Speakers :: Summer School on Real-World Crypto and Privacy

So we are now confronted with a wide variety of block ciphers and permutations on the one hand, and a large amount of attack techniques on the other. What the vast majority of these ciphers share is that they are iterative: they consist of the repeated application of a round function. When choosing the number of rounds, one estimates the number of rounds required to provide resistant against the best known attack and one adds some rounds as a safety margin. The choice of the number of rounds is essential to strike a good compromise between efficiency and safety margin.

Given a round function, choosing the number of rounds requires a good understanding of cryptanalysis. However, the design choices made before doing this analysis have a dramatic impact on the applicability of types of cryptanalysis. I will discuss these choices for round functions that have as non-linear step an S-box layer, often (incorrectly) called substitution-permutation networks (SPN). These choices are mainly the S-box width, state layout and alignment. To reason about these design choices, we introduce metrics for the linear part of the round function that allow to quantify its relevant properties with respect to known types of cryptanalysis.

Daniel Gruss, TU Graz, Austria

(Talk 1) Title

Introduction to Microarchitectural Attacks

Abstract

(Talk 2) Title

Transient Execution Attacks

Abstract

With this knowledge we are prepared to discuss which defenses against transient execution attacks are effective. We will see that there are good defenses, but most are neither effective nor efficient. Finally we will discuss how future defenses should be designed.

Seda Gürses, KU Leuven, Belgium

(Talk 1) Title

Privacy Research Paradigms in Computer Science

Abstract

(Talk 2) Title

POTs: The revolution will not be optimized?

Abstract

Protective optimization technologies (POTs) are a response to optimization systems' negative effects on users and local environments. POTs analyze how events (or lack thereof) inferred, induced or shaped by optimization systems affect users and environments, then manipulate these events to influence system outcomes, e.g., by altering the optimization constraints and poisoning system inputs. During this talk I will describe optimization systems, demonstrate problems associated with these systems, and how POTs can protect users against these.

Annelie Heuser, CNRS (IRISA), France

(Talk 1) Title

Introduction to Profiled Side-channel Attacks

Abstract

(Talk 2) Title

Recent advances in side-channel analysis using machine learning techniques

Abstract

In this talk, we will discuss recent advances made in the field of side-channel analysis using machine learning and deep learning techniques. This includes reshaping the underlying side-channel scenario with semi-supervised techniques, discussing evaluation metrics, and enhancing side-channel classification techniques.

Andreas Hülsing, TU Eindhoven, The Netherlands

(Talk 1) Title

Introduction to the theory of secret key cryptography

Abstract

(Talk 2) Title

Simplified security arguments for hash-based signatures

Abstract

Tibor Jager, Paderborn University, Germany

(Talk 1) Title

Real-World AKE

Abstract

(Talk 2) Title

Public-key 0-RTT protocols

Abstract

Elif Bilge Kavun, The University of Sheffield, UK

(Talk 1) Title

Resource-efficient Cryptography for Ubiquitous Computing

Abstract

For ubiquitous computing, the adversary model and the security level is not the same as in traditional applications due to limited resources in pervasive devices – area, power, and energy are actually harsh constraints for such devices. Unfortunately, the existing cryptographic solutions are generally quite heavy for these ubiquitous applications. In order to address the security problem of the resource-constrained devices, "lightweight cryptography" has been defined nearly two decades ago and many different lightweight cryptographic primitives have already been proposed. Initial studies mostly dealt with hardware cost reduction. However, this is not the only important metric for such devices. Depending on the application, resource-constrained devices may need lightweight ciphers to be executed in one clock cycle, which still achieve a certain security level and a small footprint. Furthermore, as most of the pervasive computing applications are implemented in software on embedded microcontrollers, there is also a need for lightweight ciphers that result in efficient code size and execution time.

In this talk, lightweight cryptography is understood as "resource-efficient cryptography". First, existing lightweight ciphers focusing on low-area will be introduced. Following that, other "resource-efficient" cipher solutions for resource-constrained devices addressing the mentioned gaps in lightweight cryptography will be explained. Finally, implementation techniques and cipher proposals towards "side-channel protected" resource-efficient cryptography will be presented.

(Talk 2) Title

Challenges in Real-world "Secure" Cryptographic Hardware Implementations:

Abstract

Many techniques have been proposed against these attacks; for example, masking is the most straightforward technique against side-channel attacks and redundancy is a very common technique against fault attacks. In a "real-world" cryptographic hardware, one has to protect the device from all of these attacks. This means implementing different countermeasures at the same time, which in turn can bring conflicts and as well cost problems. For instance, many masking techniques against side-channel attacks require fresh-randomness in every clock cycle in addition to mask shares which means that a large amount of randomness has to be generated on the chip. Furthermore, security-critical parts of the device have to be implemented redundantly against fault attacks.

Many devices and applications cannot afford the large area and high power consumption caused by implementing all these countermeasures at the same time. Sometimes, it is even too complex for the synthesizer to compile and optimize the implementation successfully. Furthermore, in order to make sure that one countermeasure does not conflict with another one, security verification has to be performed repeatedly before silicon, which is a time-consuming process.

In this talk, such challenges will be presented not only from an academic view, but also from an industry perspective. Some practical solutions will be presented and the countermeasures in the literature addressing both active and passive attacks will be explained.

Engin Kirda, Northeastern University, USA

(Talk 1) Title

Selected Topics in Web Security

Abstract

(Talk 2) Title

Advanced Malware: Attacks, Defenses, and Open Challenges

Abstract

Anja Lehmann, IBM Research, Switzerland

(Talk 1) Title

Updatable Encryption & Key Rotation

Abstract

(Talk 2) Title

Group Signatures - Concepts, New Advances and Applications

Abstract

Emmanuel Prouff, ANSSI, France

Title

Deep Learning for Embedded Security Evaluation

Abstract

Mariana Raykova, Yale University, USA

(Talk 1) Title

Introduction to Privacy Preserving Computation

Abstract

(Talk 2) Title

PanORAMa: Oblivious RAM with Logarithmic Overhead

Abstract

Our construction follows the hierarchical approach to ORAM design and relies on two main building blocks of independent interest: a new oblivious hash table construction with improved amortized O(logN+poly(loglogλ)) communication overhead for security parameter λ and N=poly(λ), assuming its input is randomly shuffled; and a complementary new oblivious random multi-array shuffle construction, which shuffles N blocks of data with communication O(Nloglogλ+NlogNlogλ) when the input has a certain level of entropy. We combine these two primitives to improve the shuffle time in our hierarchical ORAM construction by avoiding heavy oblivious shuffles and leveraging entropy remaining in the merged levels from previous shuffles. As a result, the amortized shuffle cost is asymptotically the same as the lookup complexity in our construction.

This is a joint work with Sarvar Patel, Giuseppe Persiano and Kevin Yeo.

Ahmad-Reza Sadeghi, TU Darmstadt, Germany

Title

From Smart Cities to Smart Sex Toys: A Hitchhiker’s Security & Privacy Guide to The Galaxy of Things

Abstract

However, due to lack of security by design and flawed implementations we are facing significant security and privacy challenges specific to IoT, such as perilous IoT botnet attacks, new privacy threats caused by widespread installation of wireless sensors, actuators and smart environment appliances even in the highly private setting of our homes - not even smart sex toys are safe. Unfortunately, standard security measures like encrypted communications do not protect against many of these threats.

The massive scale of the IoT device population and enormous diversity of device hardware, operating systems, software frameworks, protocols, and manufacturers makes it almost impossible to establish standards for IoT security and privacy-protecting solutions. Even worse simply applying and extending known solutions, neither for per-device security architectures nor for network security measures, are sufficient to secure the IoT. In particular, existing intrusion detection techniques seem ineffective to detect compromised IoT devices.

In this talk, we present a compact overview of various attacks on IoT systems and recent works (including ours) on addressing the diverse security and privacy challenges in the growing IoT landscape. In particular, we focus on approaches for automated device identification and reliable detection of compromised devices based on their inherent communication behavior. In this context we may use other buzzwords like (adversarial) machine learning, and if time allows, even blockchains.

Patrick Schaumont, Virginia Tech, USA

Title

Hardware Acceleration in Cryptography

Abstract

The objective of hardware-accelerated cryptography is to integrate specialized hardware seamlessly into a system application with minimal overhead. Additional considerations include proper isolation of hardware-based secrets from unauthorized access, as well as the protection of those secrets against specific hardware attacks.

We discuss various form factors for hardware/software interfaces that integrate hardware crypto modules into the system software. We describe loosely-coupled memory-mapped structures and tightly-coupled custom-instructions. Next, we discuss techniques that are used to transform sequential algorithms into parallel architectures, and we consider the application of those techniques to the hardware acceleration of cryptography.

Throughout the talk, we illustrate the design concepts with examples of hardware acceleration of secret-key and public-key cryptography.

Benjamin Smith, INRIA and École Polytechnique, France

Title

Public-key cryptosystems from groups and group actions

Abstract

Juraj Somorovsky, Ruhr-Universität Bochum, Germany

(Talk 1) Title

Scalable Scanning and Automatic Classification of TLS Padding Oracle Vulnerabilities

Abstract

We present the first large-scale scan for CBC padding oracle vulnerabilities in TLS implementations on the modern Internet. Our scan revealed vulnerabilities in 1.83 of the Alexa Top Million websites, detecting nearly 100 different vulnerabilities. Our scanner observes subtle differences in server behavior, such as responding with different TLS alerts, or with different TCP header flags.

We used a novel scanning methodology consisting of three steps. First, we created a large set of probes that detect vulnerabilities at a considerable scanning cost. We then reduced the number of probes using a preliminary scan, such that a smaller set of probes has the same detection rate but is small enough to be used in large-scale scans. Finally, we used the reduced set to scan at scale, and clustered our findings with a novel approach using graph drawing algorithms.

Contrary to common wisdom, exploiting CBC padding oracles does not necessarily require performing precise timing measurements. We detected vulnerabilities that can be exploited simply by observing the content of different server responses. These vulnerabilities pose a significantly larger threat in practice than previously assumed.

The talk is based on our papers published at USENIX Security 2018 and 2019.

(Talk 2) Title

Efail attack and its implications

Abstract

We devise working attacks for both OpenPGP and S/MIME encryption, and show that exfiltration channels exist for 23 of the 35 tested S/MIME email clients and 10 of the 28 tested OpenPGP email clients. While it is necessary to change the OpenPGP and S/MIME standards to fix these vulnerabilities, some clients had even more severe implementation flaws allowing straightforward exfiltration of the plaintext.

In addition to the attacks on encryption schemes in OpenPGP and S/MIME, we give an overview of our current work targetting email signatures. We present several techniques to spoof signed emails on different levels.

The talk is based on our papers published at USENIX Security 2018 and 2019.

Carmela Troncoso, EPFL, Switzerland

Title

When foes are friends: adversarial examples as protective technologies

Abstract

Gilles Van Assche, STMicroelectronics, Belgium

Title

Overview of the sponge, duplex and Farfalle constructions

Abstract

Ingrid Verbauwhede, KU Leuven, Belgium

Title

The need for Hardware roots of trust

Abstract