Secure Reactive Systems
|
|
|
- Peregrine Craig
- 8 years ago
- Views:
Transcription
1 Michael Backes Saarland University, Germany joint work with Birgit Pfitzmann and Michael Waidner Secure Reactive Systems Lecture at Tartu U, 02/27/06
2 Building Systems on Open Networks E-Government Hospital Bank
3 Cryptography: The Details Encryption Fact(p*q) DL(gx) Signature Hashfunction Prob[ Key establishment ] Attack Encryption Hashfunction Crypto-Toolbox
4 Cryptography: The Details Encryption Signature Hashfunction Key establishment Crypto-Toolbox Proof
5 But justify can we? Idealized Signature Saarland University Encryption Hashfunction Formal Methods: The Big Picture Key establishment Crypto Designed Verified by CAD CAV
6 Idea: Sound Abstract Protocol Proofs Formalize with given interface Prove per Protocol Abstract primitives uses Abstract protocol fulfils Abstract goals Abstrac tion Concrete primitives replace primitives uses Clear Concrete protocol Abstrac tion fulfils Property Pres. Concrete goals General defs
7 Example Only this per system Abstract SecChan uses Pay via SecChan fulfils PaySys Integrity Abstrac tion replace primitive s Abstrac tion General defs SSL (?) uses Pay via SSL fulfils " with error prob
8 Courses Syllabus What do we do in this course? 1. Define a rigorous model for reactive systems and give a definition of sound abstraction within this model 2. Show compositionality of the definition (along with some base lemmata) and give concrete examples that satisfy the definition 3. Investigate how specific properties behave under this definition (integrity, confidentiality, liveness, ) 4. Can we even justify symbolic abstractions of crypto with that? Tool support, applications to large protocols, 5. Limitations of Soundness, and spezialized properties (strong key and message secrecy, etc.)
9 What do we need for soundly abstracting? Precise system model that permits all realistic attacks.
10 What do we need for soundly abstracting? Precise system model that permits all realistic attacks. Network characteristics? synchr./asynchr., reliable, secure, etc. Power of the adversary? Passive/active, static/dynamic, secure function evaluation / reactive (!) Realistic scheduling Which other protocols may run concurrently?
11 What do we need for soundly abstracting? Precise system model that permits all realistic attacks. Capable of reasoning about abstractions and realizations at the same time
12 What do we need for soundly abstracting? Precise system model that permits all realistic attacks. Capable of reasoning about abstractions and realizations at the same time Cryptographic issues: probabilism, error-probabilities, computationsl restrictions, etc. Abstraction issues: Abstract transition functions, distributed-systems aspects, formal calculi, etc.
13 What do we need for soundly abstracting? Precise system model that permits all realistic attacks. Capable of reasoning about abstractions and realizations at the same time Mathematically rigorous definition of what a good abstraction is
14 What do we need for soundly abstracting? Precise system model that permits all realistic attacks. Capable of reasoning about abstractions and realizations at the same time Mathematically rigorous definition of what a good abstraction is Intuitive Should fit to a variety of different abstractions/real protocol classes Provable by convenient proof techniques
15 What do we need for soundly abstracting? Precise system model that permits all realistic attacks. Capable of reasoning about abstractions and realizations at the same time Mathematically rigorous definition of what a good abstraction is Should not only hold in isolation but should preserve security under composition.
16 What do we need for soundly abstracting? Precise system model that permits all realistic attacks. Capable of reasoning about abstractions and realizations at the same time Mathematically rigorous definition of what a good abstraction is Should not only hold in isolation but should preserve security under composition. (Makes the definition useful ) Make modular analysis of larger protocols possible
17 What do we need for soundly abstracting? Precise system model that permits all realistic attacks. Capable of reasoning about abstractions and realizations at the same time Mathematically rigorous definition of what a good abstraction is Should not only hold in isolation but should preserve security under composition. Should preserve essentially arbitrary security properties
18 What do we need for soundly abstracting? Precise system model that permits all realistic attacks. Capable of reasoning about abstractions and realizations at the same time Mathematically rigorous definition of what a good abstraction is Should not only hold in isolation but should preserve security under composition. Should preserve essentially arbitrary security properties Integrity, variants of confidentiality, non-interference, poly-time variants of liveness Tight links to properties shown for symbolic abstractions of crypto
19 What do we need for soundly abstracting? Precise system model that permits all realistic attacks. Capable of reasoning about abstractions and realizations at the same time Mathematically rigorous definition of what a good abstraction is Should not only hold in isolation but should preserve security under composition. Should preserve essentially arbitrary security properties Abstractions should match the intuition for the requirements in mind.
20 What do we need for soundly abstracting? Precise system model that permits all realistic attacks. Capable of reasoning about abstractions and realizations at the same time Mathematically rigorous definition of what a good abstraction is Should not only hold in isolation but should preserve security under composition. Should preserve essentially arbitrary security properties Abstractions should match the intuition for the requirements in mind. Intuitive abstractions, easy to read for non-specialist, thus enabling convenient use in larger protocols
21 What do we need for soundly abstracting? Precise system model that permits all realistic attacks. Capable of reasoning about abstractions and realizations at the same time Mathematically rigorous definition of what a good abstraction is Should not only hold in isolation but should preserve security under composition. Should preserve essentially arbitrary security properties Abstractions should match the intuition for the requirements in mind. Abstractions should be based on the functionality of the protocol, not on its structure.
22 What do we need for soundly abstracting? Precise system model that permits all realistic attacks. Capable of reasoning about abstractions and realizations at the same time Mathematically rigorous definition of what a good abstraction is Should not only hold in isolation but should preserve security under composition. Should preserve essentially arbitrary security properties Abstractions should match the intuition for the requirements in mind. Abstractions should be based on the functionality of the protocol, not on its structure. Functionalities for large protocol classes Only guarantees matter for larger protocols, not how they are achieved
23 What do we need for soundly abstracting? Precise system model that permits all realistic attacks. Capable of reasoning about abstractions and realizations at the same time Mathematically rigorous definition of what a good abstraction is Should not only hold in isolation but should preserve security under composition. Should preserve essentially arbitrary security properties Abstractions should match the intuition for the requirements in mind. Abstractions should be based on the functionality of the protocol, not on its structure. Good abstractions for many of useful protocol (classes) should exist!
24 What do we need for soundly abstracting? Precise system model that permits all realistic attacks. Capable of reasoning about abstractions and realizations at the same time Mathematically rigorous definition of what a good abstraction is Should not only hold in isolation but should preserve security under composition. Should preserve essentially arbitrary security properties Abstractions should match the intuition for the requirements in mind. Abstractions should be based on the functionality of the protocol, not on its structure. Good abstractions for many of useful protocol (classes) should exist!
25 Idea: Define Security relative to an ideal task M 1 M 2 implements as secure as TH Real system Ideal system (abstraction) How to define that? What does every attack mean? successfully converted? What are good ideal systems? What about concrete security properties, e.g., integrity or secrecy?
26 Idea: Define Security relative to an ideal task M 1 M 2 implements as secure as TH Real system Ideal system (abstraction) How to define that? What does every attack mean? successfully converted? What are good ideal systems? What about concrete security properties, e.g., integrity or secrecy?
27 Reactive Simulatability Top-Level M 1 H M 2 A H TH Sim A Real system Ideal system Idea: Whatever happens with real system could also happen view real (H) with ideal view ideal system. (H) Indistinguishability of random variables
28 What do we need for soundly abstracting? Precise system model that permits all realistic attacks. Capable for reasoning about abstractions and realizations at the same time Mathematically rigorous definition of what a good abstraction is Should not only hold in isolation but should preserve security under composition. Should preserve essentially arbitrary security properties Abstractions should match the intuition for the requirements in mind. Abstractions should be based on the functionality of the protocol, not on its structure. Good abstractions for many of useful protocol (classes) should exist!
29 Naive Approach E.g., secure channel m m Not so easy, e.g.: Who-to to-whom and length leak. No availability Ok that error probability etc. omitted?
30 What Abstractions are good at + Well-defined protocol languages + Tool-support [ ] No cryptographic semantics Often term algebras: D x (E x (E x (m))) [DY81] Initial semantics : No other equations No techniques for larger modules
31 Cryptographic Definitions + Precise,, proofs possible Long and error-prone Adversary Active attacks Error probabilities, computational restrictions
32 Example: Encryption, passive A 1, A 2 PPT: P(b* = b :: (Attacker success) (sk, pk) gen(k); (Keys) (m 0, m 1, v) A 1 (k, pk); (Message choice) b R {0, 1}; c := enc(pk, m b ); (Encrypt) b* A 2 (v, c) ) (Guess) 1/2 + 1/poly(k) (Negligible)
33 The Reactive Simulatability Framework Overview
34 The Reactive Simulatability Framework Precise system model allowing cryptographic and abstract operations Reactive simulatability with composition theorem Preservation theorems for security properties Concrete pairs of idealizations and secure realizations Sound symbolic abstractions (Dolev-Yao models) that are suitable for tool support Sound security proofs of security protocols: NSL, Otway-Rees, ikp, etc. Detailed Proofs (Poly-time, cryptographic bisimulations with static information flow analysis, )
35 What do we need for soundly abstracting? Precise system model that permits all realistic attacks. Capable for reasoning about abstractions and realizations at the same time Mathematically rigorous definition of what a good abstraction is Should not only hold in isolation but should preserve security under composition. Should preserve essentially arbitrary security properties Abstractions should match the intuition for the requirements in mind. Abstractions should be based on the functionality of the protocol, not on its structure. Good abstractions for many of useful protocol (classes) should exist!
36 Cryptographic Idealization Layers Symbolic abstractions Larger abstractions Small real abstractions Low-level crypto (not abstract) VSS [GM95] Secure channels [PW00, PW01, CK02, BJP02,...] Encryption as E(pk, 1 len ) [LMMS98, PW00, C01,...] Dolev-Yao Model Certified mail [PSW00] Credentials [CL01] Auth/sigs as statement database [BPW03...] Related: [SM93,P93] Real auth/sig s + integrity lookup [LMMS98, C01,...] Normal cryptographic definitions
37 Cryptographic Idealization Layers Symbolic abstractions Larger abstractions Small real abstractions Low-level crypto (not abstract) VSS [GM95] Secure channels [PW00, PW01, CK02, BJP02,...] Encryption as E(pk, 1 len ) [LMMS98, PW00, C01,...] Dolev-Yao Model Certified mail [PSW00] Credentials [CL01] Auth/sigs as statement database [BPW03...] Related: [SM93,P93] Real auth/sig s + integrity lookup [LMMS98, C01,...] Normal cryptographic definitions
38 The Reactive Simulatability Framework Still today: Precise system model allowing cryptographic and abstract operations Reactive simulatability with composition theorem Preservation theorems for security properties Concrete pairs of idealizations and secure realizations Sound symbolic abstractions (Dolev-Yao models) that are suitable for tool support Sound security proofs of security protocols: NSL, Otway-Rees, ikp, etc. Detailed Proofs (Poly-time, cryptographic bisimulations with static information flow analysis, )
39 Definitions Bottom-up (board) 1. General Model: Collections of probabilistic I/O automata connections via ports Turing machine realization (realistic) Timing Asynchronous: Distributed scheduling via clock ports Older Synchronous variant: Clk: Subrounds P(M*)
40 Defining Executions (Extended) Probabilistic I/O Automata Automata communicate via ports p!, p?, ( p! ) Runs defined for collections of automata: First Synchronous: Clocking scheme, e.g., {1} {1,2} {3} M 2 M 1 M 3
41 Defining Executions (Extended) Probabilistic I/O Automata Automata communicate via ports p!, p?, ( p! ) Runs defined for collections of automata: First Synchronous: Clocking scheme, e.g., {1} {1,2} {3} a M 2 a M 1 M 3 b b
42 Defining Executions (Extended) Probabilistic I/O Automata Automata communicate via ports p!, p?, ( p! ) Runs defined for collections of automata: First Synchronous: Clocking scheme, e.g., {1} {1,2} {3} a M 2 M 1 M 3 b
43 Defining Executions (Extended) Probabilistic I/O Automata Automata communicate via ports p!, p?, ( p! ) Runs defined for collections of automata: First Synchronous: Clocking scheme, e.g., {1} {1,2} {3} M 2 c d M 1 M 3 e b
44 Defining Executions (Extended) Probabilistic I/O Automata Automata communicate via ports p!, p?, ( p! ) Runs defined for collections of automata: First Synchronous: Clocking scheme, e.g., {1} {1,2} {3} d M 2 c M 1 M 3 b ο e
45 Defining Executions (Extended) Probabilistic I/O Automata Automata communicate via ports p!, p?, ( p! ) Runs defined for collections of automata: First Synchronous: Clocking scheme, e.g., {1} {1,2} {3} d M 2 c M 1 M 3 b ο e
46 Defining Executions (Extended) Probabilistic I/O Automata Automata communicate via ports p!, p?, ( p! ) Runs defined for collections of automata: First Synchronous: Clocking scheme, e.g., {1} {1,2} {3} d M 2 M 1 M 3 f
47 General Model Probabilistic I/O Automata [SL95] Automata communicate via ports p!, p?, ( p! ) Runs defined for collections of automata: Now Asynchronous: Only one machine active, sequential scheduling, master scheduler a M 2 a M 1 b M 3 b 1 b
48 General Model Probabilistic I/O Automata [SL95] Automata communicate via ports p!, p?, ( p! ) Runs defined for collections of automata: Now Asynchronous: Only one machine active, sequential scheduling, master scheduler a M 2 M 1 M 3 b
49 Definitions Bottom-up 2. Security-Specific System Model: Structure: (M, S) with S Ports(M) service ports S M Configurations: (M,( S,, H, A)
50 Reactive Simulatability ( as secure as )
51 Soundness: Reactive Simulatability M 1 H M 2 A H TH A Real system Ideal system Idea: Whatever happens with real system could also happen view real (H) with ideal view ideal system. (H) Indistinguishability of random variables
52 Outlook for Tomorrow Precise system model allowing cryptographic and abstract operations Reactive simulatability with composition theorem Preservation theorems for security properties Concrete pairs of idealizations and secure realizations Sound symbolic abstractions (Dolev-Yao models) that are suitable for tool support Sound security proofs of security protocols: NSL, Otway-Rees, ikp, etc. Detailed Proofs (Poly-time, cryptographic bisimulations with static information flow analysis, )
Simulation-Based Security with Inexhaustible Interactive Turing Machines
Simulation-Based Security with Inexhaustible Interactive Turing Machines Ralf Küsters Institut für Informatik Christian-Albrechts-Universität zu Kiel 24098 Kiel, Germany kuesters@ti.informatik.uni-kiel.de
Formal Methods in Security Protocols Analysis
Formal Methods in Security Protocols Analysis Li Zhiwei Aidong Lu Weichao Wang Department of Computer Science Department of Software and Information Systems University of North Carolina at Charlotte Big
An Overview of Common Adversary Models
An Overview of Common Adversary Karl Palmskog palmskog@kth.se 2012-03-29 Introduction Requirements of Software Systems 1 Functional Correctness: partial, termination, liveness, safety,... 2 Nonfunctional
Computational Soundness of Symbolic Security and Implicit Complexity
Computational Soundness of Symbolic Security and Implicit Complexity Bruce Kapron Computer Science Department University of Victoria Victoria, British Columbia NII Shonan Meeting, November 3-7, 2013 Overview
1 Digital Signatures. 1.1 The RSA Function: The eth Power Map on Z n. Crypto: Primitives and Protocols Lecture 6.
1 Digital Signatures A digital signature is a fundamental cryptographic primitive, technologically equivalent to a handwritten signature. In many applications, digital signatures are used as building blocks
Introduction. Digital Signature
Introduction Electronic transactions and activities taken place over Internet need to be protected against all kinds of interference, accidental or malicious. The general task of the information technology
Certified Security Proofs of Cryptographic Protocols in the Computational Model : an Application to Intrusion Resilience
Certified Security Proofs of Cryptographic Protocols in the Computational Model : an Application to Intrusion Resilience Pierre Corbineau Mathilde Duclos Yassine Lakhnech Université de Grenoble, CNRS Verimag,
Lecture 9 - Message Authentication Codes
Lecture 9 - Message Authentication Codes Boaz Barak March 1, 2010 Reading: Boneh-Shoup chapter 6, Sections 9.1 9.3. Data integrity Until now we ve only been interested in protecting secrecy of data. However,
ZQL. a cryptographic compiler for processing private data. George Danezis. Joint work with Cédric Fournet, Markulf Kohlweiss, Zhengqin Luo
ZQL Work in progress a cryptographic compiler for processing private data George Danezis Joint work with Cédric Fournet, Markulf Kohlweiss, Zhengqin Luo Microsoft Research and Joint INRIA-MSR Centre Data
1 Signatures vs. MACs
CS 120/ E-177: Introduction to Cryptography Salil Vadhan and Alon Rosen Nov. 22, 2006 Lecture Notes 17: Digital Signatures Recommended Reading. Katz-Lindell 10 1 Signatures vs. MACs Digital signatures
How to prove security of communication protocols?
1/37 Introduction on security protocols Modeling Verification Towards cryptographic guarantees How to prove security of communication protocols? Véronique Cortier, LORIA - CNRS, Nancy Colloquium Morgenstern,
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 1 January 9, 2012 CPSC 467b, Lecture 1 1/22 Course Overview Symmetric Cryptography CPSC 467b, Lecture 1 2/22 Course Overview CPSC
Cryptography and Network Security Department of Computer Science and Engineering Indian Institute of Technology Kharagpur
Cryptography and Network Security Department of Computer Science and Engineering Indian Institute of Technology Kharagpur Module No. # 01 Lecture No. # 05 Classic Cryptosystems (Refer Slide Time: 00:42)
Q: Why security protocols?
Security Protocols Q: Why security protocols? Alice Bob A: To allow reliable communication over an untrusted channel (eg. Internet) 2 Security Protocols are out there Confidentiality Authentication Example:
Technical Report: Low-level Ideal Signatures and General Integrity Idealization
Technical Report: Low-level Ideal Signatures and General Integrity Idealization Michael Backes, Birgit Pfitzmann, and Michael Waidner IBM Zurich Research Lab {mbc,bpf,wmi}@zurich.ibm.com January 11, 2007
Symmetric Authentication Within a Simulatable Cryptographic Library
Symmetric Authentication Within a Simulatable Cryptographic Library Michael Backes, Birgit Pfitzmann, and Michael Waidner IBM Zurich Research Lab {mbc,bpf,wmi}@zurich.ibm.com Abstract. Proofs of security
Secure Deduplication of Encrypted Data without Additional Independent Servers
Secure Deduplication of Encrypted Data without Additional Independent Servers Jian Liu Aalto University jian.liu@aalto.fi N. Asokan Aalto University and University of Helsinki asokan@acm.org Benny Pinkas
MACs Message authentication and integrity. Table of contents
MACs Message authentication and integrity Foundations of Cryptography Computer Science Department Wellesley College Table of contents Introduction MACs Constructing Secure MACs Secure communication and
Universally Composable Symbolic Analysis of Diffie-Hellman based Key Exchange
Universally Composable Symbolic Analysis of Diffie-Hellman based Key Exchange Ran Canetti and Sebastian Gajek School of Computer Science Tel Aviv University, Israel May 20, 2010 Abstract Canetti and Herzog
Information Security at ETH Zurich Institute of Information Security at ETH Zurich Zurich Information Security and Privacy Center
Information Security at ETH Zurich Institute of Information Security at ETH Zurich Zurich Information Security and Privacy Center Department of Computer Science Introduction Our society is undergoing a
Separations in Circular Security for Arbitrary Length Key Cycles. Venkata Koppula! Kim Ramchen! Brent Waters
Separations in Circular Security for Arbitrary Length Key Cycles Venkata Koppula! Kim Ramchen! Brent Waters Circular Security Circular Security Circular Security Choose pk, sk! Encrypt using pk! Circular
The MAC In The Box Project
The MAC In The Box Project Michael J. C. Gordon, Robert Künnemann and Graham Steel 1 password databases attack bank email etc. 2 password databases attack bank email etc. 2 password databases attack bank
Analysis of Key-Exchange Protocols and Their Use for Building Secure Channels
Analysis of Key-Exchange Protocols and Their Use for Building Secure Channels Ran Canetti 1 and Hugo Krawczyk 2, 1 IBM T.J. Watson Research Center, Yorktown Heights, New York 10598. canetti@watson.ibm.com
Lecture 1: Introduction. CS 6903: Modern Cryptography Spring 2009. Nitesh Saxena Polytechnic University
Lecture 1: Introduction CS 6903: Modern Cryptography Spring 2009 Nitesh Saxena Polytechnic University Outline Administrative Stuff Introductory Technical Stuff Some Pointers Course Web Page http://isis.poly.edu/courses/cs6903-s10
Next few lectures. Contract-Signing Protocols. Contract Signing. Example. Network is Asynchronous. Another example: stock trading. Today.
CS 259 Next few lectures Contract-Signing Protocols J. itchell V. Shmatikov oday Contract-signing protocols hursday ore about contract signing, probability Next ues Probabilistic model checking Next hurs
Ch.9 Cryptography. The Graduate Center, CUNY.! CSc 75010 Theoretical Computer Science Konstantinos Vamvourellis
Ch.9 Cryptography The Graduate Center, CUNY! CSc 75010 Theoretical Computer Science Konstantinos Vamvourellis Why is Modern Cryptography part of a Complexity course? Short answer:! Because Modern Cryptography
CIS 5371 Cryptography. 8. Encryption --
CIS 5371 Cryptography p y 8. Encryption -- Asymmetric Techniques Textbook encryption algorithms In this chapter, security (confidentiality) is considered in the following sense: All-or-nothing secrecy.
Chapter 17. Transport-Level Security
Chapter 17 Transport-Level Security Web Security Considerations The World Wide Web is fundamentally a client/server application running over the Internet and TCP/IP intranets The following characteristics
Efficient Unlinkable Secret Handshakes for Anonymous Communications
보안공학연구논문지 (Journal of Security Engineering), 제 7권 제 6호 2010년 12월 Efficient Unlinkable Secret Handshakes for Anonymous Communications Eun-Kyung Ryu 1), Kee-Young Yoo 2), Keum-Sook Ha 3) Abstract The technique
CS 758: Cryptography / Network Security
CS 758: Cryptography / Network Security offered in the Fall Semester, 2003, by Doug Stinson my office: DC 3122 my email address: dstinson@uwaterloo.ca my web page: http://cacr.math.uwaterloo.ca/~dstinson/index.html
Capture Resilient ElGamal Signature Protocols
Capture Resilient ElGamal Signature Protocols Hüseyin Acan 1, Kamer Kaya 2,, and Ali Aydın Selçuk 2 1 Bilkent University, Department of Mathematics acan@fen.bilkent.edu.tr 2 Bilkent University, Department
SECURITY ANALYSIS OF NETWORK PROTOCOLS: COMPOSITIONAL REASONING AND COMPLEXITY-THEORETIC FOUNDATIONS
SECURITY ANALYSIS OF NETWORK PROTOCOLS: COMPOSITIONAL REASONING AND COMPLEXITY-THEORETIC FOUNDATIONS A DISSERTATION SUBMITTED TO THE DEPARTMENT OF COMPUTER SCIENCE AND THE COMMITTEE ON GRADUATE STUDIES
Adversary Modelling 1
Adversary Modelling 1 Evaluating the Feasibility of a Symbolic Adversary Model on Smart Transport Ticketing Systems Authors Arthur Sheung Chi Chan, MSc (Royal Holloway, 2014) Keith Mayes, ISG, Royal Holloway
MESSAGE AUTHENTICATION IN AN IDENTITY-BASED ENCRYPTION SCHEME: 1-KEY-ENCRYPT-THEN-MAC
MESSAGE AUTHENTICATION IN AN IDENTITY-BASED ENCRYPTION SCHEME: 1-KEY-ENCRYPT-THEN-MAC by Brittanney Jaclyn Amento A Thesis Submitted to the Faculty of The Charles E. Schmidt College of Science in Partial
Electronic Voting Protocol Analysis with the Inductive Method
Electronic Voting Protocol Analysis with the Inductive Method Introduction E-voting use is spreading quickly in the EU and elsewhere Sensitive, need for formal guarantees Inductive Method: protocol verification
Security Aspects of. Database Outsourcing. Vahid Khodabakhshi Hadi Halvachi. Dec, 2012
Security Aspects of Database Outsourcing Dec, 2012 Vahid Khodabakhshi Hadi Halvachi Security Aspects of Database Outsourcing Security Aspects of Database Outsourcing 2 Outline Introduction to Database
Subtitle? Subtitle? Subtitle? Subtitle? Privacy Preserving Protocols. Subtitle? Subtitle? Subtitle? Subtitle? and Security Proof Techniques
Author Lillian Kråkmo Title Subtitle? Subtitle? Subtitle? Subtitle? Privacy Preserving Protocols Subtitle? Subtitle? Subtitle? Subtitle? and Security Proof Techniques Thesis for the degree of Philosophiae
KEY DISTRIBUTION: PKI and SESSION-KEY EXCHANGE. Mihir Bellare UCSD 1
KEY DISTRIBUTION: PKI and SESSION-KEY EXCHANGE Mihir Bellare UCSD 1 The public key setting Alice M D sk[a] (C) Bob pk[a] C C $ E pk[a] (M) σ $ S sk[a] (M) M, σ Vpk[A] (M, σ) Bob can: send encrypted data
How To Verify A Bluetooth Device Pairing With A Human Eye Oracle
Formal Analysis of Authentication in Bluetooth Device Pairing Richard Chang and Vitaly Shmatikov The University of Texas at Austin Abstract. Bluetooth is a popular standard for short-range wireless communications.
How To Protect Your Data From Attack
Security in Communication Networks Lehrstuhl für Informatik 4 RWTH Aachen Prof. Dr. Otto Spaniol Dr. rer. nat. Dirk Thißen Page 1 Organization Lehrstuhl für Informatik 4 Lecture Lecture takes place on
Overview of Public-Key Cryptography
CS 361S Overview of Public-Key Cryptography Vitaly Shmatikov slide 1 Reading Assignment Kaufman 6.1-6 slide 2 Public-Key Cryptography public key public key? private key Alice Bob Given: Everybody knows
Formal Modelling of Network Security Properties (Extended Abstract)
Vol.29 (SecTech 2013), pp.25-29 http://dx.doi.org/10.14257/astl.2013.29.05 Formal Modelling of Network Security Properties (Extended Abstract) Gyesik Lee Hankyong National University, Dept. of Computer
A Generic Process Calculus Approach to Relaxed-Memory Consistency
A Generic Process Calculus Approach to Relaxed-Memory Consistency Palle Raabjerg Tjark Weber Nadine Rohde Lars-Henrik Eriksson Joachim Parrow UPMARC Workshop on Memory Models (MM 15) 23 24 February 2015,
Non-Black-Box Techniques In Crytpography. Thesis for the Ph.D degree Boaz Barak
Non-Black-Box Techniques In Crytpography Introduction Thesis for the Ph.D degree Boaz Barak A computer program (or equivalently, an algorithm) is a list of symbols a finite string. When we interpret a
The Order of Encryption and Authentication for Protecting Communications (Or: How Secure is SSL?)
The Order of Encryption and Authentication for Protecting Communications (Or: How Secure is SSL?) Hugo Krawczyk Abstract. We study the question of how to generically compose symmetric encryption and authentication
Professor Radha Poovendran EE Department, University of Washington, Seattle, WA & Professor Dawn Song EECS Department, University of California,
Professor Radha Poovendran EE Department, University of Washington, Seattle, WA & Professor Dawn Song EECS Department, University of California, Berkeley, CA 1 Summer School Objectives Exposure to current
Secure Software Architecture Description using UML Jan Jürjens Competence Center for IT Security Software & Systems Engineering TU Munich, Germany
Secure Software Architecture Description using UML Jan Jürjens Competence Center for IT Security Software & Systems Engineering TU Munich, Germany juerjens@in.tum.de http://www.umlsec.org Problems, Causes
Authenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm By Mihir Bellare and Chanathip Namprempre
Authenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm By Mihir Bellare and Chanathip Namprempre Some slides were also taken from Chanathip Namprempre's defense
EasyCrypt - Lecture 6 Overview and perspectives. Tuesday November 25th
EasyCrypt - Lecture 6 Overview and perspectives Tuesday November 25th EasyCrypt - Lecture 6 Case studies Verified implementations Automated proofs and synthesis Perspectives 2 Inventaire à la Prevert Examples
1 Construction of CCA-secure encryption
CSCI 5440: Cryptography Lecture 5 The Chinese University of Hong Kong 10 October 2012 1 Construction of -secure encryption We now show how the MAC can be applied to obtain a -secure encryption scheme.
CS 393 Network Security. Nasir Memon Polytechnic University Module 11 Secure Email
CS 393 Network Security Nasir Memon Polytechnic University Module 11 Secure Email Course Logistics HW 5 due Thursday Graded exams returned and discussed. Read Chapter 5 of text 4/2/02 Module 11 - Secure
Contract Signing. Contract-Signing Protocols. Another example: stock trading. Example. Network is Asynchronous. Fundamental limitation
ECS Week 2005 Contract-Signing Protocols John itchell Stanford Contract Signing wo parties want to sign a contract ulti-party signing is more complicated he contract is known to both parties he protocols
Optimal Efficiency of Optimistic Contract Signing
Optimal Efficiency of Optimistic Contract Signing Birgit Pfitzmann Matthias Schunter Michael Waidner Universität des Saarlandes Universität Dortmund IBM urich Research Laboratory
Practical Yet Universally Composable Two-Server Password-Authenticated Secret Sharing
Practical Yet Universally Composable Two-Server Password-Authenticated Secret Sharing Jan Camenisch IBM Research Zurich jca@zurich.ibm.com Anna Lysyanskaya Brown University anna@cs.brown.edu Gregory Neven
Crypto-Verifying Protocol Implementations in ML
Crypto-Verifying Protocol Implementations in ML Karthikeyan Bhargavan 1,2 Ricardo Corin 1,3 Cédric Fournet 1,2 1 MSR-INRIA Joint Centre 2 Microsoft Research 3 University of Twente June 2007 Abstract We
Outline. Computer Science 418. Digital Signatures: Observations. Digital Signatures: Definition. Definition 1 (Digital signature) Digital Signatures
Outline Computer Science 418 Digital Signatures Mike Jacobson Department of Computer Science University of Calgary Week 12 1 Digital Signatures 2 Signatures via Public Key Cryptosystems 3 Provable 4 Mike
Lecture 2: Complexity Theory Review and Interactive Proofs
600.641 Special Topics in Theoretical Cryptography January 23, 2007 Lecture 2: Complexity Theory Review and Interactive Proofs Instructor: Susan Hohenberger Scribe: Karyn Benson 1 Introduction to Cryptography
Secure Computation Without Authentication
Secure Computation Without Authentication Boaz Barak 1, Ran Canetti 2, Yehuda Lindell 3, Rafael Pass 4, and Tal Rabin 2 1 IAS. E:mail: boaz@ias.edu 2 IBM Research. E-mail: {canetti,talr}@watson.ibm.com
Identity-based Encryption with Post-Challenge Auxiliary Inputs for Secure Cloud Applications and Sensor Networks
Identity-based Encryption with Post-Challenge Auxiliary Inputs for Secure Cloud Applications and Sensor Networks Tsz Hon Yuen - Huawei, Singapore Ye Zhang - Pennsylvania State University, USA Siu Ming
Digital Signatures. Prof. Zeph Grunschlag
Digital Signatures Prof. Zeph Grunschlag (Public Key) Digital Signatures PROBLEM: Alice would like to prove to Bob, Carla, David,... that has really sent them a claimed message. E GOAL: Alice signs each
1 Message Authentication
Theoretical Foundations of Cryptography Lecture Georgia Tech, Spring 200 Message Authentication Message Authentication Instructor: Chris Peikert Scribe: Daniel Dadush We start with some simple questions
CUNSHENG DING HKUST, Hong Kong. Computer Security. Computer Security. Cunsheng DING, HKUST COMP4631
Cunsheng DING, HKUST Lecture 08: Key Management for One-key Ciphers Topics of this Lecture 1. The generation and distribution of secret keys. 2. A key distribution protocol with a key distribution center.
Lecture 3: One-Way Encryption, RSA Example
ICS 180: Introduction to Cryptography April 13, 2004 Lecturer: Stanislaw Jarecki Lecture 3: One-Way Encryption, RSA Example 1 LECTURE SUMMARY We look at a different security property one might require
Trading Static for Adaptive Security in Universally Composable Zero-Knowledge
Trading Static for Adaptive Security in Universally Composable Zero-Knowledge Aggelos Kiayias and Hong-Sheng Zhou Computer Science and Engineering University of Connecticut Storrs, CT, USA {aggelos,hszhou}@cse.uconn.edu
BlackBerry Enterprise Service 10. Secure Work Space for ios and Android Version: 10.1.1. Security Note
BlackBerry Enterprise Service 10 Secure Work Space for ios and Android Version: 10.1.1 Security Note Published: 2013-06-21 SWD-20130621110651069 Contents 1 About this guide...4 2 What is BlackBerry Enterprise
Systematization of Knowledge Lessons Learned From SSL/TLS Attacks 20.08.2013
Systematization of Knowledge Lessons Learned From SSL/TLS Attacks 20.08.2013 christopher.meyer@rub.de Source: http://www.digicert.com Source: http://www.digicert.com Source: http://www.digicert.com What
Certifying the Security of Android Applications with Cassandra
1 15 th International School on Foundations of Software Security and Design August 31 st, 2015, Bertinoro Certifying the Security of Android Applications with Cassandra Steffen Lortz, Heiko Mantel, David
Elements of Applied Cryptography. Key Distribution. Trusted third party: KDC, KTC Diffie-Helmann protocol The man-in-the-middle attack
Elements of Applied Cryptography Key Distribution Trusted third party: KDC, KTC Diffie-Helmann protocol The man-in-the-middle attack Point-to-point key establishment Alice Bob Each pair of users must share
Co-Location-Resistant Clouds
Co-Location-Resistant Clouds Yossi Azar Tel-Aviv University azar@tau.ac.il Mariana Raykova SRI International mariana.raykova@sri.com Seny Kamara Microsoft Research senyk@microsoft.com Ishai Menache Microsoft
Security/Privacy Models for "Internet of things": What should be studied from RFID schemes? Daisuke Moriyama and Shin ichiro Matsuo NICT, Japan
Security/Privacy Models for "Internet of things": What should be studied from RFID schemes? Daisuke Moriyama and Shin ichiro Matsuo NICT, Japan 1 Internet of Things (IoT) CASAGRAS defined that: A global
On instance separation in the UC-framework. István Vajda. May 30, 2012
On instance separation in the UC-framework István Vajda May 30, 2012 Abstract The UC approach of Canetti offers the advantage of stand-alone analysis while keeping security guaranties for arbitrary complex
Lecture 10: CPA Encryption, MACs, Hash Functions. 2 Recap of last lecture - PRGs for one time pads
CS 7880 Graduate Cryptography October 15, 2015 Lecture 10: CPA Encryption, MACs, Hash Functions Lecturer: Daniel Wichs Scribe: Matthew Dippel 1 Topic Covered Chosen plaintext attack model of security MACs
Analysis of Privacy-Preserving Element Reduction of Multiset
Analysis of Privacy-Preserving Element Reduction of Multiset Jae Hong Seo 1, HyoJin Yoon 2, Seongan Lim 3, Jung Hee Cheon 4 and Dowon Hong 5 1,4 Department of Mathematical Sciences and ISaC-RIM, Seoul
Plain English Guide To Common Criteria Requirements In The. Field Device Protection Profile Version 0.75
Plain English Guide To Common Criteria Requirements In The Field Device Protection Profile Version 0.75 Prepared For: Process Control Security Requirements Forum (PCSRF) Prepared By: Digital Bond, Inc.
Message Authentication Code
Message Authentication Code Ali El Kaafarani Mathematical Institute Oxford University 1 of 44 Outline 1 CBC-MAC 2 Authenticated Encryption 3 Padding Oracle Attacks 4 Information Theoretic MACs 2 of 44
Session Initiation Protocol Attacks and Challenges
2012 IACSIT Hong Kong Conferences IPCSIT vol. 29 (2012) (2012) IACSIT Press, Singapore Session Initiation Protocol Attacks and Challenges Hassan Keshavarz +, Mohammad Reza Jabbarpour Sattari and Rafidah
E-Democracy and e-voting
E-Democracy and e-voting How to make them secure and transparent August 2013 Jordi Puiggali CSO and SVP R&D Jordi.puiggali@scytl.com Index Introduction e-democracy Security and Transparency in e-voting
Privacy-Preserving Set Operations
Privacy-Preserving Set Operations Lea Kissner and Dawn Song Carnegie Mellon University Abstract In many important applications, a collection of mutually distrustful parties must perform private computation
Secrecy Maintaining Public Inspecting For Secure Cloud Storage
Secrecy Maintaining Public Inspecting For Secure Cloud Storage K.Sangamithra 1, S.Tamilselvan 2 M.E, M.P.Nachimuthu.M.Jaganathan Engineering College, Tamilnadu, India 1 Asst. Professor, M.P.Nachimuthu.M.Jaganathan
Lecture 15 - Digital Signatures
Lecture 15 - Digital Signatures Boaz Barak March 29, 2010 Reading KL Book Chapter 12. Review Trapdoor permutations - easy to compute, hard to invert, easy to invert with trapdoor. RSA and Rabin signatures.
Using etoken for SSL Web Authentication. SSL V3.0 Overview
Using etoken for SSL Web Authentication Lesson 12 April 2004 etoken Certification Course SSL V3.0 Overview Secure Sockets Layer protocol, version 3.0 Provides communication privacy over the internet. Prevents
Verifying Second-Level Security Protocols
Verifying Second-Level Security Protocols G.Bella, C.Longo, L.C.Paulson UNIVERSITÀ di CATANIA Dipartimento di Matematica e Informatica Proc. of TPHOLs 2003, these days in Rome Certified e-mail delivery
Authenticated encryption
Authenticated encryption Dr. Enigma Department of Electrical Engineering & Computer Science University of Central Florida wocjan@eecs.ucf.edu October 16th, 2013 Active attacks on CPA-secure encryption
CPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 1 September 2, 2015 CPSC 467, Lecture 1 1/13 Protecting Information Information security Security principles Crypto as a security
Secure Deduplication of Encrypted Data without Additional Servers
Secure Deduplication of Encrypted Data without Additional Servers Jian Liu Aalto University jian.liu@aalto.fi N. Asokan Aalto University and University of Helsinki asokan@acm.org Benny Pinkas Bar Ilan
Mobile Electronic Payments
Chapter 7 Mobile Electronic Payments 7.1 Rationale and Motivation Mobile electronic payments are rapidly becoming a reality. There is no doubt that users of mobile phones are willing and even asking to
Certificate Based Signature Schemes without Pairings or Random Oracles
Certificate Based Signature Schemes without Pairings or Random Oracles p. 1/2 Certificate Based Signature Schemes without Pairings or Random Oracles Joseph K. Liu, Joonsang Baek, Willy Susilo and Jianying
Advanced Cryptography
Family Name:... First Name:... Section:... Advanced Cryptography Final Exam July 18 th, 2006 Start at 9:15, End at 12:00 This document consists of 12 pages. Instructions Electronic devices are not allowed.
3-6 Toward Realizing Privacy-Preserving IP-Traceback
3-6 Toward Realizing Privacy-Preserving IP-Traceback The IP-traceback technology enables us to trace widely spread illegal users on Internet. However, to deploy this attractive technology, some problems
Inductive Analysis of Security Protocols in Isabelle/HOL with Applications to Electronic Voting
Inductive Analysis of Security Protocols in Isabelle/HOL with Applications to Electronic Voting Denis Butin 1 / 37 2 / 37 Introduction Network communication sensitive: banking, private correspondence,
Advanced Topics in Cryptography and Network Security
Advanced Topics in Cryptography and Network Security Breno de Medeiros Department of Computer Science Florida State University Advanced Topics in Cryptography and Network Security p.1 Class Reference Sheet
Foundations of Access Control for Secure Storage
Foundations of Access Control for Secure Storage Thesis Proposal Avik Chaudhuri Computer Science Department University of California, Santa Cruz avik@cs.ucsc.edu Abstract Formal techniques have played
Outline. CSc 466/566. Computer Security. 8 : Cryptography Digital Signatures. Digital Signatures. Digital Signatures... Christian Collberg
Outline CSc 466/566 Computer Security 8 : Cryptography Digital Signatures Version: 2012/02/27 16:07:05 Department of Computer Science University of Arizona collberg@gmail.com Copyright c 2012 Christian
Multi-Input Functional Encryption for Unbounded Arity Functions
Multi-Input Functional Encryption for Unbounded Arity Functions Saikrishna Badrinarayanan, Divya Gupta, Abhishek Jain, and Amit Sahai Abstract. The notion of multi-input functional encryption (MI-FE) was
Security Analysis of Standard Authentication and Key Agreement Protocols Utilising Timestamps
Security Analysis of Standard Authentication and Key Agreement Protocols Utilising Timestamps M. Barbosa and P. Farshim Departamento de Informática, Universidade do Minho, Campus de Gualtar, 4710-057 Braga,
Le vote électronique : un défi pour la vérification formelle
Le vote électronique : un défi pour la vérification formelle Steve Kremer Loria, Inria Nancy 1 / 17 Electronic voting Elections are a security-sensitive process which is the cornerstone of modern democracy
Privacy-Providing Signatures and Their Applications. PhD Thesis. Author: Somayeh Heidarvand. Advisor: Jorge L. Villar
Privacy-Providing Signatures and Their Applications PhD Thesis Author: Somayeh Heidarvand Advisor: Jorge L. Villar Privacy-Providing Signatures and Their Applications by Somayeh Heidarvand In fulfillment
Soran University Faculty of Science and Engineering Computer Science Department Information Security Module Specification
1. Module Title Information Security 2. Module Code: CS403INS 3. Module Level - Forth Stage 4. Module Leader Safwan M. 5. Teaching Semester 7 and 8 Soran University Faculty of Science and Engineering Computer
Lecture 5 - CPA security, Pseudorandom functions
Lecture 5 - CPA security, Pseudorandom functions Boaz Barak October 2, 2007 Reading Pages 82 93 and 221 225 of KL (sections 3.5, 3.6.1, 3.6.2 and 6.5). See also Goldreich (Vol I) for proof of PRF construction.