NDLI: System-level Non-interference for Constant-time Cryptography

Please wait, while we are loading the content...

Founding Digital Currency on Secure Computation

Code Reuse Attacks in PHP: Automated POP Chain Generation

Rosemary: A Robust, Secure, and High-performance Network Operating System

Private-by-Design Advertising Meets the Real World

DeTrust: Defeating Hardware Trust Verification with Stealthy Implicitly-Triggered Hardware Trojans

SCORAM: Oblivious RAM for Secure Computation

A Systematic Approach to Developing and Evaluating Website Fingerprinting Defenses

Optimal Average-Complexity Ideal-Security Order-Preserving Encryption

Routing Bottlenecks in the Internet: Causes, Exploits, and Countermeasures

Multi-Ciphersuite Security of the Secure Shell (SSH) Protocol

Watching the Watchers: Automatically Inferring TV Content From Outdoor Light Effusions

Dialing Back Abuse on Phone Verified Accounts

(Nothing else) MATor(s): Monitoring the Anonymity of Tor's Path Selection

Breaking Integrated Circuit Device Security through Test Mode Silicon Reverse Engineering

Reuse It Or Lose It: More Efficient Secure Computation Through Reuse of Encrypted Values

Detection of On-Road Vehicles Emanating GPS Interference

Optimizing Obfuscation: Avoiding Barrington's Theorem

The Web Never Forgets: Persistent Tracking Mechanisms in the Wild

Exciting Security Research Opportunity: Next-generation Internet

Security Analysis of the Estonian Internet Voting System

Increasing Security Sensitivity With Social Proof: A Large-Scale Experimental Confirmation

Vulnerability and Protection of Channel State Information in Multiuser MIMO Networks

Taking Authenticated Range Queries to Arbitrary Dimensions

Wiretapping via Mimicry: Short Voice Imitation Man-in-the-Middle Attacks on Crypto Phones

Clubbing Seals: Exploring the Ecosystem of Third-party Security Seals

Quantifying Web-Search Privacy

Characterization of Real-Life PRNGs under Partial State Corruption

Structural Data De-anonymization: Quantification, Practice, and Implications

Automating Information Flow Analysis of Low Level Code

Semantics-Aware Android Malware Classification Using Weighted Contextual API Dependency Graphs

PixelVault: Using GPUs for Securing Cryptographic Operations

Privacy Beyond Confidentiality

Fail-Secure Access Control

Multi-Stage Key Exchange and the Case of Google's QUIC Protocol

S3: A Symbolic String Solver for Vulnerability Detection in Web Applications

System-level Non-interference for Constant-time Cryptography

RockJIT: Securing Just-In-Time Compilation Using Modular Control-Flow Integrity

A Tale of Two Kernels: Towards Ending Kernel Hardening Wars with Split Kernel

POSTER: When and How to Implicitly Authenticate Smartphone Users

Integrity, Consistency, and Verification of Remote Computation

Summary Abstract for the 7th ACM International Workshop on Cyber Security Analytics, Intelligence and Automation

Deanonymisation of Clients in Bitcoin P2P Network

Information Leaks Without Memory Disclosures: Remote Side Channel Attacks on Diversified Code

Hypervision Across Worlds: Real-time Kernel Protection from the ARM TrustZone Secure World

Your Online Interests: Pwned! A Pollution Attack Against Targeted Advertising

ATRA: Address Translation Redirection Attack against Hardware-based External Monitors

Toward Robust Hidden Volumes Using Write-Only Oblivious RAM

Location Privacy Protection for Smartphone Users

A New Additive Homomorphic Encryption based on the co-ACD Problem

VoIP Fraud: Identifying a Wolf in Sheep's Clothing

ARPKI: Attack Resilient Public-Key Infrastructure

Acoustic Fingerprinting Revisited: Generate Stable Device ID Stealthily with Inaudible Sound

Uncovering Large Groups of Active Malicious Accounts in Online Social Networks

Deniable Liaisons

ARMlock: Hardware-based Fault Isolation for ARM

Practical UC security with a Global Random Oracle

On The Security of Mobile Cockpit Information Systems

Fully Secure and Fast Signing from Obfuscation

MACE: Detecting Privilege Escalation Vulnerabilities in Web Applications

Harvesting High Value Foreign Currency Transactions from EMV Contactless Credit Cards Without the PIN

Are You Ready to Lock?

Blind Transmitter Authentication for Spectrum Security and Enforcement

Outsourced Proofs of Retrievability

Context-Based Zero-Interaction Pairing and Key Evolution for Advanced Personal Devices

A Nearly Four-Year Longitudinal Study of Search-Engine Poisoning

Mayhem in the Push Clouds: Understanding and Mitigating Security Hazards in Mobile Push-Messaging Services

Synthesis of Fault Attacks on Cryptographic Implementations

RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Response

Collaborative Verification of Information Flow for a High-Assurance App Store

An Epidemiological Study of Malware Encounters in a Large Enterprise

Hey, NSA: Stay Away from my Market! Future Proofing App Markets against Powerful Attackers

World-Driven Access Control for Continuous Sensing

Algebraic MACs and Keyed-Verification Anonymous Credentials

ClickMiner: Towards Forensic Reconstruction of User-Browser Interactions from Network Traces

Controlled Functional Encryption

Amandroid: A Precise and General Inter-component Data Flow Analysis Framework for Security Vetting of Android Apps

Beyond Pattern Matching: A Concurrency Model for Stateful Deep Packet Inspection

POSTER: Password Entering and Transmission Security

Tutorial: Text Analytics for Security

WPES 2014: 13th Workshop on Privacy in the Electronic Society

How to Use Bitcoin to Incentivize Correct Computations

Code Injection Attacks on HTML5-based Mobile Apps: Characterization, Detection and Mitigation

A11y Attacks: Exploiting Accessibility in Operating Systems

Characterizing Large-Scale Click Fraud in ZeroAccess

AUTOPROBE: Towards Automatic Active Malicious Server Probing Using Dynamic Binary Analysis

Oblivious Data Structures

Optimal Geo-Indistinguishable Mechanisms for Location Privacy

Verifying Curve25519 Software

Mechanized Network Origin and Path Authenticity Proofs

Securing SSL Certificate Verification through Dynamic Linking

Do You Hear What I Hear?: Fingerprinting Smart Devices Through Embedded Acoustic Components

Consequences of Connectivity: Characterizing Account Hijacking on Twitter

Community-Enhanced De-anonymization of Online Social Networks

The Last Mile: An Empirical Study of Timing Channels on seL4

A Computationally Complete Symbolic Attacker for Equivalence Properties

Real Threats to Your Data Bills: Security Loopholes and Defenses in Mobile Data Charging

ALETHEIA: Improving the Usability of Static Security Analysis

RevCast: Fast, Private Certificate Revocation over FM Radio

Efficiently Verifiable Computation on Encrypted Data

OAuth Demystified for Mobile Application Developers

From Patches to Honey-Patches: Lightweight Attacker Misdirection, Deception, and Disinformation

Cross-Tenant Side-Channel Attacks in PaaS Clouds

ShadowCrypt: Encrypted Web Applications for Everyone

PrivEx: Private Collection of Traffic Statistics for Anonymous Communication Networks

Decide Now or Decide Later?: Quantifying the Tradeoff between Prospective and Retrospective Access Decisions

Security Analyses of Click-based Graphical Passwords via Image Point Memorability

Moving Targets: Security and Rapid-Release in Firefox

Formatted Encryption Beyond Regular Languages

You Can Run but You Can't Read: Preventing Disclosure Exploits in Executable Code

The UNIX Process Identity Crisis: A Standards-Driven Approach to Setuid

POSTER: A Hybrid Botnet Ecological Environment

Client-Controlled Cloud Encryption

Fourth International Workshop on Trustworthy Embedded Devices (TrustED 2014)

A Critical Evaluation of Website Fingerprinting Attacks

Searchable Encryption with Secure and Efficient Updates

Security Vulnerability in Processor-Interconnect Router Design

PoliCert: Secure and Flexible TLS Certificate Management

Context-free Attacks Using Keyboard Acoustic Emanations

Faces in the Distorting Mirror: Revisiting Photo-based Social Authentication

ALITHEIA: Towards Practical Verifiable Graph Processing

Beware, Your Hands Reveal Your Secrets!

A Threat for Tablet PCs in Public Space: Remote Visualization of Screen Images Using EM Emanation

VerSum: Verifiable Computations over Large Public Logs

AutoCog: Measuring the Description-to-permission Fidelity in Android Applications

Blind Recognition of Touched Keys on Mobile Devices

POSTER: Analysis and Comparison of Secure Localization Schemes for Intelligent Transportation Systems

MTD 2014: First ACM Workshop on Moving Target Defense

POSTER: Positioning Attack on Proximity-Based People Discovery

WISCS 2014: The First ACM Workshop on Information Sharing & Collaborative Security

POSTER: Euclidean Distance Based Encryption: How to Embed Fuzziness in Biometric Based Encryption

SIW 2014: First Workshop on Security Information Workers

POSTER: Seven Years in MWS: Experiences of Sharing Datasets with Anti-malware Research Community in Japan

Workshop Summary of AISec'14: 2014 Workshop on Artificial Intelligent and Security

POSTER: Scanning-free Personalized Malware Warning System by Learning Implicit Feedback from Detection Logs

Second Smart Energy Grid Security Workshop (SEGS 2014)

POSTER: Compromising Cloaking-based Location Privacy Preserving Mechanisms with Location Injection Attacks

CCS'14 Co-Located Workshop Summary for SPSM 2014

POSTER: Security Control System Enabling to Keep an Intra-LAN in a Secure State Using Security-and-Performance Ratio Control Policies

CCSW 2014: Sixth ACM Cloud Computing Security Workshop

POSTER: Enhancing Security and Privacy with Google Glass

POSTER: Proactive Blacklist Update for Anti-Phishing

POSTER: Abusing URL Shortening Services for Stealthy and Resilient Message Transmitting

POSTER: A Lightweight Unknown HTTP Botnets Detecting and Characterizing System

POSTER: Arranging the Layout of Alphanumeric Buttons--the Role of Passwords

POSTER: Using Chinese Characters for Authentication--Algorithmic Framework and Empirical Results

POSTER: Study of Software Plugin-based Malware

POSTER: TraceVirt: A Framework for Detecting the Non-tampering Attacks in the Virtual Machine

POSTER: Fingerprinting the Publicly Available Sandboxes

POSTER: Recommendation-based Third-Party Tracking Monitor to Balance Privacy with Personalization

POSTER: A Proactive Cloud-Based Cross-Reference Forensic Framework

POSTER: Blind Separation of Benign and Malicious Events to Enable Accurate Malware Family Classification

Demo Overview: Privacy-Enhancing Features of IdentiDroid

POSTER: Android System Broadcast Actions Broadcasts Your Privacy

POSTER: TLS Proxies: Friend or Foe?

POSTER: Efficient Ciphertext Policy Attribute Based Encryption Under Decisional Linear Assumption

POSTER: Protecting Against Data Exfiltration Insider Attacks Through Application Programs

POSTER: Misuseablity Analysis for IT Infrastructure

POSTER: On the Resilience of DNS Infrastructure

POSTER: Quasi-ID: In fact, I am a human

POSTER: A Measurement Framework to Quantify Software Protections

POSTER: Analyzing Access Control Policies with SMT

POSTER: How Distributed Are Today's DDoS Attacks?

POSTER: AdHoneyDroid -- Capture Malicious Android Advertisements

POSTER: An E2E Trusted Cloud Infrastructure

POSTER: T-IP: A Self-Trustworthy and Secure Internet Protocol with Full Compliance to TCP/IP

POSTER: On the Capability of DNS Cache Poisoning Attacks

POSTER: LocMask: A Location Privacy Protection Framework in Android System

POSTER: UAFChecker: Scalable Static Detection of Use-After-Free Vulnerabilities

POSTER: Mining Elephant Applications in Unknown Traffic by Service Clustering

POSTER: Efficient Method for Disjunctive and Conjunctive Keyword Search over Encrypted Data

System-level Non-interference for Constant-time Cryptography

Content Provider	ACM Digital Library
Author	Luna, Carlos Betarte, Gustavo Campo, Juan Barthe, Gilles Pichardie, David
Abstract	Cache-based attacks are a class of side-channel attacks that are particularly effective in virtualized or cloud-based environments, where they have been used to recover secret keys from cryptographic implementations. One common approach to thwart cache-based attacks is to use constant-time implementations, i.e., which do not branch on secrets and do not perform memory accesses that depend on secrets. However, there is no rigorous proof that constant-time implementations are protected against concurrent cache-attacks in virtualization platforms with shared cache; moreover, many prominent implementations are not constant-time. An alternative approach is to rely on system-level mechanisms. One recent such mechanism is stealth memory, which provisions a small amount of private cache for programs to carry potentially leaking computations securely. Stealth memory induces a weak form of constant-time, called S-constant-time, which encompasses some widely used cryptographic implementations. However, there is no rigorous analysis of stealth memory and S-constant-time, and no tool support for checking if applications are S-constant-time. We propose a new information-flow analysis that checks if an x86 application executes in constant-time, or in S-constant-time. Moreover, we prove that constant-time (resp. S-constant-time) programs do not leak confidential information through the cache to other operating systems executing concurrently on virtualization platforms (resp. platforms supporting stealth memory). The soundness proofs are based on new theorems of independent interest, including isolation theorems for virtualization platforms (resp. platforms supporting stealth memory), and proofs that constant-time implementations (resp. S-constant-time implementations) are non-interfering with respect to a strict information flow policy which disallows that control flow and memory accesses depend on secrets. We formalize our results using the Coq proof assistant and we demonstrate the effectiveness of our analyses on cryptographic implementations, including PolarSSL AES, DES and RC4, SHA256 and Salsa20.
Starting Page	1267
Ending Page	1279
Page Count	13
File Format	PDF
ISBN	9781450329576
DOI	10.1145/2660267.2660283
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2014-11-03
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Non-interference Constant-time cryptography Coq Stealth memory Cache-based attacks
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in