Public key Kerberos (PKINIT) is a standard authentication and key establishment protocol. Unfortunately, it suffers from a security flaw when combined with smart cards. In particular, temporary access to a user’s card enables an adversary to impersonate that user for an indefinite period of time, even after the adversary’s access to the card is revoked. In this paper, we extend Shoup’s key exchange security model to the smart card setting and examine PKINIT in this model. Using this formalization, we show that PKINIT is indeed flawed, propose a fix, and provide a proof that this fix leads to a secure protocol.

The regulations of the European Union (EU) Council in 2004 are the basis of the deployment of electronic passports within the EU. Since then EU member states adopt the format and the access protocols to further electronic machine readable travel documents (eMRTD) like national electronic ID cards and electronic residence permits, respectively. The security protocols to communicate with an eMRTD are based on the paradigm of strong cohesion and loose coupling, i.e., each step is designed to ensure only a particular security goal like authorisation to access a certain data group, authenticity and integrity of the data, originality of the chip, or the linkage between the eMRTD and its holder. However, recently a discussion evolved to integrate the linkage security goal within the connection establishment, which currently only aims at limiting basic access of authorised terminals to the eMRTD. For instance, the BioPACE protocol proposes to replace the knowledge-based shared `secret' of PACE by a biometric-based one. The goal of the paper at hand is twofold: First, we evaluate the BioPACE protocol and propose improvements to enhance its features. Second, we analyse the expediency of integrating our BioPACE version 2 into the eMRTD domain. Our initial evaluation shows that our BioPACE version 2 is expedient if the EAC protocols and the corresponding PKI are abandoned.

Consulting a remote blacklist as part of verifying a token should not come at the cost of privacy. In particular, the blacklist provider should be unable to identify which tokens are being verified. The contents of the blacklist should also be protected; that is, it should not be possible to learn the contents of the blacklist, for example by querying the blacklist provider a large number of times. This paper defines a range of desirable properties for privacy preserving blacklist checking protocols, and surveys existing technical solutions to this problem. We propose adaptations where appropriate, and provide concrete performance estimates for the use case of checking whether or not a passport has been reported lost or stolen.

This paper describes a simple and generic attack against minutiae-based fingerprint authentication systems. The aim of the attack is to construct a fingerprint minutiae template, compliant to ISO/IEC standards, that matches a fixed but unknown target fingerprint. Our attack is expected to be most effective against systems that employ vicinity-based matching algorithms, i.e. systems that divide fingerprints into multiple regions and then compute similarity over these regions. The effectiveness of our attack is experimentally demonstrated against the recently proposed `Protected Minutiae Cylinder Code' (PMCC) scheme.

This paper presents 'For Human Eyes Only' (FHEO), our Firefox extension that enables one to conveniently post online messages, such as short emails, comments, and tweets in a form that discourages automatic processing of these messages. Similar to CAPTCHA systems, FHEO distorts the text to various extents. We provide a security analysis of its four default distortion profiles as well as a usability analysis that shows how these profiles affect response time and accurate understanding. Our results illustrate the security/usability tradeoffs that arise in the face of adversaries that use current, off-the-shelf optical character recognition technology in order to launch a variety of attacks. Two profiles, in particular, achieve a level of protection that seems to justify their respective usability degradation in many situations. The 'strongest' distortion profile, however, does not seem to provide a large additional security margin against the adversaries we considered.

While personalization is key to increase the usability of online services, disclosing one's preferences is undesirable from a privacy perspective, because it enables profiling through the linkage of what may otherwise be unlinkable service invocations. This paper considers an easily implementable class of obfuscation strategies as a means to mitigate these risks, and examines its privacy/ utility tradeoff. Our results are based on simulations that take place within a modular evaluation framework that can seamlessly accommodate real-world data. We conducted experiments with different simulated behaviors and using two preference populations, namely a population of maximally diverse preferences and one consisting of the movie preferences of some Netflix users. We measure utility in a way that is specific to the application of preference obfuscation. Privacy is measured in terms of unlinkability, with respect to two different adversaries. Our results show that reasonable privacy/utility tradeoffs require the disclosure of only small amounts of preference information.

Public key Kerberos (PKINIT) is a standardized authentication and key establishment protocol which is used by the Windows active directory subsystem. In this paper we show that card-based public key Kerberos is flawed. In particular, access to a user's card enables an adversary to impersonate that user even after the adversary's access to the card is revoked. The attack neither exploits physical properties of the card, nor extracts any of its secrets.

This paper describes a formal model for multiple privacy notions that apply to reputation systems and shows that, for certain classes of systems, very strong privacy notions are unachievable. In particular, it is shown that, systems where a user's reputation depends exclusively on the ratings he received, necessarily leak information about the relationship between ratings and reputations. In contrast, systems where a user's reputation depends both on the received ratings, and on the ratings received by others, potentially hide all information about this relationship. The paper concludes with guidelines for the construction of reputation systems that have the potential to retain high levels of privacy.

Based on the assumption that cloud providers can be trusted (to a certain extent) we define a trust, security and privacy preserving infrastructure that relies on trusted cloud providers to operate properly. Working in tandem with legal agreements, our open source software supports: trust and reputation management, sticky policies with fine grained access controls, privacy preserving delegation of authority, federated identity management, different levels of assurance and configurable audit trails. Armed with these tools, cloud service providers are then able to offer a reliable privacy preserving infrastructure-as-a-service to their clients.

This paper critically examines some recently proposed RFID privacy models. It shows that some models suffer from weaknesses such as insufficient generality and unrealistic assumptions regarding the adversary's ability to corrupt tags. We propose a new RFID privacy model that is based on the notion of indistinguishability and that does not suffer from the identified drawbacks. We demonstrate the easy applicability of our model by applying it to multiple existing RFID protocols.

In this paper, we introduce a framework for measuring un-linkability both per subject and for an entire system. The framework enables the evaluator to attach different sensitivities to individual items in the system, and to specify the severity of different types of error that an adversary can make. These parameters, as well as a threshold that defines what constitutes a privacy breach, may be varied for each subject in the system; the framework respects and combines these potentially differing parametrisations. It also makes use of graphs in a way that results in intuitive feedback of different levels of detail.We exhibit the behaviour of our measures in two experimental settings, namely that of adversaries that output randomly chosen partitions, and that of adversaries that launch attacks of different effectiveness.

A PN can provide the opportunity to personalize applications, services and the whole networking environment to the current needs of the user, making the security and privacy the key features in the PNs formation. In MAGNET Beyond the interest was concentrated on the importance of interactions between multiple PN users with common interests for various services, i.e. on PN Federation (PN-F). Establishing a PN Federation, the user should be able to control which information or services to share with others. For this reason the security is a very important aspect in PN-F as multiple people are involved and takes place at different levels: access to the PN Federation based on membership, secure transport of data within the federation and the access rights to resources and services of the federation. In this chapter, we present important contributions in the study of security of personal networks. To begin with, a threat analysis methodology tailored for PN and PN-F environments is described and applied to evaluate security. A reflection on user perspectives mapped onto security applications, privacy safeguarding and related protocols is encapsulated into the proposed Context Aware Security Manager component. Finally, we present a novel authentication protocol right tailored to specific low power devices needs.

Sometimes it is desirable to access password-protected resources, but undesirable to disclose the password to the machine in use. In such situations, providing the password is a task that can be delegated to a remote proxy server. This server has to engage the user in a challenge-response mechanism that does not require him to disclose his password to the local machine; if the user responds correctly, then the proxy must recover his password and fetch the protected resource for him. In this paper, we propose three schemes that are suitable for use in this environment and that do not require the proxy server to permanently store a copy of the user's password. We also briefly describe `Keep Your Password Secret' (KYPS), which is a system that implements one of the schemes, and that has been in use for almost two years.

This paper presents a hierarchy of privacy notions that covers multiple anonymity and unlinkability variants. The underlying definitions, which are based on the idea of indistinguishability between two worlds, provide new insights into the relation between, and the fundamental structure of, different privacy notions. We apply our definitions to group signatures and anonymous communication systems, and show how they relate to existing definitions.