Security References: Difference between revisions
Jump to navigation
Jump to search
(→RSA: Adding 3 biblio references) |
|||
| Line 32: | Line 32: | ||
== Software == |
== Software == |
||
* [http://pdos.csail.mit.edu/papers/stack:sosp13.pdf Towards Optimization-Safe Systems: Analyzing the Impact of Undefined Behavior] <ref name="STACK">Xi Wang, Nickolai Zeldovich, M. Frans Kaashoek, and Armando Solar-Lezama: Towards Optimization-Safe Systems: Analyzing the Impact of Undefined Behavior. In SOSP(2013)</ref> |
* [http://pdos.csail.mit.edu/papers/stack:sosp13.pdf Towards Optimization-Safe Systems: Analyzing the Impact of Undefined Behavior] <ref name="STACK">Xi Wang, Nickolai Zeldovich, M. Frans Kaashoek, and Armando Solar-Lezama: Towards Optimization-Safe Systems: Analyzing the Impact of Undefined Behavior. In SOSP(2013)</ref> |
||
== RSA == |
|||
* Dan Boneh, '''Twenty Years of Attacks on the RSA Cryptosystem''', February 1999, Notices of the AMS, <tt>http://www.ams.org/notices/199902/boneh.pdf</tt> |
|||
* Leo Reyzin, '''Notes for lecture 8 — Chinese Remainder Theorem and Blum-Blum-Shub PRG''', Fall 2004, BU CAS CS 538, <tt>http://www.cs.bu.edu/~reyzin/teaching/f04cs538/notes8.pdf</tt> |
|||
* Jingjing Wang, '''Attacks against RSA Cryptosystems in Thirty Years''', June 2011, <tt>http://cis.sjtu.edu.cn/download/d/df/RSA_Attacks.pdf</tt> |
|||
== References == |
== References == |
||
Revision as of 11:03, 20 January 2014
Development
- CWE/SANS TOP 25 Most Dangerous Programming Errors
- Reflections on Trusting Trust How does writing the C compiler in C bear on security issues? Well, it does (Ken Thompson, Communication of the ACM, Vol. 27, No. 8, August 1984, pp. 761-763)
- The idea is to hide a trojan code in the C compiler so that to inject a trojan code in eg. the login command code, and another trojan code so that to automatically re-inject itself when the C code is compiled with the infected compiler.
- Common Weakness Enumeration
- CWE-2000: Comprehensive CWE Dictionary
PKI
On trust model flaw in browser CAs:
- "it will CLEARLY not solve the browser security problem.", "the certifications made by even the best of those CAs are effectively MEANINGLESS" "the users are well trained to ignore EVERY browser warning they EVER get" "the ENTIRE question of OCSP is somewhat irrelevant." "spritzing the SKUNK with eau de cologne." "hanging garlands from the corpses ears."' (Cfr mail A mighty fortress is our PKI, Part II (ventzi nikov, 2010 Jul 29 09:06)
Authentication
- Handbook of Applied Cryptography, chap. 9 and 10.
Definition, objectives, properties...
Definitions
- Secure Boot
- Secure Boot [1] is a security property of a bootstrap architecture ensuring that only configurations of a certain property can be loaded. If a modification is detected, the bootstrap process is interrupted.
- Authenticated Boot
- Authenticated Boot [1] is a security property of a bootstrap architecture ensuring that remote parties can verify properties of the booted configuration.
- Trusted storage
- Trusted storage [1] is storage where confidentiality, integrity, and freshness (i.e., protection against replay attacks) of stored data is provided, and where the integrity of the TOE accessing the data is ensured (in order to prevent other software, such as alternative or modified operating systems, from accessing the data).
- Trusted Channel
- A trusted channel [1] is a channel between two entities that provides integrity, confidentiality, and authenticity of the transmitted data, and ensures integrity and authenticity of the end points.
- Nonce
- A nonce [2] is a value used no more than once for the same purpose. It typically serves to prevent (undetectable) replay
Software
RSA
- Dan Boneh, Twenty Years of Attacks on the RSA Cryptosystem, February 1999, Notices of the AMS, http://www.ams.org/notices/199902/boneh.pdf
- Leo Reyzin, Notes for lecture 8 — Chinese Remainder Theorem and Blum-Blum-Shub PRG, Fall 2004, BU CAS CS 538, http://www.cs.bu.edu/~reyzin/teaching/f04cs538/notes8.pdf
- Jingjing Wang, Attacks against RSA Cryptosystems in Thirty Years, June 2011, http://cis.sjtu.edu.cn/download/d/df/RSA_Attacks.pdf
References
- ↑ 1.0 1.1 1.2 1.3 Löhr, H., Sadeghi, A., Stüble, C., Weber, M., Winandy, M.: Modeling Trusted Computing Support in a Protection Profile for High Assurance Security Kernels. In TRUST(2009) 45-62
- ↑ Menezes, A., van Oorschot, P., Vanstone, S.: Handbook of Applied Cryptography, 1997
- ↑ Xi Wang, Nickolai Zeldovich, M. Frans Kaashoek, and Armando Solar-Lezama: Towards Optimization-Safe Systems: Analyzing the Impact of Undefined Behavior. In SOSP(2013)