58 results
Filters
Settings
Now showing1 - 10 of 58
- Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: with files , Secure and efficient hardware implementations of NTRU Prime(2025); Streamlined NTRU Prime is a cryptoscheme designed to minimize the risk of deploying a lattice-based KEM, while only incurring a low performance penalty. We investigate if this performance penalty also applies to hardware implementations and whether we can reduce any penalty with specialized hardware designs. For this, we present multiple full hardware implementations of Streamlined NTRU Prime, including high-speed, low-area and side-channel protected designs. Our results show that the design goals of Streamlined NTRU Prime are not a barrier to highly efficient hardware implementations, and that many design choices are in fact conducive to competitive implementations.Publicationtype: Doctoral Thesis91 76 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: with files , Investigations into social engineering evidence for security researchWhen technical protection mechanisms are too inflexible and security decisions are passed to users, users become part of the attack surface of a socio-technical system. This thesis contributes to the science of security regarding Social Engineering (SE), where users are the core enabler of successful attacks. Various sources were consulted to identify, analyse, and understand SE, enabling the development of a multidisciplinary knowledge base and appropriate safeguards. A suitable definition comprising five SE indicators was developed to examine anecdotes whether they express SE. Court documents (phishing), Lego modelling (cloud), and a novel SE poetry slam concept served as sources for in-depth analyses.Publicationtype: Book87 69 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: with files , Verifiable side-channel securityThe protection of cryptographic implementations against side-channel attacks is essential. Masking is a commonly used countermeasure but manifold pitfalls render this method insecure in practice. This doctoral thesis considers formal verification for qualitative assessments of physical side-channel resilience during development. We show that verification allows masking larger software implementations attaining security in practice at reduced overhead. The work contributes to formal modeling of physical leakage, the first approach to verify model completeness, security reductions and resilient post-quantum cryptography.Publicationtype: Doctoral Thesis57 312 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: without files , Combined fault and leakage resilience : composability, constructions and compiler(Springer, 2023-08-09); ; ; ; Real-world cryptographic implementations nowadays are not only attacked via classical cryptanalysis but also via implementation attacks, including passive attacks (observing side-channel information about the inner computation) and active attacks (inserting faults into the computation). While countermeasures exist for each type of attack, countermeasures against combined attacks have only been considered recently. Masking is a standard technique for protecting against passive side-channel attacks, but protecting against active attacks with additive masking is challenging. Previous approaches include running multiple copies of a masked computation, requiring a large amount of randomness or being vulnerable to horizontal attacks. An alternative approach is polynomial masking, which is inherently fault-resistant. This work presents a compiler based on polynomial masking that achieves linear computational complexity for affine functions and cubic complexity for non-linear functions. The resulting compiler is secure against attackers using region probes and adaptive faults. In addition, the notion of fault-invariance is introduced to improve security against combined attacks without the need to consider all possible fault combinations. Our approach has the best-known asymptotic efficiency among all known approaches.Publicationtype: Conference Paper19 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: with files , CIBA: continuous interruption-free brain authentication(2023); In contemporary EEG-based authentication schemes, data acquisition takes several minutes. During this time, the user typically needs to perform a certain task, e.g., focusing on a stimulus. We propose authentication schemes based on the well known brain responses SSVEP and ERP, and test the schemes using a consumer grade EEG headset. We conceptualize a continuous authentication scheme based on these brain responses using subliminal stimuli which would allow the users to focus on their regular work at a PC screen while being continuously authenticated.Publicationtype: Doctoral Thesis55 965 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: without files , Power Contracts: Provably Complete Power Leakage Models for ProcessorsThe protection of cryptographic software implementations against power-analysis attacks is critical for applications in embedded systems. A commonly used algorithmic countermeasure against these attacks is masking, a secret-sharing scheme that splits a sensitive computation into computations on multiple random shares. In practice, the security of masking schemes relies on several assumptions that are often violated by microarchitectural side-effects of CPUs. Many past works address this problem by studying these leakage effects and building corresponding leakage models that can then be integrated into a software verification workflow. However, these models have only been derived empirically, putting in question the otherwise rigorous security statements made with verification. We solve this problem in two steps. First, we introduce a contract layer between the (CPU) hardware and the software that allows the specification of microarchitectural side-effects on masked software in an intuitive language. Second, we present a method for proving the correspondence between contracts and CPU netlists to ensure the completeness of the specified leakage models. Then, any further security proofs only need to happen between software and contract, which brings benefits such as reduced verification runtime, improved user experience, and the possibility of working with vendor-supplied contracts of CPUs whose design is not available on netlist-level due to IP restrictions. We apply our approach to the popular RISC-V IBEX core, provide a corresponding formally verified contract, and describe how this contract could be used to verify masked software implementations.Publicationtype: Conference Paper21 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: without files , PCaaD: Towards automated determination and exploitation of industrial systemsOver the last decade, Programmable Logic Controllers (PLCs) have been increasingly targeted by attackers to obtain control over industrial processes that support critical services. Such targeted attacks typically require detailed knowledge of system-specific attributes, including hardware configurations, adopted protocols, and PLC control-logic, i.e., process comprehension. The consensus from both academics and practitioners suggests stealthy process comprehension obtained from a PLC alone, to execute targeted attacks, is impractical. In contrast, we assert that current PLC programming practices open the door to a new vulnerability class, affording attackers an increased level of process comprehension. To support this, we propose the concept of Process Comprehension at a Distance (PCaaD), as a novel methodological and automatable approach towards the system-agnostic identification of PLC library functions. This leads to the targeted exfiltration of operational data, manipulation of control-logic behavior, and establishment of covert command and control channels through unused memory. We validate PCaaD on widely used PLCs through its practical application.Publicationtype: Journal Article88 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: with files , Masking Kyber: first-and higher-order implementations(Ruhr-Universität Bochum, 2021-08-11); ; ; ; In the final phase of the post-quantum cryptography standardization effort, the focus has been extended to include the side-channel resistance of the candidates. While some schemes have been already extensively analyzed in this regard, there is no such study yet of the finalist Kyber. In this work, we demonstrate the first completely masked implementation of Kyber which is protected against first-and higher-order attacks. To the best of our knowledge, this results in the first higher-order masked implementation of any post-quantum secure key encapsulation mechanism algorithm. This is realized by introducing two new techniques. First, we propose a higher-order algorithm for the one-bit compression operation. This is based on a masked bit-sliced binary-search that can be applied to prime moduli. Second, we propose a technique which enables one to compare uncompressed masked polynomials with compressed public polynomials. This avoids the costly masking of the ciphertext compression while being able to be instantiated at arbitrary orders. We show performance results for first-, second-and third-order protected implementations on the Arm Cortex-M0+ and Cortex-M4F. Notably, our implementation of first-order masked Kyber decapsulation requires 3.1 million cycles on the Cortex-M4F. This is a factor 3.5 overhead compared to the unprotected optimized implementation in pqm4. We experimentally show that the first-order implementation of our new modules on the Cortex-M0+ is hardened against attacks using 100 000 traces and mechanically verify the security in a fine-grained leakage model using the verification tool scVerif.Publicationtype: Journal ArticleScopus© Citations 51 291 1021 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: with files , Masking in fine-grained leakage models: construction, implementation and verification(Ruhr-Universität Bochum, 2021-02-23); ; ; ; We propose a new approach for building efficient, provably secure, and practically hardened implementations of masked algorithms. Our approach is based on a Domain Specific Language in which users can write efficient assembly implementations and fine-grained leakage models. The latter are then used as a basis for formal verification, allowing for the first time formal guarantees for a broad range of device-specific leakage effects not addressed by prior work. The practical benefits of our approach are demonstrated through a case study of the PRESENT S-Box: we develop a highly optimized and provably secure masked implementation, and show through practical evaluation based on TVLA that our implementation is practically resilient. Our approach significantly narrows the gap between formal verification of masking and practical security.Publicationtype: Journal ArticleScopus© Citations 18 210 424 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: without files , Automated Masking of Software Implementations on Industrial MicrocontrollersPhysical side-channel attacks threaten the security of exposed embedded devices, such as microcontrollers. Dedicated countermeasures, like masking, are necessary to prevent these powerful attacks. However, a gap between well-studied leakage models and observed leakage on real devices makes the application of these countermeasures non-trivial. This work provides a gadget-based concept to automated masking covering practically relevant leakage models to achieve security on real-world devices. We realize this concept with a fully automated compiler that transforms unprotected microcontroller-implementations of cryptographic primitives into masked executables, capable of being executed on the target device. In a case study, we apply our approach to a bitsliced LED implementation and perform a TVLA-based security evaluation of its core component: the PRESENT s-box.Publicationtype: Conference Paper87