How to (not) Share a Password:
|
|
|
- Sabrina Maxwell
- 5 years ago
- Views:
Transcription
1 How to (not) Share a Password: Privacy preserving protocols for finding heavy hitters with adversarial behavior Moni Naor Benny Pinkas Eyal Ronen
2 Passwords First modern use in MIT's CTSS (1961) Passwords are dead? User tend to choose passwords with low min entropy Easy to guess
3 Compromise a User, Attack the Eco System
4 Compromise a User, Attack the Eco System Bad passwords do not only compromise the users
5 Compromise a User, Attack the Eco System Bad passwords do not only compromise the users Weak and popular passwords can be used for large scale attack
6 Compromise a User, Attack the Eco System Bad passwords do not only compromise the users Weak and popular passwords can be used for large scale attack E.g. the Mirai attack
7 Compromise a User, Attack the Eco System Bad passwords do not only compromise the users Weak and popular passwords can be used for large scale attack E.g. the Mirai attack Easy to find IoT devices with Shodan like search engines
8 Compromise a User, Attack the Eco System Bad passwords do not only compromise the users Weak and popular passwords can be used for large scale attack E.g. the Mirai attack Easy to find IoT devices with Shodan like search engines Service provider liability?
9 Possible solutions It is hard to even decide the ideal guidelines for passwords
10 Possible solutions
11 Possible solutions Two factor authentication (2FA)
12 Possible solutions Two factor authentication (2FA)
13 Possible solutions Two factor authentication (2FA) Server saves a list of all users passwords and blacklists the popular passwords
14 Possible solutions Two factor authentication (2FA) Server saves a list of all users passwords and blacklists the popular passwords Put users passwords at risk: new single point of failure
15 Possible solutions Two factor authentication (2FA) Server saves a list of all users passwords and blacklists the popular passwords Put users passwords at risk: new single point of failure Blacklisting known popular passwords From previous breaches Known lists of popular passwords
16 Passwords over time
17 Passwords over time password -> passw0rd ->
18 Passwords over time password -> passw0rd -> superman -> wonderwoman
19 Passwords over time password -> passw0rd -> superman -> wonderwoman Different populations
20 Passwords over time password -> passw0rd -> superman -> wonderwoman Different populations
21 Primum non nocere First do (almost) no harm
22 Primum non nocere First do (almost) no harm Publishing passwords blacklist can also help attackers
23 Primum non nocere First do (almost) no harm Publishing passwords blacklist can also help attackers Attacker can use auxiliary data to guess password distribution
24 Primum non nocere First do (almost) no harm Publishing passwords blacklist can also help attackers Attacker can use auxiliary data to guess password distribution Publishing the blacklist is like publishing a code vulnerability
25 Primum non nocere First do (almost) no harm Publishing passwords blacklist can also help attackers Attacker can use auxiliary data to guess password distribution Publishing the blacklist is like publishing a code vulnerability Leaking password information can hurt the user
26 Primum non nocere First do (almost) no harm Publishing passwords blacklist can also help attackers Attacker can use auxiliary data to guess password distribution Publishing the blacklist is like publishing a code vulnerability Leaking password information can hurt the user Gathering statistics requires some password information
27 Primum non nocere First do (almost) no harm Publishing passwords blacklist can also help attackers Attacker can use auxiliary data to guess password distribution Publishing the blacklist is like publishing a code vulnerability Leaking password information can hurt the user Gathering statistics requires some password information One bit leakage doesn t hurt the user a lot (next slide)
28 Primum non nocere First do (almost) no harm Publishing passwords blacklist can also help attackers Attacker can use auxiliary data to guess password distribution Publishing the blacklist is like publishing a code vulnerability Leaking password information can hurt the user Gathering statistics requires some password information One bit leakage doesn t hurt the user a lot (next slide) Differential privacy can also help
29 The Password Game PGame(L): Attacker A wants to attack device D Published a list with L guesses for passwords Wins if the password of D is in the list Effect of one bit leakage on password: If A wins PGame(L) w.p at least δ using a 1 bit leak implies There is A wins PGame(2L) w.p δ without a leak ε-dp If A wins PGame(L) w.p at least δ using ε-dp information then There is A wins PGame(L) w.p > δ e ε without a leak
30 How to (not) share a Password: Desiderata Identify and blacklist popular passwords (heavy hitters) those were chosen by more than a fraction τ of the users
31 How to (not) share a Password: Desiderata Identify and blacklist popular passwords (heavy hitters) those were chosen by more than a fraction τ of the users Server should not learn more than 1 bit on any user s password
32 How to (not) share a Password: Desiderata Identify and blacklist popular passwords (heavy hitters) those were chosen by more than a fraction τ of the users Server should not learn more than 1 bit on any user s password At most halves the number of password guesses
33 How to (not) share a Password: Desiderata Identify and blacklist popular passwords (heavy hitters) those were chosen by more than a fraction τ of the users Server should not learn more than 1 bit on any user s password At most halves the number of password guesses Probability of False Negative (pfn) must be negligible
34 How to (not) share a Password: Desiderata Identify and blacklist popular passwords (heavy hitters) those were chosen by more than a fraction τ of the users Server should not learn more than 1 bit on any user s password At most halves the number of password guesses Probability of False Negative (pfn) must be negligible No popular password is missed
35 How to (not) share a Password: Desiderata Identify and blacklist popular passwords (heavy hitters) those were chosen by more than a fraction τ of the users Server should not learn more than 1 bit on any user s password At most halves the number of password guesses Probability of False Negative (pfn) must be negligible No popular password is missed Probability of False Positive (pfp) may be a small value
36 How to (not) share a Password: Desiderata Identify and blacklist popular passwords (heavy hitters) those were chosen by more than a fraction τ of the users Server should not learn more than 1 bit on any user s password At most halves the number of password guesses Probability of False Negative (pfn) must be negligible No popular password is missed Probability of False Positive (pfp) may be a small value A legitimate password can be rejected with low probability
37 Previous work Finding heavy hitters in many settings - [DNP+10,DNPR10,CSS11,CLSX12, HKR12,DNRR15] Semi-honest version [BS15,BNST17] Non colluding mix servers [MS17] DP password list with trusted server [BDB16] Similar motivation, no DP [SHM10]
38 The Malicious World Both users and server might be malicious
39 The Malicious World Both users and server might be malicious A malicious server wants to learn the passwords
40 The Malicious World Both users and server might be malicious A malicious server wants to learn the passwords Malicious users want to hide popular passwords Adversary controls a coalition of users
41 MPC meets DP in the Malicious World Asymmetric security requirements from the parties in the protocol Relatively easy to protect users privacy from server Harder to protect against colluding malicious users Use efficient 2PC protocol tailored to the system s correctness requirements
42 Correctness Password used by at least a 1 + δ τ fraction of the users: identified as a heavy hitter w.p at least (1-pFN) Even at the presence of malicious user coalition Password used by at most a 1 δ τ fraction of the users: identified as a heavy hitter w.p at most pfp
43 The semi honest solution Similar to the heavy hitters solution of [BNSTS17] We hash the passwords to l bits values Naïve hash function We assume collisions OK if 1/ 1 δ τ 2 l Server initializes to zero a counter histogram T of size 2 l
44 The semi honest Protocol For every user: Server random r 0,1 l v = H pass, r User Server iterates over all possible value of x 0,1 l If v = x, r : T x += 1 Else: T x = 1
45 The semi honest solution T x = N Prob x + Noise Noise~Bin(N 1 Prob x, 0.5) E[T x ] = N Prob x Blacklist the hash value if T x > τn Define τ as a function of N and δ such that: Prob Noise > τnδ < pfn
46 The undercount attack A user wants to hide a popular password pass The user simply sends: 1 H pass, r
47 The required functionally Input The server sends to the Trusted Third Party (TTP) an l bit input r The user sends to the TTP an l bit input v Output The TTP sends to the server v, r The user gets no output Two approaches: QR based Yao s garbled circuit based
48 A naïve QR based solution Based on the intractability of the quadratic residuosity (QR) assumption We encrypt the r vector as in the Goldwasser-Micali public encryption scheme The server generates an RSA modules N=pq, p and q primes We encode the bits of r into r p, 0 as QR and 1 as nqr Is it secure? Not if adversary knows an nqr
49 The nqr generation assumption Is it hard to generate a nqr number w.h.p? With probability better than ε? Simple reduction from protocol security Assuming Unique N for each device
50 Reduction to nqr generation assumption The honest algorithm A(v, r p ) return e= v, r The adversary algorithm A (v, r p ) return e=1- v, r w.p δ Generate r p by random sample form Z N with Jacobi symbol 1 Generate random v Return A v, r p A v, r p, result nqr w.p δ
51 Solution based only on QR assumption Adding an Interactive zero knowledge proof that the inner product was computed correctly Non interactive version based on Fiat-Shamir Requires proof that N=pq where p and q are primes Another garbled circuit solution
52 Malicious bounds on τ
53 Implementation and other usages We implemented the full malicious QR protocol on a RPi Non interactive version runs in about 15 seconds, can run in background Server computer can verify in about 0.5 seconds Same solution can be used in any heavy hitters problem with possible malicious setting TOR network statistics Device PIN/Pattern Large service providers dynamic passwords statistics
54 Open questions Do we need Crypto? For non-malicious users no (computational based) crypto needed! Can the attacker really use the leaked information from the blacklist publications?
How to (not) Share a Password:
How to (not) Share a Password: Privacy preserving protocols for finding heavy hitters with adversarial behavior Moni Naor Benny Pinkas Eyal Ronen Passwords First modern use in MIT's CTSS (1961) Passwords
How to (not) share a password: Privacy preserving protocols for finding heavy hitters with adversarial behavior
How to (not) share a password: Privacy preserving protocols for finding heavy hitters with adversarial behavior Moni Naor, Benny Pinkas, and Eyal Ronen( ) Abstract. Bad choices of passwords were and are
Secure Multiparty Computation: Introduction. Ran Cohen (Tel Aviv University)
Secure Multiparty Computation: Introduction Ran Cohen (Tel Aviv University) Scenario 1: Private Dating Alice and Bob meet at a pub If both of them want to date together they will find out If Alice doesn
Secure Multiparty Computation
CS573 Data Privacy and Security Secure Multiparty Computation Problem and security definitions Li Xiong Outline Cryptographic primitives Symmetric Encryption Public Key Encryption Secure Multiparty Computation
CS573 Data Privacy and Security. Cryptographic Primitives and Secure Multiparty Computation. Li Xiong
CS573 Data Privacy and Security Cryptographic Primitives and Secure Multiparty Computation Li Xiong Outline Cryptographic primitives Symmetric Encryption Public Key Encryption Secure Multiparty Computation
A systematic approach to eliminating the vulnerabilities in smart cards evaluation
A systematic approach to eliminating the vulnerabilities in smart cards evaluation Hongsong Shi, Jinping Gao, Chongbing Zhang hongsongshi@gmail.com China Information Technology Security Evaluation Center
Cryptographic protocols
Cryptographic protocols Lecture 3: Zero-knowledge protocols for identification 6/16/03 (c) Jussipekka Leiwo www.ialan.com Overview of ZK Asymmetric identification techniques that do not rely on digital
Advanced Topics in Cryptography
Advanced Topics in Cryptography Lecture 9: Identity based encryption (IBE), Cocks scheme. Benny Pinkas page 1 1 Related papers Lecture notes from MIT http://crypto.csail.mit.edu/classes/6.876/lecture-notes.html
page 1 Introduction to Cryptography Benny Pinkas Lecture 3 November 18, 2008 Introduction to Cryptography, Benny Pinkas
Introduction to Cryptography Lecture 3 Benny Pinkas page 1 1 Pseudo-random generator Pseudo-random generator seed output s G G(s) (random, s =n) Deterministic function of s, publicly known G(s) = 2n Distinguisher
Bitcoin, Security for Cloud & Big Data
Bitcoin, Security for Cloud & Big Data CS 161: Computer Security Prof. David Wagner April 18, 2013 Bitcoin Public, distributed, peer-to-peer, hash-chained audit log of all transactions ( block chain ).
Concrete cryptographic security in F*
Concrete cryptographic security in F* crypto hash (SHA3) INT-CMA encrypt then-mac Auth. encryption Secure RPC some some some adversary attack attack symmetric encryption (AES). IND-CMA, CCA2 secure channels
Introduction to Secure Multi-Party Computation
Introduction to Secure Multi-Party Computation Many thanks to Vitaly Shmatikov of the University of Texas, Austin for providing these slides. slide 1 Motivation General framework for describing computation
Secure Computation of Functionalities based on Hamming Distance and its Application to Computing Document Similarity
Secure Computation of Functionalities based on Hamming Distance and its Application to Computing Document Similarity Ayman Jarrous 1 and Benny Pinkas 2,* 1 University of Haifa, Israel. 2 Bar Ilan University,
ENEE 459-C Computer Security. Security protocols
ENEE 459-C Computer Security Security protocols Key Agreement: Diffie-Hellman Protocol Key agreement protocol, both A and B contribute to the key Setup: p prime and g generator of Z p *, p and g public.
ENEE 459-C Computer Security. Security protocols (continued)
ENEE 459-C Computer Security Security protocols (continued) Key Agreement: Diffie-Hellman Protocol Key agreement protocol, both A and B contribute to the key Setup: p prime and g generator of Z p *, p
Mike Reiter. University of North Carolina at Chapel Hill. Proliferation of mobile devices. Proliferation of security-relevant apps using these
1 Capture-Resilient Cryptographic Devices Mike Reiter University of North Carolina at Chapel Hill Relevant Trends 2 Proliferation of mobile devices Proliferation of networking Proliferation of security-relevant
Secure Multiparty Computation
Secure Multiparty Computation Li Xiong CS573 Data Privacy and Security Outline Secure multiparty computation Problem and security definitions Basic cryptographic tools and general constructions Yao s Millionnare
Privacy-Preserving Distributed Linear Regression on High-Dimensional Data
Privacy-Preserving Distributed Linear Regression on High-Dimensional Data Borja Balle Amazon Research Cambridge (work done at Lancaster University) Based on joint work with Adria Gascon, Phillipp Schoppmann,
VERIFIABLE SYMMETRIC SEARCHABLE ENCRYPTION
VERIFIABLE SYMMETRIC SEARCHABLE ENCRYPTION DATE 09/03/2016 SÉMINAIRE EMSEC - RAPHAEL BOST Searchable Encryption Outsource data securely keep search functionalities Generic Solutions We can use generic
Secure Set Intersection with Untrusted Hardware Tokens
Secure Set Intersection with Untrusted Hardware Tokens Thomas Schneider Engineering Cryptographic Protocols Group, TU Darmstadt http://encrypto.de joint work with Marc Fischlin (TU Darmstadt) Benny Pinkas
COMPOSABLE AND ROBUST OUTSOURCED STORAGE
SESSION ID: CRYP-R14 COMPOSABLE AND ROBUST OUTSOURCED STORAGE Christian Badertscher and Ueli Maurer ETH Zurich, Switzerland Motivation Server/Database Clients Write Read block 2 Outsourced Storage: Security
Passwords. Secure Software Systems
1 Passwords 2 Password Lifecycle Change/Reset Password Create Password (user choice) Use Password (user supplies for auth) Store Password (with user identifier) 3 Password Creation 4 Password Creation
Michael Zohner (TU Darmstadt)
ABY -A Framework for Efficient Mixed-Protocol Secure Two-Party Computation Michael Zohner (TU Darmstadt) Joint work with Daniel Demmler and Thomas Schneider 19.02.15 ABY: Mixed-Protocol Secure Two-Party
CS 395T. Formal Model for Secure Key Exchange
CS 395T Formal Model for Secure Key Exchange Main Idea: Compositionality Protocols don t run in a vacuum Security protocols are typically used as building blocks in a larger secure system For example,
Publicly-verifiable proof of storage: a modular construction. Federico Giacon
Publicly-verifiable proof of storage: a modular construction Federico Giacon Ruhr-Universita t Bochum federico.giacon@rub.de 6th BunnyTN, Trent 17 December 2015 Proof of Storage Proof of Storage (PoS)
Notes for Lecture 14
COS 533: Advanced Cryptography Lecture 14 (November 6, 2017) Lecturer: Mark Zhandry Princeton University Scribe: Fermi Ma Notes for Lecture 14 1 Applications of Pairings 1.1 Recap Consider a bilinear e
HOST Authentication Overview ECE 525
Authentication Overview Authentication refers to the process of verifying the identity of the communicating principals to one another Usually sub-divided into Entity authentication Authentication in real-time
The Challenges of Distributing Distributed Cryptography. Ari Juels Chief Scientist, RSA
The Challenges of Distributing Distributed Cryptography Ari Juels Chief Scientist, RSA What is this new and mysterious technology? Hint: It s 20+ years old. R. Ostrovsky and M. Yung. How to withstand
Introduction to Cryptography. Lecture 3
Introduction to Cryptography Lecture 3 Benny Pinkas March 6, 2011 Introduction to Cryptography, Benny Pinkas page 1 Pseudo-random generator seed s (random, s =n) Pseudo-random generator G Deterministic
CSA E0 312: Secure Computation October 14, Guest Lecture 2-3
CSA E0 312: Secure Computation October 14, 2015 Guest Lecture 2-3 Guest Instructor: C. Pandu Rangan Submitted by: Cressida Hamlet 1 Introduction Till now we have seen only semi-honest parties. From now
1 Defining Message authentication
ISA 562: Information Security, Theory and Practice Lecture 3 1 Defining Message authentication 1.1 Defining MAC schemes In the last lecture we saw that, even if our data is encrypted, a clever adversary
Study Guide for the Final Exam
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467b: Cryptography and Computer Security Handout #22 Professor M. J. Fischer April 30, 2005 1 Exam Coverage Study Guide for the Final Exam The final
Michael Zohner (TU Darmstadt)
ABY - A Framework for Efficient Mixed-Protocol Secure Two-Party Computation Michael Zohner (TU Darmstadt) Joint work with Daniel Demmler and Thomas Schneider 11.02.14 ABY: Mixed-Protocol Secure Two-Party
Cryptography. and Network Security. Lecture 0. Manoj Prabhakaran. IIT Bombay
Cryptography and Network Security Lecture 0 Manoj Prabhakaran IIT Bombay Security In this course: Cryptography as used in network security Humans, Societies, The World Network Hardware OS Libraries Programs
Parallel Coin-Tossing and Constant-Round Secure Two-Party Computation
Parallel Coin-Tossing and Constant-Round Secure Two-Party Computation Yehuda Lindell Department of Computer Science and Applied Math, Weizmann Institute of Science, Rehovot, Israel. lindell@wisdom.weizmann.ac.il
Safely Measuring Tor. Rob Jansen U.S. Naval Research Laboratory Center for High Assurance Computer Systems
Safely Measuring Tor Safely Measuring Tor, Rob Jansen and Aaron Johnson, In the Proceedings of the 23rd ACM Conference on Computer and Communication Security (CCS 2016). Rob Jansen Center for High Assurance
CSC 5930/9010 Cloud S & P: Cloud Primitives
CSC 5930/9010 Cloud S & P: Cloud Primitives Professor Henry Carter Spring 2017 Methodology Section This is the most important technical portion of a research paper Methodology sections differ widely depending
What is Authentication? All requests for resources have to be monitored. Every request must be authenticated and authorized to use the resource.
P1L4 Authentication What is Authentication? All requests for resources have to be monitored. Every request must be authenticated and authorized to use the resource. Authentication: Who are you? Prove it.
Network Security: Anonymity. Tuomas Aura T Network security Aalto University, Nov-Dec 2010
Network Security: Anonymity Tuomas Aura T-110.5240 Network security Aalto University, Nov-Dec 2010 Outline 1. Anonymity and privacy 2. High-latency anonymous routing 3. Low-latency anonymous routing Tor
Differential Privacy. Cynthia Dwork. Mamadou H. Diallo
Differential Privacy Cynthia Dwork Mamadou H. Diallo 1 Focus Overview Privacy preservation in statistical databases Goal: to enable the user to learn properties of the population as a whole, while protecting
Rational Oblivious Transfer
Rational Oblivious Transfer Xiong Fan xfan@cs.umd.edu Kartik Nayak kartik1507@gmail.com May 14, 2014 Abstract Oblivious transfer is widely used in secure multiparty computation. In this paper, we propose
Safely Measuring Tor. Rob Jansen U.S. Naval Research Laboratory Center for High Assurance Computer Systems
Safely Measuring Tor Safely Measuring Tor, Rob Jansen and Aaron Johnson, In the Proceedings of the 23rd ACM Conference on Computer and Communication Security (CCS 2016). Rob Jansen Center for High Assurance
Searchable Symmetric Encryption: Optimal Locality in Linear Space via Two-Dimensional Balanced Allocations
Searchable Symmetric Encryption: Optimal Locality in Linear Space via Two-Dimensional Balanced Allocations Gilad Asharov Cornell-Tech Moni Naor Gil Segev Ido Shahaf (Hebrew University) Weizmann Hebrew
Lecture 8: Cryptography in the presence of local/public randomness
Randomness in Cryptography Febuary 25, 2013 Lecture 8: Cryptography in the presence of local/public randomness Lecturer: Yevgeniy Dodis Scribe: Hamidreza Jahanjou So far we have only considered weak randomness
Application Security through a Hacker s Eyes James Walden Northern Kentucky University
Application Security through a Hacker s Eyes James Walden Northern Kentucky University waldenj@nku.edu Why Do Hackers Target Web Apps? Attack Surface A system s attack surface consists of all of the ways
Secure Message Transmission with Small Public Discussion. Juan Garay (AT&T Labs Research) Clint Givens (UCLA) Rafail Ostrovsky (UCLA)
Juan Garay (AT&T Labs Research) Clint Givens (UCLA) Rafail Ostrovsky (UCLA) SMT by Public Discussion (SMT-PD) [GO08] Sender S Receiver R message Problem: Transmit a message privately and reliably S and
The IPS Compiler: Optimizations, Variants and Concrete Efficiency
The IPS Compiler: Optimizations, Variants and Concrete Efficiency Yehuda Lindell, Eli Oxman, and Benny Pinkas Dept. of Computer Science, Bar Ilan University, Ramat Gan, Israel. lindell@cs.biu.ac.il, eli.oxman@gmail.com,
Logistics. Next week, my OH will be vs HW6 (= writing + Monad.hs) counts! You HW grade = max of 5 HWs. CAPEs!
Logistics Next week, my OH will be 10-11 vs 11-12 HW6 (= writing + Monad.hs) counts! You HW grade = max of 5 HWs CAPEs! Special-topic: constant-time programming Today + Week 10 What is constant-time programming?
Detecting Denial of Service Attacks in Tor
Norman Danner Danny Krizanc Marc Liberatore Department of Mathematics and Computer Science Wesleyan University Middletown, CT 06459 USA Financial Cryptography and Data Security 2009 Outline 1 Background
MTAT Cryptology II. Commitment Schemes. Sven Laur University of Tartu
MTAT.07.003 Cryptology II Commitment Schemes Sven Laur University of Tartu Formal Syntax m M 0 (c,d) Com pk (m) pk Canonical use case Gen c d pk m Open pk (c,d) A randomised key generation algorithm Gen
Efficient Private Matching and Set Intersection
Efficient Private Matching and Set Intersection Mike Freedman, NYU Kobbi Nissim, MSR Benny Pinkas, HP Labs EUROCRYPT 2004 A Story Is there any chance we might be compatible? We could see if we have similar
COMP4109 : Applied Cryptography
COMP4109 : Applied Cryptography Fall 2013 M. Jason Hinek Carleton University Applied Cryptography Day 2 information security cryptographic primitives unkeyed primitives NSA... one-way functions hash functions
Research Statement. Yehuda Lindell. Dept. of Computer Science Bar-Ilan University, Israel.
Research Statement Yehuda Lindell Dept. of Computer Science Bar-Ilan University, Israel. lindell@cs.biu.ac.il www.cs.biu.ac.il/ lindell July 11, 2005 The main focus of my research is the theoretical foundations
SIDE CHANNEL ATTACKS AGAINST IOS CRYPTO LIBRARIES AND MORE DR. NAJWA AARAJ HACK IN THE BOX 13 APRIL 2017
SIDE CHANNEL ATTACKS AGAINST IOS CRYPTO LIBRARIES AND MORE DR. NAJWA AARAJ HACK IN THE BOX 13 APRIL 2017 WHAT WE DO What we do Robust and Efficient Cryptographic Protocols Research in Cryptography and
Network Security: Anonymity. Tuomas Aura T Network security Aalto University, Nov-Dec 2012
Network Security: Anonymity Tuomas Aura T-110.5241 Network security Aalto University, Nov-Dec 2012 Outline 1. Anonymity and privacy 2. High-latency anonymous routing 3. Low-latency anonymous routing Tor
0x1A Great Papers in Computer Security
CS 380S 0x1A Great Papers in Computer Security Vitaly Shmatikov http://www.cs.utexas.edu/~shmat/courses/cs380s/ Privacy on Public Networks Internet is designed as a public network Wi-Fi access points,
Introduction to Secure Multi-Party Computation
CS 380S Introduction to Secure Multi-Party Computation Vitaly Shmatikov slide 1 Motivation General framework for describing computation between parties who do not trust each other Example: elections N
One-Time-Password-Authenticated Key Exchange
One-Time-Password-Authenticated Key Exchange Kenneth G. Paterson 1 and Douglas Stebila 2 1 Information Security Group Royal Holloway, University of London, Egham, Surrey, UK 2 Information Security Institute
Authentication. Steven M. Bellovin January 31,
Authentication Another trilogy: identification, authentication, authorization ACLs and the like are forms of authorization: what you re allowed to do Identification is whom you claim to be be Authentication
Identification Schemes
Identification Schemes Lecture Outline Identification schemes passwords one-time passwords challenge-response zero knowledge proof protocols Authentication Data source authentication (message authentication):
Lecture 22 - Oblivious Transfer (OT) and Private Information Retrieval (PIR)
Lecture 22 - Oblivious Transfer (OT) and Private Information Retrieval (PIR) Boaz Barak December 8, 2005 Oblivious Transfer We are thinking of the following situation: we have a server and a client (or
2018: Problem Set 1
crypt@b-it 2018 Problem Set 1 Mike Rosulek crypt@b-it 2018: Problem Set 1 1. Sometimes it is not clear whether certain behavior is an attack against a protocol. To decide whether something is an attack
Verifying Real-World Security Protocols from finding attacks to proving security theorems
Verifying Real-World Security Protocols from finding attacks to proving security theorems Karthik Bhargavan http://prosecco.inria.fr + many co-authors at INRIA, Microsoft Research, Formal security analysis
Better 2-round adaptive MPC
Better 2-round adaptive MPC Ran Canetti, Oxana Poburinnaya TAU and BU BU Adaptive Security of MPC Adaptive corruptions: adversary adversary can decide can decide who to who corrupt to corrupt adaptively
Introduction to Cryptography Lecture 7
Introduction to Cryptography Lecture 7 El Gamal Encryption RSA Encryption Benny Pinkas page 1 1 Public key encryption Alice publishes a public key PK Alice. Alice has a secret key SK Alice. Anyone knowing
Department of Electrical Engineering and Computer Science MASSACHUSETTS INSTITUTE OF TECHNOLOGY Fall Quiz II
Department of Electrical Engineering and Computer Science MASSACHUSETTS INSTITUTE OF TECHNOLOGY 6.858 Fall 2011 Quiz II You have 80 minutes to answer the questions in this quiz. In order to receive credit
ICT 6541 Applied Cryptography Lecture 8 Entity Authentication/Identification
ICT 6541 Applied Cryptography Lecture 8 Entity Authentication/Identification Hossen Asiful Mustafa Introduction Entity Authentication is a technique designed to let one party prove the identity of another
Fair exchange and non-repudiation protocols
Fair exchange and non-repudiation protocols Levente Buttyán Laboratory of Cryptography and System Security (CrySyS) Budapest University of Technology and Economics buttyan@crysys.hu 2010 Levente Buttyán
CS 111. Operating Systems Peter Reiher
Security for Operating Systems: Cryptography, Authentication, and Protecting OS Resources Operating Systems Peter Reiher Page 1 Outline Basic concepts in computer security Design principles for security
A Machine Learning Approach to Privacy-Preserving Data Mining Using Homomorphic Encryption
A Machine Learning Approach to Privacy-Preserving Data Mining Using Homomorphic Encryption Seiichi Ozawa Center for Mathematical Data Science Graduate School of Engineering Kobe University 2 What is PPDM?
Ideal Security Protocol. Identify Friend or Foe (IFF) MIG in the Middle 4/2/2012
Ideal Security Protocol Satisfies security requirements Requirements must be precise Efficient Small computational requirement Small bandwidth usage, network delays Not fragile Works when attacker tries
Authenticating Pervasive Devices with Human Protocols
Authenticating Pervasive Devices with Human Protocols Presented by Xiaokun Mu Paper Authors: Ari Juels RSA Laboratories Stephen A. Weis Massachusetts Institute of Technology Authentication Problems It
Vlad Kolesnikov Bell Labs
Vlad Kolesnikov Bell Labs DIMACS/Northeast Big Data Hub Workshop on Privacy and Security for Big Data Apr 25, 2017 You are near Starbucks; here is a special Legislation may require user consent each time
Zero-Knowledge Proofs of Knowledge
Zero-Knowledge Proofs of Knowledge Stéphanie Delaune September 6, 2013 Stéphanie Delaune () Proofs of Knowledge September 6, 2013 1 / 16 Proofs of knowledge Proof of knowledge are often used to prove one
Security for Structured Peer-to-peer Overlay Networks. Acknowledgement. Outline. By Miguel Castro et al. OSDI 02 Presented by Shiping Chen in IT818
Security for Structured Peer-to-peer Overlay Networks By Miguel Castro et al. OSDI 02 Presented by Shiping Chen in IT818 1 Acknowledgement Some of the following slides are borrowed from talks by Yun Mao
How to Break and Repair Leighton and Micali s Key Agreement Protocol
How to Break and Repair Leighton and Micali s Key Agreement Protocol Yuliang Zheng Department of Computer Science, University of Wollongong Wollongong, NSW 2522, AUSTRALIA yuliang@cs.uow.edu.au Abstract.
Network Security: Anonymity. Tuomas Aura T Network security Aalto University, autumn 2015
Network Security: Anonymity Tuomas Aura T-110.5241 Network security Aalto University, autumn 2015 Outline 1. Anonymity and privacy 2. High-latency anonymous routing 3. Low-latency anonymous routing Tor
CS 495 Cryptography Lecture 6
CS 495 Cryptography Lecture 6 Dr. Mohammad Nabil Alaggan malaggan@fci.helwan.edu.eg Helwan University Faculty of Computers and Information CS 495 Fall 2014 http://piazza.com/fci_helwan_university/fall2014/cs495
Introduction to Cryptography. Lecture 3
Introduction to Cryptography Lecture 3 Benny Pinkas March 6, 2011 Introduction to Cryptography, Benny Pinkas page 1 Pseudo-random generator seed s (random, s =n) Pseudo-random generator G Deterministic
An Overview of Active Security in Garbled Circuits
An Overview of Active Security in Garbled Circuits Author: Cesar Pereida Garcia Supervisor: Pille Pullonen Department of Mathematics and Computer Science. University of Tartu Tartu, Estonia. December 15,
Introduction to Cryptoeconomics
Introduction to Cryptoeconomics What is cryptoeconomics? Cryptoeconomics is about... Building systems that have certain desired properties Use cryptography to prove properties about messages that happened
Cryptography: More Primitives
Design and Analysis of Algorithms May 8, 2015 Massachusetts Institute of Technology 6.046J/18.410J Profs. Erik Demaine, Srini Devadas and Nancy Lynch Recitation 11 Cryptography: More Primitives 1 Digital
Random number generation
Cryptographic Protocols (EIT ICT MSc) Dr. Levente Buttyán associate professor BME Hálózati Rendszerek és Szolgáltatások Tanszék Lab of Cryptography and System Security (CrySyS) buttyan@hit.bme.hu, buttyan@crysys.hu
Secure Coding, some simple steps help. OWASP EU Tour 2013
Secure Coding, some simple steps help. OWASP EU Tour 2013 About Me Steven van der Baan - Dutch - 7Safe, part of PA Consulting Group - Developer - Pentester - Consultant - CISSP, OSCP It's amazing how
MTAT Research Seminar in Cryptography IND-CCA2 secure cryptosystems
MTAT.07.006 Research Seminar in Cryptography IND-CCA2 secure cryptosystems Dan Bogdanov October 31, 2005 Abstract Standard security assumptions (IND-CPA, IND- CCA) are explained. A number of cryptosystems
Whitewash: Outsourcing Garbled Circuit Generation for Mobile Devices
Whitewash: Outsourcing Garbled Circuit Generation for Mobile Devices Annual Computer Security Applications Conference 2014 Henry Hank Carter, Charles Lever, Patrick Traynor SMC on mobile devices Mobile
PrivCount: A Distributed System for Safely Measuring Tor
PrivCount: A Distributed System for Safely Measuring Tor Rob Jansen Center for High Assurance Computer Systems Invited Talk, October 4 th, 2016 University of Oregon Department of Computer and Information
An Overview of Secure Multiparty Computation
An Overview of Secure Multiparty Computation T. E. Bjørstad The Selmer Center Department of Informatics University of Bergen Norway Prøveforelesning for PhD-graden 2010-02-11 Outline Background 1 Background
Only attaches labels to random images from the internet. Given label, can we identify where label actually is? Given label can we identify where label
Peekaboom: A Game for Locating Objects in Images By Luis von Ahn, Ruoran Liu, and Manuel Blum ESP Game Only attaches labels to random images from the internet Does not specify location o of image Thus,
Lecture 5: Zero Knowledge for all of NP
600.641 Special Topics in Theoretical Cryptography February 5, 2007 Lecture 5: Zero Knowledge for all of NP Instructor: Susan Hohenberger Scribe: Lori Kraus 1 Administrative The first problem set goes
Laconic Zero Knowledge to. Akshay Degwekar (MIT)
Laconic Zero Knowledge to Public Key Cryptography Akshay Degwekar (MIT) Public Key Encryption (PKE) [Diffie-Hellman76, Rivest-Shamir-Adelman78, Goldwasser-Micali82] sk pk Public Key Encryption ct = Enc
0x1A Great Papers in Computer Security
CS 380S 0x1A Great Papers in Computer Security Vitaly Shmatikov http://www.cs.utexas.edu/~shmat/courses/cs380s/ Attacking Cryptographic Schemes Cryptanalysis Find mathematical weaknesses in constructions
Faster Private Set Intersection based on OT Extension
Faster Private Set Intersection based on OT Extension Michael Zohner (TU Darmstadt) Joint work with Benny Pinkas (Bar Ilan University) Thomas Schneider (TU Darmstadt) 22.08.14 Faster PSI based on OT extension
CSC 5930/9010 Modern Cryptography: Digital Signatures
CSC 5930/9010 Modern Cryptography: Digital Signatures Professor Henry Carter Fall 2018 Recap Implemented public key schemes in practice commonly encapsulate a symmetric key for the rest of encryption KEM/DEM
Foundations of Cryptography CS Shweta Agrawal
Foundations of Cryptography CS 6111 Shweta Agrawal Course Information 4-5 homeworks (20% total) A midsem (25%) A major (35%) A project (20%) Attendance required as per institute policy Challenge questions
IND-CCA2 secure cryptosystems, Dan Bogdanov
MTAT.07.006 Research Seminar in Cryptography IND-CCA2 secure cryptosystems Dan Bogdanov University of Tartu db@ut.ee 1 Overview Notion of indistinguishability The Cramer-Shoup cryptosystem Newer results
Overview of Cryptography
18739A: Foundations of Security and Privacy Overview of Cryptography Anupam Datta CMU Fall 2007-08 Is Cryptography A tremendous tool The basis for many security mechanisms Is not The solution to all security
Anonymous communications: Crowds and Tor
Anonymous communications: Crowds and Tor Basic concepts What do we want to hide? sender anonymity attacker cannot determine who the sender of a particular message is receiver anonymity attacker cannot
CSE484 Final Study Guide
CSE484 Final Study Guide Winter 2013 NOTE: This study guide presents a list of ideas and topics that the TAs find useful to know, and may not represent all the topics that could appear on the final exam.
Threat Modeling. Bart De Win Secure Application Development Course, Credits to
Threat Modeling Bart De Win bart.dewin@ascure.com Secure Application Development Course, 2009 Credits to Frank Piessens (KUL) for the slides 2 1 Overview Introduction Key Concepts Threats, Vulnerabilities,