Session
Schedule FOSDEM 2020
Security

Incrementality and deck functions

Simple protocols and efficient constructions in symmetric cryptography
UA2.114 (Baudoux)
Gilles Van Assche
Protocols in symmetric cryptography are often built from block ciphers, with a fixed input and output size, while variable sizes are handled through their modes of use. Incrementality, namely, the ability to efficiently compute the output for increasing inputs, or to request longer outputs, is often a property of the implementation rather than an explicit feature of a mode. A doubly-extendable cryptographic keyed (or deck) function is a new kind of object that makes incrementality an integral part of its definition. Writing modes for various applications, such as authenticated encryption of a network channel or disk encryption with a wide block cipher, on top of a deck function turns out to be a simple exercise and leads to less error-prone implementations than on top of a block cipher. We illustrate this with the session-supporting authenticated encryption modes SANE and SANSE. (Sessions naturally protect a continuous flow of messages or a client-server dialog.) While a deck function can be constructed from existing primitives, like a block cipher, we show two more natural ways of making a deck function in practice. The first one is based on the well-known permutation-based duplex construction, of which a nice instantiation is the Strobe protocol framework. Strobe was showcased in Noise+Strobe=Disco as an advantageous replacement to all kinds of primitives in the Noise protocol framework, resulting in much simpler specifications and a lighter implementation. Xoodyak, our candidate to the NIST Lightweight Cryptography competition, is another example. The second one is based on the recent Farfalle construction, which relies on the parallel application of a permutation. Farfalle's inherent parallelism yields deck functions that are at the same time simple and efficient on a wide range of platforms. In particular, we point out the nice performance of Kravatte and Xoofff, two deck functions based on the Keccak-p and the Xoodoo permutation, respectively. It is worth noting that Kravatte and Xoofff are much faster than AES-128 in software, and at least competitive with and often faster than AES-128 using dedicated AES instructions on the more recent Intel and AMD processors!

Additional information

Type devroom

More sessions

2/1/20
Security
Arne Padmos
UA2.114 (Baudoux)
What threats do we need to take into account when building a system? A key method for answering this question is an approach called threat modelling, whereby security problems can be anticipated during the design phase. This talk discusses major threat-modelling approaches, and includes concrete examples of how to apply them to software-intensive systems.
2/1/20
Security
Tomáš Mráz
UA2.114 (Baudoux)
Management of allowed cryptographical algorithms to disallow algorithms not allowed due to weaknesses or restrictions by certification standards is complicated task. The talk will introduce system-wide crypto-policies concept and implementation as an attempt to help system administrators with this task. This talk replaces "OSINT" talk which was schedulled initially, but David Busby could not attend on the short notice.
2/1/20
Security
Tobias Reiher
UA2.114 (Baudoux)
Security vulnerabilities are still very common in todays software. Formal methods could improve the situation, but program verification remains a complex and time-consuming task. Often, the verification of existing software is infeasible and a complete rewrite can be prohibitively expensive. Both, however, is not necessarily required to improve on the current state. By replacing critical parts of an existing software by verified code, security can be strengthened significantly with moderate ...
2/1/20
Security
Oleksii Oleksenko
UA2.114 (Baudoux)
Spectre-type attacks are a real threat to secure systems because a successful attack can undermine even an application that would be traditionally considered safe. SpecFuzz is the first tool that enables fuzzing for such vulnerabilities.
2/1/20
Security
Lorenzo Fontana
UA2.114 (Baudoux)
Linux Syscalls can be used as an entrypoint to do security analysis on Linux. However reading and processing every system call in userspace creates a very unique set of challenges. In this talk we are going to see exactly what those challenges are and how we solved them in the Falco project.
2/1/20
Security
John Lionis
UA2.114 (Baudoux)
In this presentation we take under consideration the increased use of Docker in corporate environments. It is a fact that Docker has found wide spread of use during the past years, mostly because of it being very easy to use , economic w.r.t resources used, fast and easy to deploy when compared with a full blown virtual machine. More and more servers are being operated as Docker hosts on which micro-services run in containers. From a security point of view, two aspects of it arise in the context ...
2/1/20
Security
Robert Golebiowski
UA2.114 (Baudoux)
How Transparent Data Encryption is built in MySQL and Percona Server ? - keyrings – what are they used for ? What is the difference between using a server back-end (keyringvault) versus file back-end (keyringfile). How it affects server startup and why? Why per server separation is needed in Vault Server? - How Master Key encryption works ? How it is build on page level ? How do we know which key we should fetch to decrypt a table ? How do we know that used key is the correct one ? How do we ...