What If We Had TLS for Phone Numbers?
Explores applying TLS-style cryptographic identity and encryption primitives to telephone networks to mitigate spoofing and call interception.
Summary
In this technical briefing from the DEF CON Safe Mode Crypto & Privacy Village, Twilio developer advocate Kelley Robinson presents "What If We Had TLS for Phone Numbers?", exploring caller ID authentication and cryptographic identity in telecommunications. Opening at 00:00, Kelley analyzes the structural origins of robocall fraud, explaining that the legacy Public Switched Telephone Network (PSTN) was designed on implicit trust without origin verification.
At 08:00, she introduces the STIR (Secure Telephone Identity Revisited) and SHAKEN (Signature-based Handling of Asserted information using toKENs) standards, illustrating how public key cryptography, digital certificates, and SIP header signing bring cryptographic verification to phone calls much like TLS secures web traffic.
At 16:00, Kelley breaks down the three tiers of SHAKEN attestation (Full, Partial, and Gateway) and discusses the impact of regulatory mandates such as the federal TRACED Act. Concluding past 22:00, she evaluates the operational hurdles of global carrier adoption, legacy circuit-switched interconnects, and the limitations of cryptographic attestation in combating modern caller spoofing. (AI summary — Gemini Flash)
Related talks
Crypto Village·28 min
Porter Adams · Emily Stamm
Analyzes the cryptographic and privacy challenges of implementing secure end-to-end verifiable online voting systems.
Crypto Village·48 min
Per Thorsheim
Reflects on the infamous Paris Hilton Sidekick hack, analyzing account takeover tactics, security questions, and modern authentication flaws.
Crypto Village·45 min
Hanno Böck
Hanno Böck reveals critical flaws in STARTTLS implementations across mail servers and clients, demonstrating command injection and credential theft via protocol downgrade attacks.