arXiv - CS - Cryptography and Security最新文献_第6页

Double Index Calculus Algorithm: Faster Solving Discrete Logarithm Problem in Finite Prime Field 双索引微积分算法：更快解决有限素数域中的离散对数问题

arXiv - CS - Cryptography and Security Pub Date : 2024-09-13 DOI: arxiv-2409.08784

Wen Huang, Zhishuo Zhang, Weixin Zhao, Jian Peng, Yongjian Liao, Yuyu Wang

{"title":"Double Index Calculus Algorithm: Faster Solving Discrete Logarithm Problem in Finite Prime Field","authors":"Wen Huang, Zhishuo Zhang, Weixin Zhao, Jian Peng, Yongjian Liao, Yuyu Wang","doi":"arxiv-2409.08784","DOIUrl":"https://doi.org/arxiv-2409.08784","url":null,"abstract":"Solving the discrete logarithm problem in a finite prime field is an\u0000extremely important computing problem in modern cryptography. The hardness of\u0000solving the discrete logarithm problem in a finite prime field is the security\u0000foundation of numerous cryptography schemes. In this paper, we propose the\u0000double index calculus algorithm to solve the discrete logarithm problem in a\u0000finite prime field. Our algorithm is faster than the index calculus algorithm,\u0000which is the state-of-the-art algorithm for solving the discrete logarithm\u0000problem in a finite prime field. Empirical experiment results indicate that our\u0000algorithm could be more than a 30-fold increase in computing speed than the\u0000index calculus algorithm when the bit length of the order of prime field is 70\u0000bits. In addition, our algorithm is more general than the index calculus\u0000algorithm. Specifically, when the base of the target discrete logarithm problem\u0000is not the multiplication generator, the index calculus algorithm may fail to\u0000solve the discrete logarithm problem while our algorithm still can work.","PeriodicalId":501332,"journal":{"name":"arXiv - CS - Cryptography and Security","volume":"18 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-09-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142261586","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

National Treasure: The Call for e-Democracy and US Election Security 国宝：呼吁电子民主和美国选举安全

arXiv - CS - Cryptography and Security Pub Date : 2024-09-13 DOI: arxiv-2409.08952

Adam Dorian Wong

{"title":"National Treasure: The Call for e-Democracy and US Election Security","authors":"Adam Dorian Wong","doi":"arxiv-2409.08952","DOIUrl":"https://doi.org/arxiv-2409.08952","url":null,"abstract":"Faith in the US electoral system is at risk. This issue stems from trust or\u0000lack thereof. Poor leaders ranted and attempted to sew discord in the\u0000democratic process and even tried to influence election results. Historically,\u0000the US has relied on paper ballots to cast private votes. Votes are watered\u0000down by the Electoral College. Elections are contested due to voter IDs and\u0000proof of citizenship. Methods of voting are nonsensically complex. In the\u0000technology age, this can be solved with a Smartcard National ID backed by\u0000Public-Key Infrastructure (PKI). This could be a method to restore hope in\u0000democracy and move the country back towards elections under a Popular Vote.\u0000Numbers are empirical and immutable and can solve the issue of Election\u0000Security in a bipartisan way. NATO allies like Estonia have already broken\u0000ground in using technology for eDemocracy or (Internet-based) iVoting.\u0000Acknowledging cyber attacks will happen, this is an opportunity for DHS and DOD\u0000(CYBERCOM) to collaborate on domestic operations and protect critical election\u0000infrastructure. This idea will not fix malicious information operations or\u0000civil stupidity. However, this is the way forward to securing elections now and\u0000forever. The views expressed by this whitepaper are those of the author and do\u0000not reflect the official policy or position of Dakota State University, the\u0000N.H. Army National Guard, the U.S. Army, the Department of Defense, or the U.S.\u0000Government. Cleared for release by DOPSR on 13 SEP 2024.","PeriodicalId":501332,"journal":{"name":"arXiv - CS - Cryptography and Security","volume":"47 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-09-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142261587","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Cybersecurity Software Tool Evaluation Using a 'Perfect' Network Model 使用 "完美 "网络模型评估网络安全软件工具

arXiv - CS - Cryptography and Security Pub Date : 2024-09-13 DOI: arxiv-2409.09175

Jeremy Straub

引用次数: 0

A Toolchain for Assisting Migration of Software Executables Towards Post-Quantum Crytography 协助软件可执行文件向后量子加密技术迁移的工具链

arXiv - CS - Cryptography and Security Pub Date : 2024-09-12 DOI: arxiv-2409.07852

Norrathep Rattanavipanon, Jakapan Suaboot, Warodom Werapun

{"title":"A Toolchain for Assisting Migration of Software Executables Towards Post-Quantum Crytography","authors":"Norrathep Rattanavipanon, Jakapan Suaboot, Warodom Werapun","doi":"arxiv-2409.07852","DOIUrl":"https://doi.org/arxiv-2409.07852","url":null,"abstract":"Quantum computing poses a significant global threat to today's security\u0000mechanisms. As a result, security experts and public sectors have issued\u0000guidelines to help organizations migrate their software to post-quantum\u0000cryptography (PQC). Despite these efforts, there is a lack of (semi-)automatic\u0000tools to support this transition especially when software is used and deployed\u0000as binary executables. To address this gap, in this work, we first propose a\u0000set of requirements necessary for a tool to detect quantum-vulnerable software\u0000executables. Following these requirements, we introduce QED: a toolchain for\u0000Quantum-vulnerable Executable Detection. QED uses a three-phase approach to\u0000identify quantum-vulnerable dependencies in a given set of executables, from\u0000file-level to API-level, and finally, precise identification of a static trace\u0000that triggers a quantum-vulnerable API. We evaluate QED on both a synthetic\u0000dataset with four cryptography libraries and a real-world dataset with over 200\u0000software executables. The results demonstrate that: (1) QED discerns\u0000quantum-vulnerable from quantum-safe executables with 100% accuracy in the\u0000synthetic dataset; (2) QED is practical and scalable, completing analyses on\u0000average in less than 4 seconds per real-world executable; and (3) QED reduces\u0000the manual workload required by analysts to identify quantum-vulnerable\u0000executables in the real-world dataset by more than 90%. We hope that QED can\u0000become a crucial tool to facilitate the transition to PQC, particularly for\u0000small and medium-sized businesses with limited resources.","PeriodicalId":501332,"journal":{"name":"arXiv - CS - Cryptography and Security","volume":"8 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-09-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142201643","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Tweezers: A Framework for Security Event Detection via Event Attribution-centric Tweet Embedding 镊子：通过以事件归属为中心的推特嵌入进行安全事件检测的框架

arXiv - CS - Cryptography and Security Pub Date : 2024-09-12 DOI: arxiv-2409.08221

Jian Cui, Hanna Kim, Eugene Jang, Dayeon Yim, Kicheol Kim, Yongjae Lee, Jin-Woo Chung, Seungwon Shin, Xiaojing Liao

{"title":"Tweezers: A Framework for Security Event Detection via Event Attribution-centric Tweet Embedding","authors":"Jian Cui, Hanna Kim, Eugene Jang, Dayeon Yim, Kicheol Kim, Yongjae Lee, Jin-Woo Chung, Seungwon Shin, Xiaojing Liao","doi":"arxiv-2409.08221","DOIUrl":"https://doi.org/arxiv-2409.08221","url":null,"abstract":"Twitter is recognized as a crucial platform for the dissemination and\u0000gathering of Cyber Threat Intelligence (CTI). Its capability to provide\u0000real-time, actionable intelligence makes it an indispensable tool for detecting\u0000security events, helping security professionals cope with ever-growing threats.\u0000However, the large volume of tweets and inherent noises of human-crafted tweets\u0000pose significant challenges in accurately identifying security events. While\u0000many studies tried to filter out event-related tweets based on keywords, they\u0000are not effective due to their limitation in understanding the semantics of\u0000tweets. Another challenge in security event detection from Twitter is the\u0000comprehensive coverage of security events. Previous studies emphasized the\u0000importance of early detection of security events, but they overlooked the\u0000importance of event coverage. To cope with these challenges, in our study, we\u0000introduce a novel event attribution-centric tweet embedding method to enable\u0000the high precision and coverage of events. Our experiment result shows that the\u0000proposed method outperforms existing text and graph-based tweet embedding\u0000methods in identifying security events. Leveraging this novel embedding\u0000approach, we have developed and implemented a framework, Tweezers, that is\u0000applicable to security event detection from Twitter for CTI gathering. This\u0000framework has demonstrated its effectiveness, detecting twice as many events\u0000compared to established baselines. Additionally, we have showcased two\u0000applications, built on Tweezers for the integration and inspection of security\u0000events, i.e., security event trend analysis and informative security user\u0000identification.","PeriodicalId":501332,"journal":{"name":"arXiv - CS - Cryptography and Security","volume":"19 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-09-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142201618","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Automated Cybersecurity Compliance and Threat Response Using AI, Blockchain & Smart Contracts 利用人工智能、区块链和智能合约实现网络安全合规性和威胁响应自动化

arXiv - CS - Cryptography and Security Pub Date : 2024-09-12 DOI: arxiv-2409.08390

Lampis Alevizos, Vinh Thong Ta

{"title":"Automated Cybersecurity Compliance and Threat Response Using AI, Blockchain & Smart Contracts","authors":"Lampis Alevizos, Vinh Thong Ta","doi":"arxiv-2409.08390","DOIUrl":"https://doi.org/arxiv-2409.08390","url":null,"abstract":"To address the challenges of internal security policy compliance and dynamic\u0000threat response in organizations, we present a novel framework that integrates\u0000artificial intelligence (AI), blockchain, and smart contracts. We propose a\u0000system that automates the enforcement of security policies, reducing manual\u0000effort and potential human error. Utilizing AI, we can analyse cyber threat\u0000intelligence rapidly, identify non-compliances and automatically adjust cyber\u0000defence mechanisms. Blockchain technology provides an immutable ledger for\u0000transparent logging of compliance actions, while smart contracts ensure uniform\u0000application of security measures. The framework's effectiveness is demonstrated\u0000through simulations, showing improvements in compliance enforcement rates and\u0000response times compared to traditional methods. Ultimately, our approach\u0000provides for a scalable solution for managing complex security policies,\u0000reducing costs and enhancing the efficiency while achieving compliance.\u0000Finally, we discuss practical implications and propose future research\u0000directions to further refine the system and address implementation challenges.","PeriodicalId":501332,"journal":{"name":"arXiv - CS - Cryptography and Security","volume":"94 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-09-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142261619","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Unleashing Worms and Extracting Data: Escalating the Outcome of Attacks against RAG-based Inference in Scale and Severity Using Jailbreaking 释放蠕虫和提取数据：利用 "越狱 "技术扩大对基于 RAG 推断的攻击结果的规模和严重程度

arXiv - CS - Cryptography and Security Pub Date : 2024-09-12 DOI: arxiv-2409.08045

Stav Cohen, Ron Bitton, Ben Nassi

{"title":"Unleashing Worms and Extracting Data: Escalating the Outcome of Attacks against RAG-based Inference in Scale and Severity Using Jailbreaking","authors":"Stav Cohen, Ron Bitton, Ben Nassi","doi":"arxiv-2409.08045","DOIUrl":"https://doi.org/arxiv-2409.08045","url":null,"abstract":"In this paper, we show that with the ability to jailbreak a GenAI model,\u0000attackers can escalate the outcome of attacks against RAG-based GenAI-powered\u0000applications in severity and scale. In the first part of the paper, we show\u0000that attackers can escalate RAG membership inference attacks and RAG entity\u0000extraction attacks to RAG documents extraction attacks, forcing a more severe\u0000outcome compared to existing attacks. We evaluate the results obtained from\u0000three extraction methods, the influence of the type and the size of five\u0000embeddings algorithms employed, the size of the provided context, and the GenAI\u0000engine. We show that attackers can extract 80%-99.8% of the data stored in the\u0000database used by the RAG of a Q&A chatbot. In the second part of the paper, we\u0000show that attackers can escalate the scale of RAG data poisoning attacks from\u0000compromising a single GenAI-powered application to compromising the entire\u0000GenAI ecosystem, forcing a greater scale of damage. This is done by crafting an\u0000adversarial self-replicating prompt that triggers a chain reaction of a\u0000computer worm within the ecosystem and forces each affected application to\u0000perform a malicious activity and compromise the RAG of additional applications.\u0000We evaluate the performance of the worm in creating a chain of confidential\u0000data extraction about users within a GenAI ecosystem of GenAI-powered email\u0000assistants and analyze how the performance of the worm is affected by the size\u0000of the context, the adversarial self-replicating prompt used, the type and size\u0000of the embeddings algorithm employed, and the number of hops in the\u0000propagation. Finally, we review and analyze guardrails to protect RAG-based\u0000inference and discuss the tradeoffs.","PeriodicalId":501332,"journal":{"name":"arXiv - CS - Cryptography and Security","volume":"5 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-09-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142201621","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Securing Large Language Models: Addressing Bias, Misinformation, and Prompt Attacks 确保大型语言模型的安全：应对偏见、错误信息和提示性攻击

arXiv - CS - Cryptography and Security Pub Date : 2024-09-12 DOI: arxiv-2409.08087

Benji Peng, Keyu Chen, Ming Li, Pohsun Feng, Ziqian Bi, Junyu Liu, Qian Niu

{"title":"Securing Large Language Models: Addressing Bias, Misinformation, and Prompt Attacks","authors":"Benji Peng, Keyu Chen, Ming Li, Pohsun Feng, Ziqian Bi, Junyu Liu, Qian Niu","doi":"arxiv-2409.08087","DOIUrl":"https://doi.org/arxiv-2409.08087","url":null,"abstract":"Large Language Models (LLMs) demonstrate impressive capabilities across\u0000various fields, yet their increasing use raises critical security concerns.\u0000This article reviews recent literature addressing key issues in LLM security,\u0000with a focus on accuracy, bias, content detection, and vulnerability to\u0000attacks. Issues related to inaccurate or misleading outputs from LLMs is\u0000discussed, with emphasis on the implementation from fact-checking methodologies\u0000to enhance response reliability. Inherent biases within LLMs are critically\u0000examined through diverse evaluation techniques, including controlled input\u0000studies and red teaming exercises. A comprehensive analysis of bias mitigation\u0000strategies is presented, including approaches from pre-processing interventions\u0000to in-training adjustments and post-processing refinements. The article also\u0000probes the complexity of distinguishing LLM-generated content from\u0000human-produced text, introducing detection mechanisms like DetectGPT and\u0000watermarking techniques while noting the limitations of machine learning\u0000enabled classifiers under intricate circumstances. Moreover, LLM\u0000vulnerabilities, including jailbreak attacks and prompt injection exploits, are\u0000analyzed by looking into different case studies and large-scale competitions\u0000like HackAPrompt. This review is concluded by retrospecting defense mechanisms\u0000to safeguard LLMs, accentuating the need for more extensive research into the\u0000LLM security field.","PeriodicalId":501332,"journal":{"name":"arXiv - CS - Cryptography and Security","volume":"31 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-09-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142201617","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

LOCKEY: A Novel Approach to Model Authentication and Deepfake Tracking LOCKEY：模型认证和深度伪造追踪的新方法

arXiv - CS - Cryptography and Security Pub Date : 2024-09-12 DOI: arxiv-2409.07743

Mayank Kumar Singh, Naoya Takahashi, Wei-Hsiang Liao, Yuki Mitsufuji

引用次数: 0

A Secure Standard for NFT Fractionalization NFT 小数化安全标准

arXiv - CS - Cryptography and Security Pub Date : 2024-09-12 DOI: arxiv-2409.08190

Wejdene Haouari, Marios Fokaefs

引用次数: 0