NDLI: On the soundness of authenticate-then-encrypt: formalizing the malleability of symmetric encryption

Please wait, while we are loading the content...

Security analysis of India's electronic voting machines

HyperSentry: enabling stealthy in-context measurement of hypervisor integrity

A methodology for empirical analysis of permission-based security models and its application to android

Building efficient fully collusion-resilient traitor tracing and revocation schemes

Testing metrics for password creation policies by attacking large sets of revealed passwords

Robusta: taming the native beast of the JVM

Modeling attacks on physical unclonable functions

An empirical study of privacy-violating information flows in JavaScript web applications

In search of an anonymous and secure lookup: attacks on structured peer-to-peer anonymous communication systems

Abstraction by set-membership: verifying security protocols and web services with databases

AccessMiner: using system-centric models for malware protection

TASTY: tool for automating secure two-party computations

On the (in)security of IPsec in MAC-then-encrypt configurations

Mimimorphism: a new approach to binary code obfuscation

Symbolic security analysis of ruby-on-rails web applications

A privacy recommendation wizard for users of social networking sites

Enhancing resilience of probabilistic key pre-distribution schemes for WSNs through hash chaining

Dissecting one click frauds

Trail of bytes: efficient support for forensic analysis

Mobile location tracking in metro areas: malnets and others

Algebraic pseudorandom functions with improved efficiency from the augmented cascade

The security of modern password expiration: an algorithmic framework and empirical analysis

Retaining sandbox containment despite bugs in privileged memory-safe code

Dismantling SecureMemory, CryptoMemory and CryptoRF

DIFC programs by automatic instrumentation

Recruiting new tor relays with BRAIDS

Developing security protocols by refinement

Input generation via decomposition and re-stitching: finding bugs in Malware

Worry-free encryption: functional encryption with public keys

On the soundness of authenticate-then-encrypt: formalizing the malleability of symmetric encryption

Platform-independent programs

Sidebuster: automated detection and quantification of side-channel leaks in web application development

SecTag: a multi-policy supported secure web tag framework

TAPS: automatically preparing safe SQL queries

@spam: the underground on 140 characters or less

Survivable key compromise in software update systems

On pairing constrained wireless devices based on secrecy of auxiliary channels: the case of acoustic eavesdropping

Practical leakage-resilient pseudorandom generators

Attacks and design of image recognition CAPTCHAs

A control point for reducing root abuse of file-system privileges

Attacking and fixing PKCS#11 security tokens

Predictive black-box mitigation of timing channels

An improved algorithm for tor circuit scheduling

Computational indistinguishability logic

Inference and analysis of formal models of botnet command and control protocols

Synchronized aggregate signatures: new definitions, constructions and applications

A new framework for efficient password-based authenticated key exchange

Return-oriented programming without returns

NoTamper: automatic blackbox detection of parameter tampering opportunities in web applications

Demonstrating cognitive packet network resilience to worm attacks

XACML policy performance evaluation using a flexible load testing framework

PinDr0p: using single-ended audio features to determine call provenance

Practical leakage-resilient identity-based encryption from simple assumptions

Dissent: accountable anonymous group messaging

Computationally sound verification of source code

BLADE: an attack-agnostic approach for preventing drive-by malware infections

Secure text processing with applications to private DNA matching

Accountability: definition and relationship to verifiability

DieHarder: securing the heap

Protecting browsers from cross-origin CSS attacks

In God we trust all others we monitor

Protecting portable storage with host validation

Virtual browser: a web-level sandbox to secure third-party JavaScript without sacrificing functionality

CardSpace in the cloud

Secure latency estimation with treeple

TEE: a virtual DRTM based execution environment for secure cloud-end computing

Laptop theft: a case study on the effectiveness of security mechanisms in open organizations

Information security for sensors by overwhelming random sequences and permutations

On verifying stateful dataflow processing services in large-scale cloud systems

Assessing trust in uncertain information using Bayesian description logic

Timing attacks on PIN input devices

Detecting and characterizing social spam campaigns

Fingerprinting websites using remote traffic analysis

Efficient sensor node authentication via 3GPP mobile communication networks

Rendezvous tunnel for anonymous publishing

Exploiting social networking sites for spam

An implementation of event and filter confidentiality in pub/sub systems and its application to e-health

Privacy and robustness for data aggregation in wireless sensor networks

Designing router scheduling policies: a privacy perspective

CRAFT: a new secure congestion control architecture

Dialog-based payload aggregation for intrusion detection

Protecting location privacy against inference attacks

Designs to account for trust in social network-based sybil defenses

Secure encounter-based social networks: requirements, challenges, and designs

Secure online banking on untrusted computers

iFriendU: leveraging 3-cliques to enhance infiltration attacks in online social networks

Losing control of the internet: using the data plane to attack the control plane

Size-based scheduling: a recipe for DDOS?

User-friendly matching protocol for online social networks

Hierarchical attribute-based encryption for fine-grained access control in cloud storage services

Secure dynamic code generation against spraying

Ad hoc broadcast encryption

Dynamic window based multihop authentication for WSN

Spectrum based fraud detection in social networks

A portable TPM based on USB key

On efficient ciphertext-policy attribute based encryption and broadcast encryption: extended abstract

Efficient provable data possession for hybrid clouds

A cloud based SIM DRM scheme for the mobile internet

On the soundness of authenticate-then-encrypt: formalizing the malleability of symmetric encryption

Content Provider	ACM Digital Library
Author	Tackmann, Bj örn Maurer, Ueli
Abstract	A communication channel from an honest sender A to an honest receiver B can be described as a system with three interfaces labeled A, B, and E (the adversary), respectively, where the security properties of the channel are characterized by the capabilities provided at the E-interface. A security mechanism, such as encryption or a message authentication code (MAC), can be seen as the transformation of a certain type of channel into a stronger type of channel, where the term "transformation" refers to a natural simulation-based definition. For example, the main purpose of a MAC can be regarded as transforming an insecure into an authenticated channel, and encryption then corresponds to transforming an authenticated into a fully secure channel; this is the well-known Encrypt-then-Authenticate (EtA) paradigm. In the dual paradigm, Authenticate-then-Encrypt (AtE), encryption first transforms an insecure into a confidential channel, and a MAC transforms this into a secure channel. As pointed out by Bellare and Namprempre, and Krawczyk, there are encryption schemes for which AtE does not achieve the expected guarantees. We highlight two reasons for investigating nevertheless AtE as a general paradigm: First, this calls for a definition of confidentiality; what separates a confidential from a secure channel is its (potential) malleability. We propose the first systematic analysis of malleability for symmetric encryption, which, in particular, allows us to state a generic condition on encryption schemes to be sufficient for AtE. Second, AtE is used in practice, for example in TLS. We show that the schemes used in TLS (stream ciphers and CBC encryption) satisfy the condition. This is consistent with Krawczyk's results on similar instantiations of AtE in game-based models.
Starting Page	505
Ending Page	515
Page Count	11
File Format	PDF
ISBN	9781450302456
DOI	10.1145/1866307.1866364
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2010-10-04
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Authenticate-then-encrypt Composition Constructive cryptography Tls Secure communication Simulation-based security
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in