242 citations · 364 across the 13 of their papers we have counts for
16 papers
MOSAIC: Masked Outsourcing of Secure AI Computations
James Hsin-yu Chiang, Sheila Zingg, Kari Kostiainen +1
We address the challenge of securely and efficiently outsourcing AI computations from a trusted but computationally weak client to an untrusted but powerful server, in the setting…
Credential Disclosure in (EU) Digital Identity Wallets: Privacy Risks and Practical Mitigations
Sheila Zingg, Daniele Lain, Yoshimichi Nakatsuka +3
The European Union will introduce the EUDI Wallet by late 2026, which allows users to hold digital credentials (i.e., representations of physical official identity documents) on th…
Gyokuro: Source-assisted Private Membership Testing using Trusted Execution Environments
Yoshimichi Nakatsuka, Nicolas Dutly, Kari Kostiainen +1
Private Membership Testing (PMT) protocols enable clients to verify whether a certain data item is included in a database without revealing the item to the database operator or oth…
AEX-NStep: Probabilistic Interrupt Counting Attacks on Intel SGX
Nicolas Dutly, Friederike Groschupp, Ivan Puddu +2
To mitigate interrupt-based stepping attacks (notably using SGX-Step), Intel introduced AEX-Notify, an ISA extension to Intel SGX that aims to prevent deterministic single-stepping…
URL Inspection Tasks: Helping Users Detect Phishing Links in Emails
Daniele Lain, Yoshimichi Nakatsuka, Kari Kostiainen +2
The most widespread type of phishing attack involves email messages with links pointing to malicious content. Despite user training and the use of detection techniques, these attac…
Content, Nudges and Incentives: A Study on the Effectiveness and Perception of Embedded Phishing Training
Daniele Lain, Tarek Jost, Sinisa Matetic +2
A common form of phishing training in organizations is the use of simulated phishing emails to test employees' susceptibility to phishing attacks, and the immediate delivery of tra…
PayOff: A Regulated Central Bank Digital Currency with Private Offline Payments
Carolin Beer, Sheila Zingg, Kari Kostiainen +3
The European Central Bank is preparing for the potential issuance of a central bank digital currency (CBDC), called the digital euro. A recent regulatory proposal by the European C…
Phishing in Organizations: Findings from a Large-Scale and Long-Term Study
Daniele Lain, Kari Kostiainen, Srdjan Capkun
In this paper, we present findings from a large-scale and long-term phishing experiment that we conducted in collaboration with a partner company. Our experiment ran for 15 months…
2FE: Two-Factor Encryption for Cloud Storage
Anders Dalskov, Daniele Lain, Enis Ulqinaku +2
Encrypted cloud storage services are steadily increasing in popularity, with many commercial solutions currently available. In such solutions, the cloud storage is trusted for data…
Composite Enclaves: Towards Disaggregated Trusted Execution
Moritz Schneider, Aritra Dhar, Ivan Puddu +2
The ever-rising computation demand is forcing the move from the CPU to heterogeneous specialized hardware, which is readily available across modern datacenters through disaggregate…
Snappy: Fast On-chain Payments with Practical Collaterals
Vasilios Mavroudis, Karl Wüst, Aritra Dhar +2
Permissionless blockchains offer many advantages but also have significant limitations including high latency. This prevents their use in important scenarios such as retail payment…
Don't Mine, Wait in Line: Fair and Efficient Blockchain Consensus with Robust Round Robin
Mansoor Ahmed-Rengers, Kari Kostiainen
Proof-of-Stake systems randomly choose, on each round, one of the participants as a consensus leader that extends the chain with the next block such that the selection probability…
DR.SGX: Hardening SGX Enclaves against Cache Attacks with Data Location Randomization
Ferdinand Brasser, Srdjan Capkun, Alexandra Dmitrienko +3
Recent research has demonstrated that Intel's SGX is vulnerable to software-based side-channel attacks. In a common attack, the adversary monitors CPU caches to infer secret-depend…
Software Grand Exposure: SGX Cache Attacks Are Practical
Ferdinand Brasser, Urs Müller, Alexandra Dmitrienko +3
Side-channel information leakage is a known limitation of SGX. Researchers have demonstrated that secret-dependent information can be extracted from enclave execution through page-…
Hacking in the Blind: (Almost) Invisible Runtime UI Attacks on Safety-Critical Terminals
Luka Malisa, Kari Kostiainen, Thomas Knell +2
Many terminals are used in safety-critical operations in which humans, through terminal user interfaces, become a part of the system control loop (e.g., medical and industrial syst…
Personalized Security Indicators to Detect Application Phishing Attacks in Mobile Platforms
Claudio Marforio, Ramya Jayaram Masti, Claudio Soriente +2
Phishing in mobile applications is a relevant threat with successful attacks reported in the wild. In such attacks, malicious mobile applications masquerade as legitimate ones to s…