Publications associées à The Inconvenient Truth about Web Certificates

When Your AI Becomes a Target: AI Security Incidents and Best Practices

In contrast to vast academic efforts to study AI security, few real-world reports of AI security incidents exist. Released incidents prevent a thorough investigation of the attackers' motives, as crucial information about the company and AI application is ...

AAAI Press2024

On the Theory and Practice of Modern Secure Messaging

Daniel Patrick Collins

Billions of people now have conversations daily over the Internet. A large portion of this communication takes place via secure messaging protocols that offer "end-to-end encryption'" guarantees and resilience to compromise like the widely-used Double Ratc ...

EPFL2024

Isogeny Problems with Level Structure

Tako Boris Fouotsa

Given two elliptic curves and the degree of an isogeny between them, finding the isogeny is believed to be a difficult problem—upon which rests the security of nearly any isogeny-based scheme. If, however, to the data above we add information about the beh ...

2024

Silent Bugs Matter: A Study of Compiler-Introduced Security Bugs

Mathias Josef Payer, Jianhao Xu

Compilers assure that any produced optimized code is semantically equivalent to the original code. However, even "correct" compilers may introduce security bugs as security properties go beyond translation correctness. Security bugs introduced by such corr ...

Usenix Assoc2023

Cryptographic Administration for Secure Group Messaging

Serge Vaudenay, Daniel Patrick Collins

Many real-world group messaging systems delegate group administration to the application level, failing to provide formal guarantees related to group membership. Taking a cryptographic approach to group administration can prevent both implementation and pr ...

Berkeley2023

Public-Key Encryption with Quantum Keys

Khashayar Barooti

In the framework of Impagliazzo's five worlds, a distinction is often made between two worlds, one where public-key encryption exists (Cryptomania), and one in which only one-way functions exist (MiniCrypt). However, the boundaries between these worlds can ...

Springer International Publishing Ag2023

Making Classical (Threshold) Signatures Post-quantum for Single Use on a Public Ledger

Serge Vaudenay, Laurane Chloé Angélina Marco, Abdullah Talayhan

The Bitcoin architecture heavily relies on the ECDSA signature scheme which is broken by quantum adversaries as the secret key can be computed from the public key in quantum polynomial time. To mitigate this attack, bitcoins can be paid to the hash of a pu ...

2023

Security in the Presence of Quantum Adversaries

Khashayar Barooti

With the looming threat of large-scale quantum computers, a fair portion of recent cryptographic research has focused on examining cryptographic primitives from the perspective of a quantum adversary. Shor's 1994 result revealed that quantum computers can ...

EPFL2023

Revisiting the Indifferentiability of the Sum of Permutations

Ritam Bhaumik

The sum of two n-bit pseudorandom permutations is known to behave like a pseudorandom function with n bits of security. A recent line of research has investigated the security of two public n-bit permutations and its degree of indifferentiability. Mandal e ...

Springer2023

Authenticated private information retrieval

Simone Maria Stefano Colombo, Kirill Nikitin, Bryan Alexander Ford, Henry Nathaniel Corrigan-Gibbs

This paper introduces protocols for authenticated private information retrieval. These schemes enable a client to fetch a record from a remote database server such that (a) the server does not learn which record the client reads, and (b) the client either ...

Usenix Assoc2023

A Visionary Look at the Security of Reconfigurable Cloud Computing

Francesco Regazzoni, Mirjana Stojilovic

Field-programmable gate arrays (FPGAs) have become critical components in many cloud computing platforms. These devices possess the fine-grained parallelism and specialization needed to accelerate applications ranging from machine learning to networking an ...

2023

Challenging the Assumptions: Rethinking Privacy, Bias, and Security in Machine Learning

Bogdan Kulynych

Predictive models based on machine learning (ML) offer a compelling promise: bringing clarity and structure to complex natural and social environments. However, the use of ML poses substantial risks related to the privacy of their training data as well as ...

EPFL2023

Optimal Symmetric Ratcheting for Secure Communication

Serge Vaudenay, Andrea Felice Caforio, Daniel Patrick Collins, Hailun Yan

To mitigate state exposure threats to long-lived instant messaging sessions, ratcheting was introduced, which is used in practice in protocols like Signal. However, existing ratcheting protocols generally come with a high cost. Recently, Caforio et al. pro ...

OXFORD UNIV PRESS2022

PROFACTORY: Improving IoT Security via Formalized Protocol Customization

Fei Wang, Mathias Josef Payer, Xiangyu Zhang, Duo Xu

As IoT applications gain widespread adoption, it becomes important to design and implement IoT protocols with security. Existing research in protocol security reveals that the majority of disclosed protocol vulnerabilities are caused by incorrectly impleme ...

USENIX ASSOC2022

Security Measures for Grids Against Rank-1 Undetectable Time-Synchronization Attacks

Jean-Yves Le Boudec, Marguerite Marie Nathalie Delcourt

Time-synchronization attacks on phasor measurement units (PMUs) pose a real threat to smart grids; it was shown that they are feasible in practice and that they can have a nonnegligible negative impact on state estimation, without triggering the bad data d ...

IEEE-INST ELECTRICAL ELECTRONICS ENGINEERS INC2022

Review of health and well-being aspects in Green Certification Protocols

Cecile Anne Berquand

Over the past decades, the world-leading Green Certification Protocols have been paid increasing attention to health-related aspects of buildings. However, the way and the extent to which green certifications currently account for these aspects vary largel ...

TU Delft2022

Analysis and Improvements of the Sender Keys Protocol for Group Messaging

Daniel Patrick Collins

Messaging between two parties and in the group setting has enjoyed widespread attention both in practice, and, more recently, from the cryptographic community. One of the main challenges in the area is constructing secure (end-to- end encrypted) and effici ...

2022

Electrical-Level Attacks on CPUs, FPGAs, and GPUs: Survey and Implications in the Heterogeneous Era

Mirjana Stojilovic, Dina Gamaleldin Ahmed Shawky Mahmoud

Given the need for efficient high-performance computing, computer architectures combining CPUs, GPUs, and FPGAs are nowadays prevalent. However, each of these components suffers from electrical-level security risks. Moving to heterogeneous systems, with th ...

2022

Toward Mobile Distributed Ledgers

Boi Faltings, Sujit Prakash Gujar, Dimitrios Chatzopoulos, Anurag Jain

Advances in mobile computing have paved the way for new types of distributed applications that can be executed solely by mobile devices on Device-to-Device (D2D) ecosystems (e.g., crowdsensing). Sophisticated applications, like cryptocurrencies, need distr ...

IEEE-INST ELECTRICAL ELECTRONICS ENGINEERS INC2022

Moby: A Blackout-Resistant Anonymity Network for Mobile Devices

Antoine Rault, Bryan Alexander Ford, Amogh Pradeep, Hira Javaid

Internet blackouts are challenging environments for anonymity and censorship resistance. Existing popular anonymity networks (e.g., Freenet, I2P, Tor) rely on Internet connectivity to function, making them impracticable during such blackouts. In such a set ...

2022