Dr.-Ing. Dominik Schürmann

Security Researcher

Vincent Breitmoser, M.Sc.

Security Developer

Consulting

Confidential Technologies GmbH offers a range of consulting services for security research and development. We are experts in the area of real-world network security protocols and Android security.

Dr.-Ing. Dominik Schürmann conducts network protocol research and published over 15 academic papers on international conferences and journals. He is the maintainer of OpenKeychain, the OpenPGP implementation on Android, and found several security vulnerabilities in Android’s in-app billing, email apps, and messengers.

Vincent Breitmoser is a developer and consultant specialized in Android security and encryption protocols. He is one of the main developers of K-9 Mail, the leading open source email app for Android, and participated in writing the Autocrypt specification.

Please contact us for consulting services:

Analysis and implementation of security protocols
OpenPGP consulting
Double Ratchet based protocols (Signal, OMEMO,…)
Key exchange protocols (Password Authenticated Key Exchanges)
Email security
Android security
F-Droid Deployments and Whitelabeling

Previous Projects

Our consultants worked at several projects as freelancers or for Confidential Technologies GmbH.

XING messenger end-to-end encryption, 2016-2018

Protocol design and consulting
Consulting services for the secure messenger Tungsten, 2017

Working on parts of the sync protocol
OpenPGP support in K-9 Mail, 2017

Funded by the Open Technology Fund
F-Droid Privileged Extension, 2016

This enables F-Droid to install and delete apps without needing “Unknown Sources” to be enabled (e.g. just like Google Play does)
Bundesamt für Sicherheit in der Informationstechnik: Nutzung von OpenPGP auf Android, 2016

A requirements analysis and study of existing OpenPGP implementations

Software

We are the maintainers of OpenKeychain, the OpenPGP implementations on Android, and one of the main developers of K-9 Mail. We also hosted organizations for Google Summer of Code 2014-2017.

Standards

We are actively participating in the design of new standards for end-to-end encryption. Currently, our main effort is the participation in the Autocrypt project.

Vulnerabilities

CVE-2016-2425 - Surreptitious sharing on Android, 2016

Bug in AOSP Mail, GMail, WEB.DE Mail, K-9 Mail, Telegram, Threema, Signal
CVE-2016-6271 - Linphone, 2016

No verification of hash commitment in ZRTP
Signature verification bypass in Android’s in-app billing, 2013

Google In-App Billing Example

Academic Publications

We co-authored several academic papers in the area of security protocols, usable security, and device-to-device pairing.

Dominik Schürmann, Arne Brüsch, Ngu Nguyen, Stephan Sigg and Lars Wolf: Moves like Jagger: Exploiting variations in instantaneous gait for spontaneous device pairing, in Pervasive and Mobile Computing, Vol. 47, pages 1 - 12, April 2018
Signe Rüsch, Dominik Schürmann, Rüdiger Kapitza and Lars Wolf: Forward Secure Delay-Tolerant Networking, in Proceedings of the 12th Workshop on Challenged Networks, CHANTS ‘17, Snowbird, Utah, USA, pages 7-12, ACM, October 2017
Dominik Schürmann, Sergej Dechand and Lars Wolf: OpenKeychain: An Architecture for Cryptography with Smart Cards and NFC Rings on Android, in Proc. ACM Interact. Mob. Wearable Ubiquitous Technol., Vol. 1, No. 3, New York, NY, USA, pages 99:1-99:24, ACM, September 2017
Dominik Schürmann, Fabian Kabus, Gregor Hildermeier and Lars Wolf: Wiretapping End-to-End Encrypted VoIP Calls: Real-World Attacks on ZRTP, in Proceedings on Privacy Enhancing Technologies, Vol. 2017, No. 3, pages 4-20, July 2017
Sergej Dechand, Dominik Schürmann, Karoline Busse, Yasemin Acar, Sascha Fahl and Matthew Smith: An Empirical Study of Textual Key-Fingerprint Representations, in 25th USENIX Security Symposium (USENIX Security 16), Austin, TX, pages 193-208, USENIX Association, August 2016
Dominik Schürmann and Stephan Sigg: Secure Communication Based on Ambient Audio, in IEEE Transactions on Mobile Computing (TMC), Vol. 12, No. 2, pages 358-370, February 2013

Full list of publications