Modern vehicles are expected to integrate a variety of connectivity features to enrich safety, entertainment, and driver comfort. This connectivity raises confidentiality and privacy concerns with the risk for the driver to lose control on his data. As vehicles are intended to be used for several years, a major challenge is also to design stable but flexible solutions that can withstand changes in legislation as well as advances in cryptography. Legal frameworks are currently being investigated and implemented to regulate the use of drivers' and vehicles' private information. However, the transcription of these regulations in practice remains an open problem. In this paper, the first formally proven security protocol for connected vehicles is proposed. It enforces a fined-grained access control policy while providing the flexibility to support recent schemes resistant to a quantum adversary. Its detailed security analysis is assessed using the ProVerif formal verification tool. In addition, a method to generate the access control policy in compliance with the laws is proposed along with an illustrating use case. The method supports both legislation and driver access control to data. Finally, a performance evaluation of the security protocol is provided.

No abstract

Internet users are increasingly concerned about their privacy and are looking for ways to protect their data. Additionally, they may rightly fear that companies extract information about them from their online behavior. The so-called tokenization process allows for the use of trusted third-party managed temporary identities, from which no personal data about the user can be inferred. We consider in this paper tokenization systems allowing a customer to hide their credit card number from a webshop. We present here a method for managing tokens in RAM using a table. We refer to our approach as upcycling as it allows for regenerating used tokens by maintaining a table of currently valid tokens. We compare our approach to existing ones and analyze its security. Contrary to the main existing system (Voltage), our table does not increase in size nor slow down over time. The approach we propose satisfies the common specifications of the domain. It is validated by measurements from an implementation. By reaching 70 thousand tries per timeframe, we almost exhaust the possibilities of the "8-digit model" for properly dimensioned systems. a https://orcid.

The NIST Post-Quantum Cryptography standardization process is in its fourth round, with a first KEM standard based on LWE and three candidates based on ECCs. These primitives implementation are designed to be optimal on classical hardware architecture targets. However, emerging architectures with Processing In Memory, made to be multi-purpose contrary to cryptographic co-processors, have proven their efficiency in multiple use-cases and show better overall computational speed. In this paper, we show that the Classic McEliece performance can be improved on PIM architectures. Notably, the public key generation benefits of a 12.6x speed-up on architectures with bit-line operations. We also describe the open-source RISC-V simulator specifically developed for our experiments, including both in-cache and vectored operations. We discuss how these architecture changes may open the possibility of redesigning primitives or parameter sets for better efficiency.