How To Syn with Ali

Feng Hao1 and Peter Y.A. Ryan⋆2 1 S hool of Computing S ien e New astle University feng.hao n l.a .uk 2 Fa ulty of S ien e University of Luxembourg peter.ryan uni.lu Abstra t. This paper explains the syn problem and ompares solutions in Firefox 4 and Chrome 10. The syn problem studies how to se urely syn hronize data a ross di erent omputers. Google has added a built-in syn fun tion in Chrome 10, whi h uses a user-de ned password to en rypt bookmarks, history, a hed passwords et . However, due to the low-entropy of passwords, the en ryption is inherently weak anyone with a ess to the iphertext an easily un over the key (and hen e dis lose the plaintext). Mozilla used to have a very similar syn solution in Firefox 3.5, but sin e Firefox 4 it has made a omplete hange of how syn works in the browser. The new solution is based on a se urity proto ol alled J-PAKE, whi h is a balan ed Password Authenti ated Key Ex hange (PAKE) proto ol. To our best knowledge, this is the rst large-s ale deployment of the PAKE te hnology. Sin e PAKE does not require a PKI, it has ompelling advantages than PKI-based s hemes su h as SSL/TLS in many appli ations. However, in the past de ade, deploying PAKE has been greatly hampered by the patent and other issues. With the rise of patent-free solutions su h as J-PAKE and also that the EKE patent will soon expire in O tober, 2011, we believe the PAKE te hnology will be more widely adopted in the near future. 1 Introdu tion The past two de ades have seen the gradual evolution of a omputer. A omputer used to be a luxury, but now it is a ne essity; it used to be bulky and xed at one lo ation, but with the rise of smartphones and tablets, it is be oming smaller and more mobile; it used to store data lo ally, but now data storage is moving to the loud (whi h an be a essed anywhere from the Internet). One trend from this evolution is that an individual now tends to own several omputing devi es. At home, he may use a good-performan e desktop PC for entertainment; on the road, he may use a smart phone to read news and he k emails; at meetings, he may use a laptop or a tablet to deliver a presentation. The possession of multiple omputers naturally raises a pra ti al problem: how to keep data in syn a ross di erent platforms?