Vincent Rijmen is the belgian cryptographer that, together with Joan Daemen, developed the Rijndael block cipher. Their achievement was so remarkable that it was chosen by the National Institute of Standards and Technology of the United States (NIST) and ratified as a new standard, the Advanced Encryption Standard or simply AES.

Vincent Rijmen is currently leading the IAIK Krypto Group at Graz University of Technology. He was so kind to accept our invitation to answer few questions on the subject of web cryptography and the vision of the browser as a new and ubiquitous number crunching tool, capable of executing cryptographic algorithms.

[Clipperz]: Over the last years the Internet has proved to be an unprecedented communication tool, dramatically altering our communications patterns. Nonetheless it has made little difference to the way in which we handle private and confidential information. People keep using traditional solutions to safeguard their little and big secrets (locked drawers, safety boxes, notary deposit, and the ever popular post-it under the keyboard!).
What is the Internet lacking in order to be regarded a safe place for our information?

[VR]: I guess it requires a leap of mind before we start using a means of communication as a means of storing secrets. Before we had the Internet, people weren’t in the habit of mailing around their secrets with ordinary mail. It takes time to realize that keeping secrets in this way is a possibility.
Furthermore, there is an issue of availability. What happens if you lose connectivity, perhaps because of a power failure in a remote area of the world, where the server holding your secret happens to be?
Perhaps initiatives like Google Desktop will help people getting used to doing things over the Internet. Google of course lacks the confidentiality properties that Clipperz provides.

[Clipperz]: The advent of Ajax unleashed the concept of host-proof hosting, i.e. a new class of online services where providers are simply in charge of delivering the Ajax web application to the user’s browser and then storing user’s data in an encrypted form on their servers. All encryption and decryption takes place inside the browser itself.
Do you think a solid host-proof hosting platform can be built today? What are your suggestions for getting it right?

[VR]: The way you describe it, it seems within reach. What is needed, is that the user can be absolutely sure that he is executing the right programs. In my view, this requires open source development to allow people to check what a particular program does, and on top of that something like trusted computing to allow people to check that the downloaded executable corresponds to the source that was inspected.

[Clipperz]: What are your suggestions for a well designed Javascript implementation of AES?

[VR]: I have no idea, really. I must confess that I am an electronics engineer by education. I’ve never programmed anything in a scripting language. That doesn’t mean I look down on it. I just never found the time to play with it.

[Clipperz]: Clipperz is planning to release a JavaScript library of crypto primitives under a BSD license and make it publicly available for security code review. It will include the SRP protocol, SHA-2, AES, Fortuna PRNG, ECC, … We hope it could serve to ignite the development of more web applications that give users the power to encrypt and decrypt their data locally without installing any software or plugin.
The social web is great, now let’s make the private web! Would you endorse such an effort?

[VR]: This sounds like a great initiative. I suspect it will take some serious effort to get all this running on the different brands and versions of browsers that we have now.

[Clipperz]: What are your major research interests today?

[VR]: Further analysis of AES and similar ciphers: what could we have done better, given what we have learned in the meantime? Secondly, there are very interesting developments going on in the cryptanalysis of hash functions (MD5, SHA-1). My students and I are actively following up on these developments.

---

Thanks prof. Vincent Rijmen!

(Disclosure: AES is one of the building blocks of the Clipperz password manager.)