A More Cautious Approach to Security Against Mass Surveillance

Abstract. Motivated by revelations concerning population-wide surveillance of encrypted communications, we formalize and investigate the resistance of symmetric encryption schemes to mass surveillance. The focus is on algorithm-substitution attacks (ASAs), where a subverted encryption algorithm replaces the real one. We assume that the goal of "big brother" is undetectable subversion, meaning that ciphertexts produced by the subverted encryption algorithm should reveal plaintexts to big brother yet be indistinguishable to users from those produced by the real encryption scheme. We formalize security notions to capture this goal and then offer both attacks and defenses. In the first category we show that successful (from the point of view of big brother) ASAs may be mounted on a large class of common symmetric encryption schemes. In the second category we show how to design symmetric encryption schemes that avoid such attacks and meet our notion of security. The lesson that emerges is the danger of choice: randomized, stateless schemes are subject to attack while deterministic, stateful ones are not.

show abstract

“…Degabriele, Farshim and Poettering [12] critique and refine our definitions. Ateniese, Magri and Venturi [3] study ASAs on signature schemes.…”

mentioning

confidence: 92%

Security of Symmetric Encryption against Mass Surveillance

Bellare

Paterson

Rogaway

2014

Lecture Notes in Computer Science

147

208

View full text Add to dashboard Cite

show abstract

“…Note that they defined a very weak model, where the only goal of the attacker was to distinguish between two ciphertexts, but mostly used a stronger scenario with the aim to recover the encryption key. Degabriele et al criticized the model of [7] by pointing out the results crucially rely on the fact that a subverted encryption algorithm always needs to produce valid ciphertexts (the decryptability assumption) and proposed a refined security notion [13]. The model of algorithm substitution attacks introduced in [7] was extended to signature schemes by Ateniese et al in [2].…”

Section: Introductionmentioning

confidence: 99%

Algorithm Substitution Attacks from a Steganographic Perspective

Berndt

Liśkiewicz

2017

Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

The goal of an algorithm substitution attack (ASA), also called a subversion attack (SA), is to replace an honest implementation of a cryptographic tool by a subverted one which allows to leak private information while generating output indistinguishable from the honest output. Bellare, Paterson, and Rogaway provided at CRYPTO '14 a formal security model to capture this kind of attacks and constructed practically implementable ASAs against a large class of symmetric encryption schemes. At CCS'15, Ateniese, Magri, and Venturi extended this model to allow the attackers to work in a fully-adaptive and continuous fashion and proposed subversion attacks against digital signature schemes. Both papers also showed the impossibility of ASAs in cases where the cryptographic tools are deterministic. Also at CCS'15, Bellare, Jaeger, and Kane strengthened the original model and proposed a universal ASA against sufficiently random encryption schemes. In this paper we analyze ASAs from the perspective of steganography -the well known concept of hiding the presence of secret messages in legal communications. While a close connection between ASAs and steganography is known, this lacks a rigorous treatment. We consider the common computational model for secret-key steganography and prove that successful ASAs correspond to secure stegosystems on certain channels and vice versa. This formal proof allows us to conclude that ASAs are stegosystems and to "rediscover" several results concerning ASAs known in the steganographic literature.

show abstract

“…Note that the notion of ASA is very similar to that of "kleptographic" attack in the early literature [6]. Note also that Degabriele, Farshim and Poettering recently refined and improved BPR's security notions related to ASA [3].…”

Section: Introductionmentioning

confidence: 89%

“…Motivation. Since Edward Snowden revealed that the US and UK governments made a great deal of effort to subvert widely deployed cryptographic systems [4], algorithm substitution attack (ASA) [1] on cryptographic schemes has been being actively explored [2], [3], [5]. ASA, proposed by Bellare, Paterson and Rogaway (BPR), refers to an activity whereby a saboteur [5] (or a big brother [1], [6]) replaces an original implementation of a cryptographic scheme with a subverted one.…”

Section: Introductionmentioning

confidence: 99%

Efficient Subversion of Symmetric Encryption with Random Initialization Vector

Baek

You

2016

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

This paper presents an efficient subverted symmetric encryption scheme, which outputs a random initialization vector (IV). Compared with the available scheme of the same kind in the literature, our attack provides a saboteur (big brother) with much faster recovery of a key used in a victim's symmetric encryption scheme. Our result implies that care must be taken when a symmetric encryption scheme with a random IV such as randomized CBC is deployed.

show abstract

A More Cautious Approach to Security Against Mass Surveillance

Cited by 58 publications

References 22 publications

Security of Symmetric Encryption against Mass Surveillance

Security of Symmetric Encryption against Mass Surveillance

Algorithm Substitution Attacks from a Steganographic Perspective

Efficient Subversion of Symmetric Encryption with Random Initialization Vector

Contact Info

Product

Resources

About