Responsibility to protect and women, peace and security : aligning the protection agendas

In Responsibility to Protect and Women, Peace and Security: Aligning the Protection Agendas, editors Davies, Nwokora, Stamnes and Teitt address the intersections of the Responsibility to Protect (R2P) principle and the Women, Peace, and Security (WPS) agenda. Widespread or systematic sexual or gender-based violence is a war crime, a crime against humanity and an act of genocide, all of which are clearly addressed in the R2P principle. The protection of those at risk of widespread sexual violence is therefore not only relative to the Women, Peace and Security (WPS) agenda, but a fundamental sovereign obligation for all states as part of their commitment to R2P. Contributions from policy-makers and academics consider both the merits and the utility of aligning the protection agendas of R2P and WPS. Ultimately, a number of actionable recommendations are made concerning a unification of the agendas to best support the global empowerment of women and prevention of mass atrocities.

Formal analysis of security properties in trusted computing protocols

This research introduces a general methodology in order to create a Coloured Petri Net (CPN) model of a security protocol. Then standard or user-defined security properties of the created CPN model are identified. After adding an attacker model to the protocol model, the security property is verified using state space method. This approach is applied to analyse a number of trusted computing protocols. The results show the applicability of proposed method to analyse both standard and user-defined properties.

Challenges to Criminal Justice Reform

The Promise of Law Reform the most comprehensive examination of the institutions and processes of law reform published in the common law world and provides a rich source of information, inspiration and ideas. It is an edited collection of 30 essays published to celebrate the 30th anniversary of the Australian Law Reform Commission. The authors - law reform commissioners, judges, academics, politicians, government officials, and journalists - reflect the plurality of law reform styles and structures, within Australia and overseas. They cover the broad themes of the history, purpose and function of law reform; institutional design of law reform agencies; methodology and operations; how successful law reform should be assessed and judged; cooperation and mutual assistance; other law reform initiatives; and law reform in action.

National curriculum reform and equipping pre-service teachers to teach about Australia in the Asian Century

Currently a range of national policy settings are reshaping schooling and teacher education in Australia. This paper presents some of the findings from a small qualitative pilot study conducted with a group of final year pre-service teachers studying a secondary social science curriculum method unit in an Australian university. One of the study’s research objectives aimed at identifying how students reflected on their capacity to navigate curriculum change and, more specifically, on teaching about Australia and Asia in the forthcoming implementation of the first national history curriculum. The unit was designed and taught by the researcher on the assumption that beginning social science teachers need to be empowered to deal with the curriculum change they’ll encounter throughout their careers. The pilot study’s methodology was informed by a constructivist approach to grounded theory and its scope was limited to one semester with volunteer students. Of the pre-service teacher reflections on their preparedness to teach, this paper reports on the content, pedagogy and learning they experienced in one segment of the unit with specific reference to the new history curriculum’s ‘Australia in a world history’ approach and the development of Asia literacy. The findings indicate that whilst pre-service teachers valued the opportunity to engage with learning experiences which enhanced their intercultural understanding and extended their pedagogical and content knowledge on campus, the nature of the final practicum in schools was also influential in shaping their preparedness to enter the profession.

Security metrics for Java bytecode programs

Although there are many approaches for developing secure programs, they are not necessarily helpful for evaluating the security of a pre-existing program. Software metrics promise an easy way of comparing the relative security of two programs or assessing the security impact of modifications to an existing one. Most studies in this area focus on high level source code but this approach fails to take compiler-specific code generation into account. In this work we describe a set of object-oriented Java bytecode security metrics which are capable of assessing the security of a compiled program from the point of view of potential information flow. These metrics can be used to compare the security of programs or assess the effect of program modifications on security using a tool which we have developed to automatically measure the security of a given Java bytecode program in terms of the accessibility of distinguished ‘classified’ attributes.

New paradigms for password security

For the past several decades, cryptographers have consistently provided us with stronger and more capable primitives and protocols that have found many applications in security systems in everyday life. One of the central tenets of cryptographic design is that, whereas a system’s architecture ought to be public and open to scrutiny, the keys on which it depends — long, utterly random, unique strings of bits — will be perfectly preserved by their owner, and yet nominally inaccessible to foes.

Public sector project delay : the Malaysian perspective and the way forward

Construction delay has been a protracted problem for the Malaysian construction industry. Recent report showed that 80% of public sector projects are behind schedule. This underachieving time performance has led to many problems including public complaints, loss of reputation and revenue for the government and a slump in the industry’s GDP contribution. Research in the area of project delay has mushroomed worldwide with attempts to place mitigation plans, but delay remains a global phenomenon. There is now an urgent need for revolutionizing construction practices and past research, backed up with few successful cases suggests that Supply Chain Management (SCM) could prove beneficial to reduce or eliminate delays in construction. SCM which originated from the automotive manufacturing industry promotes a more collaborative approach to construction management and has recently gained attention of the construction industry. However every country, including Malaysia, would certainly have disparities of their own compared to others being it from the cultural point of view, nature of problems, locality or improvements needed. Therefore, this paper will present part of a Ph.D. research which aims at illustrating the Malaysian construction industry experts’ perception of the Malaysian public sector project delay, provide insight into these dilemmas, highlights the problems with current practices, its effects and the improvements needed. Subsequently, this paper would propose ratification to the problems using SCM. A semi-structured interview has been conducted to practitioners with at least 20 years’ experience in the industry. The findings showed that Malaysia may be unique compared to other countries and that by considering a number of additional factors, SCM could prove beneficial to increase efficiency of the Malaysian public sector projects.

New security notions and relations for public-key encryption

Since their introduction, the notions of indistinguishability and non-malleability have been changed and extended by different authors to support different goals. In this paper, we propose new flavors of these notions, investigate their relative strengths with respect to previous notions, and provide the full picture of relationships (i.e., implications and separations) among the security notions for public-key encryption schemes. We take into account the two general security goals of indistinguishability and non-malleability, each in the message space, key space, and hybrid message-key space to find six specific goals, a couple of them, namely complete indistinguishability and key non-malleability, are new. Then for each pair of goals, coming from the indistinguishability or non-malleability classes, we prove either an implication or a separation, completing the full picture of relationships among all these security notions. The implications and separations are respectively supported by formal proofs (i.e., reductions) in the concrete-security framework and by counterexamples.

Cyber security of networked critical infrastructures [Guest Editorial]

A new era of cyber warfare has appeared on the horizon with the discovery and detection of Stuxnet. Allegedly planned, designed, and created by the United States and Israel, Stuxnet is considered the first known cyber weapon to attack an adversary state. Stuxnet's discovery put a lot of attention on the outdated and obsolete security of critical infrastructure. It became very apparent that electronic devices that are used to control and operate critical infrastructure like programmable logic controllers (PLCs) or supervisory control and data acquisition (SCADA) systems lack very basic security and protection measures. Part of that is due to the fact that when these devices were designed, the idea of exposing them to the Internet was not in mind. However, now with this exposure, these devices and systems are considered easy prey to adversaries.

Does counting still count? Revisiting the security of counting based user authentication protocols against statistical attacks

At NDSS 2012, Yan et al. analyzed the security of several challenge-response type user authentication protocols against passive observers, and proposed a generic counting based statistical attack to recover the secret of some counting based protocols given a number of observed authentication sessions. Roughly speaking, the attack is based on the fact that secret (pass) objects appear in challenges with a different probability from non-secret (decoy) objects when the responses are taken into account. Although they mentioned that a protocol susceptible to this attack should minimize this difference, they did not give details as to how this can be achieved barring a few suggestions. In this paper, we attempt to fill this gap by generalizing the attack with a much more comprehensive theoretical analysis. Our treatment is more quantitative which enables us to describe a method to theoretically estimate a lower bound on the number of sessions a protocol can be safely used against the attack. Our results include 1) two proposed fixes to make counting protocols practically safe against the attack at the cost of usability, 2) the observation that the attack can be used on non-counting based protocols too as long as challenge generation is contrived, 3) and two main design principles for user authentication protocols which can be considered as extensions of the principles from Yan et al. This detailed theoretical treatment can be used as a guideline during the design of counting based protocols to determine their susceptibility to this attack. The Foxtail protocol, one of the protocols analyzed by Yan et al., is used as a representative to illustrate our theoretical and experimental results.

Security evaluation of Rakaposhi Stream Cipher

Rakaposhi is a synchronous stream cipher, which uses three main components: a non-linear feedback shift register (NLFSR), a dynamic linear feedback shift register (DLFSR) and a non-linear filtering function (NLF). NLFSR consists of 128 bits and is initialised by the secret key K. DLFSR holds 192 bits and is initialised by an initial vector (IV). NLF takes 8-bit inputs and returns a single output bit. The work identifies weaknesses and properties of the cipher. The main observation is that the initialisation procedure has the so-called sliding property. The property can be used to launch distinguishing and key recovery attacks. The distinguisher needs four observations of the related (K,IV) pairs. The key recovery algorithm allows to discover the secret key K after observing 29 pairs of (K,IV). Based on the proposed related-key attack, the number of related (K,IV) pairs is 2(128 + 192)/4 pairs. Further the cipher is studied when the registers enter short cycles. When NLFSR is set to all ones, then the cipher degenerates to a linear feedback shift register with a non-linear filter. Consequently, the initial state (and Secret Key and IV) can be recovered with complexity 263.87. If DLFSR is set to all zeros, then NLF reduces to a low non-linearity filter function. As the result, the cipher is insecure allowing the adversary to distinguish it from a random cipher after 217 observations of keystream bits. There is also the key recovery algorithm that allows to find the secret key with complexity 2 54.

Active security in multiparty computation over black-box groups

Most previous work on unconditionally secure multiparty computation has focused on computing over a finite field (or ring). Multiparty computation over other algebraic structures has not received much attention, but is an interesting topic whose study may provide new and improved tools for certain applications. At CRYPTO 2007, Desmedt et al introduced a construction for a passive-secure multiparty multiplication protocol for black-box groups, reducing it to a certain graph coloring problem, leaving as an open problem to achieve security against active attacks. We present the first n-party protocol for unconditionally secure multiparty computation over a black-box group which is secure under an active attack model, tolerating any adversary structure Δ satisfying the Q 3 property (in which no union of three subsets from Δ covers the whole player set), which is known to be necessary for achieving security in the active setting. Our protocol uses Maurer’s Verifiable Secret Sharing (VSS) but preserves the essential simplicity of the graph-based approach of Desmedt et al, which avoids each shareholder having to rerun the full VSS protocol after each local computation. A corollary of our result is a new active-secure protocol for general multiparty computation of an arbitrary Boolean circuit.

NTRUCCA : how to strengthen NTRUEncrypt to chosen-ciphertext security in the standard model

NTRUEncrypt is a fast and practical lattice-based public-key encryption scheme, which has been standardized by IEEE, but until recently, its security analysis relied only on heuristic arguments. Recently, Stehlé and Steinfeld showed that a slight variant (that we call pNE) could be proven to be secure under chosen-plaintext attack (IND-CPA), assuming the hardness of worst-case problems in ideal lattices. We present a variant of pNE called NTRUCCA, that is IND-CCA2 secure in the standard model assuming the hardness of worst-case problems in ideal lattices, and only incurs a constant factor overhead in ciphertext and key length over the pNE scheme. To our knowledge, our result gives the first IND-CCA2 secure variant of NTRUEncrypt in the standard model, based on standard cryptographic assumptions. As an intermediate step, we present a construction for an All-But-One (ABO) lossy trapdoor function from pNE, which may be of independent interest. Our scheme uses the lossy trapdoor function framework of Peikert and Waters, which we generalize to the case of (k − 1)-of-k-correlated input distributions.

Everything you do : young adult fiction and surveillance in an age of security

Espionage, surveillance and clandestine operations by secret agencies and governments were something of an East–West obsession in the second half of the twentieth century, a fact reflected in literature and film. In the twenty-first century, concerns of the Cold War and the threat of Communism have been rearticulated in the wake of 9/11. Under the rubric of ‘terror’ attacks, the discourses of security and surveillance are now framed within an increasingly global context. As this article illustrates, surveillance fiction written for young people engages with the cultural and political tropes that reflect a new social order that is different from the Cold War era, with its emphasis on spies, counter espionage, brainwashing and psychological warfare. While these tropes are still evident in much recent literature, advances in technology have transformed the means of tracking, profiling and accumulating data on individuals’ daily activities. Little Brother, The Hunger Games and Article 5 reflect the complex relationship between the real and the imaginary in the world of surveillance and, as this paper discusses, raise moral and ethical issues that are important questions for young people in our age of security.

Empirical study to investigate the difficulties of implementing safety practices in the repair and maintenance sector in Hong Kong

Repair, maintenance, minor alteration, and addition work (RMAA) has become more and more important in developed societies, but its safety performance is alarming. For example, RMAA projects accounted for 53.2% of the total construction market and the percentage of RMAA accidents to all construction accidents in the Hong Kong Special Administrative Region (HKSAR) increased considerably in 2007. The RMAA sector has a huge potential for safety improvement. This study aims to explore and evaluate the difficulties of implementing safety practices in RMAA work. The mixed methods approach was adopted, and semistructured interviews and a two-round Delphi survey were conducted for the data collection. Major difficulties were identified, including limited safety resources for small and medium enterprises (SMEs), difficulty in changing the mindset of RMAA workers, and difficulty in performing safety supervision. These obstacles for implementing safety practices in the RMAA sector, if successfully removed, could significantly improve the safety performance of the RMAA sector and the construction industry as a whole.