2014 IEEE 27th Computer Security Foundations Symposium最新文献_第2页

Declarative Policies for Capability Control 用于能力控制的声明性策略

2014 IEEE 27th Computer Security Foundations Symposium Pub Date : 2014-07-19 DOI: 10.1109/CSF.2014.9

Christos Dimoulas, Scott Moore, Aslan Askarov, Stephen Chong

{"title":"Declarative Policies for Capability Control","authors":"Christos Dimoulas, Scott Moore, Aslan Askarov, Stephen Chong","doi":"10.1109/CSF.2014.9","DOIUrl":"https://doi.org/10.1109/CSF.2014.9","url":null,"abstract":"In capability-safe languages, components can access a resource only if they possess a capability for that resource. As a result, a programmer can prevent an untrusted component from accessing a sensitive resource by ensuring that the component never acquires the corresponding capability. In order to reason about which components may use a sensitive resource it is necessary to reason about how capabilities propagate through a system. This may be difficult, or, in the case of dynamically composed code, impossible to do before running the system. To counter this situation, we propose extensions to capability-safe languages that restrict the use of capabilities according to declarative policies. We introduce two independently useful semantic security policies to regulate capabilities and describe language-based mechanisms that enforce them. Access control policies restrict which components may use a capability and are enforced using higher-order contracts. Integrity policies restrict which components may influence (directly or indirectly) the use of a capability and are enforced using an information-flow type system. Finally, we describe how programmers can dynamically and soundly combine components that enforce access control or integrity policies with components that enforce different policies or even no policy at all.","PeriodicalId":285965,"journal":{"name":"2014 IEEE 27th Computer Security Foundations Symposium","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2014-07-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134104386","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 30

Actor Key Compromise: Consequences and Countermeasures 行动者关键妥协:后果和对策

2014 IEEE 27th Computer Security Foundations Symposium Pub Date : 2014-07-19 DOI: 10.1109/CSF.2014.25

D. Basin, C. Cremers, Marko Horvat

引用次数: 12

Stateful Declassification Policies for Event-Driven Programs 事件驱动程序的有状态解密策略

2014 IEEE 27th Computer Security Foundations Symposium Pub Date : 2014-07-19 DOI: 10.1109/CSF.2014.28

M. Vanhoef, Willem De Groef, Dominique Devriese, F. Piessens, Tamara Rezk

引用次数: 41

Information Flow Monitoring as Abstract Interpretation for Relational Logic 作为关系逻辑抽象解释的信息流监控

2014 IEEE 27th Computer Security Foundations Symposium Pub Date : 2014-07-19 DOI: 10.1109/CSF.2014.12

A. Chudnov, George Kuan, D. Naumann

引用次数: 23

Modeling Diffie-Hellman Derivability for Automated Analysis 自动分析的Diffie-Hellman可导性建模

2014 IEEE 27th Computer Security Foundations Symposium Pub Date : 2014-07-19 DOI: 10.1109/CSF.2014.24

Moses D. Liskov, F. Thayer

{"title":"Modeling Diffie-Hellman Derivability for Automated Analysis","authors":"Moses D. Liskov, F. Thayer","doi":"10.1109/CSF.2014.24","DOIUrl":"https://doi.org/10.1109/CSF.2014.24","url":null,"abstract":"Automated analysis of protocols involving Diffie-Hellman key exchange is challenging, in part because of the undecidability of the unification problem in relevant theories. In this paper, we justify the use of a more restricted theory that includes multiplication of exponents but not addition, providing unitary and efficient unification. To justify this theory, we compare it to a computational model of non-uniform circuit complexity through several incremental steps. First, we give a model closely analogous to the computational model, in which derivability is modeled by closure under simple algebraic transformations. This model retains many of the complex features of the computational model, including defining success based on asymptotic probability for a non-uniform family of strategies. We describe an intermediate model based on formal polynomial manipulations, in which success is exact and there is no longer a parametrized notion of the strategy. Despite the many differences in form, we are able to prove an equivalence between the asymptotic and intermediate models by showing that a sufficiently successful asymptotic strategy implies the existence of a perfect strategy. Finally, we describe a symbolic model in which addition of exponents is not modeled, and prove that (for expressible problems), the symbolic model is equivalent to the intermediate model.","PeriodicalId":285965,"journal":{"name":"2014 IEEE 27th Computer Security Foundations Symposium","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2014-07-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123898689","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

TUC: Time-Sensitive and Modular Analysis of Anonymous Communication 匿名通信的时间敏感和模块化分析

2014 IEEE 27th Computer Security Foundations Symposium Pub Date : 2014-07-19 DOI: 10.1109/CSF.2014.34

M. Backes, Praveen Manoharan, Esfandiar Mohammadi

引用次数: 15

Malleable Signatures: New Definitions and Delegatable Anonymous Credentials 可延展签名:新定义和可委派匿名凭证

2014 IEEE 27th Computer Security Foundations Symposium Pub Date : 2014-07-19 DOI: 10.1109/CSF.2014.22

Melissa Chase, Markulf Kohlweiss, Anna Lysyanskaya, S. Meiklejohn

引用次数: 47

Who's Afraid of Which Bad Wolf? A Survey of IT Security Risk Awareness 谁害怕哪只坏狼?IT安全风险意识调查

2014 IEEE 27th Computer Security Foundations Symposium Pub Date : 2014-07-19 DOI: 10.1109/CSF.2014.15

M. Harbach, S. Fahl, Matthew Smith

引用次数: 32

Certified Synthesis of Efficient Batch Verifiers 高效批验证器的认证合成

2014 IEEE 27th Computer Security Foundations Symposium Pub Date : 2014-07-19 DOI: 10.1109/CSF.2014.19

Joseph A. Akinyele, G. Barthe, B. Grégoire, Benedikt Schmidt, Pierre-Yves Strub

{"title":"Certified Synthesis of Efficient Batch Verifiers","authors":"Joseph A. Akinyele, G. Barthe, B. Grégoire, Benedikt Schmidt, Pierre-Yves Strub","doi":"10.1109/CSF.2014.19","DOIUrl":"https://doi.org/10.1109/CSF.2014.19","url":null,"abstract":"Many algorithms admit very efficient batch versions that compute simultaneously the output of the algorithms on a set of inputs. Batch algorithms are widely used in cryptography, especially in the setting of pairing-based computations, where they deliver significant speed-ups. AutoBatch is an automated tool that computes highly optimized batch verification algorithms for pairing-based signature schemes. Thanks to finely tuned heuristics, AutoBatch is able to rediscover efficient batch verifiers for several signature schemes of interest, and in some cases to output batch verifiers that outperform the best known verifiers from the literature. However, AutoBatch only provides weak guarantees (in the form of a LaTeX proof) of the correctness of the batch algorithms it outputs. In this paper, we verify the correctness and security of these algorithms using the EasyCrypt framework. To achieve this goal, we define a domain-specific language to describe verification algorithms based on pairings and provide an efficient algorithm for checking (approximate) observational equivalence between expressions of this language. By translating the output of AutoBatch to this language and applying our verification procedure, we obtain machine-checked correctness proofs of the batch verifiers. Moreover, we formalize notions of security for batch verifiers and we provide a generic proof in EasyCrypt that batch verifiers satisfy a security property called screening, provided they are correct and the original signature is unforgeable against chosen-message attacks. We apply our techniques to several well-known pairing-based signature schemes from the literature, and to Groth-Sahai zero-knowledge proofs.","PeriodicalId":285965,"journal":{"name":"2014 IEEE 27th Computer Security Foundations Symposium","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2014-07-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124346835","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 10

From Input Private to Universally Composable Secure Multi-party Computation Primitives 从输入私有到普遍可组合的安全多方计算原语

2014 IEEE 27th Computer Security Foundations Symposium Pub Date : 2014-07-19 DOI: 10.1109/CSF.2014.21

D. Bogdanov, Peeter Laud, S. Laur, Pille Pullonen

引用次数: 27