Skip to search formSkip to main contentSkip to account menu

Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice

Logjam, a novel flaw in TLS that lets a man-in-the-middle downgrade connections to "export-grade" Diffie-Hellman, is presented and a close reading of published NSA leaks shows that the agency's attacks on VPNs are consistent with having achieved a break.
ACM (opens in a new tab)

Verified Models and Reference Implementations for the TLS 1.3 Standard Candidate

A methodology for developing verified symbolic and computational models of TLS 1.3 hand-in-hand with a high-assurance reference implementation of the protocol, and presents a computational CryptoVerif model for TLS1.3 Draft-18 and proves its security.
IEEE (opens in a new tab)

HACL*: A Verified Modern Cryptographic Library

HACL* implements the NaCl cryptographic API and can be used as a drop-in replacement for NaCl libraries like libsodium and TweetNaCl, showing that writing fast, verified, and usable C cryptographic libraries is now practical.
ACM (opens in a new tab)

A Messy State of the Union: Taming the Composite State Machines of TLS

This work systematically test popular open-source TLS implementations for state machine bugs and discovers several critical security vulnerabilities that have lain hidden in these libraries for years, and have now finally been patched due to the disclosures.
ACM (opens in a new tab)

Formal Verification of Smart Contracts: Short Paper

This paper outlines a framework to analyze and verify both the runtime safety and the functional correctness of Ethereum contracts by translation to F*, a functional programming language aimed at program verification.
ACM (opens in a new tab)

Refinement Types for Secure Implementations

The design and implementation of a typechecker for verifying security properties of the source code of cryptographic protocols and access control mechanisms and typechecking generates veri¿cation conditions that are passed to an SMT solver.
ACM (opens in a new tab)

Automated Verification for Secure Messaging Protocols and Their Implementations: A Symbolic and Computational Approach

This work uses ProVerif and CryptoVerif to find new and previously-known weaknesses in the protocol and suggest practical countermeasures, and demonstrates that, with disciplined programming and some verification expertise, the systematic analysis of complex cryptographic web applications is now becoming practical.
IEEE (opens in a new tab)

Formal verification of standards for distance vector routing protocols

This work shows how to use an interactive theorem prover, HOL, together with a model checker, SPIN, to prove key properties of distance vector routing protocols, and develops verification techniques suited to routing protocols generally.
ACM (opens in a new tab)

Discovering Concrete Attacks on Website Authorization by Formal Analysis

This work model several configurations of the OAuth 2.0 protocol in the applied pi-calculus and verify them using ProVerif, a new library for modeling web applications and web-based attackers that is designed to help discover concrete website attacks.
IEEE (opens in a new tab)

SoK: Computer-Aided Cryptography

A cross-cutting systematization of the computer-aided cryptography literature, focusing on three main areas: (i) design-level security (both symbolic security and computational security), (ii) functional correctness and efficiency, and (iii) implementation- level security (with a focus on digital side-channel resistance).
IEEE (opens in a new tab)
...
By clicking accept or continuing to use the site, you agree to the terms outlined in our Privacy Policy (opens in a new tab), Terms of Service (opens in a new tab), and Dataset License (opens in a new tab)