Sapient bundle - Enhance API confidentiality

With Let's Encrypt, HTTPS has been implemented in many websites very quickly. However, this is not enough to secure certain use cases. Setting up the sapient bundle allows you to add an additional layer of authentication and encryption of the contents of your HTTP responses.
I propose to see how to use this bundle.

Transcript

1. SAPIENT BUNDLE Enhance API confidentiality
2. WHO AM I? Thierry Thuon Developer @ Eleven-Labs github.com/lepiaf
3. API EVERYWHERE
4. Threat on Internet - Phishing - DNS/ARP Cache poisoning - Trust / compromised CA / intermediate - Hacker / Government
5. Countermeasure - DNSSEC - HTTPS / VPN - Public-key pinning - Bunker underground fully isolated in Sweden
6. Focus on trust threat
7. Do you trust CDN? API CDN Client Big data Decrypt / store
8. Use case to level up trust - Public API with signed content - Public API via CDN - Private API through untrusted network
9. Sapient bundle
10. Let’s talk about the bundle - Based on sapient library - Which is based on libsodium - Which is audited and in PHP core - Which bring modern cryptography
11. Let’s talk about the bundle - It ease integration of sapient library in Symfony - Add a new layer of confidentiality and integrity
12. Show me how easy it is - Assuming PHP 7.2 and Symfony 4 composer config extra.symfony.allow-contrib true composer install lepiaf/sapient-bundle
13. Creation of asymmetric keys bin/console sapient:configure sapient: sign: public: 'G3zo5Zub2o...' private: 'giP81DlS_R3JL...' host: 'api-alice' response: true seal: public: 'tquhje8C_hNdd85...' private: 'NoxnlCvhxl8...' response: true sealing_public_keys: ~ verifying_public_keys: ~
14. Signing message
15. Elliptic curve Curve25519 - X25519 - Ed25519 y2 = x3 + 486662x2
16. Demo time !
17. Sign all response - Enable configuration - All done automatically in Symfony
18. Encrypt response - Enable a configuration
19. Encrypt request - Visit documentation ◦ http://sapient-bundle.readthedocs.io/ - Visit blog post ◦ https://blog.eleven-labs.com/fr/renforcer-confidentialite-api -sapient-bundle/
20. Under the hood Plain text Symfony response PSR-7 response Generate ephemeral X25519 key pair Key exchange with X25519 algorithm Public key of client AEAD with XChaCha20-Poly1305 Shared key Generate PSR-7 response Symfony response with authenticated and encrypted body Ephemeral public key
21. Under the hood Plain text Symfony response PSR-7 response Fetch ephemeral public key in response Key exchange with X25519 algorithm Private key of client Decrypt AEAD with XChaCha20-Poly1305 Shared key Generate PSR-7 response Symfony response with authenticated and encrypted body Ephemeral public key
22. Conclusion - Niche problematic - Security low priority - Elegant and modern solution exist - libsodium can do more
24. Resources - http://wiki.cacert.org/Risk/History#C0m0d0 - https://security.googleblog.com/2013/12/further-improving-digital-certificate.html - https://www.theregister.co.uk/2018/03/01/trustico_digicert_symantec_spat/ - https://blog.cloudflare.com/a-relatively-easy-to-understand-primer-on-elliptic-curve-cryptography/ - https://safecurves.cr.yp.to/ - http://www.bortzmeyer.org/7539.html - https://blog.eleven-labs.com/fr/renforcer-confidentialite-api-sapient-bundle/ - https://commons.wikimedia.org/wiki/File:Adding_P,Q.PNG - https://commons.wikimedia.org/wiki/File:Public_key_encryption.svg - https://commons.wikimedia.org/wiki/File:Private_key_signing.png - http://picpedia.org/handwriting/t/trust.html