The objective of this paper is to give a comprehensive introduction to applied cryptography with an engineer or computer scientist in mind. The emphasis is on the knowledge needed to create practical systems which supports integrity, confidentiality, or authenticity. Topics covered includes an introduction to the concepts in cryptography, attacks against cryptographic systems, key use and handling, random bit generation, encryption modes, and message authentication codes. Recommendations on algorithms and further reading is given in the end of the paper. This paper should make the reader able to build, understand and evaluate system descriptions and designs based on the cryptographic components described in the paper.

[서평]「Applied Cryptography」

Current mechanisms for authenticating communication between devices that share no prior context are inconvenient for ordinary users, without the assistance of a trusted authority. We present and analyze seeing-is-believing, a system that utilizes 2D barcodes and camera-telephones to implement a visual channel for authentication and demonstrative identification of devices. We apply this visual channel to several problems in computer security, including authenticated key exchange between devices that share no prior context, establishment of a trusted path for configuration of a TCG-compliant computing platform, and secure device configuration in the context of a smart home.

/pdf/seeing-is-believing-using-camera-phones-for-human-verifiable-3mst0x1js1.pdf

Seeing-is-believing: using camera phones for human-verifiable authentication

The Personal Server is a mobile device that enables you to readily store and access the data and applications you carry with you through interfaces found in the local environment. Unlike conventional mobile computers with relatively poor user interfaces, it does not have a display at all, instead wirelessly utilizing displays, keyboards and other IO devices found nearby. By co-opting large screens such as those found on desktop PCs, public display monitors, information kiosks, and other computers, a Personal Server is more effective than relying on a small mobile screen. This model goes beyond the mobile context and has wider implications for how we think about computing in general. A prototype system, including applications, system infrastructure, and a mobile platform, has been built to fully explore this model. This prototype sheds light on the suitability of standard components to support such a computing model, and from this illuminates directions for the design of future ubiquitous computing systems.

/pdf/the-personal-server-changing-the-way-we-think-about-2gb19haifg.pdf

The Personal Server: Changing the Way We Think about Ubiquitous Computing

As computing becomes pervasive, people increasingly rely on public computers to do business over the Internet. But accessing today's web-based services invariably requires typing a username and password to authenticate – a significant vulnerability, since the password can be captured by the public computer and later reused by a hostile party. We introduce a solution to this problem using a mobile phone as a hand-held authentication token and a security proxy which allows the system to be used with unmodified third-party web services. Our goal is to create an authentication system that is both secure and highly usable. Figure 1 illustrates the authentication process. A user who wishes to use an Internet kiosk to access a remote service requiring authentication would instead connect to a trusted security proxy (step 1). The proxy stores the user's passwords and can use them to log in to the remote service. It also stores a mobile phone number for each user, to which a short text message (SMS) is sent to complete the authentication. Once the user responds to this message, the user’s connection from the kiosk is authenticated (step 2). The proxy then operates as a traditional web proxy and mediates all aspects of the user's communication with the remote service, but preventing long-term authenticators (e.g., cookies) from touching the kiosk (step 3).

/pdf/secure-web-authentication-with-mobile-phones-2mtb4vzqts.pdf

Secure Web Authentication with Mobile Phones

As a technique for authentication through untrusted public Internet terminals, photographic authentication relies on a person's ability to recognize personal photographs. The results from the authors' study demonstrate that this technique can reasonably withstand replay attacks, a common vulnerability of many existing techniques.

Photographic authentication through untrusted terminals

The Post-PC revolution is bringing information access to a wide range of devices beyond the desktop, such as public kiosks, and mobile devices like cellular telephones, PDAs, and voice based vehicle telematics. However, existing deployed Internet services are geared toward the secure rich interface of private desktop computers. We propose the use of an infrastructure-based secure proxy architecture to bridge the gap between the capabilities of Post-PC devices and the requirements of Internet services. By combining generic content and security transformation functions with service-specific rules, the architecture decouples device capabilities from service requirements and simplifies the addition of new devices and services. Security and protocol specifics are abstracted into reusable components. Additionally, the architecture offers the novel ability to deal with untrusted public Internet access points by providing fine-grain control over the content and functionality exposed to the end device, as well as support for using trusted and untrusted devices in tandem. Adding support for a deployed Internet service requires a few hundred lines of scraping scripts. Similarly, adding support for a new device requires a few hundred lines of stylesheets for the device format. The average latency added by proxy transformations is around three seconds in our unoptimized Java implementation.

A composable framework for secure multi-modal access to internet services from Post-PC devices

The post-PC revolution is bringing information access to a wide-range of devices beyond the desktop, such as public kiosks, and mobile devices like cellular telephones, PDAs, and voice based vehicle telematics. However existing deployed Internet services are geared toward the secure rich interface of private desktop computers. We propose the use of an infrastructure-based secure proxy architecture to bridge the gap between the capabilities of post-PC devices and the requirements of Internet services. By combining generic content and security transformation functions with service-specific rules, the architecture decouples device capabilities from service requirements and simplifies the addition of new devices and services. Security and protocol specifics are abstracted into reusable components. Additionally, the architecture offers the novel ability to deal with untrusted public Internet access points by providing fine-grain control over the content and functionality exposed to the end device, as well as support for using trusted and untrusted devices in tandem. Adding support for a deployed Internet service requires a few hundred lines of scraping scripts. Similarly, adding support for a new device requires a few hundred lines of stylesheets for the device format. The average latency added by proxy transformations is around three seconds in our unoptimized Java implementation.

/pdf/a-composable-framework-for-secure-multi-modal-access-to-hrmrrvv295.pdf

Steven J. Ross

Papers

A composable framework for secure multi-modal access to internet services from Post-PC devices

A composable framework for secure multi-modal access to Internet services from post-PC devices