ZigBee/ZigBee PRO security assessment based on compromised cryptographic keys

Sensor networks have many applications in monitoring and controlling of environmental properties such as sound, acceleration, vibration and temperature. Due to limitedresources in computation capability, memory and energy, they are vulnerable to many kinds of attacks. The ZigBee specification based on the 802.15.4 standard, defines a set of layers specifically suited to sensor networks. These layers support secure messaging using symmetric cryptographic. This paper presents two different ways for grabbing the cryptographic key in ZigBee: remote attack and physical attack. It also surveys and categorizes some additional attacks which can be performed on ZigBee networks: eavesdropping, spoofing, replay and DoS attacks at different layers. From this analysis, it is shown that some vulnerabilities still in the existing security schema in ZigBee technology.

PEAP 802.1x-tunnistuksen toteutus RADIUS-palvelimeen

Valimo iDServer -tunnistuspalvelin on ohjelmisto, joka tukee eri käyttäjientunnistusmenetelmiä, kuten tekstiviestillä lähetettävää kertakäyttösalasanaa tai normaaliakäyttäjätunnusta ja salasanaa. Tässä diplomityössä kuvataan, kuinka palvelimeenon lisätty tuki käyttäjien kirjautumiselle langattoman verkon tukiasemien ja virtuaalilähiverkkoa tukevien kytkinten kautta käyttäen normaaleja Windows-käyttöjärjestelmän mukana tulevia asiakasohjelmistoja. Työn ensimmäisessä vaiheessa kuvataan lähtökohdat ja vaatimukset tulevalle järjestelmälle. Työn osana käytännössä tehty kokonaisuus muodostuu useista eri määrityksistä koostuvista osista. Työn toisessa vaiheessa käydään läpi korkealla tasolla sovelluksen vaatimat protokollat. Osana näihin protokolliin kuului erilaisten avainten jatarkisteiden laskenta sekä salausmenetelmien käyttö, jotka myös kuvataan tässä työssä. Viimeisessä kappaleessa analysoidaan työn tuloksia jakäydään läpi toteutukseen ja itse sovelluksen toimintaan liittyvät ongelmat. Suurin osa havaituista ongelmista liittyi tilanteisiin, joihin itse palvelinsovelluksen toteutuksella ei voitu vaikuttaa. Eniten ongelmia aiheuttivat asiakasohjelmiston sekä verkkokorttien ja niiden ajureiden toiminta ongelmatilanteissa. Asiakasohjelmistoa ei selkeästi ole suunniteltu käytettäväksi kuin muuttumattomien salasanojen kanssa, koska käyttäjän näkökulmasta käyttökokemus ei ollut optimaalinen. Ongelmista huolimatta työn tuloksena saatiin asiakkaan vaatimukset täyttävä järjestelmä. Myös tuotekehitysnäkökulmasta projektia voitaneen pitää onnistuneena, koska nyt tehty sovellus luo pohjan uusien tunnistustapojen ja menetelmien toteuttamiselle tuotteen jatkokehitystä ajatellen.

Anàlisi de les claus criptogràfiques utilitzades en bitcoin

El present projecte realitza una anàlisi de les claus criptogràfiques utilitzades en bitcoin. El projecte introdueix les nocions bàsiques necessàries de les corbes el·líptiques, la criptografia de corbes el·líptiques i els bitcoins per a realitzar l’anàlisi. Aquesta anàlisi consisteix en explorar el codi de diferents wallets bitcoin i realitzar un estudi empíric de l’aleatorietat de les claus. Per últim, el projecte introdueix el concepte de wallet determinista, el seu funcionament i alguns dels problemes que presenta.

Robustness of bipartite Gaussian entangled beams propagating in lossy channels

Subtle quantum properties offer exciting new prospects in optical communications. For example, quantum entanglement enables the secure exchange of cryptographic keys(1) and the distribution of quantum information by teleportation(2,3). Entangled bright beams of light are increasingly appealing for such tasks, because they enable the use of well-established classical communications techniques(4). However, quantum resources are fragile and are subject to decoherence by interaction with the environment. The unavoidable losses in the communication channel can lead to a complete destruction of entanglement(5-8), limiting the application of these states to quantum-communication protocols. We investigate the conditions under which this phenomenon takes place for the simplest case of two light beams, and analyse characteristics of states which are robust against losses. Our study sheds new light on the intriguing properties of quantum entanglement and how they may be harnessed for future applications.

A practical approach for biometric authentication based on smartcards

Cryptographic systems are safe. However, the management of cryptographic keys of these systems is a tough task. They are usually protected by the use of password-based authentication mechanisms, which is a weak link on conventional cryptographic systems, as the passwords can be easily copied or stolen. The usage of a biometric approach for releasing the keys is an alternative to the password-based mechanisms. But just like passwords, we need mechanisms to keep the biometrical signal safe. One approach for such mechanism is to use biometrical key cryptography. The cryptographic systems based on the use of biometric characteristics as keys are called biometrical cryptographic systems. This article presents the implementation of Fuzzy Vault, a biometrical cryptographic system written in Java, along with its performance evaluation. Fuzzy Vault was tested on a real application using smartcards.

Certificados electrónicos de servidor en administración y comercio electrónicos: garantías de seguridad

El uso de Internet por parte de los ciudadanos para relacionarse con las Administraciones Públicas o en relación con actividades de comercio electrónico crece día a día. Así lo evidencian los diferentes estudios realizados en esta materia, como los que lleva a cabo el Observatorio Nacional de las Telecomunicaciones y la Sociedad de la Información (http://www.ontsi.red.es/ontsi/). Se hace necesario, por tanto, identificar a las partes intervinientes en estas transacciones, además de dotarlas de la confidencialidad necesaria y garantizar el no repudio. Uno de los elementos que, junto con los mecanismos criptográficos apropiados, proporcionan estos requisitos, son los certificados electrónicos de servidor web. Existen numerosas publicaciones dedicadas a analizar esos mecanismos criptográficos y numerosos estudios de seguridad relacionados con los algoritmos de cifrado, simétrico y asimétrico, y el tamaño de las claves criptográficas. Sin embargo, la seguridad relacionada con el uso de los protocolos de seguridad SSL/TLS está estrechamente ligada a dos aspectos menos conocidos:  el grado de seguridad con el que se emiten los certificados electrónicos de servidor que permiten implementar dichos protocolos; y  el uso que hacen las aplicaciones software, y en especial los navegadores web, de los campos que contiene el perfil de dichos certificados. Por tanto, diferentes perfiles de certificados electrónicos de servidor y diferentes niveles de seguridad asociados al procedimiento de emisión de los mismos, dan lugar a diferentes tipos de certificados electrónicos. Si además se considera el marco jurídico que afecta a cada uno de ellos, se puede concluir que existe una tipología de certificados de servidor, con diferentes grados de seguridad o de confianza. Adicionalmente, existen otros requisitos que también pueden pasar desapercibidos tanto a los titulares de los certificados como a los usuarios de los servicios de comercio electrónico y administración electrónica. Por ejemplo, el grado de confianza que otorgan los navegadores web a las Autoridades de Certificación emisoras de los certificados y cómo estas adquieren tal condición, o la posibilidad de poder verificar el estado de revocación del certificado electrónico. El presente trabajo analiza todos estos requisitos y establece, en función de los mismos, la correspondiente tipología de certificados electrónicos de servidor web. Concretamente, las características a analizar para cada tipo de certificado son las siguientes:  Seguridad jurídica.  Normas técnicas.  Garantías sobre la verdadera identidad del dominio.  Verificación del estado de revocación.  Requisitos del Prestador de Servicios de Certificación. Los tipos de certificados electrónicos a analizar son:  Certificados de servidor web:  Certificados autofirmados y certificados emitidos por un Prestador de Servicios de Certificación.  Certificados de dominio simple y certificados multidominio (wildcard y SAN)  Certificados de validación extendida.  Certificados de sede electrónica. ABSTRACT Internet use by citizens to interact with government or with e-commerce activities is growing daily. This topic is evidenced by different studies in this area, such as those undertaken by the Observatorio Nacional de las Telecomunicaciones y la Sociedad de la Información (http://www.ontsi.red.es/ontsi/ ). Therefore, it is necessary to identify the parties involved in these transactions, as well as provide guaranties such as confidentiality and non-repudiation. One instrument which, together with appropriate cryptographic mechanisms, provides these requirements is SSL electronic certificate. There are numerous publications devoted to analyzing these cryptographic mechanisms and many studies related security encryption algorithms, symmetric and asymmetric, and the size of the cryptographic keys. However, the safety related to the use of security protocols SSL / TLS is closely linked to two lesser known aspects:  the degree of security used in issuing the SSL electronic certificates; and  the way software applications, especially web Internet browsers, work with the fields of the SSL certificates profiles. Therefore, the diversity of profiles and security levels of issuing SSL electronic certificates give rise to different types of certificates. Besides, some of these electronic certificates are affected by a specific legal framework. Consequently, it can be concluded that there are different types of SSL certificates, with different degrees of security or trustworthiness. Additionally, there are other requirements that may go unnoticed both certificate holders and users of e-commerce services and e-Government. For example, the degree of trustworthiness of the Certification Authorities and how they acquire such a condition by suppliers of Internet browsers, or the possibility to verify the revocation status of the SSL electronic certificate. This paper discusses these requirements and sets, according to them, the type of SSL electronic certificates. Specifically, the characteristics analyzed for each type of certificate are the following:  Legal security.  Technical standards.  Guarantees to the real identity of the domain.  Check the revocation status.  Requirements of the Certification Services Providers. The types of electronic certificates to be analyzed are the following:  SSL electronic certificates:  Self-signed certificates and certificates issued by a Certification Service Provider.  Single-domain certificates and multi-domain certificates (wildcard and SAN)  Extended Validation Certificates.  “Sede electrónica” certificates (specific certificates for web sites of Spanish Public Administrations).

Trace Oblivious Program Execution

The big data era has dramatically transformed our lives; however, security incidents such as data breaches can put sensitive data (e.g. photos, identities, genomes) at risk. To protect users' data privacy, there is a growing interest in building secure cloud computing systems, which keep sensitive data inputs hidden, even from computation providers. Conceptually, secure cloud computing systems leverage cryptographic techniques (e.g., secure multiparty computation) and trusted hardware (e.g. secure processors) to instantiate a “secure” abstract machine consisting of a CPU and encrypted memory, so that an adversary cannot learn information through either the computation within the CPU or the data in the memory. Unfortunately, evidence has shown that side channels (e.g. memory accesses, timing, and termination) in such a “secure” abstract machine may potentially leak highly sensitive information, including cryptographic keys that form the root of trust for the secure systems. This thesis broadly expands the investigation of a research direction called trace oblivious computation, where programming language techniques are employed to prevent side channel information leakage. We demonstrate the feasibility of trace oblivious computation, by formalizing and building several systems, including GhostRider, which is a hardware-software co-design to provide a hardware-based trace oblivious computing solution, SCVM, which is an automatic RAM-model secure computation system, and ObliVM, which is a programming framework to facilitate programmers to develop applications. All of these systems enjoy formal security guarantees while demonstrating a better performance than prior systems, by one to several orders of magnitude.

Whirlwind: a new cryptographic hash function

A new cryptographic hash function Whirlwind is presented. We give the full specification and explain the design rationale. We show how the hash function can be implemented efficiently in software and give first performance numbers. A detailed analysis of the security against state-of-the-art cryptanalysis methods is also provided. In comparison to the algorithms submitted to the SHA-3 competition, Whirlwind takes recent developments in cryptanalysis into account by design. Even though software performance is not outstanding, it compares favourably with the 512-bit versions of SHA-3 candidates such as LANE or the original CubeHash proposal and is about on par with ECHO and MD6.

A family of implementation-friendly BN elliptic curves

For the last decade, elliptic curve cryptography has gained increasing interest in industry and in the academic community. This is especially due to the high level of security it provides with relatively small keys and to its ability to create very efficient and multifunctional cryptographic schemes by means of bilinear pairings. Pairings require pairing-friendly elliptic curves and among the possible choices, Barreto-Naehrig (BN) curves arguably constitute one of the most versatile families. In this paper, we further expand the potential of the BN curve family. We describe BN curves that are not only computationally very simple to generate, but also specially suitable for efficient implementation on a very broad range of scenarios. We also present implementation results of the optimal ate pairing using such a curve defined over a 254-bit prime field. (C) 2001 Elsevier Inc. All rights reserved.

GA topology optimization using random keys for tree encoding of structures

Topology optimization consists in finding the spatial distribution of a given total volume of material for the resulting structure to have some optimal property, for instance, maximization of structural stiffness or maximization of the fundamental eigenfrequency. In this paper a Genetic Algorithm (GA) employing a representation method based on trees is developed to generate initial feasible individuals that remain feasible upon crossover and mutation and as such do not require any repairing operator to ensure feasibility. Several application examples are studied involving the topology optimization of structures where the objective functions is the maximization of the stiffness and the maximization of the first and the second eigenfrequencies of a plate, all cases having a prescribed material volume constraint.

Lophopidae of the amazon basin with keys to new world genera and species (HOMOPTERA: FULGOROIDEA).

The two especies of Lophopidae found in the lowland Amazon Basin, Hesticus rufimanus, (walker) and H. sanguinifrons Muir, are redescribed and their geographical distributions given. Keys are provided to genera of New World lophopidae, and to species of Hesticus .

Flora of the sand keys of Florida, by Charles Frederick Millspaugh.

v.2:no.5(1907)