Zum Einsatz von Hash-Funktionen in der Computer-Forensik: Status Quo und Herausforderungen
|
|
|
- Clemence Lambert
- 6 years ago
- Views:
Transcription
1 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 Zum Einsatz von Hash-Funktionen in der Computer-Forensik: Status Quo und Herausforderungen Harald Baier Hochschule Darmstadt, CASED Fhg-SIT,
2 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 Harald Baier 1. Doctoral degree from TU Darmstadt in the area of elliptic curve cryptography. 2. Principal Investigator within Center for Advanced Security Research Darmstadt (CASED) 3. Establishment of forensic courses within Hochschule Darmstadt. 4. Current working fields: Fuzzy Hashing (IT forensics, biometrics, malware detection). Real-time and efficient detection of malware. Anomaly detection in high-traffic environments.
3 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 Motivation Foundations of Hash Functions Piecewise Hashing Outlook
4 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 Motivation Motivation Foundations of Hash Functions Piecewise Hashing Outlook
5 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 Motivation Finding relevant files resembles... Source: tu-harburg.de Source: beepworld.de
6 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 Motivation... or is it solved for suspect files?
7 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 Foundations of Hash Functions Motivation Foundations of Hash Functions Piecewise Hashing Outlook
8 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 Foundations of Hash Functions Definition and Avalanche Effect 1. A hash function h is a function with two properties: Compression: h : {0, 1} {0, 1} n. Ease of computation: Computation of h(m) is fast in practice. 2. Notation: m is a document (e.g. a file, a volume, a device). h(m) its hash value or digest. 3. Cryptographic hash functions follow the avalanche effect: If m is replaced by m, h(m ) behaves pseudo randomly. No control over the output, if the input is changed. If only one bit in m is changed to get m, the two outputs h(m) and h(m ) look very different.
9 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 Foundations of Hash Functions Sample Cryptographic Hash Functions Name MD5 SHA-1 SHA-256 SHA-512 RIPEMD-160 n watson $ sha1sum vortrag_hash-in-forensics.pdf d77d6f03de998c5ee1c2c9a2ad08f0901d2 vortrag_hash-in-forensics.pdf 3 4 watson $ sha1sum /dev/hda1 5 fba ff5a26f1b2ab3a4674ab1d9dbf113 /dev/hda1 6 7 watson $ sha256sum /dev/hda 8 80ba7ddb c1a6254de059e5734e5e4ab03e8a fce6fde2de41 /dev/ hda
10 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 Motivation Foundations of Hash Functions Piecewise Hashing Outlook
11 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 Use Cases 1. Ensure authenticity and integrity during data acquisition. Relevant for both dead and live analysis. Hash values must be protected: Written down by hand in investigation notebook. Compute a digital signature over it. 2. Automatically identify known files: Whitelisting: Known to be good files. Blacklisting: Known to be bad files. Relevant security property of the hash function: Second-preimage resistance.
12 Whitelisting 1. Underlying Idea: Generate a database G of known to be good files and their corresponding hash values. Identify automatically an unsuspicious file on base of its hash value, which matches a fingerprint of a file in G. Exclude a known to be good file from further investigation. Significant reduction of irrelevant data. 2. Examples of unsuspicious files: System files of operating systems. Well-known benign applications like browsers, editors, Widespread database: Reference Data Set (RDS) of the National Software Reference Library (NSRL), maintained by NIST Harald Baier Hash Functions in Forensics / Fhg-SIT, /25
13 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 NSRL-RDS: Sample Entries watson $ less NSRLFile.txt "SHA-1","MD5","CRC32","FileName","FileSize","ProductCode","OpSystemCode","SpecialCode" " EDD92C4E3D2E F849","392126E756571EBF112CB1C1CDEDF926","EBD105A0","I05002T2.PFB",98 " DA6391F7F5D2F7FCCF36CEBDA60C6EA02","0E53C14A3E48D94FF596A B492","AA6A7B16","00br2026.gif",22 "000000A9E47BD385A0A3685AA12C2DB6FD727A20","176308F27DD52890F013A3FD80F92E51","D749B562","femvo523.wav",42 " AFA836117B1B572FAE4713F200567","9B3702B0E788C6D FE3C9786A","05E566DF","J JPG",32 " AFA836117B1B572FAE4713F200567","9B3702B0E788C6D FE3C9786A","05E566DF","J JPG",32 " AFA836117B1B572FAE4713F200567","9B3702B0E788C6D FE3C9786A","05E566DF","J JPG",32 " AFA836117B1B572FAE4713F200567","9B3702B0E788C6D FE3C9786A","05E566DF","J JPG",32 " AFA836117B1B572FAE4713F200567","9B3702B0E788C6D FE3C9786A","05E566DF","J JPG",32 " AFA836117B1B572FAE4713F200567","9B3702B0E788C6D FE3C9786A","05E566DF","J JPG",32 1 "SHA-1","MD5","CRC32","FileName","FileSize","ProductCode","OpSystemCode","SpecialCode" 2 3 " AFA836117B1B572FAE4713F200567","9 B3702B0E788C6D FE3C9786A","05E566DF","J JPG",32768,2322,"WIN",""
14 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 Whitelisting: Assessment 1. General assessment: Well-known and established process in computer forensics. If database is trusted, no false positives (positive = benign). 2. Possible bottleneck: Size of database. Size of database is increasing. Currently RDS is about 6 gigabyte.
15 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 Blacklisting 1. Underlying idea: Generate a database of known to be bad files and their corresponding hash values. Let B denote this set. Find automatically a suspicious file on base of its fingerprint, which matches a fingerprint of a file in B. 2. Sample suspect files: Malware. Encryption or steganographic software. Corporate secrets. IPR protected files. Child pornography.
16 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 Blacklisting: Evaluation 1. Anti-detection approach: Let a suspicious file b B be given. Change some (irrelevant) bit of b to get b. Consequence: h(b ) is very different from h(b). b is not detected automatically. 2. Core problem: Cryptographic requirements of a hash function and forensic goals are complementary. A suspicious file similar to an element of B is not detected. 3. Fragments of elements of B are not identified, too.
17 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 Piecewise Hashing Motivation Foundations of Hash Functions Piecewise Hashing Outlook
18 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 Goals Piecewise Hashing 1. Overcome drawbacks of cryptographic hash functions in the context of computer forensics. 2. Main drawbacks are: Data acquisition: Integrity of copy is destroyed, if some bits change. White-/Blacklisting: Suspect files similar to known to be bad files are not detected. Fragments are not detected (due to deletion, fragmentation). 3. Currently known approaches: Segment hashes (also called block hashes). Context-triggered piecewise hashes.
19 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 Piecewise Hashing Segment Hashes 1. Underlying idea: Split input data (volume, file) in blocks of fixed length. Compute for each segment its cryptographic hash. Lookup in hash database for matches. 2. Original aim: Improve integrity of storage media.
20 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 Piecewise Hashing Segment Hashes: Evaluation 1. Anti-Blacklisting is very easy: Introduce / Delete an irrelevant byte in the first sector. All segment hashes differ from the stored segment hashes. Modified suspect file is not detected. 2. A good technique for whitelisting (see NIST results). 3. Size of segment hash database is large: 4096 byte block size, SHA-1. size of hash database size of raw data = = = 1 terabyte of raw data yields a 5 gigabyte hash database. 4. Hash database depends on the hashwindow size.
21 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 Piecewise Hashing Context Triggered Piecewise Hashes 1. Originally proposed for spam detection (spamsum by Andrew Tridgell, 2002) 2. Ported to forensics by Jesse Kornblum, 2006: ssdeep.
22 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 CTPH: A sample tool Piecewise Hashing 1. ssdeep (based on spamsum). 2. CTPH is a sequence of printable characters: Only the least significant 6 bits (LS6B) of a segment hash are considered. LS6B are encoded base64. 1 watson $ ssdeep -l vortrag_hash-in-forensics_sit pdf 2 3 ssdeep,1.0--blocksize:hash:hash,filename :UweC9h947a4LMqsMSO/6tzDEPU6P8Ohu7B9N9Fi:HD9/0MjI6aPU6kk69i," vortrag_hash-in-forensics_sit pdf" 3. A good tool in absence of an active adversary. 4. FTK implements CTPH.
23 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 Outlook Motivation Foundations of Hash Functions Piecewise Hashing Outlook
24 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 Central Challenges Outlook 1. In the short term: Determine a compression ratio for whitelisting. How successful is block hashing? Process model of using CTPH and semantic layer similarity tools. 2. In the long term: Find a similarity preserving hash function. Fuzzy hash function, denoted by f. m and m are similar = f(m) and f(m ) are similar, too. m shall be of any type: txt, doc, odt, jpg, bmp, devices,...
25 Harald Baier Hash Functions in Forensics / Fhg-SIT, /25 Outlook Thank you for your attention! 1. Harald Baier 2. harald.baier@h-da.de harald.baier@cased.de
Performance Issues about Context-Triggered Piecewise Hashing
Performance Issues about Context-Triggered Piecewise Hashing Frank Breitinger and Harald Baier Center for Advanced Security Research Darmstadt (CASED) and Department of Computer Science, Hochschule Darmstadt,
Similarity Preserving Hashing: Eligible Properties and a new Algorithm MRSH-v2
Similarity Preserving Hashing: Eligible Properties and a new Algorithm MRSH-v2 Frank Breitinger and Harald Baier da/sec - Biometrics and Internet Security Research Group Hochschule Darmstadt, Darmstadt,
mvhash - a new approach for fuzzy hashing Knut Petter Åstebøl
Knut Petter Åstebøl Master s Thesis Master of Science in Information Security 30 ECTS Department of Computer Science and Media Technology Gjøvik University College, 2012 This master thesis was written
mvhash-b - a new approach for similarity preserving hashing
mvhash-b - a new approach for similarity preserving hashing Frank Breitinger, Knut Petter Åstebøl, Harald Baier, Christoph Busch da/sec - Biometrics and Internet Security Research Group Hochschule Darmstadt,
Security and Implementation Analysis of the Similarity Digest sdhash
Security and Implementation Analysis of the Similarity Digest sdhash Frank Breitinger & Harald Baier & Jesse Beckingham Center for Advanced Security Research Darmstadt (CASED) and Department of Computer
Cryptography. Summer Term 2010
Summer Term 2010 Chapter 2: Hash Functions Contents Definition and basic properties Basic design principles and SHA-1 The SHA-3 competition 2 Contents Definition and basic properties Basic design principles
ManTech SMA. Computer Forensics and Intrusion Analysis. Fuzzy Hashing. Jesse Kornblum
ManTech SMA Computer Forensics and Intrusion Analysis Fuzzy Hashing Jesse Kornblum 1 Introduction Interactive Presentation The answer is always it depends Ask me anything at any time Computer Forensics
Frank Breitinger, Georg Ziroff, Steffen Lange and Harald Baier
Chapter 10 SIMILARITY HASHING BASED ON LEVENSHTEIN DISTANCES Frank Breitinger, Georg Ziroff, Steffen Lange and Harald Baier Abstract It is increasingly common in forensic investigations to use automated
USING APPROXIMATE MATCHING TO REDUCE THE VOLUME OF DIGITAL DATA
Chapter 11 USING APPROXIMATE MATCHING TO REDUCE THE VOLUME OF DIGITAL DATA Frank Breitinger, Christian Winter, York Yannikos, Tobias Fink, and Michael Seefried Abstract Digital forensic investigators frequently
On the Database Lookup Problem of Approximate Matching
University of New Haven Digital Commons @ New Haven Electrical & Computer Engineering and Computer Science Faculty Publications Electrical & Computer Engineering and Computer Science 5-2014 On the Database
A comparative analysis about similarity search strategies for digital forensics investigations
A comparative analysis about similarity search strategies for digital forensics investigations Vitor Hugo Galhardo Moia and Marco Aurélio A. Henriques Abstract Known File Filtering method separates relevant
On Criteria for Evaluating Similarity Digest Schemes
DIGITAL FORENSIC RESEARCH CONFERENCE On Criteria for Evaluating Similarity Digest Schemes By Jonathan Oliver Presented At The Digital Forensic Research Conference DFRWS 2015 EU Dublin, Ireland (Mar 23
Betriebssysteme und Sicherheit. Stefan Köpsell, Thorsten Strufe. Modul 5: Mechanismen Integrität
Betriebssysteme und Sicherheit Stefan Köpsell, Thorsten Strufe Modul 5: Mechanismen Integrität Disclaimer: large parts from Mark Manulis, Dan Boneh, Stefan Katzenbeisser Dresden, WS 17/18 Reprise from
Cryptographic Hash Functions. William R. Speirs
Cryptographic Hash Functions William R. Speirs What is a hash function? Compression: A function that maps arbitrarily long binary strings to fixed length binary strings Ease of Computation: Given a hash
Chapter 11 Message Integrity and Message Authentication
Chapter 11 Message Integrity and Message Authentication Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 11.1 Chapter 11 Objectives To define message integrity
Fourteenforty Research Institute, Inc.
Monthly Research Consideration and evaluation of using fuzzy hashing Fourteenforty Research Institute, Inc. FFRI, Inc http://www.ffri.jp Ver2.00.01 Agenda Background and purpose Basis of fuzzy hashing
CSN08101 Digital Forensics. Module Leader: Dr Gordon Russell Lecturers: Robert Ludwiniak
CSN08101 Digital Forensics Lecture 6: Acquisition Module Leader: Dr Gordon Russell Lecturers: Robert Ludwiniak Objectives Storage Formats Acquisition Architecture Acquisition Methods Tools Data Acquisition
Hash Function. Guido Bertoni Luca Breveglieri. Fundations of Cryptography - hash function pp. 1 / 18
Hash Function Guido Bertoni Luca Breveglieri Fundations of Cryptography - hash function pp. 1 / 18 Definition a hash function H is defined as follows: H : msg space digest space the msg space is the set
ANALYSIS AND VALIDATION
UNIT V ANALYSIS AND VALIDATION Validating Forensics Objectives Determine what data to analyze in a computer forensics investigation Explain tools used to validate data Explain common data-hiding techniques
Approximate Search and Data Reduction Algorithms
Approximate Search and Data Reduction Algorithms Research Questions Kyle Porter NTNU Gjøvik Outline of Presentation Introduction: Problems General Goals Research Questions Brief theoretical/practical background
Information Security. message M. fingerprint f = H(M) one-way hash. 4/19/2006 Information Security 1
Information Security message M one-way hash fingerprint f = H(M) 4/19/2006 Information Security 1 Outline and Reading Digital signatures Definition RSA signature and verification One-way hash functions
Cryptographic Hash Functions. Rocky K. C. Chang, February 5, 2015
Cryptographic Hash Functions Rocky K. C. Chang, February 5, 2015 1 This set of slides addresses 2 Outline Cryptographic hash functions Unkeyed and keyed hash functions Security of cryptographic hash functions
Introduction to Network Security Missouri S&T University CPE 5420 Data Integrity Algorithms
Introduction to Network Security Missouri S&T University CPE 5420 Data Integrity Algorithms Egemen K. Çetinkaya Egemen K. Çetinkaya Department of Electrical & Computer Engineering Missouri University of
Introduction. Collecting, Searching and Sorting evidence. File Storage
Collecting, Searching and Sorting evidence Introduction Recovering data is the first step in analyzing an investigation s data Recent studies: big volume of data Each suspect in a criminal case: 5 hard
CS408 Cryptography & Internet Security
CS408 Cryptography & Internet Security Lecture 18: Cryptographic hash functions, Message authentication codes Functions Definition Given two sets, X and Y, a function f : X Y (from set X to set Y), is
GJU IT-forensics course. Storage medium analysis
Harald Baier Storage medium analysis / 2014-04-02 1/32 GJU IT-forensics course Storage medium analysis Harald Baier Hochschule Darmstadt, CASED 2014-04-02 Partitions Harald Baier Storage medium analysis
Security Analysis of MVhash-B Similarity Hashing
Journal of Digital Forensics, Security and Law Volume 11 Number 2 Article 2 2016 Security Analysis of MVhash-B Similarity Hashing Donghoon Chang Indraprastha Institute of Information Technology Delhi Somitra
UNIT - IV Cryptographic Hash Function 31.1
UNIT - IV Cryptographic Hash Function 31.1 31-11 SECURITY SERVICES Network security can provide five services. Four of these services are related to the message exchanged using the network. The fifth service
Ed Ferrara, MSIA, CISSP
MIS 5208 - Lecture 12 Investigation Methods Data Acquisition Ed Ferrara, MSIA, CISSP eferrara@temple.edu Objectives List digital evidence storage formats Explain ways to determine the best acquisition
Part II Authentication Techniques
Part II Authentication Techniques Authentication Codes Provides means for ensuring integrity of message Independent of secrecy - in fact sometimes secrecy may be undesirable! Techniques for Authentication
Research Article Similarity Digest Search: A Survey and Comparative Analysis of Strategies to Perform Known File Filtering Using Approximate Matching
Hindawi Security and Communication Networks Volume 2017, Article ID 1306802, 17 pages https://doiorg/101155/2017/1306802 Research Article Similarity Digest Search: A Survey and Comparative Analysis of
Cryptographic Concepts
Outline Identify the different types of cryptography Learn about current cryptographic methods Chapter #23: Cryptography Understand how cryptography is applied for security Given a scenario, utilize general
CSCE 715: Network Systems Security
CSCE 715: Network Systems Security Chin-Tser Huang huangct@cse.sc.edu University of South Carolina Next Topic in Cryptographic Tools Symmetric key encryption Asymmetric key encryption Hash functions and
Lecture 1: Course Introduction
Lecture 1: Course Introduction Thomas Johansson T. Johansson (Lund University) 1 / 37 Chapter 9: Symmetric Key Distribution To understand the problems associated with managing and distributing secret keys.
Lecture 18 Message Integrity. Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides from Miller & Bailey s ECE 422
Lecture 18 Message Integrity Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides from Miller & Bailey s ECE 422 Cryptography is the study/practice of techniques for secure communication,
ENEE 459-C Computer Security. Message authentication
ENEE 459-C Computer Security Message authentication Data Integrity and Source Authentication Encryption does not protect data from modification by another party. Why? Need a way to ensure that data arrives
Cryptographic Systems
CPSC 426/526 Cryptographic Systems Ennan Zhai Computer Science Department Yale University Recall: Lec-10 In lec-10, we learned: - Consistency models - Two-phase commit - Consensus - Paxos Lecture Roadmap
Pretty Good Privacy (PGP
PGP - S/MIME - Internet Firewalls for Trusted System: Roles of Firewalls Firewall related terminology- Types of Firewalls - Firewall designs - SET for E-Commerce Transactions. Pretty Good Privacy (PGP
Forensic Image Recognition using a Novel Image Fingerprinting and Hashing Technique
Forensic Image Recognition using a Novel Image Fingerprinting and Hashing Technique R D Neal, R J Shaw and A S Atkins Faculty of Computing, Engineering and Technology, Staffordshire University, Stafford
COMP4109 : Applied Cryptography
COMP4109 : Applied Cryptography Fall 2013 M. Jason Hinek Carleton University Applied Cryptography Day 2 information security cryptographic primitives unkeyed primitives NSA... one-way functions hash functions
Generic collision attacks on hash-functions and HMAC
Generic collision attacks on hash-functions and HMAC Chris Mitchell Royal Holloway, University of London 1 Agenda 1. Hash-functions and collision attacks 2. Memoryless strategy for finding collisions 3.
A hash function is strongly collision-free if it is computationally infeasible to find different messages M and M such that H(M) = H(M ).
CA4005: CRYPTOGRAPHY AND SECURITY PROTOCOLS 1 5 5.1 A hash function is an efficient function mapping binary strings of arbitrary length to binary strings of fixed length (e.g. 128 bits), called the hash-value
Digital Forensics Lecture 02- Disk Forensics
Digital Forensics Lecture 02- Disk Forensics Hard Disk Data Acquisition Akbar S. Namin Texas Tech University Spring 2017 Analysis of data found on a storage device It is more common to do dead analysis
S. Erfani, ECE Dept., University of Windsor Network Security
4.11 Data Integrity and Authentication It was mentioned earlier in this chapter that integrity and protection security services are needed to protect against active attacks, such as falsification of data
Digital Forensics Lecture 01- Disk Forensics
Digital Forensics Lecture 01- Disk Forensics An Introduction to Akbar S. Namin Texas Tech University Spring 2017 Digital Investigations and Evidence Investigation of some type of digital device that has
Deploying a New Hash Algorithm. Presented By Archana Viswanath
Deploying a New Hash Algorithm Presented By Archana Viswanath 1 function? Hash function - takes a message of any length as input - produces a fixed length string as output - termed as a message digest
Lecture 5. Cryptographic Hash Functions. Read: Chapter 5 in KPS
Lecture 5 Cryptographic Hash Functions Read: Chapter 5 in KPS 1 Purpose CHF one of the most important tools in modern cryptography and security CHF-s are used for many authentication, integrity, digital
Distributed Systems. 26. Cryptographic Systems: An Introduction. Paul Krzyzanowski. Rutgers University. Fall 2015
Distributed Systems 26. Cryptographic Systems: An Introduction Paul Krzyzanowski Rutgers University Fall 2015 1 Cryptography Security Cryptography may be a component of a secure system Adding cryptography
File Detection in Network Traffic Using Approximate Matching
File Detection in Network Traffic Using Approximate Matching Vikas Gupta Master in Security and Mobile Computing Submission date: August 2013 Supervisor: Danilo Gligoroski, ITEM Co-supervisor: Christian
APNIC elearning: Cryptography Basics
APNIC elearning: Cryptography Basics 27 MAY 2015 03:00 PM AEST Brisbane (UTC+10) Issue Date: Revision: Introduction Presenter Sheryl Hermoso Training Officer sheryl@apnic.net Specialties: Network Security
Princess Nora Bint Abdulrahman University College of computer and information sciences Networks department Networks Security (NET 536)
Princess Nora Bint Abdulrahman University College of computer and information sciences Networks department Networks Security (NET 536) Prepared by Dr. Samia Chelloug E-mail: samia_chelloug@yahoo.fr Content
Introduction to Software Security Hash Functions (Chapter 5)
Introduction to Software Security Hash Functions (Chapter 5) Seong-je Cho Spring 2018 Computer Security & Operating Systems Lab, DKU Sources / References Textbook, Chapter 5. An Illustrated Guide to Cryptographic
Lecture 1 Applied Cryptography (Part 1)
Lecture 1 Applied Cryptography (Part 1) Patrick P. C. Lee Tsinghua Summer Course 2010 1-1 Roadmap Introduction to Security Introduction to Cryptography Symmetric key cryptography Hash and message authentication
CASP CompTIA Advanced Security Practitioner Study Guide: (Exam CAS-001)
CASP CompTIA Advanced Security Practitioner Study Guide: (Exam CAS-001) Gregg, Michael ISBN-13: 9781118083192 Table of Contents Foreword xxi Introduction xxvii Assessment Test xliv Chapter 1 Cryptographic
Data Hiding on Text Using Big-5 Code
Data Hiding on Text Using Big-5 Code Jun-Chou Chuang 1 and Yu-Chen Hu 2 1 Department of Computer Science and Communication Engineering Providence University 200 Chung-Chi Rd., Shalu, Taichung 43301, Republic
Functional Documentation for "NFC CSP Light" Version 1.0
Functional Documentation for "NFC CSP Light" Version 1.0 Prepared by: "Vincent Le Toux" Date: 03/02/2014 1 Table of Contents Table of Contents Revision History Description... 4 System Specifications...
Data Integrity. Modified by: Dr. Ramzi Saifan
Data Integrity Modified by: Dr. Ramzi Saifan Encryption/Decryption Provides message confidentiality. Does it provide message authentication? 2 Message Authentication Bob receives a message m from Alice,
TLSH - A Locality Sensitive Hash. Jonathan Oliver, Chun Cheng and Yanggui Chen
TLSH - A Locality Sensitive Hash Jonathan Oliver, Chun Cheng and Yanggui Chen TREND MICRO LEGAL DISCLAIMER The information provided herein is for general information and educational purposes only. It is
Security Protocols and Infrastructures
Security Protocols and Infrastructures Dr. Michael Schneider michael.schneider@h-da.de October 9, 2017 h_da WS2017/18 Security Protocols Dr. Michael Schneider 1 1 Formalities 2 Contents, Time Table 3 Literature
CSC 5930/9010 Modern Cryptography: Cryptographic Hashing
CSC 5930/9010 Modern Cryptography: Cryptographic Hashing Professor Henry Carter Fall 2018 Recap Message integrity guarantees that a message has not been modified by an adversary Definition requires that
New Security Features in DLMS/COSEM
New Security Features in DLMS/COSEM A comparison to the Smart Meter Gateway Workshop on Power Line Communications 2015 (HRW), Robin Massink (DNV GL), Gerd Bumiller (HRW) 21.09.2015 21.09.2015 1 Initiated
Security. Communication security. System Security
Security Communication security security of data channel typical assumption: adversary has access to the physical link over which data is transmitted cryptographic separation is necessary System Security
Lecture 5. Cryptographic Hash Functions. Read: Chapter 5 in KPS
Lecture 5 Cryptographic Hash Functions Read: Chapter 5 in KPS 1 Purpose CHF one of the most important tools in modern cryptography and security In crypto, CHF instantiates a Random Oracle paradigm In security,
Cryptography. Dr. Michael Schneider October 10, 2017 h_da WS2017/18 Security Protocols Dr. Michael Schneider 1
Cryptography Dr. Michael Schneider michael.schneider@h-da.de October 10, 2017 h_da WS2017/18 Security Protocols Dr. Michael Schneider 1 1 Formalities 2 Contents, Time Table 3 Literature 4 Announcements
Internet Key Exchange
CHAPTER16 The help topics in this section describe the (IKE) configuration screens. (IKE) What Do You Want to Do? (IKE) is a standard method for arranging for secure, authenticated communications. IKE
Cyber Security Applied Cryptography. Dr Chris Willcocks
Cyber Security Applied Cryptography Dr Chris Willcocks Introduction 1. Content in this lecture will be examinable 2. This is a single lecture on applied cryptography for computer security. there is an
Cryptography. Summer Term 2010
Cryptography Summer Term 2010 Harald Baier Chapter 3: Pseudo Random Bit Generators and Stream Ciphers Contents Random bits and pseudo random bits Stream ciphers Harald Baier Cryptography h_da, Summer Term
Cryptography and Network Security Overview & Chapter 1. Network Security. Chapter 0 Reader s s Guide. Standards Organizations.
Cryptography and Network Security Overview & Chapter 1 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 0 Reader s s Guide The art of war teaches us to rely
Cryptography V: Digital Signatures
Cryptography V: Digital Signatures Computer Security Lecture 12 David Aspinall School of Informatics University of Edinburgh 19th February 2009 Outline Basics Constructing signature schemes Security of
Cryptography V: Digital Signatures
Cryptography V: Digital Signatures Computer Security Lecture 10 David Aspinall School of Informatics University of Edinburgh 10th February 2011 Outline Basics Constructing signature schemes Security of
Running head: FTK IMAGER 1
Running head: FTK IMAGER 1 FTK Imager Jean-Raymond Ducasse CSOL-590 June 26, 2017 Thomas Plunkett FTK IMAGER 2 FTK Imager Outline Process for Adding Individual Files & Folders as Evidence Items Although
ryptograi "ГС for Tom St Denis, Elliptic Semiconductor Inc. Simon Johnson and Author of the LibTom Project
for ryptograi "ГС V6 е Tom St Denis, Elliptic Semiconductor Inc. and Author of the LibTom Project Simon Johnson Contents Preface Chapter 1 Introduction 1 Introduction 2 Threat Models 3 What Is Cryptography?
Lecture 4: Hashes and Message Digests,
T-79.159 Cryptography and Data Security Lecture 4: Hashes and Message Digests Helsinki University of Technology mjos@tcs.hut.fi 1 Cryptographic hash functions Maps a message M (a bit string of arbitrary
Spring 2010: CS419 Computer Security
Spring 2010: CS419 Computer Security MAC, HMAC, Hash functions and DSA Vinod Ganapathy Lecture 6 Message Authentication message authentication is concerned with: protecting the integrity of a message validating
Winter 2011 Josh Benaloh Brian LaMacchia
Winter 2011 Josh Benaloh Brian LaMacchia Symmetric Cryptography January 20, 2011 Practical Aspects of Modern Cryptography 2 Agenda Symmetric key ciphers Stream ciphers Block ciphers Cryptographic hash
MTAT Applied Cryptography
MTAT.07.017 Applied Cryptography Hash functions and HMAC University of Tartu Spring 2017 1 / 23 Cryptographic hash function A hash function is a function that takes an arbitrary block of data and returns
Network and System Security
Network and System Security Lecture 5 2/12/2013 Hashes and Message Digests Mohammad Almalag 1 Overview 1. What is a cryptographic hash? 2. How are hashes used? 3. One-Way Functions 4. Birthday Problem
Overview. CSC 580 Cryptography and Computer Security. Hash Function Basics and Terminology. March 28, Cryptographic Hash Functions (Chapter 11)
CSC 580 Cryptography and Computer Security Cryptographic Hash Functions (Chapter 11) March 28, 2017 Overview Today: Review Homework 8 solutions Discuss cryptographic hash functions Next: Study for quiz
The security and insecurity of blockchains and smart contracts
The security and insecurity of blockchains and smart contracts Jean-Pierre Flori, expert in cryptography, Agence Nationale de la Sécurité des Systèmes d Information (ANSSI) In J.P. Dardayrol, editor of
Providing File Services using a Distributed Hash Table
Providing File Services using a Distributed Hash Table Lars Seipel, Alois Schuette University of Applied Sciences Darmstadt, Department of Computer Science, Schoefferstr. 8a, 64295 Darmstadt, Germany lars.seipel@stud.h-da.de
CA DataMinder. Stored Data Integration Guide. Release 14.5
CA DataMinder Stored Data Integration Guide Release 14.5 This Documentation, which includes embedded help systems and electronically distributed materials, (hereinafter referred to as the Documentation
A j-lanes tree hashing mode and j-lanes SHA-256
A j-lanes tree hashing mode and j-lanes SHA-5 Shay Gueron 1, 1 Department of Mathematics, University of Haifa, Israel Intel Corporation, Israel Development Center, Haifa, Israel August 1, Abstract. j-lanes
Enhanced Management of Certificate Caching and Revocation Lists in VANET
Enhanced Management of Certificate Caching and Revocation Lists in VANET Sadiq H. Abdulhussain Computer Engineering Department College of Engineering University of Baghdad ABSTRACT Vehicular network security
Computer Security. 10r. Recitation assignment & concept review. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 10r. Recitation assignment & concept review Paul Krzyzanowski Rutgers University Spring 2018 April 3, 2018 CS 419 2018 Paul Krzyzanowski 1 1. What is a necessary condition for perfect
CHAPTER 6 EFFICIENT TECHNIQUE TOWARDS THE AVOIDANCE OF REPLAY ATTACK USING LOW DISTORTION TRANSFORM
109 CHAPTER 6 EFFICIENT TECHNIQUE TOWARDS THE AVOIDANCE OF REPLAY ATTACK USING LOW DISTORTION TRANSFORM Security is considered to be the most critical factor in many applications. The main issues of such
Department of Computer Science and Engineering. CSE 3482 Introduction to Computer Security. Instructor: N. Vlajic Date: Mar 1, 2017
Department of Computer Science and Engineering CSE 3482 Introduction to Computer Security Instructor: N. Vlajic Date: Mar 1, 2017 Midterm Examination Instructions: Examination time: 75 min. Print your
SKBI Cryptocurrency Technical Seminar Series Seminar 1: Basics: Cryptography and Transactions
SKBI Cryptocurrency Technical Seminar Series Seminar 1: Basics: Cryptography and Transactions Zhiguo Wan Sim Kee Boon Institute for Financial Economics Singapore Management University Schedule of bitcoin
Known File Filter (KFF)
Known File Filter (KFF) Installation Guide Version 6.3.x 1 AccessData Legal and Contact Information Document date: November 7, 2017 Legal Information 2017 AccessData Group, Inc. All rights reserved. No
IEEE Std and IEEE Std 1363a Ashley Butterworth Apple Inc.
apple IEEE Std 1363-2000 and IEEE Std 1363a-2004 Ashley Butterworth Apple Inc. The Titles IEEE Std 1363-2000 - IEEE Standard Specifications for Public-Key Cryptography IEED Std 1363a-2004 - IEEE Standard
VPN Overview. VPN Types
VPN Types A virtual private network (VPN) connection establishes a secure tunnel between endpoints over a public network such as the Internet. This chapter applies to Site-to-site VPNs on Firepower Threat
Program Integrity: Why Worry?
Program Integrity with Steganography and Program Analysis Mike Jochen Lori Pollock Lisa Marvel 28 August 2008 Program Integrity: Why Worry? 8/28/08 2008 Mike Jochen 2 1 Malicious Code (Malware) What are
Internet Engineering Task Force (IETF) April Elliptic Curve Digital Signature Algorithm (DSA) for DNSSEC
Internet Engineering Task Force (IETF) Request for Comments: 6605 Category: Standards Track ISSN: 2070-1721 P. Hoffman VPN Consortium W.C.A. Wijngaards NLnet Labs April 2012 Abstract Elliptic Curve Digital
CSC 580 Cryptography and Computer Security
CSC 580 Cryptography and Computer Security Cryptographic Hash Functions (Chapter 11) March 22 and 27, 2018 Overview Today: Quiz (based on HW 6) Graded HW 2 due Grad/honors students: Project topic selection
Introduction to Volume Analysis, Part I: Foundations, The Sleuth Kit and Autopsy. Digital Forensics Course* Leonardo A. Martucci *based on the book:
Part I: Foundations, Introduction to Volume Analysis, The Sleuth Kit and Autopsy Course* Leonardo A. Martucci *based on the book: File System Forensic Analysis by Brian Carrier LAM 2007 1/12h Outline Part
Homework 2. Out: 09/23/16 Due: 09/30/16 11:59pm UNIVERSITY OF MARYLAND DEPARTMENT OF ELECTRICAL AND COMPUTER ENGINEERING
UNIVERSITY OF MARYLAND DEPARTMENT OF ELECTRICAL AND COMPUTER ENGINEERING ENEE 457 Computer Systems Security Instructor: Charalampos Papamanthou Homework 2 Out: 09/23/16 Due: 09/30/16 11:59pm Instructions
Data Integrity & Authentication. Message Authentication Codes (MACs)
Data Integrity & Authentication Message Authentication Codes (MACs) Goal Ensure integrity of messages, even in presence of an active adversary who sends own messages. Alice (sender) Bob (reciever) Fran
Introduction to Cryptography. Lecture 6
Introduction to Cryptography Lecture 6 Benny Pinkas page 1 1 Data Integrity, Message Authentication Risk: an active adversary might change messages exchanged between Alice and Bob M Alice M M M Bob Eve
Overview of Cryptography
18739A: Foundations of Security and Privacy Overview of Cryptography Anupam Datta CMU Fall 2007-08 Is Cryptography A tremendous tool The basis for many security mechanisms Is not The solution to all security
CS 645 : Lecture 6 Hashes, HMAC, and Authentication. Rachel Greenstadt May 16, 2012
CS 645 : Lecture 6 Hashes, HMAC, and Authentication Rachel Greenstadt May 16, 2012 Reminders Graded midterm, available on bbvista Project 3 out (crypto) Hash Functions MAC HMAC Authenticating SSL Man-in-the-middle
Symantec Ransomware Protection
Symantec Ransomware Protection Protection Against Ransomware Defense in depth across all control points is required to stop ransomware @ Email Symantec Email Security.cloud, Symantec Messaging Gateway