Practical cryptography with Tink
summary
Google's Tink is a high‑level crypto library that replaces error‑prone APIs with concrete primitives: AEAD for one‑liner authenticated encryption (avoids manual IVs and the 128‑bit tag pitfall), streaming AEAD that chunks data (8 KB or 1 MB) and verifies each chunk before releasing plaintext, and hybrid public‑key crypto using KEM/DEM to support post‑quantum schemes. Keysets carry algorithm metadata, a primary key picks the algorithm for new outputs, verification throws on failure (no ignored booleans), and integrations target KMS, Android Keystore and iOS Keychain.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:54What is Tink
- 5:26Old crypto libraries insecure
- 10:18Modern crypto libraries
- 12:47Authenticated encryption simplified
- 16:21Streaming encryption
- 20:37Digital signatures
- 22:44Public key encryption
- 27:12Key management
- 31:53Cryptographic agility explained
- 35:48Secure key management
- 37:35Tink's support for JSON Web Tokens
- 39:21Secure-by-design patterns
- 40:50Easier to audit
- 41:14Q&A
related talks
28mModern security for Android Developers
20m10 Weird Applications of Public Key Cryptography
50mUsing OP-TEE as a Cryptography Engine
25mCryptography Isn't Scary
29mThe Go Cryptography State of the Union
52mPrivacy & Security, Policy & Technology
36mUse Cryptography; Don't Learn It
01h 04mWhispered Secrets