5 citations · 19 across the 16 of their papers we have counts for
16 papers · 1 filter
From Specs to Apps: Verifying and Monitoring Models of Signal and WhatsApp
Moustafa Said, Aurora Naska, Kevin Morio +1
The Signal protocol is a prominent messaging protocol that secures communication for billions of users. It powers WhatsApp, the most widely used messaging application worldwide, an…
Accountability in Certificate Transparency and Variants
Timo Treitz, Robert Künnemann
Certificate Transparency (CT) aims to reduce the trust required in Certificate Authorities (CAs) within the TLS certificate ecosystem. It is supported by all major browsers. The pr…
A Sound Translation from Tamarin to ProVerif: Enabling Comparative Analysis
Kevin Morio, Yavor Ivanov, Robert Künnemann
Tamarin and ProVerif are two prominent tools for the formal verification of security protocols. They share the same high-level goal but differ significantly in their underlying for…
Automated Side-Channel Analysis of Cryptographic Protocol Implementations
Faezeh Nasrabadi, Robert Künnemann, Hamed Nemati
Formal verification of cryptographic protocols typically relies on symbolic models that abstract away compiled code and microarchitectural side channels, leaving a gap between veri…
Symbolic Parallel Composition for Multi-language Protocol Verification
Faezeh Nasrabadi, Robert Künnemann, Hamed Nemati
The implementation of security protocols often combines different languages. This practice, however, poses a challenge to traditional verification techniques, which typically assum…
Adaptive Exploit Generation against Security Devices and Security APIs
Robert Künnemann, Julian Biehl
Proof-of-concept exploits help demonstrate software vulnerability beyond doubt and communicate attacks to non-experts. But exploits can be configuration-specific, for example when…
Computationally Bounded Robust Compilation and Universally Composable Security
Robert Künnemann, Marco Patrignani, Ethan Cecchetti
Universal Composability (UC) is the gold standard for cryptographic security, but mechanizing proofs of UC is notoriously difficult. A recently-discovered connection between UC and…
CryptoBap: A Binary Analysis Platform for Cryptographic Protocols
Faezeh Nasrabadi, Robert Künnemann, Hamed Nemati
We introduce CryptoBap, a platform to verify weak secrecy and authentication for the (ARMv8 and RISC-V) machine code of cryptographic protocols. We achieve this by first transpilin…
Automated Security Analysis of Exposure Notification Systems
Kevin Morio, Ilkan Esiyok, Dennis Jackson +1
We present the first formal analysis and comparison of the security of the two most widely deployed exposure notification systems, ROBERT and the Google and Apple Exposure Notifica…
Accountable Javascript Code Delivery
Ilkan Esiyok, Pascal Berrang, Katriel Cohn-Gordon +1
The internet is a major distribution platform for web applications, but there are no effective transparency and audit mechanisms in place for the web. Due to the ephemeral nature o…
On the Soundness of Infrastructure Adversaries
Alexander Dax, Robert Künnemann
Companies and network operators perform risk assessment to inform policy-making, guide infrastructure investments or to comply with security standards such as ISO 27001. Due to the…
Verifying Accountability for Unbounded Sets of Participants
Kevin Morio, Robert Künnemann
Little can be achieved in the design of security protocols without trusting at least some participants. This trust should be justified or, at the very least, subject to examination…
Automated Verification of Accountability in Security Protocols
Robert Künnemann, Ilkan Esiyok, Michael Backes
Accountability is a recent paradigm in security protocol design which aims to eliminate traditional trust assumptions on parties and hold them accountable for their misbehavior. It…
Towards Automated Network Mitigation Analysis (extended)
Patrick Speicher, Marcel Steinmetz, Jörg Hoffmann +2
Penetration testing is a well-established practical concept for the identification of potentially exploitable security weaknesses and an important component of a security audit. Pr…
Computational Soundness for Dalvik Bytecode
Michael Backes, Robert Künnemann, Esfandiar Mohammadi
Automatically analyzing information flow within Android applications that rely on cryptographic operations with their computational security guarantees imposes formidable challenge…
Automated analysis of security protocols with global state
Steve Kremer, Robert Künnemann
Security APIs, key servers and protocols that need to keep the status of transactions, require to maintain a global, non-monotonic state, e.g., in the form of a database or registe…