arXiv subjects

Reihaneh Safavi-Naini

Publications and source records attributed to Reihaneh Safavi-Naini.

31 records · Page 2Linked to original sources

arXiv2018

A New Look at the Refund Mechanism in the Bitcoin Payment Protocol

BIP70 is the Bitcoin payment protocol for communication between a merchant and a pseudonymous customer. McCorry et al. (FC~2016) showed that BIP70 is prone to refund attacks and proposed a fix that requires the customer to sign their refund request. They argued that this minimal change will provide resistance against refund attacks. In this paper, we point out the drawbacks of McCorry et al.'s fix and propose a new approach for protection against refund attacks using the Bitcoin multi-signature mechanism. Our solution does not rely on merchants storing refund requests, and unlike the previous solution, allows updating refund addresses through email. We discuss the security of our proposed method and compare it with the previous solution. We also propose a novel application of our refund mechanism in providing anonymity for payments between a payer and payee in which merchants act as mixing servers. We finally discuss how to combine the above two mechanisms in a single payment protocol to have an anonymous payment protocol secure against refund attacks.

cs.CR↗

arXiv2018

HCAP: A History-Based Capability System for IoT Devices

Permissions are highly sensitive in Internet-of-Things (IoT) applications, as IoT devices collect our personal data and control the safety of our environment. Rather than simply granting permissions, further constraints shall be imposed on permission usage so as to realize the Principle of Least Privilege. Since IoT devices are physically embedded, they are often accessed in a particular sequence based on their relative physical positions. Monitoring if such sequencing constraints are honoured when IoT devices are accessed provides a means to fence off malicious accesses. This paper proposes a history-based capability system, HCAP, for enforcing permission sequencing constraints in a distributed authorization environment. We formally establish the security guarantees of HCAP, and empirically evaluate its performance.

cs.CR↗

arXiv2017

Non-Malleable Codes with Leakage and Applications to Secure Communication

Non-malleable codes are randomized codes that protect coded messages against modification by functions in a tampering function class. These codes are motivated by providing tamper resilience in applications where a cryptographic secret is stored in a tamperable storage device and the protection goal is to ensure that the adversary cannot benefit from their tamperings with the device. In this paper we consider non-malleable codes for protection of secure communication against active physical layer adversaries. We define a class of functions that closely model tampering of communication by adversaries who can eavesdrop on a constant fraction of the transmitted codeword, and use this information to select a vector of tampering functions that will be applied to a second constant fraction of codeword components (possibly overlapping with the first set). We derive rate bounds for non-malleable codes for this function class and give two modular constructions. The first construction adapts and provides new analysis for an existing construction in the new setting. The second construction uses a new approach that results in an explicit construction of non-malleable codes. We show applications of our results in securing message communication against active physical layer adversaries in two settings: wiretap II with active adversaries and Secure Message Transmission (SMT) in networks. We discuss our results and directions for future work.

cs.CR↗

arXiv2016

Detecting Algebraic Manipulation in Leaky Storage Systems

Algebraic Manipulation Detection (AMD) Codes detect adversarial noise that is added to a coded message and stored in a storage that is opaque to the adversary. We study AMD codes when the storage can leak up to ρ\log|G| bits of information about the stored codeword, where G is the group in which the stored codeword lives and ρis a constant. We propose ρ-AMD codes that provide protection in this new setting, and define weak and strong ρ-AMD codes that provide security for a random and an arbitrary message, respectively. We derive concrete and asymptotic bounds for the efficiency of these codes featuring a rate upper bound of 1-ρfor the strong codes. We also define the class of ρ^{LV}-AMD codes that provide protection when leakage is in the form of a number of codeword components, and give constructions featuring a strong ρ^{LV}-AMD codes that asymptotically achieve the rate 1-ρ. We describe applications of ρ-AMD codes to, (i) robust ramp secret sharing scheme and, (ii) wiretap II channel when the adversary can eavesdrop a ρfraction of codeword components and tamper with all components of the codeword.

cs.IT↗

arXiv2016

Information-theoretically Secure Key Agreement over Partially Corrupted Channels

Key agreement is a fundamental cryptographic primitive. It has been proved that key agreement protocols with security against computationally unbounded adversaries cannot exist in a setting where Alice and Bob do not have dependent variables and communication between them is fully public, or fully controlled by the adversary. In this paper we consider this problem when the adversary can "partially" control the channel. We motivate these adversaries by considering adversarial corruptions at the physical layer of communication, give a definition of adversaries that can "partially" eavesdrop and "partially" corrupt the communication. We formalize security and reliability of key agreement protocols, derive bounds on the rate of key agreement, and give constructions that achieve the bound. Our results show that it is possible to have secret key agreement as long as some of the communicated symbols remain private and unchanged by the adversary. We relate our results to the previous known results, and discuss future work.

cs.CR↗

arXiv2015

Adversarial Wiretap Channel with Public Discussion

Wyner's elegant model of wiretap channel exploits noise in the communication channel to provide perfect secrecy against a computationally unlimited eavesdropper without requiring a shared key. We consider an adversarial model of wiretap channel proposed in [18,19] where the adversary is active: it selects a fraction $ρ_r$ of the transmitted codeword to eavesdrop and a fraction $ρ_w$ of the codeword to corrupt by "adding" adversarial error. It was shown that this model also captures network adversaries in the setting of 1-round Secure Message Transmission [8]. It was proved that secure communication (1-round) is possible if and only if $ρ_r + ρ_w <1$. In this paper we show that by allowing communicants to have access to a public discussion channel (authentic communication without secrecy) secure communication becomes possible even if $ρ_r + ρ_w >1$. We formalize the model of \awtppd protocol and for two efficiency measures, {\em information rate } and {\em message round complexity} derive tight bounds. We also construct a rate optimal protocol family with minimum number of message rounds. We show application of these results to Secure Message Transmission with Public Discussion (SMT-PD), and in particular show a new lower bound on transmission rate of these protocols together with a new construction of an optimal SMT-PD protocol.

cs.CR↗

arXiv2014

A Model for Adversarial Wiretap Channel

In wiretap model of secure communication the goal is to provide (asymptotic) perfect secrecy and reliable communication over a noisy channel that is eavesdropped by an adversary with unlimited computational power. This goal is achieved by taking advantage of the channel noise and without requiring a shared key. The model has attracted attention in recent years because it captures eavesdropping attack in wireless communication. The wiretap adversary is a passive eavesdropping adversary at the physical layer of communication. In this paper we propose a model for adversarial wiretap (AWTP) channel that models active adversaries at this layer. We consider a $(ρ_r, ρ_w)$ wiretap adversary who can see a fraction $ρ_r$, and modify a fraction $ρ_w$, of the sent codeword. The code components that are read and/or modified can be chosen adaptively, and the subsets of read and modified components in general, can be different. AWTP codes provide secrecy and reliability for communication over these channels. We give security and reliability definitions and measures for these codes, and define secrecy capacity of an AWTP channel that represents the secrecy potential of the channel. The paper has two main contributions. First, we prove a tight upper bound on the rate of AWTP codes with perfect secrecy for $(ρ_r, ρ_w)$-AWTP channels, and use the bound to derive the secrecy capacity of the channel. We prove a similar bound for $ε$-secure codes also, but in this case the bound is not tight. Second, we give an explicit construction for a capacity achieving AWTP code family, and prove its security and efficiency properties. We show that AWTP model is a natural generalization of Wyner's wiretap models and somewhat surprisingly, also provides a direct generalization for a seemingly unrelated cryptographic primitive, Secure Message Transmission (SMT).

cs.CR↗

arXiv2014

Efficient Codes for Adversarial Wiretap Channels

In [13] we proposed a (ρ_r , ρ_w )-adversarial wiretap channel model (AWTP) in which the adversary can adaptively choose to see a fraction ρ_r of the codeword sent over the channel, and modify a fraction ρ_w of the codeword by adding arbitrary noise values to them. In this paper we give the first efficient construction of a capacity achieving code family that provides perfect secrecy for this channel.

cs.IT↗

arXiv2014

Multipath Private Communication: An Information Theoretic Approach

Sending private messages over communication environments under surveillance is an important challenge in communication security and has attracted attentions of cryptographers through time. We believe that resources other than cryptographic keys can be used for communication privacy. We consider private message transmission (PMT) in an abstract multipath communication model between two communicants, Alice and Bob, in the presence of an eavesdropper, Eve. Alice and Bob have pre-shared keys and Eve is computationally unbounded. There are a total of $n$ paths and the three parties can have simultaneous access to at most $t_a$, $t_b$, and $t_e$ paths. The parties can switch their paths after every $λ$ bits of communication. We study perfect (P)-PMT versus asymptotically-perfect (AP)-PMT protocols. The former has zero tolerance of transmission error and leakage, whereas the latter allows for positive error and leakage that tend to zero as the message length increases. We derive the necessary and sufficient conditions under which P-PMT and AP-PMT are possible. We also introduce explicit P-PMT and AP-PMT constructions. Our results show AP-PMT protocols attain much higher information rates than P-PMT ones. Interestingly, AP-PMT is possible even in poorest condition where $t_a=t_b=1$ and $t_e=n-1$. It remains however an open question whether the derived rates can be improved by more sophisticated AP-PMT protocols. We study applications of our results to private communication over the real-life scenarios of multiple-frequency links and multiple-route networks. We show practical examples of such scenarios that can be abstracted by the multipath setting: Our results prove the possibility of keyless information-theoretic private message transmission at rates $17\%$ and $20\%$ for the two example scenarios, respectively. We discuss open problems and future work at the end.

cs.CR↗

arXiv2013

Efficient Codes for Limited View Adversarial Channels

We introduce randomized Limited View (LV) adversary codes that provide protection against an adversary that uses their partial view of the communication to construct an adversarial error vector to be added to the channel. For a codeword of length N, the adversary selects a subset of ρ_rN of the codeword components to "see", and then "adds" an adversarial error vector of weight ρ_wN to the codeword. Performance of the code is measured by the probability of the decoder failure in recovering the sent message. An (N, q^{RN},δ)-limited view adversary code ensures that the success chance of the adversary in making decoder fail, is bounded by δwhen the information rate of the code is at least R. Our main motivation to study these codes is providing protection for wireless communication at the physical layer of networks. We formalize the definition of adversarial error and decoder failure, construct a code with efficient encoding and decoding that allows the adversary to, depending on the code rate, read up to half of the sent codeword and add error on the same coordinates. The code is non-linear, has an efficient decoding algorithm, and is constructed using a message authentication code (MAC) and a Folded Reed-Solomon (FRS) code. The decoding algorithm uses an innovative approach that combines the list decoding algorithm of the FRS codes and the MAC verification algorithm to eliminate the exponential size of the list output from the decoding algorithm. We discuss application of our results to Reliable Message Transmission problem, and open problems for future work.

cs.IT↗

arXiv2013

Secure Distance Bounding Verification using Physical-Channel Properties

We consider the problem of distance bounding verification (DBV), where a proving party claims a distance and a verifying party ensures that the prover is within the claimed distance. Current approaches to "secure" distance estimation use signal's time of flight, which requires the verifier to have an accurate clock. We study secure DBV using physical channel properties as an alternative to time measurement. We consider a signal propagation environment that attenuates signal as a function of distance, and then corrupts it by an additive noise. We consider three attacking scenarios against DBV, namely distance fraud (DFA), mafia fraud (MFA) and terrorist fraud (TFA) attacks. We show it is possible to construct efficient DBV protocols with DFA and MFA security, even against an unbounded adversary; on the other hand, it is impossible to design TFA-secure protocols without time measurement, even with a computationally-bounded adversary. We however provide a TFA-secure construction under the condition that the adversary's communication capability is limited to the bounded retrieval model (BRM). We use numerical analysis to examine the communication complexity of the introduced DBV protocols. We discuss our results and give directions for future research.

cs.CR↗

arXiv2010

New Results on Secret Key Establishment over a Pair of Broadcast Channels

The problem of Secret Key Establishment (SKE) over a pair of independent Discrete Memoryless Broadcast Channels (DMBCs) has already been studied in \cite{Ah10}, where we provided lower and upper bounds on the secret-key capacity. In this paper, we study the above setup under each of the following two cases: (1) the DMBCs have secrecy potential, and (2) the DMBCs are stochastically degraded with independent channels. In the former case, we propose a simple SKE protocol based on a novel technique, called Interactive Channel Coding (ICC), and prove that it achieves the lower bound. In the latter case, we give a simplified expression for the lower bound and prove a single-letter capacity formula under the condition that one of the legitimate parties sends only i.i.d. variables.

cs.IT↗

arXiv2010

Secret Key Establishment over a Pair of Independent Broadcast Channels

This paper considers the problem of information-theoretic Secret Key Establishment (SKE) in the presence of a passive adversary, Eve, when Alice and Bob are connected by a pair of independent discrete memoryless broadcast channels in opposite directions. We refer to this setup as 2DMBC. We define the secret-key capacity in the 2DMBC setup and prove lower and upper bounds on this capacity. The lower bound is achieved by a two-round SKE protocol that uses a two-level coding construction. We show that the lower and the upper bounds coincide in the case of degraded DMBCs.

cs.IT↗