 All right everybody, our last presentation of the day, Mark Cooper is going to present how PKI and Shakenster will fix the global robocall problem and I'm really interested in that. Thank you. Well good afternoon. It's an amazing coincidence that over the years of speaking somehow I always wind up in the slot that's between you and alcohol. I don't know what it is so I'm painfully aware of the fact that the end of the day is after this so I appreciate you coming. So as he read this is actually a brand new topic that I'm just starting to talk about because frankly a lot of people aren't even aware that this is going on. There's a brand new change that's coming to the telecom space and the Shakenster framework is what we're going to talk about today so my company focuses just in the PKI so public key infrastructure doing cryptography and traditionally that's been enterprises as well as a lot of IOT and this has kind of come out of nowhere and it's an interesting topic that we started talking about earlier this year simply because of the fact that's so heavily reliant on cryptography and the fact that it's affecting everybody. So today we're going to go through and talk a little bit about what the current landscape is and I could probably guess this but I'm going to ask your cooperation on this one. How many people have gotten a robocall sometime in the last couple of days? Thanks. All right. Anyone gotten one today? All right and just because of DEF CON is anyone here actually the ones making those calls? All right there's two guys. All right so perhaps. So we're going to talk a little bit about what's going on since everyone's pretty painfully aware of what these robocalls are we're going to talk a little bit about the scope we don't really have to go too far into there but we're going to talk a little bit about the motives and the motives are really important because as we start talking about this framework one of the areas I want to go into with you guys is the fact that just because there's a solution to the problem doesn't mean it's going to fix the problem and it's going to actually present a whole new set of exploits that people can potentially take advantage of. So we're going to talk about not just what shaken stir is and how it works but we're going to talk a little bit about those technical details so depending on what side of the argument you're on you can have a better understanding of how this works. So a couple interesting things around the robocall space there's actually just a summit that the FCC held um Chairman Egypt Patel uh held this in DC just a couple of weeks ago uh interesting set of statistics almost half of all phone calls that are made now are some type of robocall caller id spoofing or something relating to that space that's why we're getting so many of these they've been around for a long time um at one point I took a screenshot of the voicemails on my phone a couple days ago nine out of ten of the voicemails were either a healthcare provider IRS scam or something else it's now gotten to the point like most people if it's a number I don't recognize I'm not even answering the phone my phone has essentially turned into what my daughter uses the phone for email and web browsing if someone calls me I know it's a scam my wife doesn't call me my daughter doesn't call well let's not go there that just is but anyway the phone calls are not doing anything good for me the other thing that we're seeing is the vast majority of these are some type of robocall and there are some that do a much better job than others probably one of the best ones I've heard is a recording and it sounds like someone who's picking up their headset and starting to talk most of the call systems have a and they're just waiting for that pickup click and then maybe they'll connect you to someone or they'll start playing a message but the best one is like hold on a second oh there you are okay this is that bank loan so some of them are much better about how to attract once you pick up the phone but if you don't pick the phone you're not going to fall prey to this the other thing that we're seeing and a lot of people in the us don't realize this is a global problem this isn't just happening in the us it's not just us numbers that are being spoofed it's not just us phones that are being called the calls are coming from all around the world they're happening around the world so they're not just coming to the us or leaving the us it's a global problem the other thing that we're seeing is we're expecting a greater number of calls that are happening to mobile phones for a long time we were seeing a lot of the robocalls going to landlines well they got smart a couple years ago and realized they need to start using the mobile numbers and as you probably have been painfully aware things like do not call lists that's essentially just the publication of your number to robocall so a couple things that were going on when we talk about the problem is definitely a global issue not just happening in the us there's a huge impact from a cost it may just be a few seconds of your time to determine if you want to answer the call or hang up the call from a business perspective that's happening over and over again an interesting thing that's happened to me I have a service that answers my main office number because we're often traveling working with customers we don't have someone sitting there at the phone so it's provided me a really interesting data point they charge me for every call they pick up even if it's a robocall so suddenly I was able to get this nice data on oh look at how many calls I'm getting look how much this is costing me my answering calls even though it takes them a few seconds ago oh solicitation hang up pushed a button charge mark almost doubled or tripled over periods of time and you could see this ebb and flow were some months you can see somebody was really going at it hard on the robocall side and my service costs went up well that same thing impacts businesses if you have a receptionist that's sitting there you have employees that are getting those calls those fractions of minutes fractions of calls add up to productivity losses that has no inclusion of the financial loss most of those robocalls are out to get something steal information get you to buy something or get details from you or get some type of scam the IRS scam for instance so there's money transactions in addition to these billions of dollars of loss what we're starting to see in the U.S. is the FCC is encouraging companies to implement stronger controls there isn't a regulated requirement yet we're starting to see some things at the federal level of encouraging the adaptation of authenticated calls there is encouragement for private enterprise on the telco side to start implementing solutions but as of today there's no regulatory requirement that's forcing this fortunately a lot of that's being driven from the fact that there is a technology standard that's coming out we have been seeing some things from the phone company perspective you may have seen something earlier this year with Comcast and AT&T they had put out that they started testing and implementing authenticated caller IDs and when I get in the shake and stir I'll show you essentially what they did it's it's not shake and stir it's a proof of concept so why are we here where did this problem come from and it really goes back to the beginning of caller ID and when caller ID was first created I believe it was invented in the 60s we really didn't see adoption in the U.S. till the mid 80s and the concept was that the telephone switch itself is a trusted source the switch was at the telco when you placed a call that circuit ID got assigned a caller ID number that was then sent to the recipient and that was your caller ID it was from trusted source to trusted source well with the advent of computerized PBX systems now micro computer based PBX systems that concept of trust has moved out of the telco is now potentially in the hands of the caller originator a lot of people that are using voice over IP services are acting as their own switch which means it's now up to them to choose what caller ID they put onto their calls so that trust source changed but the whole concept of caller ID had no way of keeping up with that so because of the fact that we're now allowing the originator in many cases with these virtual PBX's to designate their call it's a non-trivial issue for them to change number every call they make every dozen calls to make whatever process they want to go through very easily demonstrated they can go through and the reason that they change their number is a very important thing yes there are some tactics of having error codes and prefixes that match your number but a lot of people have gotten smart on that the whole reason they're doing that is to keep their line from getting flagged and blocked a lot of the technology that's out there you can get this from AT&T you can get on your mobile phones for instance they offer these spam blocking applications really all that they're doing is if a lot of people mark a particular number as being a spam call or a fraudulent or a robo call if they get enough complaints the intent was to block it well the originator simply needs to change their number and if it's an ever revolving set of numbers there's nothing that can be blocked so the problem is is kind of a cat mousing it's always moving around it's not a consistent ID so there's really no reliable way to block those calls and to know if it's a genuine caller or not so that's where the shake and stir framework comes in this is a global standard and the reason that a lot of people haven't heard this is it was only recently ratified it was at the end of 2018 that the standards were complete it was created by the alliance for telecom industry standards or ATIS and ATIS is comprised of industry bodies so it was brought by the global telecom industry itself and what it does is it provides a framework for authenticated caller ID the intent is it will no longer simply be the originator of a call who happens to own a PBX they will not be able to designate caller ID in addition it provides cryptographic functions and integrity to verify all calls that are going to be made now the ATIS framework itself has several different components that are at play and the primary one that we're really looking at here is shaken and stir now interesting I had a conversation with one of the principal authors a couple of weeks ago and interestingly enough it started with stir as the original concept and then shaken came along and their joke was shaken not stir and if you're into martinis there's another variation called lemon twist so basically a lot of alcoholics are getting together to try to figure out how to fix this phone problem is pretty much why I'm learning here ironically we were drinking martinis when we were talking about this so the intent is the originating telco not the PBX the originating telco themselves will now be responsible for asserting the caller ID so imagine that scenario where the switch used to be that giant box sitting inside of the telco data center that's now sitting on a computer or now sitting on some void provider the telco that places that call will now be the one responsible for asserting that caller ID and I'll show you how that works on the receiving side they're going to validate that information so shaken and stir are the two primary methods that this is going to happen at the very center of shaken and stir and the reason that this is a place that I've taken a great interest in and why it's important to us is it's really built on PKI and when we first got exposed to this we had a company that came to us because we're subject matter experts in PKI and they said we know telecom we don't know what this PKI thing is can you help us figure out what this is all about so the challenge of being a little bit of a crypto geek is if you have a family sometimes you say family go away I want to read something really interesting so I spent the weekend reading through all of these standards to figure out what the heck they were doing now the interesting thing is it's 99% normal PKI so if you work with any type of public infrastructure you work with certificates you have a concept of asynchronous cryptography it's the same thing they're doing some unique things in there but the basic constraints are the same what is essentially going to happen is by using PKI and those certificates is every telco is going to either assert or validate caller ID information the shaken stir framework defines most of the properties that are needed in this ecosystem what types of certificates the type of cryptography how it's going to be implemented how things are validated there are some unique things as far as how the telcos themselves will get authenticated because their enrollment is a little non-standard but the framework itself kind of does a good job of defining those boundaries but there's a lot that still has to be determined with that PKI that's in place every telco is going to be responsible for implementing this and there are controls that help define what happens for a telco that doesn't have a PKI or they're not up to speed the good thing is phone calls will still go through from a consumer perspective the bad news is phone calls still go through I'll show a little bit about why this is a transitional technology that has some weaknesses in there but still something that's going to provide some value now what shaken stir what we're going to find is the originating telco is going to place the caller ID information into the header of each call so if you're not already where the vast majority of voice calls you make regardless of the device you use winds up as a voice call we're talking sip communications over either close networks or internet networks it's all sip communications so if you imagine that initial header packet has information about the destination essentially the receiving telco in there is going to be caller ID information that's encrypted in there there's going to be a structure where each telco has a signing certificate that they control that allows them to do the signing and then on the receiving side the receiving telco is going to go through a validation process to actually validate that caller ID information so this is kind of what the framework looks like now the challenge with shaken stir is because it's a global standard a lot of it is left up to each country to implement if they're going to follow shaken stir there's certain framework things that they need to follow but it's up to them to implement each of these components themselves so I've tried to keep this as generic across the globe as I can but there's some of these components that are applicable to the U.S. right now based on what we're seeing at the very top we have this concept of a policy administrator and in the U.S. this is just the point that we've got right now so at a hole if you take this entire chart all that we have is a company assigned as the policy administrator what happened is there's an organization created out of AIDIS and the I think it was the ETF they created the STI GA and if you want to find acronyms AIDIS and the shaken stir is a great place to go everything is three and four and five letter acronyms so at the very top is this concept of STI GA that secure telephone information general administrator their job is to essentially be the non government entity that is responsible for secure telephony and all that they've done essentially is put out a bid for a company to run as the policy administrator that was one by a company called I connective in the U.S. so this is an example of something that's gonna have to happen in every country each country is going to have to put some type of a body in place to run their shaken stir framework whether it's private enterprise like it is in the U.S. or a government entity that's going to be left up to each country the policy administrator has a couple of important jobs they're responsible for defining what this ecosystem is because even though shaken stir has defined the technical requirements they have left the number of things to the policy administrator to figure out how do you determine what PKI's are trusted to do this how do you a test and audit those PKI's to make sure that they're following the rules not only that but the shaken stir framework if you work in the PKI space there's a common practice we go through called the certificate policy and practice statement well in the shaken stir framework there's all of about five paragraphs that say this is the only thing we're going to stipulate for a CPC PS it's up to the policy administrator to figure the rest of this stuff out so none of that has even been defined yet so one of the biggest challenges we're having is for companies that want to get into this space because there's a commercial play here is what are the rules what am I gonna have to do what are my requirements don't know what they are they haven't been written yet so the policy administrator has two main functions one is they're going to be able to oversee the ecosystem of commercial CAs so think of this a lot like the global signs of Digi search the go daddies all of those CAs that work in a trusted root space for Windows and Linux and Macintosh is all of those concepts have no bearing in this ecosystem just because a CAs trusted by Windows or Google for instance doesn't mean that they're trusted to run inside this ecosystem well in order to be part of this framework the policy administrator is going to have to define those rules and allow those commercial entities to participate the challenge right now is what are those rules and who are they going to be the other interesting thing about that is from a commercial perspective if I want to get in the business of selling certificates to do shake and stir in the US a total customer base is 2000 there are 2000 telcos in the US so how much money do I have to charge per certificate if I had 100% of the market and keep a business going that whole financial picture has been quite figured out the other part that's here is we could also have a PKI that is within the telco itself so we have the commercial entities we have the originating telco we could have the telcos themselves so you know what I don't want to use a third party certificate I'm just going to stand up my own PKI why bother buying a cert I'm big co I can do it myself now the same things we don't know what the rules are we don't know the security requirements that are going to be there but they have that option the challenges in the US maybe 10 of the telcos are big enough that they can look at that and go that's inconsequential money but the other 1990 telcos a lot of them are very small shop a lot of them are virtual providers are going to be faced with how do I invest not only in the technology but in the operations of this so it's a big uphill battle for them now within that once we've figured out what those PKI's are going to be what we essentially wind up with it is a roadmap that looks like this when a call is placed it goes to the originating telco and they have a service that is part of the shake and circle the authentication service essentially what the authentication service is going to do is use existing customer records we know this calls coming on this circuit that means this caller ID is assigned to that circuit it's then going to use its key management and secure key storage this essentially comes down to their certificate and some type of hardware security module that's protecting the key once they know that circuit ID they know the telephone number associated with it they'll use their signing key and then they will route the call out with a signed here is the originators caller ID and some additional information. Now a couple of the interesting things that are a little different than a typical PKI is the fact that we have this concept of a certificate repository. So one of the challenges that we have when using certificates is we have to be able to validate the certificate itself doesn't come from a trusted PKI has it been revoked a lot of times when we do things like TLS we can shove all that stuff down in the negotiation of the TLS session itself. Well from the telephony side time is our problem we can't send a lot of data if we're sending all of that it's going to increase the time to connect so what they've done instead is they created this certificate repository which frankly isn't much more than a file repository but a certificate and revocation details that are sitting there when the call is routed in the header it will say here's where my repository is so now every telco or every commercial CA will have to have a repository that can be used to retrieve certificates and revocation details to validate that header. Now there's some really important things when it comes to caching because the time to completion is a really important part of all this. Once the call goes through on the receiving telco they have to decrypt all of that they go through a verification service and the verification service is essentially going to validate the header validate the signature make sure it was a trusted PKI that signed it they then have the caller ID and that's what's presented to the user. So at no point did the user themselves have the opportunity to affect the caller ID if they're running as a virtual switch or a virtual operator they have no way of asserting that caller ID if they put it in the call packet itself it's overwritten by the telco itself. So it moves that concept of trust and how we define that caller ID on telco. Now our problem is how do we make sure the telcos do it the right way and securely? Now the shake and stir the fact that we can validate identities only solves part of the problem. All that shake and stir will do is give us consistent data. This caller making these calls got flagged X number of times as a spam call. But they're consistently on that number. Shake and stir cannot stop those calls and in fact calls will go through whether shake and stir is there or not. All that we're doing is providing consistent attestable information about who is placing the call. Now with that shake and stir has provided suggestions to telcos and to handset manufacturers of how to deal with this information. There are really two things. How do you as a receiving telco want to deal with calls that are consistently being reported as spam? That's up to you. Do you want to just let them through and you ignore the problem? Will your consumers complain about and ask you to do something about it? Or do you somehow provide some clues to the user about what's going on? And then the handset manufacturers have to have some way of displaying that information to you. So a couple of things that we have is the terminating network or the receiving network now has a couple of things they can bring to bear. There have been these analytical options or CVT options to provide information about whether a call is a spam call or a robocall. And you may see some of these now. I know on my phone I'll get a suspect spam or some other type of alert. So there is some analytics that are out there. But it's not wholly thorough without consistent caller ID information. But now those existing analytics and consistent caller IDs, now the receiving telco has options. Do we want to start marking things so that they show up differently to our user? Do we want something that comes through with no particular warning? It's just a name and a number, essentially what you see now, but doesn't necessarily assert that it's a valid name or number? Or do we only start marking things as suspect spam or invalid number? Or do we have other types of visual indicators of what things should be going on? So shaken stir doesn't fix all the elements that are there, but now give a platform where Apple and Android and everyone else could now decide, hey, how do we handle these unvalidated calls? What do we show to their users? How do we respond? So the current ecosystem itself, and this is kind of the challenging space. We have ADIS, it's been around for quite some time. They're responsible for helping bring together the authors and the concepts and the IETF was also part of the creation of the standard. We have government entities around the world, as I said, each country is going to have to implement this in their own way in the US that falls under the FCC. But as I indicated, the FCC is not taking a regulatory approach to this quite yet. There's a lot of encouragement to private enterprise to implement technologies like this. It stated we would like this today. Well, what I'm going to tell you is this ecosystem, if we go back to the flow, the only thing that exists is the fact that the policy administrator has been selected. We're now sitting almost in the middle of August. Nothing's getting done by the end of the year. There's a number of agencies that we're going to see involved from a purely policy side. So the STIGA, as I mentioned, the policy ministry will be specific to each country in the US that was awarded to iConnective. A lot of the work right now is being done at this level between the STIGA and their subject matter experts and the policy administrator. This ecosystem is being defined. Was it going to take to attest these PKI's? What are the operational requirements? What's the timeline? All the stuff that wasn't in the standard itself. Now beyond that, we have the telcos. Just because the framework is being stood up, it's up to each telco to decide how they're going to participate in the space. It's a it's an industry standard with no regulatory requirement, which means they can drag their feet as long as they can. There's no one that's going to shut them down if they don't do this. Now there are some interesting thoughts around how are these companies going to be compelled to participate. If we start seeing things from a consumer perspective, where I can get alerts that are consistently better about spam calls, that might start to influence people on what provider they go to. And it may no longer just be, can you hear me now? It's like, can you flag my spam for me now? From a business perspective, if I have a provider that's not on the shake and stir framework, and my calls are consistently getting flagged as unverified, think of it like your website, if it comes up as unable to validate your certificate, could people click through? Could they still get to the website? Yeah, maybe. But do you want that for your business? Probably not. So we may see pressure from businesses to their telco saying, I'm going to move my business somewhere else because you're not properly validating my calls on the way out. Now I'm not able to reach my customers. So we may see pressures coming from that place. And obviously, part of the ecosystem is going to be those handset manufacturers. I haven't seen anything from them today as far as how they're going to be participating. Now there's obviously many more telcos than I can have space for. But we are seeing early activity from AT&T and Comcast, as I said, what they essentially did when they did their announcement earlier this year, and you can look this up, they'll say they've implemented new authenticated caller ID systems. It's shaken stir. What they essentially did was they both created self-signed certificates and exchanged them with each other. They did the protocol, they did take that SIP header, they did encrypt it, they did put a caller ID in there, and it completed it was great. And now they get to say they're doing authenticated caller ID. Yes, it doesn't scale. But could by the end of this year, could we take all of the major telcos in the US, the handful that there are and shrinking every day? Could they all potentially do this in the short term? Yes. Will it be shaken stir to the whole framework? No. But they can at least start doing authenticated caller ID now. So what's next? Where are we in this process? If we know who these players are, we know there's a technical standard. Where we're at right now is the standards themselves, the framework, how is all of this going to work is being fleshed out right now. So between the STI GA and the policy administrator for the US based approach, that's all being figured out now. So conversations with them is they're trying to figure out what that policy is going to look like, who those players are going to be, what the options are from the telco perspective. And obviously a big part of this is how is all of this going to be funded? If we've got a pseudo government agency that's going to be supervising all of this, and potentially commercial CAs that are going to be providing the certificates, who's paying for what? And that was not part of the framework. So each country kind of gets to figure out what that's going to look like. The other thing that we're seeing is we're starting to see the peer to peer concepts, as I said, I believe 18 team Comcast are the only ones have at least publicly stated that they're doing this. I wouldn't be surprised to see more of that by the end of the year so they can say that yes, they're following FCC recommendations and they're doing this. After that evolution, we're going to be moving into the deployment. Once that operating set of policies are created by the PA, we'll start to see the ability for companies to figure out if they want to be commercial CAs. Because in my opinion, I suspect with 2000 telcos in the US, not all of them are going to have the ability to do this on their own. So I think we're going to have to have commercial entities, but they're not going to be able to figure out what that business is like until the rules have been defined. As far as a timeline itself, FCC wants all of the major telcos doing it this year. That's going to be that peer-to-peer exchanging of certificates. I really think that by next year will be the earliest that we even start to see what the framework looks like. I would not expect a very large percentage of the industry to be on board by next year. Then there's the global. How long take every other country in the world to do it? No idea. So a couple of critical things that we need. Obviously, we need all the carriers to figure out, are they going to participate? How are they going to do it? There's the technology approach policies, the implementations of the PKI. There's a lot of global issues. The interesting thing about the way Shake and Stir works is if you can't validate the caller ID, the call still goes through. It just gets flagged as unverified. So that means if 99% of the world has implemented secure caller ID, if I'm a bad actor, all I have to do is move my business to some telco who's sitting in that one lone country that hasn't implemented this yet. And my call will still go through and it will still be unflagged, but that's better than being flagged as spam. So wherever that weak point is in that global telecom structure, that's where the bad actors are going to go. And they don't even physically have to be there. I could be sitting here using a provider in another country virtually. So those remaining countries have the potential to still affect the global basis if they allow those robo calls through their infrastructure. So a couple of technical things. This is stuff I haven't really shared with other people because they kind of start to nod off when we go much deeper on Shake and Stir. But I thought you guys might be interested in this. If you want to read up on this a little bit more, those 8s documents are very easy to find. The standards are, I don't know, 1,084 and 1,080 in the documents in between, as well as 1,074. But beyond that, what you'll find. The entire recommendation is around the elliptical curve. And this is really from an efficiency standpoint, much faster to validate that cryptographic key size, much easier to transport. And that SIP header that's going to go between the originating and receiving telco, the signing certificate is sent along with that, or not sent along. But its signing key is going to be signing that packet. If it's a much larger key, like an RSA key, that's that much more data, that much more transmit that we have to do. So elliptical curve. Interestingly enough, something not in the standard. I had to ask one of the authors, is it elliptical curve all the way up and down the chain? No. I go, well, that's kind of silly. So RSA encryption keys at a higher level are acceptable, but the signing keys themselves elliptical curve. The other thing is each provider is going to have to be responsible for having the infrastructure to be able to go out to that certificate repository for every other provider and retrieve those certificates to be able to validate a call. In the U.S. with 2,000 telcos, if everybody was doing that, imagine a server that's doing this verification service, when it starts back up with no cached information, the first call from every originating telco, it's going to have to go out and retrieve that information. Go retrieve those signing certificates, the chain, and revocation information. The only way that this really works at scale is the fact that maybe the first call or two after that machine is rebooted goes through is unflagged. It retrieves the information and then caches it. It's not a giant number of certificates that would have to be cached, but it's something that's going to have to be built into that verification service. The other interesting thing here is we work with PKI's all the time. Telcos are no different than most enterprises and governments. They struggle to do PKI's today. And that's just to get their users on the Wi-Fi networks and encrypt stuff. Now we're going to ask them to deploy PKI's to secure every telephone call they make. I don't have a whole lot of confidence in that. A couple of telcos I've looked at have one that comes to mind has nine different PKI's simply because they can't ever figure out how to get rid of the one that they didn't quite do the right thing on and it's still sitting around. So they now have nine of them. To now ask them on the regulated operation side to deploy a PKI to secure my phone calls, I don't think it's going to happen. The other interesting thing is how they're going to do the enrollment and verification. All of this is designed to be automated. Very distinct from say getting a TLS certificate where you go to a website and you get an account and you buy your cert and you come back two years later. This is going to use some type of security token still to be defined. I'm guessing some type of JSON token that the policy administrator will give to each telco that says, hey, we've authenticated who you are. Use this when you go get your signing certificate. Well, that is then going to use ACME in a very unique way. ACME is going to essentially say, if you've got an authenticated security token, we're going to let you get your signing certificate. So all of this still has to be created and defined. Again, it's not going to happen by the end of this year. So the SIP header itself, this is what we see in a outgoing call. You may recognize some of this, but this is what it's going to look like with shake and stir in place. In the header itself, you'll see that there's a signing algorithm that specified. In this case, it's elliptical curve 256 and asserting the fact that there's a shaken token or a passport that's been defined. And one other thing that they're doing unique that certificate repository that I said that was a little different than a normal PKI. This is where the chain and revocation information is going to be available. The signing certificate that was used to sign this header is going to be specified in the header itself. So rather than sending the certificate so it could be validated, the header goes across and the validation service will then go retrieve that certificate if it doesn't already have it in memory and use that key to validate the signature that was on the SIP header. Now the payload itself, what's actually in the call that's attesting to it, you can see that the payload is attesting to the call itself. There's a destination telephone number or TN and more importantly, we have the originator, the originating telephone. So this is the caller ID that's been inserted into the SIP payload by the telco itself. There's two other important things. There's originator ID, a GUID that will help the originating telco track that back to particular transactions and accounts and the IAT is an encryption of date and time to prevent replay attacks. So the important technical stuff, things that you could go do to muck around with this stuff. From a weakness perspective, like any kind of PKI, the biggest weakness is going to come from rushed, hurried and bad deployments. The fact that the calls themselves are designed to be attested but still go through if they can't be validated simply means many telcos may not have the greatest incentive to do this right and secure. They could really look at this to say, hey, if we do a bad job, the call still goes through, things are flagged, we'll fix whatever we did and we'll just recover and move on to the next thing and make a nice commercial. So there's not a whole lot of incentive as opposed to saying, if you deploy your PKI and something goes wrong, we're not going to do calls. So there's no provision that says we're not going to accept unattested calls. Simply means the telcos have little incentive to do it right. The other thing is the fact that a lot of times when we talk about PKI's and we're working with organizations, we talk about the theory of compromise. Who's going to compromise your PKI? Who wants to get to your data? This is one place where I think there's going to be a lot of value around the human engineering and technical ability to break a PKI because imagine a world where there's a lot of big business today behind robocalls. They're not doing it to spread the gospel of their religion or because they got no one to talk to his friends, they're doing it because it's a business. Which means if there's a technology like Schenster that threatens that business, there's going to be a value associated with being a business that still has the ability to make spam calls. And if you're that one company left in the world that's still able to make automated robocalls and you can charge a lot of money to do that because you're the only one that's doing it, now there's a distinct incentive to find that PKI that you can exploit. Is that finding some employee that I can bribe? Is it stealing information? Is it finding a weakness in someone's deployment? There's going to be a very clear financial incentive to go out and find out how to break this somewhere. The other challenge is PKI is tough. We deal with this all the time. It's not a technology where you can push a button and you've got a secure infrastructure. Almost everything we do is bespoke because every risk is different. Every organization is different. Who do you trust? Who don't you trust? Do you want two person controls or are you just concerned about a rogue adversary? Are you trusting of your administrators? Do you need two data centers or three data centers of fault tolerance? Do you need fault tolerance within the data center? It's tough. That is difficult and takes a lot of deep subject matter expertise but there's not a lot of it out there. With 2,000 telcos in the US and only 10 of them of considerable size and what I mean by that meaning an enterprise that's large enough that they probably have subject matter or money to make this happen, the rest are left to fend for themselves. And in fact at the FCC summit many of them were simply there to discuss their challenges and how the heck to deal with this new requirement. How are they going to implement this? The other interesting thing is the fact that from an adversarial standpoint things like a denial of service or direct attacks against the shake and stir framework, while it won't necessarily result in validated IDs without the theft of signing keys or something else, a denial of service does have one distinct advantage because calls still go through even if they're unverified. If I simply want my calls going through, I want to denial service attack. You can't validate information but the call still goes through as opposed to the fact that you are validating that my caller ID is this number that's blocked. So there's going to be an incentive to potentially find ways to break this simply so that your call gets marked as unflagged as opposed to spam or suspect. So there's several areas that are likely to come up as issues here. A couple things before we go into questions. If anyone likes to geek out on PKI, we are running a little thing. We have an online PKI class. If you take a little snapshot, we have a little code called defcon. So if you come up to our site, we're doing 50% off our training. It's just a way of trying to get more people to be aware of what the heck PKI is. And frankly, the shake and stir space is something that is of interest to us, but we realize that there's going to be a need for a lot more people associated with the telco space or work space that are going to need to know PKI. So hopefully this is something that will be available out there. So with that I'll open up the questions. Alright, and if you could please line up behind the human microphone stand. Come on up everybody. And don't eat before the end of questions. I have one more thing. Well, here, I'll tell you now. Just in case you want to go this and I'll come right back to your question. We're going to run a little crypto chat and drinks afterwards. If you would like to come down, we're giving away drink tickets. You need to get a wristband from me. So I'll do that just on the other side of the partition when we're done with Q&A. I have 50 wristbands, but you get two drink tickets. So there's a little bit of work. It's down at the Blue Moon bar, just down in the lobby. So we're going to run that from six to eight with our partner Key Factor. So if you want to come talk some more crypto, if you just want to go get a Coke or a martini or a lemon twist or a lemon drop, whatever you want, that's okay too. But we'll be around to talk crypto down there. Thanks. Thank you for a very comprehensive presentation. I am curious though, I just went to Twilio's conference a couple days ago. I think it's called Segment or Signal, something like that. And they actually showed a demonstration of this kind of implementation using their own stack. I thought it was interesting that I think a common theme in your presentation was how inept bureaucracy is to do this. Do you think it's likely that the companies like the Twilio are going to be essentially implementing this for everyone? So the one good thing that's going here is the fact that the the implementation and the day-to-day is really out of the government's control. So there's some benefit there. The fact that we've got iConnective operating as that policy administrator, it's not bureaucracy on a day-to-day basis running it. I don't necessarily think that every organization is going to do this the right way. In fact, I'm betting on it. And I think that there's going to be mistakes. I suspect it's going to be commercial pressure that makes this happen. That really being why are my calls not going through as validated? My business is telephony for a hospital. I'm going to move my business somewhere else. So I suspect if anything people are going to go kicking and screaming into this. It's going to be the commercial companies are going to force them to do it. Great. That was that was actually what I think I saw at the conference too. Is a DoorDash was like showing verified versus non-verified and their logo on it and everything. And you may even see some providers that say you know what we're just going to go for that bottom barrel. We're just not even going to do it. We're going to keep our costs low and they'll be the last ones to do it until they go, okay no one's signing up because we're the only ones not doing this now. Cool. Great. Thanks. I'll probably go a little into the weeds with this. How do you think this is going to affect the toll-free side of all of this and places that use that as sort of their outbound number? Yeah. So ironically that's where this concept of lemon twist comes from. So the initial concept doesn't scale well for things like hospitals, government agencies, schools that have a large number of telephone numbers that may want all of their outgoing calls to be identified by a particular ID which is what you're asking about because today that circuit comes in is going to get tagged with whatever number is associated with that. So the next stage of this has a few names lemon twist is one of those proposed standards. Enterprise, shake and stir is what this typically gets referred to and in that case what we're talking about is accredited organizations undefined what that means but imagine City Hall they would then have a signing certificate instead of the telco. So we're kind of going back to the model of the originator does the caller ID they can then on their PBX have this signing certificate so it has to come from a trusted source but then they could say all of our outgoing calls are going to get flagged with this one static caller ID but how that gets attested who gets that how is that going to be kept secure TBD but they do see that that's going to be that next stage and that's frankly why a lot of the commercial entities are thinking about getting into the market selling certs they see the market today is 2000 certificates because one for each telco but once we start talking about giant businesses okay now we're talking about a much larger ecosystem that could be selling the service into and then how do you see fraud basically it's going to be rampant as soon as I don't necessarily think that we're going to see fraud directly from the telco side from the initial shake and stir because it's going to be in their incentive not to have a lot of fraud that's happening the initial amount of fraud that we're going to see somebody deliberately breaking the implementation at the telco the human engineering something going on there once we get to the point where we're crediting institutions it's going to be kind of like how do we know that and now EV search for websites are really going to the right organizations and there's rules that are constantly evolving because people find new ways of exploiting it so I think the biggest challenge is going to be how the heck do we determine what that trusted organization is and then how do we make sure it's secure there and then how do we determine who's allowed to credit now hi this is city hall I want a signing certificate from my switch okay great how do I know you're really city hall so I think a lot of those things have to be figured out cool thank you so my question is a little different so your your talk today is it's interesting but it sounds like you're saying that potentially this could be the death of the phone as well because if you look at and I've been a phone guy I was certified on AT&T Definity and I've been doing this 30 something years and they were in the early days of the phone their phones are critical and the network was less critical and over time I've seen it where I can reboot the PBX in the middle of the day and know what he cared people don't even use the phones very often and so you sort of see in the home phone is basically disappearing right and and so I sort of wonder is it going to be enough in time to make it so that I really want to even bother answering my phone if it's not yeah I think you're you're touching on a couple interesting things there what one I think if nothing is done the trust in telephony is just getting eroded so people are finding other sources to go to now my daughter doesn't not call me because she doesn't trust that I'm on the other side she's just the Gen Xer and you know she she'll text so there is a different use of telephony that's there I would also say a lot of businesses have evolved so there's probably fewer businesses that rely direct on telephony and use other services like web and and email to communicate but like the the previous presenter is was illustrating is a lot of businesses still interact with their consumers and their customers via telephony because in many ways that is the closest secure connection that they have to them I want to hear your voice I'm going to ask you some questions so telephony may change no the fact that it's all sip and voice based today but could it be conceivable in a couple years that my bank will want me to use FaceTime or some other type of service to talk to them certainly because at the end of the day it's not a lot of data for voice I mean you know 30 years ago it was considered significant exactly I mean it's a very low modulation is very easy to move around the old system seven signaling systems that were in play when I was in the telcoside are all gone so it's all digital so it really is right or at least it's not all IP based right exactly but eventually winds up at some point being transmitted as IP somewhere so I think it's kind of like what we're seeing on the broadband side you know you're still getting broadband TV is kind of broadcast channels but it's going over digital media everything's kind of morphing but I think telephony is going to have to come up with a better identity because it used to be you picked up the phone book if you had a number you knew who was going to be on the other end and it just doesn't happen that way anymore thank you in the shake and stir model with MVNO's would they be required to implement their own certificates or would they be able to leverage the carriers that they're operating on sure so that's kind of the the framework that's in vision if I just back up here real quick the concept would really be if there we go that the model was designed that any organization that's either originating or receiving calls could implement their own PKI TBD on how that gets attested or the fact that there could be a commercial provider that's out there when we look at things like the enterprise or that lemon twist variation where it would be the large organizations the differing models are where to do their signing certificates come from do they come from the telco or do they come from the policy administrator like where that gets defined we know it would have to come from a trusted PKI I think we'll probably see that technically any PKI could be operated by any of those players but it would have to be attested and audited much like we would expect to see a web trust audit for a commercial CA doing no TLS certificates but all that has yet to be defined one other space in telecom industry is the SMS messages a lot of companies use it for multi-factor authentication and it is considered as the weakest link there were a couple of attacks that happened earlier this year and last year as well is anything happening in that space to yeah I I think the interesting thing is I haven't seen anything specific to the shake and stir in that framework so I don't think it was designed to do anything in there I think it's a little bit of a different problem we don't tend to see on the SMS side too much of the impersonating of the sending of it a lot of what we tend to see on the SMS is impersonating the receiver so whether that's the SIM jacking or something else where I'm trying to get myself in front of someone else by impersonating their SIM or their number on my phone it's almost kind of the opposite problem what we're trying to do is shake and stir where here's where we're trying to prove who the originator is well in the case of a lot of the SMS attacks we know it's the bank that's trying to reach the consumer is this that somebody's inserting themselves in the middle so the top part is how would the messaging structure have to change so that if I want to send an SMS I would need some type of a relay mechanism that went back to the originator to say I got to this thing I was able to validate it somehow and here's the proof I don't know of any frameworks that are directly addressing that but that's probably why we're starting to see the use of other types of the two way texting or other types of messaging systems and I think there's a I haven't looked into it but I know there's kind of a growing standard to replace SMS I think Android just said they're going to start doing it but I forget what it's called you have done one? You had the last one? I mean it was like no I don't want to hold it anymore any other questions? All right I'm going to move to the other side of the partition some more questions and wristbands and I'll see you there thanks for coming thank you very much