First this paper measures and analyzes various trade-offs between different DNSSEC configurations, such as, NSEC, NSEC3, aggressive caching, and online vs. offline signing. These measurements expose a trade-off between (1) aggressive caching DNSSEC configuration that provides excellent performance (higher robustness to DDoS attacks) but is vulnerable to zone enumeration attacks in addition to offline signing disadvantages, and (2) online signing DNSSEC configuration, that prevent zone enumeration but is more susceptible to DDoS attacks due to lower maximum throughput. Second, following these, we suggest and evaluate an alternative, Adaptive DNS over QUIC, (AdaDoQ), an adaptive, efficient and secure communication layer between a DNS resolver and the authoritative servers, that offers a better trade-off between DDoS resiliency and security. Under normal load conditions the resolver communicates with each authoritative server with standard DNSSEC however, when the traffic load increases, AdaDoQ switches to a QUIC connection with heavily communicating authoritative server(s), for as long as the traffic load is high. The public key of the authoritative ZSK (which is verifiable through the DNSSEC chain of trust) is integrated into the symmetric key creation in QUIC to provide a DNSSEC level of authenticity and security. AdaDoQ ensures DNS authenticity, good throughput, and disables zone walking attacks, DNS hijacking, and cache poisoning.
The widespread sharing of anonymized graph datasets for research and public use has raised new privacy concerns, as sensitive information can often be re-identified through advanced deanonymization techniques. Existing graph deanonymization methods span a variety of strategies, including structural alignment, embedding-based matching, and feature extraction combined with machine learning classifiers. However, these approaches remain grounded in graph-specific workflows. In this paper, we introduce G2TA (Graph to Table Attack), a novel attack framework that bridges graph and tabular privacy domains. By transforming anonymized graphs into semantically enriched tabular representations that capture structural patterns and neighborhood-level attribute signals, our approach enables the use of record linkage and quasi-identifier-based attacks originally developed for tabular datasets. These semantic features preserve node-to-neighborhood relationships that are crucial for identity recovery. We evaluate the framework on anonymized graphs and compare it to well-known graph-based attacks, showing that meaningful re-identification is possible, even without graph-specific algorithms. We also evaluated our methodology on differentially private graphs. Our findings underscore the importance of privacy evaluations that account for both graph-specific threats and relational tabular attacks before public release.
Industry 4.0 drives the ICS and SCADA systems to utilize the cloud for its significant benefits. New models, designs, and applications of traditional ICS systems incorporate the cloud to enhance and streamline industrial processes. In this paper, we propose a novel model that utilizes avatar processes for devices in the ICS system, such as PLCs. The avatar runs on the cloud and executes PLC tasks. The avatar can perform heavy computations that were previously impossible, especially for legacy devices standard in these systems. We also describe a security architecture for our system that thwarts cybersecurity threats that may arise from attackers on the cloud. Furthermore, we introduce a new decentralized architecture that combines blockchain with avatars to secure our ecosystem. In total, our system enhances the industrial process and enables engineers to easily incorporate complex logic into their (potentially heterogeneous and legacy) systems.
Managing the timing and delays of computing events is central to distributed systems. Timed cryptography, such as time-lock puzzles (introduced almost 30 years ago) and verifiable delay functions, provides central tools for such tasks: A single party (the committer) knows a secret, commits to it publicly, and then the committed secret can be opened via a time-consuming staged computation by any observer; this process is independent of post-commitment actions by or presence of the committer. Implicit in this scenario is the requirement that the committer itself does not attack the system, and, say, prematurely selectively leak or de-commit the value, either maliciously or due to external attacks. To prevent the above attack and to expand timed-delayed cryptography to address more applications, we initiate here the study of how to distributedly hold a timed secret known neither to any individual party nor to any group smaller than a quorum. This primitive is defined in the context of multi-party computation (MPC). In fact, this implements a setting where a group of parties simultaneously learn a secret that has been kept private for a predetermined amount of time, and could have been collectively generated without a single party controlling its generation (as in distributed key generation scenarios). This new paradigm, and the ability to compose such protocols, also extends time-lock functionalities to applications where a firm commitment by a group of parties to future release is executed even without knowing the underlying secrets and even without assuming cooperation or availability of parties in the future. Sample applications requiring such delayed disclosure include accountable future scanning of software for zero-day vulnerabilities and accountable, secure sharing of clinical trial documents. We design the first secure practical protocol for Multi-party Time-lock Puzzles (MTP), a new primitive centered on the inherently needed distributed generation of a time-lock puzzle, and the inability to prematurely reconstruct the committed value unless a quorum of parties is compromised. We then leverage MTP to build Timed Multi-party Computation (TMPC), which we model as MPC with a single time-locked output.
This paper studies Locally Maximal Satisfying Truth Assignments (LMSTAs) of satisfiable random k-SAT formulas via Kolmogorov complexity. For Kolmogorov-random instances, we show that the fraction of zeros in any LMSTA lies in a contiguous sub-interval of (0, 1) whose bounds depend on the clause-to-variable ratio r. We further derive a mixed-width version that applies to heterogeneous CNFs. As case studies, we analyse the standard SAT encodings of 200-round Trivium and the public 30-round Bivium benchmark and prove that no LMSTAs exist for either, ruling out single-bit “local traps”. This work links information-theoretic randomness to local maximality providing a heuristic, compression-based test for real-world SAT reductions in cryptography.
