We expect a future where we are surrounded by embedded devices, ranging from Java-enabled cell phones to sensor networks and smart appliances. An adversary can compromise our privacy and safety by maliciously modifying the memory contents of these embedded devices. In this paper, we propose a softWare-based attestation technique (SWATT) to verify the memory contents of embedded devices and establish the absence of malicious changes to the memory contents. SWATT does not need physical access to the device's memory, yet provides memory content attestation similar to TCG or NGSCB without requiring secure hardware. SWATT can detect any change in memory contents with high probability, thus detecting viruses, unexpected configuration settings, and Trojan Horses. To circumvent SWATT, we expect that an attacker needs to change the hardware to hide memory content changes. We present an implementation of SWATT in off-the-shelf sensor network devices, which enables us to verify the contents of the program memory even while the sensor node is running.

/pdf/swatt-software-based-attestation-for-embedded-devices-27m3gey8ee.pdf

SWATT: softWare-based attestation for embedded devices

We propose a primitive, called Pioneer, as a first step towards verifiable code execution on untrusted legacy hosts. Pioneer does not require any hardware support such as secure co-processors or CPU-architecture extensions. We implement Pioneer on an Intel Pentium IV Xeon processor. Pioneer can be used as a basic building block to build security systems. We demonstrate this by building a kernel rootkit detector.

/pdf/pioneer-verifying-code-integrity-and-enforcing-untampered-20v66m46x4.pdf

Pioneer: verifying code integrity and enforcing untampered code execution on legacy systems

Pioneer: Verifying Code Integrity and Enforcing Untampered Code Execution on Legacy Systems.

We expand on the idea, proposed by Kelsey et al [?], of cache memory being used as a side-channel which leaks information during the run of a cryptographic algorithm By using this side-channel, an attacker may be able to reveal or narrow the possible values of secret information held on the target device We describe an attack which encrypts 2 chosen plaintexts on the target processor in order to collect cache profiles and then performs around 2 computational steps to recover the key As well as describing and simulating the theoretical attack, we discuss how hardware and algorithmic alterations can be used to defend against such techniques

/pdf/theoretical-use-of-cache-memory-as-a-cryptanalytic-side-flxmhuuzto.pdf

Theoretical Use of Cache Memory as a Cryptanalytic Side-Channel.

This paper presents SCUBA (Secure Code Update By Attestation), for detecting and recovering compromised nodes in sensor networks. The SCUBA protocol enables the design of a sensor network that can detect compromised nodes without false negatives, and either repair them through code updates, or revoke the compromised nodes. The SCUBA protocol represents a promising approach for designing secure sensor networks by proposing a first approach for automatic recovery of compromised sensor nodes. The SCUBA protocol is based on ICE (Indisputable Code Execution), a primitive we introduce to dynamically establish a trusted code base on a remote, untrusted sensor node.

/pdf/scuba-secure-code-update-by-attestation-in-sensor-networks-igm5en4nm2.pdf

SCUBA: Secure Code Update By Attestation in sensor networks

Invertible transformations over n-bit words are essential ingredients in many cryptographic constructions. When n is small (e.g., n = 8) we can compactly represent any such transformation as a lookup table, but when n is large (e.g., n = 64) we usually have to represent it as a composition of simpler operations such as linear mappings, S-P networks, Feistel structures, etc. Since these cryptographic constructions are often implemented in software on standard microprocessors, we are particularly interested in invertible univariate or multivariate transformations which can be implemented as small compositions of basic machine instructions on 32 or 64 bit words. In this paper we introduce a new class of provably invertible mappings which can mix arithmetic operations (negation, addition, subtraction, multiplication) and boolean operations (not, xor, and, or), are highly efficient, and have desirable cryptographic properties. In particular, we show that for any n the mapping x ? x + (x2 ? C) (mod 2n) is a permutation with a single cycle of length 2n iff both the least significant bit and the third least significant bit in the constant C are 1.

/pdf/a-new-class-of-invertible-mappings-1uquhjlecr.pdf

A New Class of Invertible Mappings

In this paper we analyse the security of a new key exchange protocol proposed in [3], which is based on mutually learning neural networks. This is a new potential source for public key cryptographic schemes which are not based on number theoretic functions, and have small time and memory complexities. In the first part of the paper we analyse the scheme, explain why the two parties converge to a common key, and why an attacker using a similar neural network is unlikely to converge to the same key. However, in the second part of the paper we show that this key exchange protocol can be broken in three different ways, and thus it is completely insecure.

/pdf/analysis-of-neural-cryptography-4q1cxrqksp.pdf

Analysis of Neural Cryptography

A T-function is a mapping in which the i-th bit of the output can depend only on bits 0,1,..., i of the input. All the bitwise machine operations and most of the numeric machine operations in modern processors are T-functions, and their compositions are also T-functions. In this paper we show that T-functions can be used to construct exceptionally efficient cryptographic building blocks which can be used as nonlinear maximal length state transition functions in stream ciphers, as large S-boxes in block ciphers, and as non-algebraic multipermutations in hash functions.

Cryptographic applications of T-functions

A T-function is a mapping from n-bit words to n-bit words in which for each 0 ≤ i <n bit i of the output can depend only on bits 0,1,..., i of the input. All the boolean operations and most of the numeric operations in modern processors are T-functions, and their compositions are also T-functions. In earlier papers we considered ‘crazy’ T-functions such as f(x)= x+(x 2 ∨ 5), proved that they are invertible mappings which contain all the 2 n possible states on a single cycle for any word size n, and proposed to use them as primitive building blocks in a new class of software-oriented cryptographic schemes. The main practical drawback of this approach is that most processors have either 32 or 64 bit words, and thus even a maximal length cycle (of size 232 or 264) may be too short. In this paper we develop new ways to construct invertible T-functions on multiword states whose iteration is guaranteed to yield a single cycle of arbitrary length (say, 2256). Such mappings can lead to stream ciphers whose software implementation on a standard Pentium 4 processor can encrypt more than 5 gigabits of data per second, which is an order of magnitude faster than previous designs such as RC4.

/pdf/new-cryptographic-primitives-based-on-multiword-t-functions-3k2vnb6tra.pdf

New cryptographic primitives based on multiword T-functions

A T-function is a mapping in which the i-th bit of the output can depend only on bits 0,1,, i of the input All the bitwise machine operations and most of the numeric machine operations in modern processors are T-functions, and their compositions are also T-functions In this paper we show that T-functions can be used to construct exceptionally efficient cryptographic building blocks which can be used as nonlinear maximal length state transition functions in stream ciphers, as large S-boxes in block ciphers, and as non-algebraic multipermutations in hash functions

/pdf/cryptographic-applications-of-t-functions-14at2xtb6d.pdf

Alexander Klimov

Papers

A New Class of Invertible Mappings

Analysis of Neural Cryptography

Cryptographic applications of T-functions

New cryptographic primitives based on multiword T-functions

Cryptographic Applications of T-Functions