arXiv subjects
Publications and source records attributed to Marc-André Laverdière.
This document presents brief software specification of a secure file exchange system prototype involving mutual authentication of the users via their browser and the application server with PKI-based certificates as credentials, the use of LDAP for credential management, and authentication between the application and database servers to maintain a high level of trust between all parties.
We report on the software engineering design and implementation of an web- and LDAP-based secure file exchange system with bi-directional authentication of all parties involved in the process that is the user's browsers and the application server mutually authenticate, and the application and database servers authenticate using certificates, credentials, etcs. with the directory service provided by LDAP using open-source technologies.
Cryptolysis is a framework that includes a collection of automated attacks on the classical ciphers based on the article by Clark Dawson on Optimisation heuristics for the automated cryptanalysis of classical ciphers from the Journal of Combinatorial Mathematics and Combinatorial Computing, 1998.
The purpose behind this article is to describe the features of Ftklipse, an extendable platform for computer forensics. This document designed to provide a detailed specification for the developers of Ftklipse. Ftklipse is a thick-client solution for forensics investigation. It is designed to collect and preserve evidence, to analyze it and to report on it. It supports chain of custody management, access control policies, and batch operation of its included tools in order to facilitate and accelerate the investigation. The environment itself and its tools are configurable as well and is based on Eclipse.
The purpose of this work is to design and implement a plugin-based environment that allows to integrate forensic tools working together to support programming tasks and addition of new tools. Integration is done through GUI components. The end-system environment must have user friendly GUI, configuration capabilities, plug-in capabilities to insert/inject new tools, case management, and chain of custody capabilities, along with evidence gathering capabilities, evidence preservation capabilities, and, finally report generation capabilities. A subset of these requirements has been implemented in Ftklipse, an open-source project, which is detailed throughout the rest of this document.
The functions standardized as part of ISO C 1999 and their addendums improved very little the security options from the previously available library. The largest flaw remained that no function asked for the buffer size of destination buffers for any function copying data into a user-supplied buffer. According to earlier research we performed, we know that error condition handling was the first solution to security vulnerabilities, followed by precondition validation. The standard C functions typically perform little precondition validation and error handling, allowing for a wide range of security issues to be introduced in their use. ISO/IEC TR 24731, titled as "TR 24731: Safer C library functions", defines 41 new library functions for memory copying, string handling (both for normal and wide character strings), time printing, sorting, searching etc. Another innovation it brings is a constraint handling architecture, forcing error handling when certain security-related preconditions are violated when the functions are called. It also specifies the null-termination of all strings manipulated through its function and introduces a new unsigned integer type that helps preventing integer overflows and underflows. It is currently implemented by Microsoft as part of their Visual Studio 2005 and above. We examine the architecture of our implementation of ISO/IEC TR 24731. We first introduce our architectural philosophy before informing the reader about the Siemens Four View Model, an architectural methodology for the conception of large-scale software systems. Afterwards, we examine each of the view, as architected for our library. Finally, we conclude with other software engineering matters that were of high importance in the development of our implementation.