such services.

Cellular Operators’ Association of India (COAI) Director General SP Kochhar said the association, as part of the draft telecom bill, has given its suggestions on how OTT communication services should be defined to ensure there is no ambiguity.

Other aspects like exact financial model for OTT communication services to compensate telecom service providers will be made to the government going forward as and when the nuances of framework for light-touch regulation is discussed, Kochhar told reporters at a briefing.

OTT communication services include the likes of WhatsApp, Signal, Google Meet, Telegram and other similar apps.

In future, the same principle of revenue share basis data consumption can be applied to other OTTs (all categories) as well, he added. For now, COAI’s suggestions are confined to the realm of OTT communication apps, not the entire ecosystem, since the draft bill mentions communication apps.

COAI maintained that KYC is an essential requirement, be it for telcos or OTT communication services.

Industry bodies COAI and Broadband India Forum (BIF) had been locked in a pitched battle on the issue of treatment of OTTs while consultations on the draft telecom bill was underway.

The telecom service providers, under the aegis of COAI, have been pushing for OTT communication services to be brought under regulation. COAI has been propagating ‘same service same rules’ for OTT communication services and telcos, to ensure a level playing field.

On the other hand, digital think-tank BIF — which counts tech companies such as Tata Consultancy Services, Cisco, Amazon, Google, Microsoft, and Facebook-owner Meta as its key members — has warned that the regulation of OTT players could stifle the socioeconomic ecosystem and hurt innovation.

COAI, in a note outlining the recent submissions on the draft telecom bill, said: “The OTTs providing telecom services similar to telcos such as voice/video calling and messaging within the meaning of telecom Bill… be defined clearly, and the same regulatory and security obligations to be met by them as done by TSPs for providing similar services.” Alternatively, it said, OTT communication service providers can pay directly to the telcos for use of their networks for providing services “in a fair and equitable manner by way of an equivalent interconnect charge (say network access charge) for the actual traffic carried by these OTTs on TSPs network, which can be easily measured.” The contribution of OTTs to network costs can be based on assessable criteria such as volume of traffic, turnover threshold and number of users, among others.

COAI cited a report which estimated that 56 per cent of the global data traffic on telcos’ network is from leading OTTs. The association also went on to suggest that OTT contribution to exchequer, if a levy is put in place, could be about Rs 800 crore.

“Since the telecom service providers will be receiving the revenue from OTTs as part of their telecom services rendered, they would automatically be paying licence fee to the Government (as part of TSP’s Adjusted Gross Revenue) on an incremental basis to the extent of the payments by OTTs to the TSPs,” COAI said.

Other major recommendations of COAI — whose members include Reliance jio, Bharti Airtel and Vodafone Idea — include reduction of licence fee from 3 per cent to 1 per cent, a move the association says will ensure that more funds are available to players for rollout of networks. The suggestion on lowering of levies is also part of COAI’s pre-Budget wishlist to the government.

COAI further said Internet shutdowns not only affect telcos’ Average Revenue Per User, but also the consumer base.

“Non commercial infrastructure is also required to be set up by the telecom service providers in this regard, costing them. Reimbursement for the same to be considered by the Government,” COAI has suggested. There should be standard operating procedures spelt out for such actions and accountability for the same must lie with the officials initiating or supervising such actions, it noted.

Beside this, it said, contributions towards the Telecom Development Fund should be met from budgetary allocation and from amounts collected through spectrum auctions as also “from contribution from entities that cause the traffic, that is, OTTs – streaming, gaming and social media companies”.

So far as protection of users is concerned, the “Bill may be extended to cover cyber or financial fraud or unsolicited commercial communications and may include a proviso to align the powers of Telecom Department on this issue with TRAI. Ideally there should be only one body regulating the issue,” COAI said.

The draft telecom bill seeks to replace three laws — the Indian Telegraph Act, 1885, the Indian Wireless Telegraphy Act, 1933 and the Telegraph Wires (Unlawful Possession) Act, 1950.

The bill proposes all Internet calling and messaging apps to comply with the Know Your Customer (KYC) provisions when they come under the telecom regulation ambit.

The telecom department has also mooted a provision for the refund of fees in case a telecom or Internet provider surrenders its licence.

Affiliate links may be automatically generated – see our ethics statement for details.

Check out our Latest News and Follow us at Facebook

Original Source

TRAI’ Concerns Over Draft Telecom Bill Provisions Said to Be Duly Addressed

TRAI’s apprehensions over potential dilution of powers under the draft telecom bill have been addressed, and the government may look at the option of taking up provisions related to strengthening of the regulatory body separately at a later stage, DoT sources said.

On over-the-top (OTT) communication apps, sources said, the focus is on user protection related regulation, not licensing. The Department of Telecommunications (DOT), through the provisions of the draft bill, will come down heavily on spammers and those indulging in cyber frauds, sources said.

Amid reports of TRAI‘s opposition to certain clauses of the draft telecom bill, that were seen diluting its powers, sources said, ​​​discussions have taken place between the two sides. All the outstanding issues have been resolved, they said.

There are no differences between Telecom Regulatory Authority of India (TRAI) and the telecom department on this issue, sources said.

The thinking in telecom department now is that specific provisions related to strengthening of TRAI, on the lines of US’ Federal Communications Commission or UK’s communications regulator Ofcom, can be taken up after a period of time, say 3-4 years, through a separate exercise. For now, the contentious amendments may be removed from the draft telecom bill, currently in the works.

The government, in the draft telecom bill — circulated for stakeholder comments last month — has proposed a provision to waive fees and penalty of telecom and internet service providers. The telecom department has also mooted a provision for the refund of fees in case a telecom or internet provider surrenders his licence.

Meanwhile, telecom service providers are pushing for OTT apps to be brought under regulation. They argue that apps offering services similar to them — say WhatsApp, Signal and other similar apps used for calling and messaging — should be subject to the same licence conditions as telcos, thus ensuring a level-playing-field for all technologies.

 

 

Affiliate links may be automatically generated – see our ethics statement for details.

Check out our Latest News and Follow us at Facebook

Original Source

Exit mobile version