Panoramix member, Aggelos Kiayias, attended the 23rd ACM Conference on Computer and Communications Security in Vienna. Aggelos is co-author on two papers that were presented during the conference:
“Practical Non-Malleable Codes from l-more Extractable Hash Functions” Aggelos Kiayias (University of Edinburgh), Feng- Hao Liu (Florida Atlantic University) and Yiannis Tselekounis (University of Athens)
Yiannis Tselekounis presenting paper.
Abstract: In this work, we significantly improve the efficiency of non- malleable codes in the split state model, by constructing a code with codeword length (roughly) |s|+9k, where |s| is the length of the message, and k is the security parameter. This is a substantial improvement over previous
constructions, both asymptotically and concretely. Our construction relies on a new primitive which we define and study, called l-more extractable hash functions. This notion, which may be of independent interest, is strictly stronger than the previous notion of extractable hash by Goldwasser et al. (Eprint ’11) and Bitansky et al. (ITCS ’12, Eprint ’14), yet we can instantiate it under the same assumption used for
the previous extractable hash function (a variant of the Knowledge of Exponent Assumption).
“SFADiff: Automated Evasion Attacks and Fingerprinting Using Blackbox Differential Automata Learning” George Argyros (Columbia University), Ioannis Stais (University of Athens), Suman Jana, Angelos Keromytis (Columbia University) and Aggelos Kiayias (University of Edinburgh)
George Argyros presenting paper.
Abstract: Finding differences between programs with similar functionality is an important security problem as such differences can be used for fingerprinting or creating evasion attacks against security software like Web Application Firewalls (WAFs) which are designed to detect malicious inputs to web applications. In this paper, we present SFADiff, a black-box differential testing framework based on Symbolic Finite Automata (SFA) learning. SFADiff can automatically find differences between a set of programs with comparable func- tionality. Unlike existing differential testing techniques, instead of searching for each difference individually, SFADiff infers SFA models of the target programs using black-box queries and systematically enumerates the differences between the inferred SFA models. All differences between the inferred models are checked against the corresponding programs. Any difference between the models, that does not result in a difference between the corresponding programs, is used as a counterexample for further refinement of the inferred models. SFADiff’s model-based approach, unlike existing differential testing tools, also support fully automated root cause analysis in a domain-independent manner.