Previous Projects

Our consultants worked at several projects as freelancers or for Confidential Technologies GmbH.

• XING messenger end-to-end encryption, 2016-2018
  
  Protocol design and consulting
• Consulting services for the secure messenger Tungsten, 2017
  
  Working on parts of the sync protocol
• OpenPGP support in K-9 Mail, 2017
  
  Funded by the Open Technology Fund
• F-Droid Privileged Extension, 2016
  
  This enables F-Droid to install and delete apps without needing “Unknown Sources” to be enabled (e.g. just like Google Play does)
• Bundesamt für Sicherheit in der Informationstechnik: Nutzung von OpenPGP auf Android, 2016
  
  A requirements analysis and study of existing OpenPGP implementations

Software

We are the maintainers of OpenKeychain, the OpenPGP implementations on Android, and one of the main developers of K-9 Mail. We also hosted organizations for Google Summer of Code 2014-2017.

• OpenKeychain
• K-9 Mail

Standards

We are actively participating in the design of new standards for end-to-end encryption. Currently, our main effort is the participation in the Autocrypt project.

• Autocrypt
• XEP-0373: OpenPGP for XMPP
• XEP-0374: OpenPGP for XMPP Instant Messaging
• Internet-Draft: Linked Identities for OpenPGP
• Internet-Draft: URI Attributes for OpenPGP

Vulnerabilities

• CVE-2016-2425 - Surreptitious sharing on Android, 2016
  
  Bug in AOSP Mail, GMail, WEB.DE Mail, K-9 Mail, Telegram, Threema, Signal
• CVE-2016-6271 - Linphone, 2016
  
  No verification of hash commitment in ZRTP
• Signature verification bypass in Android’s in-app billing, 2013
  
  Google In-App Billing Example

Academic Publications

We co-authored several academic papers in the area of security protocols, usable security, and device-to-device pairing.

• Dominik Schürmann, Arne Brüsch, Ngu Nguyen, Stephan Sigg and Lars Wolf: Moves like Jagger: Exploiting variations in instantaneous gait for spontaneous device pairing, in Pervasive and Mobile Computing, Vol. 47, pages 1 - 12, April 2018
• Signe Rüsch, Dominik Schürmann, Rüdiger Kapitza and Lars Wolf: Forward Secure Delay-Tolerant Networking, in Proceedings of the 12th Workshop on Challenged Networks, CHANTS ‘17, Snowbird, Utah, USA, pages 7-12, ACM, October 2017
• Dominik Schürmann, Sergej Dechand and Lars Wolf: OpenKeychain: An Architecture for Cryptography with Smart Cards and NFC Rings on Android, in Proc. ACM Interact. Mob. Wearable Ubiquitous Technol., Vol. 1, No. 3, New York, NY, USA, pages 99:1-99:24, ACM, September 2017
• Dominik Schürmann, Fabian Kabus, Gregor Hildermeier and Lars Wolf: Wiretapping End-to-End Encrypted VoIP Calls: Real-World Attacks on ZRTP, in Proceedings on Privacy Enhancing Technologies, Vol. 2017, No. 3, pages 4-20, July 2017
• Sergej Dechand, Dominik Schürmann, Karoline Busse, Yasemin Acar, Sascha Fahl and Matthew Smith: An Empirical Study of Textual Key-Fingerprint Representations, in 25th USENIX Security Symposium (USENIX Security 16), Austin, TX, pages 193-208, USENIX Association, August 2016
• Dominik Schürmann and Stephan Sigg: Secure Communication Based on Ambient Audio, in IEEE Transactions on Mobile Computing (TMC), Vol. 12, No. 2, pages 358-370, February 2013

Full list of publications