Integrating Crypto Identities with Android

 Posted on December 28, 2013  |  Hans-Christoph Steiner

ver the past couple of years, Android has included a central database for managing information about people, it is known as the ContactsContract (that’s a mouthful). Android then provides the People app and reusable interface chunks to choose contacts that work with all the information in the ContactsContract database. Any time that you are adding an account in the Settings app, you are setting up this integration. You can see it with Google services, Skype, Facebook, and many more. [Read More]
Android  encryption  gnupg  gpg  identity  openpgp  otr  pgp  psst  usability 

Keys, signatures, certificates, verifications, etc. What are all these for?

 Posted on December 12, 2013  |  Hans-Christoph Steiner

For the past two years, we have been thinking about how to make it easier for anyone to achieve private communications. One particular focus has been on the “security tokens” that are required to make private communications systems work. This research area is called internally Portable Shared Security Tokens aka PSST. All of the privacy tools that we are working on require “keys” and “signatures”, to use the language of cryptography, and these are the core of what “security tokens” are. [Read More]
encryption  identity  nfc  openpgp  otr  pgp  privacy  psst  qrcode  secure introductions  security  trust  usability 

Getting keys into your keyring with Gnu Privacy Guard for Android

 Posted on December 6, 2013  |  Hans-Christoph Steiner

Now that you can have a full GnuPG on your Android device with Gnu Privacy Guard for Android, the next step is getting keys you need onto your device and included in Gnu Privacy Guard. We have tried to make it as easy as possible without compromising privacy, and have implemented a few approaches, while working on others. There are a few ways to get this done right now. Gnu Privacy Guard registered itself with Android as a handler of all the standard OpenPGP MIME types (application/pgp-keys, application/pgp-encrypted, application/pgp-signature), as well as all of the OpenPGP and GnuPG file extensions (. [Read More]
Android  encryption  gnupg  gpg  howto  identity  open source  openpgp  pgp  privacy  psst  security 

Keeping data private means it must be truly deletable!

 Posted on August 23, 2013  |  Hans-Christoph Steiner

There are lots of apps these days that promise to keep your data secure, and even some that promise to wipe away private information mere seconds or minutes after it has been received. It is one thing to keep data out of view from people you don’t want seeing it, it is also important to be able to truly delete information. Unfortunately computers make it very difficult to make data truly disappear. [Read More]
cacheword  encryption  iocipher  panic button  privacy  psst  secure deletion  security  sqlcipher  wipe 

GnuPG for Android progress: we have an command line app!

 Posted on May 9, 2013  |  Hans-Christoph Steiner

This alpha release of our command-line developer tool brings GnuPG to Android for the first time! GNU Privacy Guard Command-Line (gpgcli) gives you command line access to the entire GnuPG suite of encryption software. GPG is GNU’s tool for end-to-end secure communication and encrypted data storage. This trusted protocol is the free software alternative to PGP. GnuPG 2.1 is the new modularized version of GnuPG that now supports OpenPGP and S/MIME. [Read More]
Android  encryption  gnupg  gpg  oi2  open source  openpgp  pgp  preview  psst 

IOCipher beta: easy encrypted file storage for your Android app

 Posted on February 7, 2013  |  Hans-Christoph Steiner

At long last, we are proud to announce the first beta release of IOCipher, an easy framework for providing virtual encrypted disks for Android apps. does not require root or any special permissions at all the API is a drop-in replacement for the standard java.io.File API, so if you have ever worked with files in Java, you already know how to use IOCipher works easiest in an app that stores all files in IOCipher, but using standard java. [Read More]
Android  beta  encryption  iocipher  open source  privacy  psst  secure storage 

report on IOCipher beta dev sprint

 Posted on January 31, 2013  |  Hans-Christoph Steiner

We are just wrapping up an intensive dev sprint on IOCipher in order to get the first real beta release out, and it has been a wonderfully productive session on many levels! Before we started this, we had a proof-of-concept project that was crashy and ridiculously slow. We’re talking crashes every 100 or so transactions and 9 minutes to write 2 megs. Abel and I were plodding thru the bugs, trying to find the motivation to dive into the hard problems in the guts of some of the more arcane parts of the code. [Read More]
Android  encryption  iocipher  libsqlfs  open source  psst  sqlcipher 

IOCipher lives! encrypted virtual file system for Android

 Posted on May 17, 2012  |  Hans-Christoph Steiner

Nathan and I just got the first complete test of IOCipher working in the IOCipherServer/SpotSync app. We created a filesystem sqlite.db file, then mounted it and got all the files via HTTP. In the test suite, I have lots of operations all running fine and encrypting! The core idea here is a java.io API replacement that transparently writes to an encrypted store. So for the most part, just change your import statements from: [Read More]
Android  encryption  open source  prototype  psst  security 

User scenarios to guide our crypto development

 Posted on April 14, 2012  |  Hans-Christoph Steiner

At Guardian Project, we find user-centered development to be essential to producing useful software that addresses real world needs. To drive this, we work with user stories and scenarios as part of the process of developing software. One particular development focus is the Portable Shared Security Token (PSST) project, which aims to make it easy to use encryption across both mobile and desktop computers, as well as keep the stores of cryptographic identities (i. [Read More]
anonymity  encryption  openpgp  otr  privacy  psst  usability  user scenarios  user stories 

Transparent encrypted virtual disks for Android (we call it IOCipher)

 Posted on April 3, 2012  |  Hans-Christoph Steiner

When using phones, laptops, computers, etc. it feels like a private experience, as if our screen was the same as a piece of paper, and when that paper is gone, then no one can see it anymore. Digital media works very differently. While the user interface portrays the deletion of files as very final, for someone with the right tools, it is actually not hard to recover deleted files. Also, digital information takes up so little space, we now regularly carry vast amounts of information in our pockets. [Read More]
Android  encryption  full disk encryption  fuse  open source  psst 

On Verifying Identity Using Cryptography

 Posted on March 19, 2012  |  Hans-Christoph Steiner

One of the most important uses of cryptography these days is verifying the identity of the other side of a digital conversation. That conversation could be between two people using OTR-encrypted IM, a web browser showing a bank website, a Debian Developer uploading a package to the Debian build server, an ssh client logging into an ssh server, and on and on. In all of these cases, cryptography is used to ensure that the software is indeed receiving replies from the expected entity. [Read More]
crypto  https  identity  openpgp  otr  psst  signing  ssh 

How many ways to store 5 numbers?

 Posted on February 23, 2012  |  Hans-Christoph Steiner

At the core of all software that aims to be secure, private and anonymous is encryption, or as I think of it, amazing math tricks with really large numbers. These really large numbers can serve as a token of identity or the key to information locked away behind the encryption math. There are a number of different encryption methods commonly used based on different mathematical ideas, but they all rely on people managing sets of really large numbers, usually known as keys. [Read More]
dsa  encryption  keys  otr  psst