Search CSRC

Conference: 19th European Symposium on Research in Computer Security (ESORICS 2014) Abstract: The interest in diversity as a security mechanism has recently been revived in various applications, such as Moving Target Defense (MTD), resisting worms in sensor networks, and improving the robustness of network routing. However, most existing efforts on formally modeling diversity have focused on...

Conference: Second International Conference on Human Aspects of Information Security, Privacy, and Trust (HAS 2014) Abstract: Many users must authenticate to multiple systems and applications, often using different passwords, on a daily basis. At the same time, the recommendations of security experts are driving increases in the required character length and complexity of passwords. The thinking is that longer passwords wi...

Conference: 6th International Conference Cross-Cultural Design (CCD 2014) Abstract: Institutions often require or recommend that their employees use secure, system-generated passwords. It is not clear how well linguistic and phonological language properties map onto complex, randomly-generated passwords. Passwords containing a mix of letters, numbers, and other symbol characters ma...

Conference: Second International Conference on Human Aspects of Information Security, Privacy, and Trust (HAS 2014) Abstract: Given the numerous constraints of onscreen keyboards, such as smaller keys and lack of tactile feedback, remembering and typing long, complex passwords—an already burdensome task on desktop computing systems—becomes nearly unbearable on small mobile touchscreens. Complex passwords require numerous s...

Conference: 8th International Conference on Algorithms and Complexity (CIAC 2013) Abstract: Cryptographic applications, such as hashing, block ciphers and stream ciphers, make use of functions which are simple by some criteria (such as circuit implementations), yet hard to invert almost everywhere. A necessary condition for the latter property is to be "sufficiently distant" from linear, a...

Conference: IEEE International Workshop on Information Forensics and Security 2012 (WIFS 2012) Abstract: Attack graphs compute potential attack paths from a system configuration and known vulnerabilities of a system. Evidence graphs model intrusion evidence and dependencies among them for forensic analysis. In this paper, we show how to map evidence graphs to attack graphs. This mapping is useful for a...

Conference: Third Workshop on Mathematical Cryptology (WMC 2012) Abstract: Many new systems have been proposed which hide an easily invertible multivariate quadratic map in a larger structure by adding more variables and introducing some mixing of a random component to the structured system. While many systems which have been formed by attempting to hide the hidden structu...

Conference: Sixth International Conference on Digital Society (ICDS 2012) Abstract: Smart cards are now being extensively deployed for identity verification(smart identity tokens) for controlling access to Information Technology (IT) as well as physical resources. Depending upon the sensitivity of the resources and the risk of wrong identification, different authentication uses are...

Conference: 5th International Conference on Information Security and Cryptology (Inscrypt 2009) Abstract: ESSENCE is a family of cryptographic hash functions, accepted to the first round of NIST’s SHA-3 competition. This paper presents the first known attacks on ESSENCE. We present a semi-free-start collision attack on 31 out of 32 rounds of ESSENCE-512, invalidating the design claim that at least 24 ro...

In: Towards Trustworthy Elections: New Directions in Electronic Voting Abstract: In this paper, we develop methods for constructing vote-buying/coercion attacks on end-to-end voting systems, and describe vote-buying/coercion attacks on three proposed end-to-end voting systems: Punchscan, Pret-a-voter, and ThreeBallot. We also demonstrate a different attack on Punchscan, which co...

Conference: 16th International Workshop, Selected Areas in Cryptography (SAC 2009) Abstract: In this paper we present new attack techniques to analyze the structure of hash functions that are not based on the classical Merkle-Damgard construction. We extend the herding attack to concatenated hashes, and to certain hash functions that process each message block several times. Using this tech...

Conference: 16th International Workshop, Fast Software Encryption (FSE 2009) Abstract: The CBC-MAC, or cipher block chaining message authentication code, is a well-known method to generate message authentication codes. Unfortunately, it is not forgery-secure over an arbitrary domain. There are several secure variants of CBC-MAC, among which OMAC (or one-key CBC-MAC) is a widely-used c...

Conference: 33rd International Symposium, MFCS 2008 Abstract: We study the complexity of the Shortest Linear Program (SLP) problem, which is to the number of linear operations necessary to compute a set of linear forms. SLP is shown to be NP-hard. Furthermore, a special case of the corresponding decision problem is shown to be Max SNP-Complete. Algorithms prod...

In: The Analysis, Communication, and Perception of Risk Abstract: For the past few years, the National Institute of Standards and Technology (NIST; formerly the National Bureau of Standards) and the National Security Agency (NSA) have been jointly developing a framework for computer security risk management. The need for this framework became increasingly apparent...