arXiv subjects

Eric Filiol

Publications and source records attributed to Eric Filiol.

18 recordsLinked to original sources

arXiv2026

Arbitrary Reduction of Validation Error for AI Decision Tests using Homomorphic AI and Repetition Codes

This paper presents new results and breakthrough obtained with the HbHAI techniques (Hash-based Homomorphic Artificial Intelligence) proposed in \cite{filiol0,sepp}. HbHAI is based on a novel class of key-dependent hash functions that naturally preserve most similarity properties, most AI algorithms rely on. It enables to analyse and process data in its cryptographically secure form while using existing native AI algorithms without modification, with unprecedented performances compared to existing homomorphic encryption schemes and most notably compared to the same processing on corresponding plaintext data. Two major results have been obtained further. First we enable to reduce the compression rate up to a factor of 10 thus allowing to process massive datasets while reducing the computation time and the energy footprint in the same order. Second, we show how it is possible to arbitrarily reduce the final validation error of AI-based decision tests by using repetition error-correcting codes.

cs.CR↗

arXiv2026

A New Approach in Cryptanalysis Through Combinatorial Equivalence of Cryptosystems

We propose a new approach in cryptanalysis based on an evolution of the concept of \textit{Combinatorial Equivalence}. The aim is to rewrite a cryptosystem under a combinatorially equivalent form in order to make appear new properties that are more strongly discriminating the secret key used during encryption. We successfully applied this approach to the most secure stream ciphers category nowadays. We first define a concept cipher called Cipherbent6 that capture most of the difficulty of stream cipher cryptanalysis. We significantly outperformed all known cryptanalysis. We applied this approach to the Achterbahn cipher and we obtained again far better cryptanalysis results.

cs.CR↗

arXiv2025

Community Covert Communication - Dynamic Mass Covert Communication Through Social Media

Since the early 2010s, social network-based influence technologies have grown almost exponentially. Initiated by the U.S. Army's early OEV system in 2011, a number of companies specializing in this field have emerged. The most (in)famous cases are Bell Pottinger, Cambridge Analytica, Aggregate-IQ and, more recently, Team Jorge. In this paper, we consider the use-case of sock puppet master activities, which consist in creating hundreds or even thousands of avatars, in organizing them into communities and implement influence operations. On-purpose software is used to automate these operations (e.g. Ripon software, AIMS) and organize these avatar populations into communities. The aim is to organize targeted and directed influence communication to rather large communities (influence targets). The goal of the present research work is to show how these community management techniques (social networks) can also be used to communicate/disseminate relatively large volumes (up to a few tens of Mb) of multi-level encrypted information to a limited number of actors. To a certain extent, this can be compared to a Dark Post-type function, with a number of much more powerful potentialities. As a consequence, the concept of communication has been totally redefined and disrupted, so that eavesdropping, interception and jamming operations no longer make sense.

cs.CR↗

arXiv2025

Technical Evaluation of a Disruptive Approach in Homomorphic AI

We present a technical evaluation of a new, disruptive cryptographic approach to data security, known as HbHAI (Hash-based Homomorphic Artificial Intelligence). HbHAI is based on a novel class of key-dependent hash functions that naturally preserve most similarity properties, most AI algorithms rely on. As a main claim, HbHAI makes now possible to analyze and process data in its cryptographically secure form while using existing native AI algorithms without modification, with unprecedented performances compared to existing homomorphic encryption schemes. We tested various HbHAI-protected datasets (non public preview) using traditional unsupervised and supervised learning techniques (clustering, classification, deep neural networks) with classical unmodified AI algorithms. This paper presents technical results from an independent analysis conducted with those different, off-the-shelf AI algorithms. The aim was to assess the security, operability and performance claims regarding HbHAI techniques. As a results, our results confirm most these claims, with only a few minor reservations.

cs.CR↗

arXiv2020

Key-dependent Security of Stream Ciphers

The control of the cryptography is more than ever a recurrent issue. As the current international regulation does not apply in the signatory countries, the concept of enforcing backdoors in encryption system is reborn with more strength. This paper deals with a particular class of stream cipher backdoors. This class, under a different form, has been widely used by the industry in the 80s and 90s in the context of the export control rules imposed by the US to the Western countries. We propose here a new system -- called BSEA-2, with a 128-bit secret key -- which is a seemingly minor modification of BSEA-1, a system proposed in \cite{filiol_bsea1}. BSEA-2 illustrates, in a simple and didactic~\textemdash~it has been also designed for a MSc cryptanalysis course~\textemdash~but efficient way the concept of key-dependent cryptographic security. The aim is to keep control on encryption means that a country/provider could provide to another country/client for which the secret key are also provided. With such systems, changing the key class results in downgrading the cryptographic security.

cs.CR↗

arXiv2019

BSEA-1 - A Stream Cipher Backdooring Technique

cs.CR↗

arXiv2018

Developing a K-ary malware using Blockchain

Cyberattacks are nowadays moving rapidly. They are customized, multi-vector, staged in multiple flows and targeted. Moreover, new hacking playgrounds appeared to reach mobile network, modern architectures and smart cities. For that purpose, malware use different entry points and plug-ins. In addition, they are now deploying several techniques for obfuscation, camouflage and analysis resistance. On the other hand, antiviral protections are positioning innovative approaches exposing malicious indicators and anomalies, revealing assumptions of the limitations of the anti-antiviral mechanisms. Primarily, this paper exposes a state of art in computer virology and then introduces a new concept to create undetectable malware based on the blockchain technology. It summarizes techniques adopted by malicious software to avoid functionalities implemented for viral detection and presents the implementation of new viral techniques that leverage the blockchain network.

cs.CR↗

arXiv2018

OSINT Analysis of the TOR Foundation

This research paper is a study on the TOR Foundation and the TOR Network. Due to the blind confidence over this network and this foundation we have collect data and gather information in open sources to understand how it is organized. We discovered that the US government is very active through the financial aspect and development aspect. Furthermore, we discovered that some critical points of the TOR network are running by unknown people who have special nodes and the foundations never talks about them.

cs.CR↗

arXiv2017

Advances in Security in Computing and Communications

In the era of Internet of Things (IoT) and with the explosive worldwide growth of electronic data volume, and associated need of processing, analysis, and storage of such humongous volume of data, several new challenges are faced in protect-ing privacy of sensitive data and securing systems by designing novel schemes for secure authentication, integrity protection, encryption, and non-repudiation. Lightweight symmetric key cryptography and adaptive network security algo-rithms are in demand for mitigating these challenges. This book presents some of the state-of-the-art research work in the field of cryptography and security in computing and communications. It is a valuable source of knowledge for re-searchers, engineers, practitioners, graduates, and doctoral students who are working in the field of cryptography, network security, and security and privacy issues in the Internet of Things (IoT). It will also be useful for faculty members of graduate schools and universities.

cs.CR↗

arXiv2017

Mathematical Backdoors in Symmetric Encryption Systems - Proposal for a Backdoored AES-like Block Cipher

Recent years have shown that more than ever governments and intelligence agencies try to control and bypass the cryptographic means used for the protection of data. Backdooring encryption algorithms is considered as the best way to enforce cryptographic control. Until now, only implementation backdoors (at the protocol/implementation/management level) are generally considered. In this paper we propose to address the most critical issue of backdoors: mathematical backdoors or by-design backdoors, which are put directly at the mathematical design of the encryption algorithm. While the algorithm may be totally public, proving that there is a backdoor, identifying it and exploiting it, may be an intractable problem. We intend to explain that it is probably possible to design and put such backdoors. Considering a particular family (among all the possible ones), we present BEA-1, a block cipher algorithm which is similar to the AES and which contains a mathematical backdoor enabling an operational and effective cryptanalysis. The BEA-1 algorithm (80-bit block size, 120-bit key, 11 rounds) is designed to resist to linear and differential cryptanalyses. A challenge will be proposed to the cryptography community soon. Its aim is to assess whether our backdoor is easily detectable and exploitable or not.

cs.CR↗

arXiv2016

Glassbox: Dynamic Analysis Platform for Malware Android Applications on Real Devices

Android is the most widely used smartphone OS with 82.8% market share in 2015. It is therefore the most widely targeted system by malware authors. Researchers rely on dynamic analysis to extract malware behaviors and often use emulators to do so. However, using emulators lead to new issues. Malware may detect emulation and as a result it does not execute the payload to prevent the analysis. Dealing with virtual device evasion is a never-ending war and comes with a non-negligible computation cost. To overcome this state of affairs, we propose a system that does not use virtual devices for analysing malware behavior. Glassbox is a functional prototype for the dynamic analysis of malware applications. It executes applications on real devices in a monitored and controlled environment. It is a fully automated system that installs, tests and extracts features from the application for further analysis. We present the architecture of the platform and we compare it with existing Android dynamic analysis platforms. Lastly, we evaluate the capacity of Glassbox to trigger application behaviors by measuring the average coverage of basic blocks on the AndroCoverage dataset. We show that it executes on average 13.52% more basic blocks than the Monkey program.

cs.CR↗

arXiv2016

Hacking of the AES with Boolean Functions

One of the major issues of cryptography is the cryptanalysis of cipher algorithms. Cryptanalysis is the study of methods for obtaining the meaning of encrypted information, without access to the secret information that is normally required. Some mechanisms for breaking codes include differential cryptanalysis, advanced statistics and brute-force. Recent works also attempt to use algebraic tools to reduce the cryptanalysis of a block cipher algorithm to the resolution of a system of quadratic equations describing the ciphering structure. In our study, we will also use algebraic tools but in a new way: by using Boolean functions and their properties. A Boolean function is a function from $F_2^n\to F_2$ with $n>1$, characterized by its truth table. The arguments of Boolean functions are binary words of length $n$. Any Boolean function can be represented, uniquely, by its algebraic normal form which is an equation which only contains additions modulo 2 - the XOR function - and multiplications modulo 2 - the AND function. Our aim is to describe the AES algorithm as a set of Boolean functions then calculate their algebraic normal forms by using the M\"obius transforms. After, we use a specific representation for these equations to facilitate their analysis and particularly to try a combinatorial analysis. Through this approach we obtain a new kind of equations system. This equations system is more easily implementable and could open new ways to cryptanalysis.

cs.CR↗

arXiv2014

A Corollary of Hamada and Ohmori's on Group Law over BIBD

In this note, we present an interesting corollary of a theorem of Hamada and Ohmori. We prove that the complementary of PG(n,2) is the only design, up to an isomorphism, whose blocks form a group for the symmetric difference.

math.CO↗

arXiv2010

PERSEUS Technology: New Trends in Information and Communication Security

Using cryptography to protect information and communication has bacically two major drawbacks. First, the specific entropy profile of encrypted data makes their detection very easy. Second, the use of cryptography can be more or less regulated, not to say forbidden, according to the countries. If the right to freely protect our personal and private data is a fundamental right, it must not hinder the action of Nation States with respect to National security. Allowing encryption to citizens holds for bad guys as well. In this paper we propose a new approach in information and communication security that may solve all these issues, thus representing a rather interesting trade-off between apparently opposite security needs. We introduce the concept of scalable security based on computationnally hard problem of coding theory with the PERSEUS technology. The core idea is to encode date with variable punctured convolutional codes in such a way that any cryptanalytic attempt will require a time-consuming encoder reconstruction in order to decode. By adding noise in a suitable way, that reconstruction becomes untractable in practice except for Intelligence services that however must use supercomputers during a significant, scalable amount of time. Hence it limits naturally any will to unduly performs such attacks (eg. against citizens' privacy). On the users' side, encoder and noise parameters are first exchanged through an initial, short HTTPS session. The principles behind that approach have been mathematically validated in 1997 and 2007. We present the PERSEUS library we have developed under the triple GPL/LGPL/MPL licences. This library can be used to protect any kind of data.

cs.CR↗

arXiv2010

Processor-Dependent Malware... and codes

Malware usually target computers according to their operating system. Thus we have Windows malwares, Linux malwares and so on ... In this paper, we consider a different approach and show on a technical basis how easily malware can recognize and target systems selectively, according to the onboard processor chip. This technology is very easy to build since it does not rely on deep analysis of chip logical gates architecture. Floating Point Arithmetic (FPA) looks promising to define a set of tests to identify the processor or, more precisely, a subset of possible processors. We give results for different families of processors: AMD, Intel (Dual Core, Atom), Sparc, Digital Alpha, Cell, Atom ... As a conclusion, we propose two {\it open problems} that are new, to the authors' knowledge.

cs.CR↗

arXiv2010

Malicious cryptography techniques for unreversable (malicious or not) binaries

Fighting against computer malware require a mandatory step of reverse engineering. As soon as the code has been disassemblied/decompiled (including a dynamic analysis step), there is a hope to understand what the malware actually does and to implement a detection mean. This also applies to protection of software whenever one wishes to analyze them. In this paper, we show how to amour code in such a way that reserse engineering techniques (static and dymanic) are absolutely impossible by combining malicious cryptography techniques developped in our laboratory and new types of programming (k-ary codes). Suitable encryption algorithms combined with new cryptanalytic approaches to ease the protection of (malicious or not) binaries, enable to provide both total code armouring and large scale polymorphic features at the same time. A simple 400 Kb of executable code enables to produce a binary code and around $2^{140}$ mutated forms natively while going far beyond the old concept of decryptor.

cs.CR↗

arXiv2009

Formalization of malware through process calculi

Since the seminal work from F. Cohen in the eighties, abstract virology has seen the apparition of successive viral models, all based on Turing-equivalent formalisms. But considering recent malware such as rootkits or k-ary codes, these viral models only partially cover these evolved threats. The problem is that Turing-equivalent models do not support interactive computations. New models have thus appeared, offering support for these evolved malware, but loosing the unified approach in the way. This article provides a basis for a unified malware model founded on process algebras and in particular the Join-Calculus. In terms of expressiveness, the new model supports the fundamental definitions based on self-replication and adds support for interactions, concurrency and non-termination allows the definition of more complex behaviors. Evolved malware such as rootkits can now be thoroughly modeled. In terms of detection and prevention, the fundamental results of undecidability and isolation still hold. However the process-based model has permitted to establish new results: identification of fragments from the Join-Calculus where malware detection becomes decidable, formal definition of the non-infection property, approximate solutions to restrict malware propagation.

cs.CR↗

arXiv2009

Malware Detection using Attribute-Automata to parse Abstract Behavioral Descriptions

Most behavioral detectors of malware remain specific to a given language and platform, mostly PE executables for Windows. The objective of this paper is to define a generic approach for behavioral detection based on two layers respectively responsible for abstraction and detection. The first abstraction layer remains specific to a platform and a language. This first layer interprets the collected instructions, API calls and arguments and classifies these operations as well as the involved objects according to their purpose in the malware lifecycle. The second detection layer remains generic and is totally interoperable between the different abstraction components. This layer relies on parallel automata parsing attribute-grammars where semantic rules are used for object typing (object classification) and object binding (data-flow). To feed detection and to experiment with our approach we have developed two different abstraction components: one processing system call traces from native code and one processing the VBScript interpreted language. The different experimentations have provided promising detection rates, in particular for script files (89%), with almost none false positives. In the case of process traces, the detection rate remains significant (51%) but could be increased by more sophisticated collection tools.

cs.CR↗