The procedure for extracting a cryptographic key from noisy sources, such as biometrics and physically uncloneable functions (PUFs), is known as fuzzy extractor (FE). Although FE constructions deal with discrete sources, most noisy sources are continuous. In the continuous case, it is required to transform the source to a discrete one. We introduce a 1) model-based uncoupling construction that directly deals with the continuous noisy source and produces helper data uncoupling the discrete representation from the noisy source, guaranteeing the diversity of the discrete representation, and making it more robust and a 2) strengthened uncoupled fuzzy extractor, suitable for privacy-preserving applications, which integrates an additional fixed authentication factor and obtains a key uncoupled to the noisy sources and unlinkable helper data. We present optimal model-based uncoupling constructions for Gaussian sources. Specifically, we show how to: 1) extract one or multiple bits from a single Gaussian source; 2) extract one bit from several unreliable Gaussian sources; and 3) provide a general procedure to obtain an optimal uncoupled FE from Gaussian source(s). Our experiments show that the proposed constructions achieve much higher security levels for wide operational scenarios, approximately doubling the obtained effective key length without affecting false rejection rates.

This paper targets the efficient implementation of digital signatures and signcryption schemes on typical internet-of-things (IoT) devices, i.e. embedded processors with constrained computation power and storage. Both signcryption schemes (providing digital signatures and encryption simultaneously) and digital signatures rely on computation-intensive public-key cryptography. When the number of signatures or encrypted messages the device needs to generate after deployment is limited, a trade-off can be made between performing the entire computation on the embedded device or moving part of the computation to a precomputation phase. The latter results in the storage of the precomputed values in the memory of the processor. We examine this trade-off on a health sensor platform and we additionally apply storage encryption, resulting in five implementation variants of the considered schemes.

Biometrics are widely used for authentication in several domains, services and applications. However, only very few systems succeed in effectively combining highly secure user authentication with an adequate privacy protection of the biometric templates, due to the difficulty associated with jointly providing good authentication performance, unlinkability and irreversibility to biometric templates. This thwarts the use of biometrics in remote authentication scenarios, despite the advantages that this kind of architectures provides. We propose a user-specific approach for decoupling the biometrics from their binary representation before using biometric protection schemes based on fuzzy extractors. This allows for more reliable, flexible, irreversible and unlinkable protected biometric templates. With the proposed biometrics decoupling procedures, biometric metadata, that does not allow to recover the original biometric template, is generated. However, different biometric metadata that are generated starting from the same biometric template remain statistically linkable, therefore we propose to additionally protect these using a second authentication factor (e.g., knowledge or possession based). We demonstrate the potential of this approach within a two-factor authentication protocol for remote biometric authentication in mobile scenarios.

Weak security, excessive personal data collection for user profiling, and a poor user experience are just a few of the many problems that mobile authentication solutions suffer from. Despite being an interesting platform, mobile devices are still not being used to their full potential for authentication. n-Auth is a firm step in unlocking the full potential of mobile devices in authentication, by improving both security and usability whilst respecting the privacy of the user. Our focus is on the combined usage of several strong cryptographic techniques with secure HCI design principles to achieve a better user experience. We specified and built n-Auth, for which robust Android and iOS apps are openly available through the official stores.

A sparse Merkle tree is an authenticated data structure based on a perfect Merkle tree of intractable size. It contains a distinct leaf for every possible output from a cryptographic hash function, and can be simulated efficiently because the tree is sparse (i.e., most leaves are empty). We are the first to provide complete, succinct, and recursive definitions of a sparse Merkle tree and related operations. We show that our definitions enable efficient space-time trade-offs for different caching strategies, and that verifiable audit paths can be generated to prove (non-)membership in practically constant time (<4 ms) when using SHA-512/256. This is despite a limited amount of space for the cache—smaller than the size of the underlying data structure being authenticated—and full (concrete) security in the multi-instance setting.

Service providers collect and process more user data then ever, while users of these services remain oblivious to the actual processing and utility of the processed data to the service providers. This leads users to put less trust in service providers and be more reluctant to share data. Transparency logging is about service providers continuously logging descriptions of the data processing on their users’ data, where each description is intended for a particular user. We propose Insynd, a new cryptographic scheme for privacy-preserving transparency logging. Insynd improves on prior work by (1) increasing the utility of all data sent through the scheme thanks to our publicly verifiable proofs: one can disclose selected events without having to disclose any long term secrets; and (2) enabling a stronger adversarial model: Inysnd can deal with an untrusted server (such as commodity cloud services) through the use of an authenticated data structure named Balloon. Finally, our publicly available prototype implementation shows greatly improved performance with respect to related work and competitive performance for more data-intensive settings like secure logging.

We present Balloon, a forward-secure append-only persistent authenticated data structure. Balloon is designed for an initially trusted author that generates events to be stored in a data structure (the Balloon) kept by an untrusted server, and clients that query this server for events intended for them based on keys and snapshots. The data structure is persistent such that clients can query keys for the current or past versions of the data structure based upon snapshots, which are generated by the author as new events are inserted. The data structure is authenticated in the sense that the server can verifiably prove all operations with respect to snapshots created by the author. No event inserted into the data structure prior to the compromise of the author can be modified or deleted without detection due to Balloon being publicly verifiable. Balloon supports efficient (non-) membership proofs and verifiable inserts by the author, enabling the author to verify the correctness of inserts without having to store a copy of the Balloon. We formally define and prove that Balloon is a secure authenticated data structure.

With the constant news of data breaches and global (governmental) surveillance, endusers are becoming more and more reluctant to share sensitive data. As a result trust of end-users is an essential business enabler. For the end-user, sharing data with companies is often a prerequisite for using their services. Moreover, for certain services, e.g., governmental and healthcare services, end-users do not really have the option to not share personal data with these services. There is an information asymmetry between the organisations that handle personal data and the individuals to whom these data relate: these organisations know more about the individual than just the data disclosed by that individual (e.g., inferred data, enriched data from combining these with other databases), while the individual has little information on what these organisations do with the collected personal data. By offering transparency, e.g., through the deployment of transparency-enhancing technologies (TETs) at service providers, while giving individuals insights in what is happening with their personal data, organisations can reduce this information asymmetry and profile themselves as trust-worthy. With these insights, end-users can hold organisations more accountable for their actions and file a complaint in case of abuse. With the upcoming European data protection regulation, organisations will also be required to offer some kind of transparency. An important prerequisite for individuals to put trust in the system is the integrity of the data generated by such a transparency-enhancing tool. In particular, it should be impossible to alter the information on which the individual bases his/her insights, i.e. metadata about personal data processing. Such a tool should also take into account both data privacy and confidentiality, since the mere existence of metadata already reveals information, e.g., the individual visited the hospital. Ideally, the integrity of the data generated by the tool could also be verified by a trusted third party or auditor without infringing on the individuals’ right to privacy. Within project Opacity, we developed a transparency-enhancing tool that meets these criteria: integrity, data privacy, confidentiality and public verifiability. This solution is based on strong state-of-the-art cryptographic building blocks and validated protocols. It allows organisations to easily generate an end-user specific history of data processing in real time, which can be consulted by the end-user at any point in time. The end-user is ensured of the integrity, confidentiality and timeliness of the presented events. The integrity of the global history for all end-users of a single organisation can be validated by an external auditor without violating the end-users' privacy. Finally, this tool can also be deployed for processes (data handling) that span multiple organisations. A reference implementation of this tool, named Insynd, is freely available under open source. 1 KU Leuven, COSIC and iMinds 2 Karlstad University, Department of Mathematics and Computer Science 3 Project Opacity: http://www.project-opacity.com

Physically unclonable functions (PUFs) exploit the unavoidable manufacturing variations of an Integrated Circuit (IC). Their input-output behavior serves as a unique IC “fingerprint.” Therefore, they have been envisioned as an IC authentication mechanism, in particular the subclass of so-called strong PUFs. The protocol proposals are typically accompanied with two PUF promises: lightweight and an increased resistance against physical attacks. In this work, we review 19 proposals in chronological order: from the original strong PUF proposal (2001) to the more complicated noise bifurcation and system of PUF proposals (2014). The assessment is aided by a unified notation and a transparent framework of PUF protocol requirements.

Insynd is a cryptographic scheme for privacy-preserving transparency logging. In the setting of transparency logging, a service provider continuously logs descriptions of its data processing on its users’ personal data, where each description is intended for a particular user. Our work focuses on protecting the privacy of users. Insynd provides secrecy of messages, message integrity and authenticity, protection against recipient profiling, and publicly verifiable proofs of who sent what message to which recipient at what particular time. Our scheme is built on an authenticated data structure (Balloon) that enables the safe outsourcing of storage of messages to an untrusted server (such as commodity cloud services). The author of messages is in the forward-security model. Insynd provides stronger privacy protections than prior work in this setting, improved efficiency in terms of event generation, and increases the utility of all data sent through the scheme thanks to the publicly verifiable proofs. Our prototype implementation shows greatly improved performance over related work and competitive performance for more data-intensive settings like secure logging.

The overall ePassport authentication procedure should be fast to have a sufficient throughput of people at border crossings such as airports. At the same time, the ePassport and its holder should be checked as thoroughly as possible. By speeding up the ePassport authentication procedure, more time can be spend on verification of biometrics. We demonstrate that our proposed solution allows to replace the current combination of PACE and EAC with a more efficient authentication procedure that provides even better security and privacy guarantees. When abstracting away from the time needed for the ePassport to verify the terminal's certificate, a speed-up of at least 40% in comparison with the current ePassport authentication procedure is to be expected.

Online social networks' (OSNs) epic popularity has accustomed users to the ease of sharing information. At the same time, OSNs have been a focus of privacy concerns with respect to the information shared. Therefore, it is important that users have some assurance when sharing on OSNs: popular OSNs provide users with mechanisms, to protect shared information access rights. However, these mechanisms do not allow collaboration when defining access rights for joint content related to more than one user (e.g, party pictures in which different users are being tagged). In fact, the access rights list for such content is represented by the union of the access list defined by each related user, which could result in unwanted leakage. We propose a collaborative access control scheme, based on secret sharing, in which sharing of content on OSNs is decided collaboratively by a number of related users. We demonstrate that such mechanism is feasible and benefits users' privacy.

Template protection plays a crucial role in protecting the privacy of biometric data, by providing irreversibility and unlinkability. The Glass Maze, as presented by Trugenberger at BIOSIG 2011, is a fingerprint key binding mechanism that is claimed to provide template protection. With the correct fingerprint, the key that is entangled with the fingerprint data can be retrieved. The template protection of the Glass Maze is based on the convergence properties of a Hopfield model, a neural network. We however show how to revert the Glass Maze to recover the key, without requiring a correct fingerprint. This completely breaks the irreversibility property, and hence also unlinkability.

Biometric template protection systems are expected to meet two major security requirements: irreversibility and unlinkability. We analyze the Bloom filter based iris biometric template protection system recently introduced by Rathgeb et al. at ICB 2013 and IET Biometrics 2014. We demonstrate that the scheme does not achieve unlinkability, presenting a simple attack that in the worst case succeeds with probability at least 96%. We also present a security analysis on generating false positives or recovering the key, both leading to undesirably low attack complexities: 225 for generating false positives for the smaller versions of the scheme, and a complexity between 22 and 28 for recovering the secret key.

We approach RFID privacy both from modelling and protocol point of view. Our privacy model avoids the drawbacks of several proposed RFID privacy models that either suffer from insufficient generality or put forward unrealistic assumptions regarding the adversary's ability to corrupt tags. Furthermore, our model can handle multiple readers and introduces two new privacy notions to capture the recently discovered insider attackers. We analyse multiple existing RFID protocols, demonstrating the easy applicability of our model, and propose a new wide-forward-insider private RFID authentication protocol. This protocol provides sufficient privacy guarantees for most practical applications and is the most efficient of its kind, it only requires two scalar-EC point multiplications.

In 2011 Stajano proposed Pico, a secure and easy-to-use alternative for passwords. Among the many proposals in this category, Pico stands out by being creative and convincing. However, the description as published leaves some details unspecified, and to the best of our knowledge the complete system has not yet been tested. This work presents detailed specifications and future-proof security protocols for Pico. Moreover, we present the first robust and efficient Pico implementation. Our implementation allows to further mature the Pico concept and can be used for large scale usability evaluations at negligible cost.

We present two attacks on the security of the private grouping proof by Batina et al. [1]. We introduce the first formal models for yoking proofs. One model incorporates the aspect time, ensuring that the grouping proofs were generated at a specific time. A more general variant only provides a proof that tags were together at some time. Based on these models we propose two new protocols to generate sound yoking proofs that can trivially be extended to multiple parties and that attain narrow-strong privacy.

The regulations of the European Union (EU) Council in 2004 are the basis of the deployment of electronic passports within the EU. Since then EU member states adopt the format and the access protocols to further electronic machine readable travel documents (eMRTD) like national electronic ID cards and electronic residence permits, respectively. The security protocols to communicate with an eMRTD are based on the paradigm of strong cohesion and loose coupling, i.e., each step is designed to ensure only a particular security goal like authorisation to access a certain data group, authenticity and integrity of the data, originality of the chip, or the linkage between the eMRTD and its holder. However, recently a discussion evolved to integrate the linkage security goal within the connection establishment, which currently only aims at limiting basic access of authorised terminals to the eMRTD. For instance, the BioPACE protocol proposes to replace the knowledge-based shared `secret' of PACE by a biometric-based one. The goal of the paper at hand is twofold: First, we evaluate the BioPACE protocol and propose improvements to enhance its features. Second, we analyse the expediency of integrating our BioPACE version 2 into the eMRTD domain. Our initial evaluation shows that our BioPACE version 2 is expedient if the EAC protocols and the corresponding PKI are abandoned.