arXiv subjects

Antonio Lioy

Publications and source records attributed to Antonio Lioy.

8 recordsLinked to original sources

arXiv2026

Shaping a Quantum-Resistant Future: Strategies for Post-Quantum PKI

As the quantum computing era approaches, securing classical cryptographic protocols becomes imperative. Public key cryptography is widely used for signature and key exchange but it is the type of cryptography more threatened by quantum computing. Its application typically requires support via a public-key certificate, which is a signed data structure and must therefore face twice the quantum challenge: for the certified keys and for the signature itself. We present the latest developments in selecting robust Post-Quantum algorithms and investigate their applicability in the Public Key Infrastructure context. Our contribution entails defining requirements for a secure transition to a quantum-resistant Public Key Infrastructure, with a focus on adaptations for the X.509 certificate format. Additionally, we explore transitioning Certificate Revocation List and Online Certificate Status Protocol to support quantum-resistant algorithms. Through comparative analysis, we elucidate the complex transition to a quantum-resistant PKI.

cs.CR↗

arXiv2026

Towards Quantum-Resistant Trusted Computing: Architectures for Post-Quantum Integrity Verification Techniques

Trust is the core building block of secure systems, and it is enforced through methods to ensure that a specific system is properly configured and works as expected. In this context, a Root of Trust (RoT) establishes a trusted environment, where both data and code are authenticated via a digital signature based on asymmetric cryptography, which is vulnerable to the threat posed by Quantum Computers (QCs). Firmware, being the first layer of trusted software, faces unique risks due to its longevity and difficult update. The transition of firmware protection to Post-Quantum Cryptography (PQC) is urgent, since it reduces the risk derived from exposing all computing and network devices to quantum-based attacks. This paper offers an analysis of the most common trust techniques and their roadmap towards a Post-Quantum (PQ) world, by investigating the current status of PQC and the challenges posed by such algorithms in existing Trusted Computing (TC) solutions from an integration perspective. Furthermore, this paper proposes an architecture for TC techniques enhanced with PEC, addressing the imperative for immediate adoption of quantum-resistant algorithms.

cs.CR↗

arXiv2019

Preliminary steps in designing and implementing a privilege verifier for PMI

We have designed and deployed a system that uses X.509 public-key certificates (PKC) and attribute certificates (AC) for access control. This includes an authorization service for on-line environments where clients are identified by X.509 PKCs and their privileges are expressed with X.509 ACs. During a request to a protected resource, a privilege verifier decides if the user satisfies all the requirements to get access to the controlled resource. In this paper we focus on the steps to be performed by the privilege verifier, which is the entity in charge of validating both the PKCs and the ACs involved. The validation of PKCs and of ACs are two separate tasks but they are closely related. In our system we have identified two distinct entities: the privilege verifier whose task is to validate ACs, and the certificate validation server, whose task is to validate the PKCs. The validation of PKC is more complex, and it thus can be implemented and provided as a service by a dedicated authority, named Validation Authority. This paper describes the model, architecture and implementation of this system. It also includes some preliminary measurements and our future plans for the development of the system.

cs.CR↗

arXiv2019

A Framework for Secure Digital Administration

The efficiency and service quality in public administration can be improved by using electronic documents (or e-docs) and digital signature to speed up their activity and at the same time to better satisfy customer needs. This paper presents an XML-based document exchange system that integrates a platform for the management (creation, search, storage) of e-docs and a secure trustworthy environment for digitally signing e-docs. The framework provides security services, like privacy, authorization, authentication and non-repudiation. Possibly a mobile terminal equipped with a smartcard reader and integrating WYSIWYS features could be used for viewing and signing e-docs. The proposed system can be easily integrated with the infrastructure (e.g. database system) already in use at each administration site. It is described also the use of the system in a real world service.

cs.CR↗

arXiv2019

Secure Digital Administration in Medical Environment

The efficiency and service quality in a medical environment can be improved by using electronic documents (or e-docs) and digital signatures to speed up both doctors' activity and to provide in the same time easy retrieval and use of needed data without loosing convenience. Our proposed solution satisfies these needs by making use of the AIDA system and many cutting-edge techniques to build a digitalized management system. To be more specific, we present firstly the AIDA document exchange framework for the management (creation, search, storage) of e-docs expressed in XML format. The framework provides security services, like privacy, authorization, authentication and non-repudiation. We describe next the use of AIDA in a real world medical service, namely the creation of electronic medical records (e- MRs). Doctors can use mobile devices that embed a secure trustworthy environment defined also in AIDA for digitally signing the e-MRs. Technically speaking a handheld PC equipped with a smart-card reader and integrating What You See Is What You Sign (WYSIWYS) features will be used for viewing and signing the e-MRs. Furthermore the proposed system is easily integrated with the infrastructure (e.g., database system) already in use at hospital's administration site and allows easy handling and updating of data processed on the mobile devices. The use of web interface for the operations to be executed on the mobile device or for those executed on the remote part of the system makes the whole application homogeneous and easy to use.

cs.CR↗

arXiv2019

Towards Simplifying PKI Implementation: Client-Server based Validation of Public Key Certificates

With real-time certificate validation checking, a public-key-using system that needs to validate a certificate executes a transaction with a specialized validation party. At the end of the transaction the validation party returns an indication about the validity status of the certificate. This paper analysis the public key (PbK) certificate validation service from a practical point of view by describing the implementation of a system that makes use of the Data Validation and Certification Server (DVCS) protocols to provide certificate validation service to the Relying Parties (RPs). However the system is not restricted to use only the specified protocol and allows the integration of other validation protocols or mechanisms. Our implementation efforts emphasize the possibility to pursue a specific RP tradeoff between timeliness, security and computational resource usage via dynamic selection of several configurable options.

cs.CR↗

arXiv2017

Classification and Analysis of Communication Protection Policy Anomalies

This paper presents a classification of the anomalies that can appear when designing or implementing communication protection policies. Together with the already known intra- and inter-policy anomaly types, we introduce a novel category, the inter-technology anomalies, related to security controls implementing different technologies, both within the same network node and among different network nodes. Through an empirical assessment, we prove the practical significance of detecting this new anomaly class. Furthermore, this paper introduces a formal model, based on first-order logic rules that analyses the network topology and the security controls at each node to identify the detected anomalies and suggest the strategies to resolve them. This formal model has manageable computational complexity and its implementation has shown excellent performance and good scalability.

cs.CR↗

arXiv2008

Impact of Vehicular Communications Security on Transportation Safety

Transportation safety, one of the main driving forces of the development of vehicular communication (VC) systems, relies on high-rate safety messaging (beaconing). At the same time, there is consensus among authorities, industry, and academia on the need to secure VC systems. With specific proposals in the literature, a critical question must be answered: can secure VC systems be practical and satisfy the requirements of safety applications, in spite of the significant communication and processing overhead and other restrictions security and privacy-enhancing mechanisms impose? To answer this question, we investigate in this paper the following three dimensions for secure and privacy-enhancing VC schemes: the reliability of communication, the processing overhead at each node, and the impact on a safety application. The results indicate that with the appropriate system design, including sufficiently high processing power, applications enabled by secure VC can be in practice as effective as those enabled by unsecured VC.

cs.CR↗