Sedat Akleylek
A Comparison of Post-Quantum Symmetric-based Signature Schemes
The task is to understand the symmetric-based signature schemes submitted to NIST Post-Quantum Cryptography Standardization Project. The signature schemes are Picnic, AIMer, Ascon-Sign, FAEST, SPHINCS, SPHINCS-Alpha [1,2]. At least 3 signature schemes is selected for the both theoretical and practical comparison. The comparison includes performance analysis (running time, etc.) and the structural similarities/differences. [1] https://csrc.nist.gov/Projects/post-quantum-cryptography/post-quantum-cryptography-standardization/round-3-submissions [2] https://csrc.nist.gov/Projects/pqc-dig-sig/round-1-additional-signatures
A Report on the Shortest Linear Program and Its Variants
Symmetric key cryptosystems have diffusion and confusion layers. The Shortest Linear Program (SLP) problem, which is to the number of linear operations necessary to compute a set of linear forms. In this project, the task is to understand and implement the circuit minimization algorithms for linear/permutation layers of symmetric key cryptosystems. [1,2] are the code examples for the Boyar-Peralta algorithm. [3] explains the Boyar-Peralta algorithm. In the report, basic work-flow of the circuit minimization algorithms, their comparison, implementation results on the linear layers and discussion on them are given. [1] https://bitbucket.org/anubhab001/boyar-peralta-xor3/src/master/ [2] https://github.com/thomaspeyrin/XORreduce [3] https://doi.org/10.1007/s00145-012-9124-7
Experimental Results on OpenFHE
The task is to run open-source fully homomorphic encryption (FHE) libraries which has the implementations of several FHE schemes and provide a detailed comparison. The focus will be given to CKKS scheme. [1] https://eprint.iacr.org/2022/915 [2] https://github.com/snucrypto/HEAAN [3] https://github.com/homenc/HElib
Implementation of ring signature scheme based on multivariate quadratic polynomials
The task is to read about their approach from https://eprint.iacr.org/2020/286, to write a summary and to implement the scheme.
Implementation of group signature scheme over lattices
In this project, the aim is to implement one of the group signature scheme and to write a summary of the following survey. https://www.mdpi.com/2410-387X/6/1/3#B25-cryptography-06-00003
Quantum one-time programs
The task is to read about their approach from https://arxiv.org/pdf/1211.1080.pdf, to write a summary.
Polynomial Multiplication methods for Lattice-based Cryptographic Schemes
In this project, the aim is to present a survey on the state-of-the-art for polynomial multiplication methods in lattice-based cryptography.
Graph-based vulnerability and risk assessment models
IoT devices and systems are vulnerable to attacks due to their characteristics. There are various attack and vulnerability assessment studies in the literature to bring persistent and applicable solutions for security concerns in IoT. These studies provide different approaches in terms of network representation and solution techniques. The graph model is one of these representations and technical approaches. An attack graph model shows all possible attack path sequences from the source to the target. Therefore, graph-based models can offer systematic, formal, and strong directions to determine vulnerable points, and they can help to design defense mechanisms. In this seminar, the main goal is to give a literature review with comparison of available models.
Android Malware Analysis [taken]
Various approaches have been proposed to detect Android malware. These are evaluated in three different ways: static analysis, dynamic analysis, and hybrid analysis. In static analysis, source code or application components are analyzed without running applications. In contrast, in dynamic analysis, applications are run by running on a virtual machine or real device. The advantage of static analysis over dynamic analysis is that the analysis is carried out quickly, as the application is not run. However, they are not as effective as dynamic analysis methods against zero-day attacks. Structures, where both dynamic analysis and static analysis are used together, are called hybrid analysis. Due to the analysis methods, many features can be extracted and inferences about the application can be made. In this seminar, the main goal is to give a literature review of dynamic analysis with comparison of available models.
Cybersecurity in Aviation
Over the past few years, information on hundreds of millions of aviation customers has been stolen in cyber-attacks. In addition to data breaches, airports and aviation applications have also been targeted in ransomware attacks where information and services are made unavailable until a ransom is paid. Aviation experts have expressed concern over potential vulnerabilities in aviation technologies that communicate information between aircraft and with air traffic control and ground services without any authentication or encryption. This could allow the injection of false messages and ghost aircraft. In this seminar, the main goal is to give a literature review with comparison of available models. https://erau.edu/degrees/master/aviation-cybersecurity
Hendrik Eerikson
A Comparison of Multi-Party Learning Protocols Based on Secret Sharing [taken]
Multi-party learning (MPL) uses techniques from secure multi-party computation to train and evaluate machine learning models. The task of this seminar topic is to compare two papers [1][2] on training neural networks with input data privacy and NN-model privacy. Both papers are based on replicated secret-sharing but achive different performance and security outcomes. What are the key differences of the two approaches and how does the different security setting affect performance?
[1] Falcon: Honest-Majority Maliciously Secure Framework for Private Deep Learning (https://arxiv.org/pdf/2004.02229.pdf) [2] Secure Quantized Training for Deep Learning (https://proceedings.mlr.press/v162/keller22a/keller22a.pdf)
Toomas Krips
Zero-knowledge proofs of photo authenticity [taken]
Considering the advances in machine learning for image generation lately, the problem of authenticity of photos seems quite important. One approach is issuing digital cameras with cryptographic signing keys so that they would sign the images they generate, although it is possible that those keys might be extracted. And even if we fix that extraction problem, practically, there are a small amount of photo-editing tools that we might consider legitimate, such as cropping or resizing. The basic task is to take a look at the PhotoProof protocol that gives a tool for proving in zero-knowledge that the image in hand was obtained via legitimate transformations from a signed image. The student should write a summary on that paper. The paper can be found at https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=7546506 The more advanced task (for 6 credits) would be to also look at some other work that builds upon it, as the PhotoProof paper is already quite old. Another possible basic task for 3 credits would be just to look at some more modern advancements on that topic.
Arnis Paršovs
Applied cyber security topics
Applied cyber security group offers research seminar supervision on various cyber security-related topics for students who are interested in more applied research that may involve hands-on activities as well. Various hardware can be provided to students for experiments. Students who are doing applied research must still describe the research they have performed in a seminar report and convince the supervisor that the work done is worth 3 ECTS (~78 hours of work). Students are welcome to contact Arnis Paršovs (arnis.parsovs@ UT) with their seminar topic ideas.
Recommended prerequisites: Applied Cryptography (MTAT.07.017) / Wireless Technologies and Security (LTAT.04.009)
Level:BSc, MSc or PhD
Vitaly Skachek
Surveillance and monitoring of the internet: how is it done?
It is a folklore that governments in various countries monitor internet activities of the general population. However, the efficient surveillance of the whole population is a difficult and resource-demanding process. In this project, a student will research into the existing methodology for surveillance of the general internet users, the technical challenges involved, and the extent to which different countries go in this context.
Some initial links for reading:
https://cabar.asia/en/the-hidden-side-of-the-internet-how-governments-track-populations
BSc or MSc level
Security Comparisons and Performance Analyses of Post-Quantum Signature Algorithms (taken)
Quantum computing challenges the computational hardness assumptions anchoring the security of public-key ciphers, such as the prime factorization and the discrete logarithm problem. To prepare for the quantum era and withstand the attacks equipped with quantum computing, the security and cryptography communities are designing new quantum-resistant public-key ciphers. National Institute of Standards and Technology (NIST) is collecting and standardizing the postquantum ciphers, similarly to its past involvements in establishing DES and AES as symmetric cipher standards. The NIST finalist algorithms for public-key signatures are Dilithium, Falcon, and Rainbow. In this project, the student will discuss the strengths and the weaknesses of each of these algorithms.
Initial reading:
MSc or PhD level
Dominique Unruh
Security proofs in EasyCrypt
When checked by humans, the security of proofs for cryptographic protocols are inherently error-prone. One way out is to use formal (i.e., computer-aided) verification. Probably the most popular tool today for this purpose is EasyCrypt, which allows us to interactively design a proof that the computer will be able to understand and check.
The goal of this seminar topic can either be to read and understand a research paper about EasyCrypt (e.g., the verification of a concrete protocol), or a paper about work on EasyCrypt itself (e.g., recent work on supporting quantum proofs), or to do security proofs in EasyCrypt (simple ones).
Requirements: (negotiable) Crypto I, if possible Crypto II. Or something related to theorem proving.
Fujisaki-Okamoto transforms in the quantum setting
When designing a practical public key encryption scheme, one usually uses the following approach:
*Build one with weak security properties based on some credible assumption
*Transform it into a so-called key encapsulation mechanism (KEM, basically an encryption scheme for encrypting keys)
*Use it together with a symmetric encryption scheme to encrypt arbitrary data
On of the most popular ways for step 2 is the Fujisaki-Okamoto transform. It comes in many variants, and security can be in the classical and the quantum setting.
Your task is to understand how KEMs and Fujisaki-Okamoto work, and what the problems and solutions in the quantum setting are, and to present those things in talk and report.
A good starting point is: https://eprint.iacr.org/2017/604.pdf
Requirements: Crypto I and/or Quantum Crypto.
Fiat-Shamir transform in the quantum setting
When designing a practical signature scheme, one often uses a construction called the Fiat-Shamir transform. The Fiat-Shamir transform takes an iteractive protocol (e.g., an identification scheme, a zero-knowledge proof) and makes it non-interactive. The Fiat-Shamir transform, though hugely important, was not known to be secure in the quantum setting for many years. The most important breakthrough was https://eprint.iacr.org/2019/190 .
Your task is to understand that paper, what the problems and solutions in the quantum setting are, and to present those things in talk and report.
Requirements: Quantum Crypto.