28 research outputs found
On the impact of warning interfaces for enabling the detection of Potentially Unwanted Applications
Privacy-friendly Monero transaction signing on a hardware wallet, extended version
Keeping cryptocurrency spending keys safe and being able to use them when signing a transaction
is a well-known problem, addressed by hardware wallets.
Our work focuses on a transaction signing process for privacy-centric cryptocurrency Monero, in the hardware wallets. We designed, implemented, and analyzed a privacy-preserving transaction signing protocol that runs on a hardware wallet and protects the spending keys. Moreover, we also implemented a privacy-preserving multi-party version of the Bulletproof zero-knowledge prover algorithm, which runs on a hardware wallet with constant memory.
We present the protocols and evaluate their performance on a real hardware wallet
sec-certs: Examining the security certification practice for better vulnerability mitigation
Products certified under security certification frameworks such as Common
Criteria undergo significant scrutiny during the costly certification process.
Yet, critical vulnerabilities, including private key recovery (ROCA, Minerva,
TPM-Fail...), get discovered in certified products with high assurance levels.
Furthermore, assessing which certified products are impacted by such
vulnerabilities is complicated due to the large amount of unstructured
certification-related data and unclear relationships between the certificates.
To address these problems, we conducted a large-scale automated analysis of
Common Criteria and FIPS 140 certificates. We trained unsupervised models to
learn which vulnerabilities from NIST's National Vulnerability Database impact
existing certified products and how certified products reference each other.
Our tooling automates the analysis of tens of thousands of
certification-related documents, extracting machine-readable features where
manual analysis is unattainable. Further, we identify the security requirements
that are associated with products being affected by fewer and less severe
vulnerabilities (on average). This indicates which aspects of certification
correlate with higher security. We demonstrate how our tool can be used for
better vulnerability mitigation on four case studies of known, high-profile
vulnerabilities. All tools and continuously updated results are available at
https://seccerts.org
Experimental large-scale review of attractors for detection of potentially unwanted applications
DiSSECT: Distinguisher of Standard & Simulated Elliptic Curves via Traits
It can be tricky to trust elliptic curves standardized in a non-transparent way. To rectify this, we propose a systematic methodology for analyzing curves and statistically comparing them to the expected values of a large number of generic curves with the aim of identifying any deviations in the standard curves.
For this purpose, we put together the largest publicly available database of standard curves. To identify unexpected properties of standard generation methods and curves, we simulate over 250 000 curves by mimicking the generation process of four standards. We compute 22 different properties of curves and analyze them with automated methods to pinpoint deviations in standard curves, pointing to possible weaknesses
A Study on The Value of Location Privacy
This paper introduces results of a study into the value of location privacy for individuals using mobile devices. We questioned a sample of over 1200 people from five EU countries, and used tools from experimental psychology and economics to extract from them the value they attach to their location data. We compare this value across national groups, gender and technical awareness, but also the perceived difference between academic use and commercial exploitation. We provide some analysis of the self-selection bias of such a study, and look further at the valuation of location data over time using data from another experiment
PIN (& Chip) or signature - beating the cheating
Abstract. Our paper first reviews some of the most critical issues related to the introduction of Chip & PIN card payment authorisation, and then outlines one part of our experiment 1 that we decided to undertake to validate some of our views and ideas. Our experiment examines, in two phases, whether introduction of this authorisation method is advantageous for an opportunistic thief and whether the customer truly benefits from the Chip & PIN technology with respect to this opportunistic thief.