Users' devices, e.g., smartphones or laptops, are typically incapable of securely storing and processing cryptographic keys. We present Tandem, a novel set of protocols for securing cryptographic keys with support from a central server. Tandem uses one-time-use key-share tokens to preserve users' privacy with respect to a malicious central server. Additionally, Tandem enables users to block their keys if they lose their device, and it enables the server to limit how often an adversary can use an unblocked key. We prove Tandem's security and privacy properties, apply Tandem to attribute-based credentials, and implement a Tandem proof of concept to show that it causes little overhead.
Securing a secret master key is a non-trivial task, we even argue it is impossible to fully secure it, hence we must make it as difficult as possible for any powerful adversary to steal or use the key. We introduce the reader to interesting cryptography which is starting to get more attention in terms of addressing the above problem, and we briefly overview some commercial and open-source products that can be used. Finally, we propose a set of solutions on how to secure master keys, more as guidelines rather than exact technical specifications, with aim to inspire and raise awareness of how to…
We explore the use of SGX enclaves as a means to improve the security of handling keys and data in storage systems. We study two main configurations for SGX computations, as they apply to performing data-at-rest encryption in a storage system. The first configuration aims to protect the encryption keys used in the encryption process. The second configuration aims to protect both the encryption keys and the data, thus providing end-to-end security of the entire data path. Our main contribution is an evaluation of the viability of SGX for data-at-rest encryption from a performance perspective an…
Secure communication between two nodes in a network depends on reliable key management systems that generate and distribute keys between communicating nodes and a secure routing protocol that establishes a route between them. But due to lack of central server and infrastructure in Mobile Ad hoc Networks (MANETs), this is major problem to manage the keys in the network. Dynamically changes in network's topology causes weak trust relationship among the nodes in the network. In MANETs a mobile node operates as not only end terminal but also as an intermediate router. Therefore, a multi-hop scenar…
When Bluetooth devices come within the range of another, an electronic conversation takes place to determine whether the devices in range are known or whether one needs to control the other. Most Bluetooth devices do not require any form of user interaction for this to occur. If devices within range are known to one another, the devices automatically form a network known as a pairing. Authentication addresses the identity of each communicating device. The sender sends an encrypted authentication request frame to the receiver. The receiver sends an encrypted challenge frame back to the sender. …
Autonomous and self-driving vehicles are appearing on the public highways. These vehicles commonly use wireless communication techniques for both vehicle-to-vehicle and vehicle-to-infrastructure communications. Manufacturers, regulators and the public are understandably concerned about large-scale systems failure or malicious attack via these wireless vehicular networks. This paper explores the use of sensing and signalling devices that are commonly integrated into modern vehicles for side-channel communication purposes. Visible light (using a CMOS camera) and acoustic (ultrasonic audio) side-…
The emerging Information-Centric Networking (ICN) paradigm is expected to facilitate content sharing among users. ICN will make it easy for users to appoint storage nodes, in various network locations, perhaps owned or controlled by them, where shared content can be stored and disseminated from. These storage nodes should be (somewhat) trusted since not only they have (some level of) access to user shared content, but they should also properly enforce access control. Traditional forms of encryption introduce significant overhead when it comes to sharing content with large and dynamic groups of…
In this work, we propose a secret key generation procedure specifically designed for the inter-spacecraft communication links. As a novel secrecy source, the spacecrafts utilize Doppler frequency shift based measurements. In this way, the mobilities of the communication devices are exploited to generate secret keys, where this resource can be utilized in the environments that the channel fading based key generation methods are not available. The mobility of a spacecraft is modeled as the superposition of a pre-determined component and a dynamic component. We derive the maximum achievable secre…
Traditional cryptography assumes an eavesdropper receives an error-free copy of the transmitted ciphertext. Wyner's wiretap channel model recognizes that at the physical layer both the intended receiver and the passive eavesdropper inevitably receive an error-prone version of the transmitted message which must be corrected prior to decryption. This paper considers the implications of using both channel and cryptographic codes under the wiretap channel model in a way that enhances the \emph{information-theoretic} security for the friendly parties by keeping the information transfer to the eaves…
Informatics Institute, Istanbul Technical University（伊斯坦布尔理工大学信息学研究所）；Securify Information Technology and Security Training Consulting Inc.（Securify信息技术与安全培训咨询有限公司）
DNA fingerprinting is a cornerstone for human identification in forensics, where the sequence of highly polymorphic short tandem repeats (STRs) from an individual is compared against a DNA database. This presents significant privacy risks to individuals with DNA profiles in the database due to hacking by malicious attackers who may access the data and misuse it for secondary purposes. In this paper, we propose a novel cryptographic framework for jointly encrypting DNA-based fingerprints (STRs) with other biometric data, for example, facial images, such that the STRs and biometrics information …
The Internet of Things (IoT) is becoming an indispensable part of everyday life, enabling a variety of emerging services and applications. However, the presence of rogue IoT devices has exposed the IoT to untold risks with severe consequences. The first step in securing the IoT is detecting rogue IoT devices and identifying legitimate ones. Conventional approaches use cryptographic mechanisms to authenticate and verify legitimate devices' identities. However, cryptographic protocols are not available in many systems. Meanwhile, these methods are less effective when legitimate devices can be ex…
Crypto-ncRNA: a bio-inspired post-quantum cryptographic primitive exploiting RNA folding complexity
Tsinghua University-Peking University Joint Center for Life Sciences, Tsinghua University（清华大学-北京大学联合生命科学中心，清华大学）；Xinjiang Key Laboratory of Biological Resources and Genetic Engineering, College of Life Science and Technology, Xinjiang University（新疆生物资源与基因工程重点实验室，新疆大学生命科学与技术学院）；College of Mathematics and System Science, Xinjiang University（新疆大学数学与系统科学学院）；Department of Industrial and Systems Engineering, Faculty of Engineering, The Hong Kong Polytechnic University（工程学院工业与系统工程系，香港理工大学）；School of Environment and Energy, Shenzhen Graduate School, Peking University（环境与能源学院，北京大学深圳研究生院）
