发布求助
文献互助 智能选刊 最新文献

2010 23rd IEEE Computer Security Foundations Symposium最新文献

筛选
英文 中文
Impossibility Results for Secret Establishment 秘密建立的不可能结果
2010 23rd IEEE Computer Security Foundations Symposium Pub Date : 2010-07-17 DOI: 10.1109/CSF.2010.25
Benedikt Schmidt, P. Schaller, D. Basin
{"title":"Impossibility Results for Secret Establishment","authors":"Benedikt Schmidt, P. Schaller, D. Basin","doi":"10.1109/CSF.2010.25","DOIUrl":"https://doi.org/10.1109/CSF.2010.25","url":null,"abstract":"Security protocol design is a creative discipline where the solution space depends on the problem to be solved and the cryptographic operators available. In this paper, we examine the general question of when two agents can create a shared secret. Namely, given an equational theory describing the cryptographic operators available, is there a protocol that allows the agents to establish a shared secret? We examine this question in several settings. First, we provide necessary and sufficient conditions for secret establishment using subterm convergent theories. This directly yields a decision procedure for this problem. As a consequence, we obtain impossibility results for symmetric encryption and signature schemes. Second, we use algebraic methods to prove impossibility results for two important theories that are not subterm convergent: XOR and abelian groups. Finally, we develop a general combination result that enables modular impossibility proofs. For example, the results for symmetric encryption and XOR can be combined to obtain impossibility for the joint theory.","PeriodicalId":309713,"journal":{"name":"2010 23rd IEEE Computer Security Foundations Symposium","volume":"105 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-07-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124699498","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 7
A Machine-Checked Formalization of Sigma-Protocols 西格玛协议的机器检查形式化
2010 23rd IEEE Computer Security Foundations Symposium Pub Date : 2010-07-17 DOI: 10.1109/CSF.2010.24
G. Barthe, Daniel Hedin, Santiago Zanella Béguelin, B. Grégoire, S. Heraud
{"title":"A Machine-Checked Formalization of Sigma-Protocols","authors":"G. Barthe, Daniel Hedin, Santiago Zanella Béguelin, B. Grégoire, S. Heraud","doi":"10.1109/CSF.2010.24","DOIUrl":"https://doi.org/10.1109/CSF.2010.24","url":null,"abstract":"Zero-knowledge proofs have a vast applicability in the domain of cryptography, stemming from the fact that they can be used to force potentially malicious parties to abide by the rules of a protocol, without forcing them to reveal their secrets. Σ-protocols are a class of zero-knowledge proofs that can be implemented efficiently and that suffice for a great variety of practical applications. This paper presents a first machine-checked formalization of a comprehensive theory of Σ-protocols. The development includes basic definitions, relations between different security properties that appear in the literature, and general composability theorems. We show its usefulness by formalizing—and proving the security—of concrete instances of several well-known protocols. The formalization builds on CertiCrypt, a framework that provides support to reason about cryptographic systems in the Coq proof assistant, and that has been previously used to formalize security proofs of encryption and signature schemes.","PeriodicalId":309713,"journal":{"name":"2010 23rd IEEE Computer Security Foundations Symposium","volume":"207 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-07-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114757001","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 32
Strong Invariants for the Efficient Construction of Machine-Checked Protocol Security Proofs 高效构造机器检查协议安全证明的强不变量
2010 23rd IEEE Computer Security Foundations Symposium Pub Date : 2010-07-17 DOI: 10.1109/CSF.2010.23
Simon Meier, C. Cremers, D. Basin
{"title":"Strong Invariants for the Efficient Construction of Machine-Checked Protocol Security Proofs","authors":"Simon Meier, C. Cremers, D. Basin","doi":"10.1109/CSF.2010.23","DOIUrl":"https://doi.org/10.1109/CSF.2010.23","url":null,"abstract":"We embed an operational semantics for security protocols in the interactive theorem prover Isabelle/HOL and derive two strong protocol-independent invariants. These invariants allow us to reason about the possible origin of messages and justify a local typing assumption for the otherwise untyped protocol variables. The two rules form the core of a theory that is well-suited for interactively constructing natural, human-readable, correctness proofs. Moreover, we develop an algorithm that automatically generates proof scripts based on these invariants. Both interactive and automatic proof construction are faster than competing approaches. Moreover, we have strong correctness guarantees since all proofs, including those deriving the underlying theory from the semantics, are machine checked.","PeriodicalId":309713,"journal":{"name":"2010 23rd IEEE Computer Security Foundations Symposium","volume":"116 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-07-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122023073","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 36
Modeling and Verifying Ad Hoc Routing Protocols 建模和验证自组织路由协议
2010 23rd IEEE Computer Security Foundations Symposium Pub Date : 2010-07-17 DOI: 10.1109/csf.2010.12
Mathilde Arnaud, V. Cortier, S. Delaune
{"title":"Modeling and Verifying Ad Hoc Routing Protocols","authors":"Mathilde Arnaud, V. Cortier, S. Delaune","doi":"10.1109/csf.2010.12","DOIUrl":"https://doi.org/10.1109/csf.2010.12","url":null,"abstract":"Mobile ad hoc networks consist of mobile wireless devices which autonomously organize their infrastructure. In such networks, a central issue, ensured by routing protocols, is to find a route from one device to another. Those protocols use cryptographic mechanisms in order to prevent malicious nodes from compromising the discovered route. Our contribution is twofold. We first propose a calculus for modeling and reasoning about security protocols, including in particular secured routing protocols. Our calculus extends standard symbolic models to take into account the characteristics of routing protocols and to model wireless communication in a more accurate way. Our second main contribution is a decision procedure for analyzing routing protocols for any network topology. By using constraint solving techniques, we show that it is possible to automatically discover (in NPTIME) whether there exists a network topology that would allow malicious nodes to mount an attack against the protocol, for a bounded number of sessions. We also provide a decision procedure for detecting attacks in case the network topology is given a priori. We demonstrate the usage and usefulness of our approach by analyzing the protocol SRP applied to DSR.","PeriodicalId":309713,"journal":{"name":"2010 23rd IEEE Computer Security Foundations Symposium","volume":"27 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-07-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126370892","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 37
Approximation and Randomization for Quantitative Information-Flow Analysis 定量信息流分析的近似和随机化
2010 23rd IEEE Computer Security Foundations Symposium Pub Date : 2010-07-17 DOI: 10.1109/CSF.2010.8
Boris Köpf, A. Rybalchenko
{"title":"Approximation and Randomization for Quantitative Information-Flow Analysis","authors":"Boris Köpf, A. Rybalchenko","doi":"10.1109/CSF.2010.8","DOIUrl":"https://doi.org/10.1109/CSF.2010.8","url":null,"abstract":"Quantitative information-flow analysis (QIF) is an emerging technique for establishing information-theoretic confidentiality properties. Automation of QIF is an important step towards ensuring its practical applicability, since manual reasoning about program security has been shown to be a tedious and expensive task. Existing automated techniques for QIF fall short of providing full coverage of all program executions, especially in the presence of unbounded loops and data structures, which are notoriously difficult to analyze automatically. In this paper we propose a blend of approximation and randomization techniques to bear on the challenge of sufficiently precise, yet efficient computation of quantitative information flow properties. Our approach relies on a sampling method to enumerate large or unbounded secret spaces, and applies both static and dynamic program analysis techniques to deliver necessary over- and under-approximations of information-theoretic characteristics.","PeriodicalId":309713,"journal":{"name":"2010 23rd IEEE Computer Security Foundations Symposium","volume":"27 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-07-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131439404","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 80
On Protection by Layout Randomization 基于布局随机化的保护
2010 23rd IEEE Computer Security Foundations Symposium Pub Date : 2010-07-17 DOI: 10.1145/2240276.2240279
M. Abadi, G. Plotkin
{"title":"On Protection by Layout Randomization","authors":"M. Abadi, G. Plotkin","doi":"10.1145/2240276.2240279","DOIUrl":"https://doi.org/10.1145/2240276.2240279","url":null,"abstract":"Layout randomization is a powerful, popular technique for software protection. We present it and study it in programming-language terms. More specifically, we consider layout randomization as part of an implementation for a highlevel programming language; the implementation translates this language to a lower-level language in which memory addresses are numbers. We analyze this implementation, by relating low-level attacks against the implementation to contexts in the high-level programming language, and by establishing full abstraction results.","PeriodicalId":309713,"journal":{"name":"2010 23rd IEEE Computer Security Foundations Symposium","volume":"7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-07-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114897296","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 86
Towards a Formal Foundation of Web Security 迈向Web安全的正式基础
2010 23rd IEEE Computer Security Foundations Symposium Pub Date : 2010-07-17 DOI: 10.1109/CSF.2010.27
Devdatta Akhawe, A. Barth, Peifung E. Lam, John C. Mitchell, D. Song
{"title":"Towards a Formal Foundation of Web Security","authors":"Devdatta Akhawe, A. Barth, Peifung E. Lam, John C. Mitchell, D. Song","doi":"10.1109/CSF.2010.27","DOIUrl":"https://doi.org/10.1109/CSF.2010.27","url":null,"abstract":"We propose a formal model of web security based on an abstraction of the web platform and use this model to analyze the security of several sample web mechanisms and applications. We identify three distinct threat models that can be used to analyze web applications, ranging from a web attacker who controls malicious web sites and clients, to stronger attackers who can control the network and/or leverage sites designed to display user-supplied content. We propose two broadly applicable security goals and study five security mechanisms. In our case studies, which include HTML5 forms, Referer validation, and a single sign-on solution, we use a SAT-based model-checking tool to find two previously known vulnerabilities and three new vulnerabilities. Our case study of a Kerberos-based single sign-on system illustrates the differences between a secure network protocol using custom client software and a similar but vulnerable web protocol that uses cookies, redirects, and embedded links instead.","PeriodicalId":309713,"journal":{"name":"2010 23rd IEEE Computer Security Foundations Symposium","volume":"34 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-07-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115053866","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 233
Information Flow in Credential Systems 凭证系统中的信息流
2010 23rd IEEE Computer Security Foundations Symposium Pub Date : 2010-07-17 DOI: 10.1109/CSF.2010.19
Moritz Y. Becker
{"title":"Information Flow in Credential Systems","authors":"Moritz Y. Becker","doi":"10.1109/CSF.2010.19","DOIUrl":"https://doi.org/10.1109/CSF.2010.19","url":null,"abstract":"This paper proposes a systematic study of information flow in credential-based declarative authorization policies. It argues that a treatment in terms of information flow is needed to adequately describe, analyze and mitigate a class of probing attacks which allow an adversary to infer any confidential fact within a policy. Two information flow properties that have been studied in the context of state transition systems, non-interference and opacity, are reformulated in the current context of policy languages. A comparison between these properties reveals that opacity is the more useful, and more general of the two; indeed, it is shown that non-interference can be stated in terms of opacity. The paper then presents an inference system for non-opacity, or detectability, in Datalog-based policies. Finally, a pragmatic method is presented, based on a mild modification of the mechanics of delegation, for preventing a particularly dangerous kind of probing attack that abuses delegation of authority.","PeriodicalId":309713,"journal":{"name":"2010 23rd IEEE Computer Security Foundations Symposium","volume":"189 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-07-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133264803","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 18
Information Flow Monitor Inlining 信息流监视器内联
2010 23rd IEEE Computer Security Foundations Symposium Pub Date : 2010-07-17 DOI: 10.1109/CSF.2010.21
A. Chudnov, D. Naumann
{"title":"Information Flow Monitor Inlining","authors":"A. Chudnov, D. Naumann","doi":"10.1109/CSF.2010.21","DOIUrl":"https://doi.org/10.1109/CSF.2010.21","url":null,"abstract":"In recent years it has been shown that dynamic monitoring can be used to soundly enforce information flow policies. For programs distributed in source or bytecode form, the use of just-in-time (JIT) compilation makes it difficult to implement monitoring by modifying the language runtime system. An inliner avoids this problem and also serves to provide monitoring for more than one runtime. We show how to inline an information flow monitor, specifically a flow sensitive one previously proved to enforce termination insensitive noninterference. We prove that the inlined version is observationally equivalent to the original.","PeriodicalId":309713,"journal":{"name":"2010 23rd IEEE Computer Security Foundations Symposium","volume":"6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-07-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115322141","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 72
Automating Open Bisimulation Checking for the Spi Calculus Spi演算的自动开放双仿真检查
2010 23rd IEEE Computer Security Foundations Symposium Pub Date : 2010-07-17 DOI: 10.1109/CSF.2010.28
Alwen Tiu, J. Dawson
{"title":"Automating Open Bisimulation Checking for the Spi Calculus","authors":"Alwen Tiu, J. Dawson","doi":"10.1109/CSF.2010.28","DOIUrl":"https://doi.org/10.1109/CSF.2010.28","url":null,"abstract":"We consider the problem of automating open bisimulation checking for the spi calculus, an extension of the pi-calculus with cryptographic primitives. The notion of open bisimulation considered here is indexed by a (symbolic) environment, represented as bi-traces (i.e., pairs of symbolic traces), which encode the history of interaction between the intruder with the processes being checked for bisimilarity. A crucial part of the definition of this open bisimulation, that is, the notion of consistency of bi-traces, involves infinite quantification over a certain notion of “respectful substitutions”. We show that one needs only to check a finite number of respectful substitutions in order to check bi-trace consistency. Our decision procedure uses techniques that have been well developed in the area of symbolic trace analysis for security protocols. More specifically, we make use of techniques for symbolic trace refinement, which transform a symbolic trace into a finite set of symbolic traces in a certain “solved form”. Crucially, we show that refinements of a projection of a bitrace can be uniquely extended to refinements of the bi-trace, and that consistency of all instances of the original bi-trace can be reduced to consistency of its finite set of refinements. We then give a sound and complete procedure for deciding open bisimilarity for finite spi processes.","PeriodicalId":309713,"journal":{"name":"2010 23rd IEEE Computer Security Foundations Symposium","volume":"91 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-07-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122044785","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 83
下一页 尾页
0
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
提示
您的信息不完整，为了账户安全，请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
请完成安全验证×
相关产品
×
本文献相关产品
联系我们：info@booksci.cn Book学术提供免费学术资源搜索服务，方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。 Copyright © 2023 布克学术 All rights reserved.
京ICP备2023020795号-1
ghs 京公网安备 11010802042870号
Book学术文献互助
Book学术文献互助群
群 号：604180095
Book学术官方微信
小红书