ZISC Worksop 2014: Information Security
Date: September 12, 2014
Place: ETH Zurich, campus Zentrum, GEP pavilion
Program
Program
08:30h Registration ETH Zentrum, Rämistrasse 101, CH-8006 Zurich, Switzerland, in the GEP pavilion (room MM C 78.1)
09:00h Opening note by Ueli Maurer
09:15h Kenny Paterson on “TLS Security – Where Do We Stand?”
10:15h Break
10:40h Phillip Rogaway on “The Rise of Authenticated Encryption”
11:40h Lunch
13:00h Engin Kirda on “Experiences and Challenges in Automated Malware Analysis: Quo Vadis Sandboxes?”
14:00h Stefan Dziembowski on “Bitcoin contracts – digital economy without lawyers?”
15:00h Break
15:30h Eran Tromer on “Succinct Zero Knowledge Proofs and their Applications to Bitcoin”
16:30h Closing
17:30h Apéro
Speakers
Stefan Dziembowski
Title: Bitcoin contracts – digital economy without lawyers?
Abstract: BitCoin is a digital currency system introduced in 2008 by an anonymous developer using a pseudonym “Satoshi Nakamoto”. Despite of its mysterious origins, Bitcoin became the first cryptographic currency that got widely adopted — as of May 2014 the Bitcoin capitalization is over 5 bln euro. Bitcoin owes its popularity mostly to the fact that it has no central authority, the transaction fees are very low, and the amount of coins in the circulation is restricted, which in particular means that nobody can “print” money to generate inflation. The financial transactions between the participants are published on a public ledger maintained jointly by the users of the system.
One of the very interesting, but slightly less known, features of the Bitcoin is the fact that it allows for more complicated “transactions” than the simple money transfers between the participants: very informally, in Bitcoin it is possible to “deposit” some amount of money in such a way that it can be claimed only under certain conditions. These conditions are written in the form of the “Bitcoin scripts” and in particular may involve some timing constrains. This property allows to create the so-called “contracts”, where a number of mutually-distrusting parties engage in a Bitcoin-based protocol to jointly perform some task. The security of the protocol is guaranteed purely by the properties of the Bitcoin, and no additional trust assumptions are needed. This Bitcoin feature can have several applications in the digital economy, like creating the assurance contracts, the escrow and dispute mediation, the rapid micropayments, the multiparty lotteries.
In this talk I will give a short introduction to this area, present some recent results, and highlight the future research directions.
Bio: Stefan Dziembowski is professor at the University of Warsaw. He is interested in theoretical and applied cryptography. Dziembowski received an MSc degree in computer science in 1996 from the University of Warsaw, and a PhD degree in computer science in 2001 from the University of Aarhus, Denmark. He was a post-doc at the ETH Zurich, CNR Pisa and the University of Rome “La Sapienza”, where he joined the faculty in 2008. In 2010 he moved to the University of Warsaw where he leads the Cryptography and Data Security Group. His papers appeared at leading computer science conferences (FOCS, STOC, CRYPTO, EUROCRYPT, ASIACRYPT, TCC, LICS), and journals (Journal of Cryptology and IEEE Transactions on Information Theory). He also served as a PC member of several international conferences, including CRYPTO, EUROCRYPT, ASIACRYPT, Theoretical Cryptography Conference (TCC), and the International Colloquium on Automata, Languages and Programming (ICALP). He is a recipient of an ERC Starting Independent Researcher Grant grant, an FNP Welcome grant and a Marie-Curie Intra-European Fellowship (2006-2007). He is a co-author of two papers that won the Best Paper Awards (on Eurocrypt 2014 and on IEEE S&P 2014).
Engin Kirda
Title: Experiences and Challenges in Automated Malware Analysis: Quo Vadis Sandboxes?
Abstract: Malicious software (or malware) is one of the most pressing and major security threats facing the Internet today. Anti-malware companies typically have to deal with tens of thousands of new malware samples every day. To cope with these large quantities, researchers and practitioners alike have developed a number of automated, dynamic malware analysis systems. These systems automatically execute a program in a controlled environment, and produce a report describing the program’s behavior. Such dynamic malware analysis sandboxes are the latest rage, and a popular example of such a is Anubis, a freely-accessible, large-scale public malware analysis system that that we have developed, and have been maintaining for more than six years. In this talk, I will discuss the problems and challenges in dynamic malware analysis, and will report on our experiences in maintaining a large-scale malware analysis system. I will also talk about some of our research that aims to address the problem of evasive malware. Finally, I will elaborate on some of the remaining challenges and open research topics in the area.
Bio: Engin Kirda is a Professor of Computer Science at the Northeastern University in Boston and the director of the Northeastern Information Assurance Institute. He is also a co-founder and Chief Architect at Lastline, Inc. Before moving to the US, he has held faculty positions at Institute Eurecom in the French Riviera and the Technical University of Vienna where he co-founded the Secure Systems Lab that is now distributed over five institutions in Europe and US. Engin’s recent research has focused on malware analysis (e.g., Anubis, Exposure, Fire) and detection, web application security, and practical aspects of social networking security. His recent work on the deanonymization of social network users received wide media coverage. He co- authored more than 100 peer-reviewed scholarly publications and served on program committees of numerous well-known international conferences and workshops. In 2009, Engin was the Program Chair of the International Symposium on Recent Advances in Intrusion Detection (RAID), in 2010/11, Program Chair of the European Workshop on Systems Security (Eurosec), and in 2012 the Program Chair of the USENIX Workshop on Large Scale Exploits and Emergent Threats. He is currently the chair of NDSS. In the past, Engin has consulted the European Commission on emerging threats, and gave a Congressional Briefing in Washington D.C. on advanced malware attacks and cyber-security in 2012.
Kenny Paterson
Title: TLS Security – Where Do We Stand?
Abstract: SSL/TLS is one of the most important secure communications protocols in use today. It has become the de facto “protocol of choice” for developers wanting to secure their application traffic. The protocol has become increasingly complex, with many options and extensions; SSL/TLS also has a complex deployment eco-system. Driven by its rising importance, the research community has put significant effort into analysing SSL/TLS, finding attacks and developing security proofs for elements of the protocol. Implementation-specific attacks (such as Heartbleed and the Apple “goto fail” bug) have also made the headlines. The Snowden revelations have prompted renewed examination of SSL/TLS’s use of cryptography and SSL/TLS implementations. In this talk, I’ll attempt to bring some order to this apparent chaos, presenting an overview of some of the more important developments in our evolving understanding of the security provided by SSL/TLS.
Bio: Kenny Paterson is an EPSRC Leadership Fellow and Professor of Information Security at Royal Holloway, University of London. Prior to joining Royal Holloway in 2001, he worked at Hewlett-Packard’s European Research Laboratories as a technical staff member and project manager (1996-2001). Kenny received his PhD in the area of discrete mathematics in 1993. He worked extensively in coding and communications in the 1990s and switched research areas to cryptography and network security around 2000. A particular research interest in recent years has been applied cryptography, including the design and analysis of real-world protocols using cryptography. This latter area is the focus of his EPSRC-funded Leadership Fellowship, the research output of which is having a significant impact on the security of Internet protocols such as IPsec, SSL/TLS and SSH. He was awarded an Applied Networking Research Prize by the Internet Research Task Force (IRTF) for his work on SSL/TLS. He was appointed co-chair of the Crypto Forum Research Group (CFRG) of the IRTF in June 2014. Kenny was program chair of EUROCRYPT 2011. He founded the “Pairings” series of conferences, with Steven Galbraith and Mike Scott. He also founded, with Nigel Smart, the rapidly growing “Real World Cryptography” workshop series. He serves on the editorial board of the Journal of Cryptology and is co-editor in chief of Springer’s Information Security and Cryptography book series. He was Associate Editor for Sequences for the IEEE Transactions on Information Theory (2002-2005). He has published more than 130 refereed articles in conferences and journals, including CRYPTO, EUROCRYPT, ASIACRYPT, ACM-CCS, IEEE S&P, USENIX Security and NDSS. He will be an invited speaker at Asiacrypt 2014.
Phillip Rogaway
Title: The Rise of Authenticated Encryption
Abstract: Although practical schemes for symmetric encryption (eg, blockcipher modes) are one of the principal “exports” of cryptography, for years serious cryptographers mostly ignored this corner of our field. In recent years this has dramatically changed: there has been a quiet revolution in our understanding of what definitions general-purpose symmetric encryption schemes should meet, and what algorithms should be employed to satisfy them. Nonce-based authenticated encryption (AE) has come to eclipse semantic security as the standard notion for what a symmetric encryption scheme should do.
In this talk I’ll trace the history of AE, exploring why it emerged, how it evolved, and some of the schemes that have been offered for achieving it. I’ll explore how security notions for AE have evolved. I’ll look afresh at generic composition. I’ll describe some all-in-one methods for AE, including a new scheme that I have worked on, AEZ. Finally, I’ll talk about the CAESAR competition for AE, a contest that has drawn a remarkable 57 round-1 submissions.
Bio: Phil is a professor in the Computer Science Department at the University of California, Davis. He completed his Ph.D. in 1991 at MIT, under the direction of Silvio Micali. Phil came to UC Davis in 1994, after a stint at IBM as a security architect. Phil is the co-inventor of practice-oriented provable-security, which aims to use definitions, reductions, and concrete-security analysis to develop practical and efficient cryptographic mechanisms. Phil is a winner of the Paris Kanellakis Theory and Practice Award and the RSA Mathematics Award. About 20,000 papers reference his work. Phil is also interested in ethical and social problems surrounding technology, including the emergence of ubiquitous surveillance.
Eran Tromer
Title: Succinct Zero Knowledge Proofs and their Applications to Bitcoin
Abstract: “Computers are unreliable and vulnerable to attacks; therefore we shouldn’t believe what they say, unless they prove its correctness.” Imagine how more robust our networks and protocols would be, if they could be built on this tenet! This talk will survey recent work aiming to achieve this vision via cryptographic tools: zero-knowledge Noninteractive ARguments of Knowledge (zkSNARK) systems, and their extension to Proof-Carrying Data. In particular, we’ll discuss prototypes that achieve the following: Protecting the integrity of general computation (e.g., C programs) in the presence of arbitrary platform corruptions. Zerocash, which solves Bitcoin’s privacy problem. Whereas Bitcoin publicly broadcast all transactions and account balances, Zerocash replaces these by privacy-preserving zkSNARK proofs. These are joint works with Eli Ben-Sasson, Alessandro Chiesa, Christina Garman, Daniel Genkin, Matthew Green, Ian Miers, Eran Tromer, and Madars Virza. For papers and code see SCIPR Lab and Zerocash.
Bio: Dr. Eran Tromer is a faculty member at Tel Aviv University’s School of Computer Science, where he is heading the Lab for Experimental Information Security and is codirector of the Check Point Institute for Information Security. He received his Ph.D. at the Weizmann Institute of Science, advised by Prof. Adi Shamir, and before joining TAU pursued his research at MIT and at Microsoft Research.
Dr. Tromer’s research area is cryptography and information security, focusing on risks posed by physical attacks and untrusted platforms. He has demonstrated side-channel information leakage in commercial cloud computing services, and extraction of secret keys from PCs using acoustic, electric and electromagnetic emanations. His designs for RSA codebreaking hardware have led to revision of encryption standards worldwide. On the constructive side, Dr. Tromer pursues means of improving security at the levels of implementations, algorithms and protocols. He has proposed and implemented succicnt zero-knowledge proofs that ensure the integrity of program execution even when the underlying platform is untrusted or faulty, and has used these to improve privacy in Bitcoin. Dr. Tromer’s research spans the full spectrum from theory to practice (he is the first person ever to both author STOC/FOCS/TCC papers and win a Black Hat Pwnie Award), and he believes that such integration of theory and practice is essential for securing tomorrow’s computers.