* [2024] [[https://pyecsca.org/papers.html#pyecsca-reverse-engineering-black-box-elliptic-curve-cryptography-via-side-channel-analysis| Jančár, J.; Suchánek, V.; Švenda P.; Sedláček, V.; Chmielewski, L.: pyecsca: Reverse engineering black-box elliptic curve cryptography via side-channel analysis]], In IACR Transactions on Cryptographic Hardware and Embedded Systems, Ruhr-University of Bochum, 2024, 355–381. **Received Honorable mention and Best Artifact Award**
* [2020] Jančár, J.; Sedláček, V.; Sýs, M.; Švenda, P.: [[https://minerva.crocs.fi.muni.cz/| Minerva: The curse of ECDSA nonces; Systematic analysis of lattice attacks on noisy leakage of bit-length of ECDSA nonces]], In IACR Transactions on Cryptographic Hardware and Embedded Systems (CHES) 2020. **Received Best Paper Award**
* [2020] Jančár, J.; Sedláček, V.; Sýs, M.; Švenda, P.: [[https://minerva.crocs.fi.muni.cz/| Minerva: The curse of ECDSA nonces; Systematic analysis of lattice attacks on noisy leakage of bit-length of ECDSA nonces]], In IACR Transactions on Cryptographic Hardware and Embedded Systems (CHES) 2020. **Received Best Paper Award**
* [2020] Klinec D.; Matyas V.: [[:public:papers:monero_ifipsec20| Privacy-Friendly Monero Transaction Signing on a Hardware Wallet]], In IFIP TC 11 International Conference (SEC) 2020.
* [2020] Klinec D.; Matyas V.: [[:public:papers:monero_ifipsec20| Privacy-Friendly Monero Transaction Signing on a Hardware Wallet]], In IFIP TC 11 International Conference (SEC) 2020.
Line 90:
Line 91:
<collapse id="secapi" collapsed="true">
<collapse id="secapi" collapsed="true">
-
**Last update: 17. 01. 2024**
+
**Last update: 20. 01. 2025**
**Contact:** Vašek Matyáš <matyas@fi.muni.cz>
**Contact:** Vašek Matyáš <matyas@fi.muni.cz>
Line 105:
Line 106:
** Selected publications: **
** Selected publications: **
+
* [2024] Fourné M., De Almeida Braga D., Jancar J., Sabt M., Schwabe P., Barthe G., Fouque P., Acar Y.: [[public:papers:usablect_usenix24|“These results must be false”: A usability evaluation of constant-time analysis tools]], USENIX Security 2024.
* [2022] Jancar J., Fourné M., De Almeida Braga D., Sabt M., Schwabe P., Barthe G., Fouque P., Acar Y.: [[public:papers:usablect_sp22|“They’re not that hard to mitigate”: What Cryptographic Library Developers Think About Timing Attacks]], IEEE S&P 2022.
* [2022] Jancar J., Fourné M., De Almeida Braga D., Sabt M., Schwabe P., Barthe G., Fouque P., Acar Y.: [[public:papers:usablect_sp22|“They’re not that hard to mitigate”: What Cryptographic Library Developers Think About Timing Attacks]], IEEE S&P 2022.
* [2022] Ukrop M., Balážová M., Žáčik P., Valčík E., Matyas V.: [[public:papers:eurousec2022|Assessing Real-World Applicability of Redesigned Developer Documentation for Certificate Validation Errors]], EuroUSEC 2022.
* [2022] Ukrop M., Balážová M., Žáčik P., Valčík E., Matyas V.: [[public:papers:eurousec2022|Assessing Real-World Applicability of Redesigned Developer Documentation for Certificate Validation Errors]], EuroUSEC 2022.
* [[:public:papers:usenix2016| Classification of RSA key origin based on public key only]], accurate popularity of libraries [[:public:papers:acsac2017|for TLS keys]], [[http://crcs.cz/rsapp | online checker]], [[https://github.com/crocs-muni/RSABias|classifier of private keys]]
* [[:public:papers:usenix2016| Classification of RSA key origin based on public key only]], accurate popularity of libraries [[:public:papers:acsac2017|for TLS keys]], [[http://crcs.cz/rsapp | online checker]], [[https://github.com/crocs-muni/RSABias|classifier of private keys]]
* [2024] Svenda, P.; Dufka, A.; Broz, M.; Lacko, R.; Jaros, T.; Zatovic, D.; Pospisil, J.: [[https://crocs.fi.muni.cz/papers/tpm_ches2024|TPMScan: A wide-scale study of security-relevant properties of TPM 2.0 chips]], In IACR Transactions on Cryptographic Hardware and Embedded Systems (CHES) 2024.
+
* [2024] Svenda, P.; Dufka, A.; Broz, M.; Lacko, R.; Jaros, T.; Zatovic, D.; Pospisil, J.: [[https://crocs.fi.muni.cz/papers/tpm_ches2024|TPMScan: A wide-scale study of security-relevant properties of TPM 2.0 chips]], In IACR Transactions on Cryptographic Hardware and Embedded Systems (CHES) 2024. **Received Honorable Mention**
* [2024] Jancar, J.; Suchanek, V.; Svenda, P.; Chmielwski, L.: [[https://crocs.fi.muni.cz/papers/tpm_ches2024|pyecsca: Reverse engineering black-box elliptic curve cryptography via side-channel analysis]], In IACR Transactions on Cryptographic Hardware and Embedded Systems (CHES) 2024.
* [2024] Jancar, J.; Suchanek, V.; Svenda, P.; Chmielwski, L.: [[https://crocs.fi.muni.cz/papers/tpm_ches2024|pyecsca: Reverse engineering black-box elliptic curve cryptography via side-channel analysis]], In IACR Transactions on Cryptographic Hardware and Embedded Systems (CHES) 2024.
* [2020] Jančár, J.; Sedláček, V.; Sýs, M.; Švenda, P.: [[https://minerva.crocs.fi.muni.cz/|Minerva: The curse of ECDSA nonces; Systematic analysis of lattice attacks on noisy leakage of bit-length of ECDSA nonces]], In IACR Transactions on Cryptographic Hardware and Embedded Systems (CHES) 2020. **Received Best Paper Award**
* [2020] Jančár, J.; Sedláček, V.; Sýs, M.; Švenda, P.: [[https://minerva.crocs.fi.muni.cz/|Minerva: The curse of ECDSA nonces; Systematic analysis of lattice attacks on noisy leakage of bit-length of ECDSA nonces]], In IACR Transactions on Cryptographic Hardware and Embedded Systems (CHES) 2020. **Received Best Paper Award**
Line 178:
Line 181:
{{ :public:research:curves.png?nolink&120|}}
{{ :public:research:curves.png?nolink&120|}}
-
Likely the most theoretical and math-heavy research we do, though still with real-world consequences in mind. We approach elliptic curves from many different directions: we study ECC implementations, problems with ECC formulas, ECC key datasets and in general diverse mathematical ideas involving elliptic curves. Sometimes, this requires us to dive into lattice methods as well.
+
Likely the most theoretical and math-heavy research we do, though still with real-world consequences in mind. We approach elliptic curves from many different directions: we study ECC implementations, problems with ECC formulas, ECC key datasets, and, in general, diverse mathematical ideas involving elliptic curves. Sometimes, this requires us to dive into lattice methods as well.
In the past, we were systematically analyzing standardized elliptic curves. Lately, we have been mainly focusing on ECC with respect to side-channel attacks and the involvement of elliptic curves in the Bitcoin protocol.
In the past, we were systematically analyzing standardized elliptic curves. Lately, we have been mainly focusing on ECC with respect to side-channel attacks and the involvement of elliptic curves in the Bitcoin protocol.
* [2024] [[:public:papers:dcp_acns| Suchánek, V.; Sedláček, V.; Sýs, M.: Decompose and conquer: ZVP attacks on GLV curves]], In ACNS - Applied Cryptography and Network Security
+
* [2024] [[https://pyecsca.org/papers.html#pyecsca-reverse-engineering-black-box-elliptic-curve-cryptography-via-side-channel-analysis| Jančár, J.; Suchánek, V.; Švenda P.; Sedláček, V.; Chmielewski, L.: pyecsca: Reverse engineering black-box elliptic curve cryptography via side-channel analysis]], In IACR Transactions on Cryptographic Hardware and Embedded Systems, Ruhr-University of Bochum, 2024, 355–381. **Received Honorable mention and Best Artifact Award**
* [2022] [[https://dissect.crocs.fi.muni.cz/| Sedláček, V.; Suchánek, V.; Dufka A.; Sýs, M.; Matyáš, V.: DiSSECT: Distinguisher of Standard and Simulated Elliptic Curves via Traits]], In Progress in Cryptology - AFRICACRYPT 2022.
* [2022] [[https://dissect.crocs.fi.muni.cz/| Sedláček, V.; Suchánek, V.; Dufka A.; Sýs, M.; Matyáš, V.: DiSSECT: Distinguisher of Standard and Simulated Elliptic Curves via Traits]], In Progress in Cryptology - AFRICACRYPT 2022.
* [2021] [[:public:papers:formulas_asiacrypt21| Sedláček, V.; Chi-Domínguez, J.J.; Jančár, J.; Brumley, B.B.: A formula for disaster: a unified approach to elliptic curve special-point-based attacks]], In Advances in Cryptology – ASIACRYPT 2021.
* [2021] [[:public:papers:formulas_asiacrypt21| Sedláček, V.; Chi-Domínguez, J.J.; Jančár, J.; Brumley, B.B.: A formula for disaster: a unified approach to elliptic curve special-point-based attacks]], In Advances in Cryptology – ASIACRYPT 2021.
Line 261:
Line 266:
* [2015] [[http://www.imt.ro/romjist/Volum18/Number18_1/pdf/02-MSys.pdf| Sýs M., Říha Z., Matyáš V., Márton K., Suciu A.: On the Interpretation of Results from the NIST Statistical Test Suite]], ROMJIST Journal, 2015.
* [2015] [[http://www.imt.ro/romjist/Volum18/Number18_1/pdf/02-MSys.pdf| Sýs M., Říha Z., Matyáš V., Márton K., Suciu A.: On the Interpretation of Results from the NIST Statistical Test Suite]], ROMJIST Journal, 2015.
* [2014] {{:public:crocs:sys_space_2014.pdf| Sýs M., Říha Z.: Faster randomness testing with NIST STS}},SPACE 2014, Fourth International Conference on Security, Privacy, and Applied Cryptography Engineering, 2014.
* [2014] {{:public:crocs:sys_space_2014.pdf| Sýs M., Říha Z.: Faster randomness testing with NIST STS}},SPACE 2014, Fourth International Conference on Security, Privacy, and Applied Cryptography Engineering, 2014.
-
</collapse>
-
-
===== Social and behavioral aspects of security =====
-
-
Our end-user oriented usable security projects focus on computer security and interactions of systems with end-users. We started in our first significant project in this area in 2014, in cooperation with three industrial partners, Faculty of social studies, and Faculty of law.
-
The project aimed to identify influences that make users change their risky behavior to more secure one. Four sets of experiments ran in cooperation with commercial companies (ESET, Netsuite and SodatSW). Every experiment targeted a different target group and used a different technique (warning, security dialogue, e-learning, user-friendly password recovery, etc.). This project was unique for the cooperation of three different faculties of MU and three commercial companies, who wanted to understand their users better and increase their products' overall security by improving interfaces and processes used by their end-users.
-
-
We also finished a project in cooperation with the Faculty of social studies and AHEAD Itec/Monet+ company. It aimed at user testing of selected authentication methods (NFC token, smart card with card reader, fingerprint and PIN code). Results from this project are available here: https://crocs.fi.muni.cz/public/papers/2020-tacr-report
-
-
-
<button icon="fa fa-caret-down" collapse="social">Find out more</button>
* [2018] Stavova, V., Dedkova, L., Ukrop, M., and Matyas, V. (in press). A large-scale comparative study of beta testers and standard users. Communications of the ACM. ACM, 2018, 64–71.
-
* [2017] Stavova, V., Matyas, V., Just M. and Ukrop, M.:Factors Influencing the Purchase of Security Software for Mobile Devices – Case Study, Infocommunications Journal, 2017, 18–23.
-
* [2016] Stavova, V., Matyas, V. and Just M.: Codes v. People: A Comparative Usability Study of Two Password Recovery Mechanisms, WISTP 2016.
-
* [2016] Stavova, V., Matyas, V. and Just M.: On the impact of warning interfaces for enabling the detection of Potentially Unwanted Applications, EuroUSEC 2016.
-
* [2015] {{public:papers:stavova_memics2016.pdf|Stavova, V., Matyas, V. and Malinka K.: The challenge of increasing safe response of antivirus software users, MEMICS 2015.}}
-
</collapse>
</collapse>
Line 352:
Line 322:
<collapse id="cryptocurrencies" collapsed="true">
<collapse id="cryptocurrencies" collapsed="true">
-
**Last update: 22. 10. 2024**
+
**Last update: 19. 1. 2025**
**Contact:** Petr Svenda <svenda@fi.muni.cz>
**Contact:** Petr Svenda <svenda@fi.muni.cz>
**More information, projects and resources:**
**More information, projects and resources:**
+
* Tools
+
* BlockSci (fork) adapted to CoinJoins, [[https://github.com/crocs-muni/blocksci|Github repository]]
* [[https://is.muni.cz/auth/osoba/4085|Petr Švenda]] 2019-now (project lead, some initial implementations)
* [[https://is.muni.cz/auth/osoba/4085|Petr Švenda]] 2019-now (project lead, some initial implementations)
-
**Former participants:** Dušan Klinec 2017-2022 (Monero on Trezor T, attack on Ledger's Monero); Filip Vass 2021-2022 (EU SSI framework); Denis Varga 2021-2022 (CoinJoin protocols analysis); K. Raczova 2020-2021 (usability of Bitcoin wallets); Adam Parak 2021-2022 (building blocks of hardware wallets); Jan Kubeša 2019-2022 (weak Bitcoin EC keys);
+
**Former participants:** Stepan Yakimovich 2022-2023 (Bitcoin pub keys extraction), Dušan Klinec 2017-2022 (Monero on Trezor T, attack on Ledger's Monero); Filip Vass 2021-2022 (EU SSI framework); Denis Varga 2021-2022 (CoinJoin protocols analysis); K. Raczova 2020-2021 (usability of Bitcoin wallets); Adam Parak 2021-2022 (building blocks of hardware wallets); Jan Kubeša 2019-2022 (weak Bitcoin EC keys);
** Selected publications: **
** Selected publications: **
Line 396:
Line 371:
We believe that the open-source security tools are crucial not only for the general accessibility, but also to produce more robust secure software and hardware products and their more transparent security certifications. Not only the dedicated testing laboratories, but also end-users shall be able to replicate majority of the steps carried during the certification like Common Criteria or FIPS140-2.
We believe that the open-source security tools are crucial not only for the general accessibility, but also to produce more robust secure software and hardware products and their more transparent security certifications. Not only the dedicated testing laboratories, but also end-users shall be able to replicate majority of the steps carried during the certification like Common Criteria or FIPS140-2.
-
Existing certification process produces trove of interesting, but hard to automatically process data. We extract, process and analyze these datasets to aid quick identification of potentially vulnerable products, provide ecosystem insight, and reason about the overall state of security. We also map and evaluate the existing open-source security software from several categories including (but not limited to) operating systems, browsers, password managers, and encryption tools. Majority of our other research results are accompanied with open-source tooling.
+
Existing certification process produces trove of interesting, but hard to automatically process data. We extract, process and analyze these datasets to aid quick identification of potentially vulnerable products, provide ecosystem insight, and reason about the overall state of security. Majority of our other research results are accompanied with open-source tooling.
Line 403:
Line 378:
<collapse id="opentools" collapsed="true">
<collapse id="opentools" collapsed="true">
-
**Last update: 22. 10. 2024**
+
**Last update: 21. 1. 2025**
**Contact: Petr Švenda <svenda@fi.muni.cz> **
**Contact: Petr Švenda <svenda@fi.muni.cz> **
Line 412:
Line 387:
* JCAlgTest [[https://github.com/crocs-muni/JCAlgTest | GitHub repository]] - tools for thorough testing of smart card capabilities
* JCAlgTest [[https://github.com/crocs-muni/JCAlgTest | GitHub repository]] - tools for thorough testing of smart card capabilities
* TPMAlgtest[[https://github.com/crocs-muni/tpm2-algtest | GitHub repository]] - tools for thorough testing of TPM capabilities
* TPMAlgtest[[https://github.com/crocs-muni/tpm2-algtest | GitHub repository]] - tools for thorough testing of TPM capabilities
+
* SCRUTINY [[https://github.com/crocs-muni/scrutiny | GitHub repository]] - hardware and software security testing and reference profile comparison tools.
* [2024] Janovsky, A., Jancar, J.; Svenda, P.; Chmielewski, L.; Michalik, J.; Matyas, V.: [[https://arxiv.org/abs/2311.17603|sec-certs: Examining the security certification practice for better vulnerability mitigation]], In Computers and Security journal vol.143, 2024.
+
* [2024] Jancar, J.; Suchanek, V.; Svenda, P.; Sedlacek, V.; Chmielewski, L.: [[https://pyecsca.org|pyecsca: Reverse engineering black-box elliptic curve cryptography via side-channel analysis]], In IACR Transactions on Cryptographic Hardware and Embedded Systems (CHES) 2024. Received Honorable mention and Best artifact awards.
* [2024] Svenda, P.; Dufka, A.; Broz, M.; Lacko, R.; Jaros, T.; Zatovic, D.; Pospisil, J.: [[https://crocs.fi.muni.cz/papers/tpm_ches2024|TPMScan: A wide-scale study of security-relevant properties of TPM 2.0 chips]], In IACR Transactions on Cryptographic Hardware and Embedded Systems (CHES) 2024.
* [2024] Svenda, P.; Dufka, A.; Broz, M.; Lacko, R.; Jaros, T.; Zatovic, D.; Pospisil, J.: [[https://crocs.fi.muni.cz/papers/tpm_ches2024|TPMScan: A wide-scale study of security-relevant properties of TPM 2.0 chips]], In IACR Transactions on Cryptographic Hardware and Embedded Systems (CHES) 2024.
* [2022] Petr Svenda, Rudolf Kvasnovsky, Imrich Nagy and Antonin Dufka: [[public:papers:jcalgtest_secrypt22|JCAlgTest: Robust identification metadata for certified smartcards]], In SECRYPT'22
* [2022] Petr Svenda, Rudolf Kvasnovsky, Imrich Nagy and Antonin Dufka: [[public:papers:jcalgtest_secrypt22|JCAlgTest: Robust identification metadata for certified smartcards]], In SECRYPT'22
Line 432:
Line 412:
-
===== Archived projects =====
+
-
<callout type="info" icon="true">Click to see [[:public:research:main_archived | Archived projects]]. Older projects, which are not currently actively pursued further, but may be activated again later (as happened for multiple projects already).
+
----
+
+
----
+
+
----
+
+
----
+
+
====== Archived research projects in CRoCS laboratory ======
+
<callout type="info" icon="true">Click <button icon="fa fa-caret-down" collapse="archived">Find out more</button> to see older projects, which are not currently actively pursued further, but may be activated again later (as happened for multiple projects already).
</callout>
</callout>
+
+
<collapse id="archived" collapsed="true">
+
+
+
===== Social and behavioral aspects of security =====
+
+
Our end-user oriented usable security projects focus on computer security and interactions of systems with end-users. We started in our first significant project in this area in 2014, in cooperation with three industrial partners, Faculty of social studies, and Faculty of law.
+
The project aimed to identify influences that make users change their risky behavior to more secure one. Four sets of experiments ran in cooperation with commercial companies (ESET, Netsuite and SodatSW). Every experiment targeted a different target group and used a different technique (warning, security dialogue, e-learning, user-friendly password recovery, etc.). This project was unique for the cooperation of three different faculties of MU and three commercial companies, who wanted to understand their users better and increase their products' overall security by improving interfaces and processes used by their end-users.
+
+
We also finished a project in cooperation with the Faculty of social studies and AHEAD Itec/Monet+ company. It aimed at user testing of selected authentication methods (NFC token, smart card with card reader, fingerprint and PIN code). Results from this project are available here: https://crocs.fi.muni.cz/public/papers/2020-tacr-report
+
+
+
<button icon="fa fa-caret-down" collapse="social">Find out more</button>
* [2018] Stavova, V., Dedkova, L., Ukrop, M., and Matyas, V. (in press). A large-scale comparative study of beta testers and standard users. Communications of the ACM. ACM, 2018, 64–71.
+
* [2017] Stavova, V., Matyas, V., Just M. and Ukrop, M.:Factors Influencing the Purchase of Security Software for Mobile Devices – Case Study, Infocommunications Journal, 2017, 18–23.
+
* [2016] Stavova, V., Matyas, V. and Just M.: Codes v. People: A Comparative Usability Study of Two Password Recovery Mechanisms, WISTP 2016.
+
* [2016] Stavova, V., Matyas, V. and Just M.: On the impact of warning interfaces for enabling the detection of Potentially Unwanted Applications, EuroUSEC 2016.
+
* [2015] {{public:papers:stavova_memics2016.pdf|Stavova, V., Matyas, V. and Malinka K.: The challenge of increasing safe response of antivirus software users, MEMICS 2015.}}
+
+
+
----
+
===== Disk encryption =====
+
{{ :public:research:fde.png?direct&200|}}
+
The first goal is research, and implementation of new algorithms (key derivation, authenticated encryption or integrity protection mechanism) into existing open-source LUKS/cryptsetup disk encryption project.
+
+
The second goal is to make LUKS/libcryptsetup (and supported FDE formats) truly multiplatform tool (Windows/Linux) with focus to independent and extensible open-source software based FDE (Full Disk Encryption) solution.
+
+
**Last update: 22.01.2021**
+
+
**Contact:** Milan Brož <xbroz@fi.muni.cz>
+
+
* Research project [[research:lukswin:lukswin| internal wiki pages]]
** Join us! The possible areas for cooperation: **
+
* Developing HMI (Human-machine interface) for storage encryption - ease of use, test cases, simple GUI, HMI usability experiments.
+
* Disk (sector-level) storage encryption in Windows study, existing approaches and implementations (TrueCrypt, DiskCryptor, Bitlocker, FreeOTFE, ...) with focus on free and open-source solutions. Windows driver architecture for implementing similar encryption capabilities as provided in Linux dm-crypt module.
+
* Windows boot process analysis and possibilities to use open-source boot loaders like GRUB2 to inject boot of core Windows system from (LUKS) encrypted device.
+
* Using open-source multiplatform encryption libraries (gcrypt, openssl, etc) for implementation of symmetric block cipher encryption wrappe in windows environment, both in userspace and driver.
+
* Current status quo in RNG available in Windows7 and later systems, implementation of wrapper (or usable alternative) to Linux /dev/[u]random device.
* [[https://is.muni.cz/auth/osoba/409782|Agáta Dařbujanová]] 2014-2016 (Student, User interface for storage encryption application)
+
+
+
** Selected publications: **
+
+
* [2016] [[https://is.muni.cz/auth/th/422714/fi_b/|Harčár, M.: Generátory náhodných čísel v multiplatformním prostředí]], FI bachelor thesis
+
* [2016] [[https://is.muni.cz/auth/th/409782/fi_b/|Dařbujanová, A.: Uživatelské rozhraní aplikace pro šifrování disku]], FI bachelor thesis
+
* [2016] Brož M.,Kozina,O.: [[https://mbroz.fedorapeople.org/talks/DevConf2016/devconf2016-luks2.pdf|The Future of Disk Encryption with LUKS2]], DevConf 2016
+
* [2015] Brož M.,Matyáš V.: Selecting a New Key Derivation Function for Disk Encryption, STM 2015
+
* [2015] [[https://is.muni.cz/auth/th/409879/fi_b/|Mosnáček, O.: Key derivation functions and their GPU implementations]], FI bachelor thesis
+
* [2014] [[https://is.muni.cz/publication/1185613/|Brož M.,Matyáš V.: The TrueCrypt On-Disk Format—An Independent View]], IEEE Security & Privacy, 2014, vol. 12, No 3, p. 74-77. ISSN 1540-7993
+
* [2011] [[https://mbroz.fedorapeople.org/talks/DevConf2012/|Brož M.:Disk encryption (not only) in Linux]], Europen.cz 2011, Red Hat DevConf 2012
+
+
+
===== Wireless Sensor Networks =====
+
{{ :public:research:wsn.png?direct&150|}}
+
+
This project includes providing a secure platform that is transparent for applications in wireless sensor networks (WSN) - WSNProtectLayer. Our platform includes intrusion detection system (IDS) detecting active attacks. We consider privacy issues to prevent passive attacks on the WSN. We also propose secrecy amplification protocols and evaluate key management schemes. Current work includes parametrised attacker simulated on KMSforWSN framework.
Additionally, we are developing an optimization framework for the IDS incorporating MiXiM simulator. Evolutionary algorithms are used to optimize the IDS's performance.
+
+
* Research project [[research:wsn:main| internal wiki pages]]
+
* **WSNProtectLayer** - security middleware for TinyOS
+
* virtual radio is simulated and automatic packet protection, IDS and key management is provided.
* Take a look at [[https://youtu.be/qHaUO_XMEqE | video]] showing WSNProtectLayer middleware in action.
+
* **Secrecy amplification protocols**
+
* establishing secure links in partially compromised network
+
* SensorSim simulator [[http://www.fi.muni.cz/~xsvenda/s3.html| download page]] - fast simulator optimized for simulation of secrecy amplification protocols and probabilistic key predistribution
+
* KMSforWSN framework based on OMNet++ simulator together with parametrised attacker specification
+
* **Laboratory testbed**
+
* [[research:wsn:testbed| Laboratory tesbed]] with 28 TelosB and 20 JeeNode nodes
+
* [[https://github.com/crocs-muni/Edu-hoc/ | Edu-Hoc]] - laboratory Arduino-based [[research:wsn:testbed_arduino| testbed]] with JeeNode nodes together with security applications for ad-hoc and wireless sensor networks.
* [2018] [[public:papers:dcoss2018 | Němec, L.; Ošťádal, R.; Švenda, P.; Matyáš, V.: Adaptive Secrecy Amplification with Radio Channel Key Extraction]], 2018 14th International Conference on Distributed Computing in Sensor Systems (DCOSS), 2018.
+
* [2018] Němec, L.; Ošťádal, R.; Švenda, P.; Matyáš, V.: Entropy Crowdsourcing – Protocols for Link Key Updates in Wireless Sensor Networks, In 26th International Workshop on Security Protocols (SPW 2018). Lecture Notes of Computer Science. Springer.
+
* [2016] [[public:papers:icnsc2016 | Stehlík, M.; Matyáš, V.; Stetsko, A.: Towards Better Selective Forwarding and Delay Attacks Detection in Wireless Sensor Networks]]
+
* [2016] [[public:papers:spw2016 | Ošťádal, R.; Švenda, P.; Matyáš, V.: Reconsidering Attacker Models in Ad-hoc Networks]], In 24th International Workshop on Security Protocols (SPW 2016). Lecture Notes of Computer Science. Springer.
+
* [2015] {{:public:papers:secamplif_wistp15.pdf| Ošťádal, R.; Švenda, P.; Matyáš, V.: On Secrecy Amplification Protocols}}, In 9th WISTP International Conference on Information Security Theory and Practice, LNCS 9311, Springer, pp. 3-19, 2015.
+
* [2014] {{:public:crocs:space14_final.pdf| Ošťádal, R.; Švenda, P.; Matyáš, V.: A new approach to secrecy amplification in partially compromised networks}}, In 4th International Conference on Security, Privacy and Applied Cryptography Engineering, LNCS 8804, Springer, pp. 92–109, 2014.
+
+
===== Software Security and Secure Programming =====
+
+
This project focuses on usage, evaluation and extension of various tools related to secure programming, application vulnerabilities, security testing and code review. We are interested in static and dynamic analysis of applications with a special focus on security bugs, fuzzy testing, taint analysis and semi-automated review procedures and its incorporation into application development lifecycle. This project is coordinated with [[ http://www.ysoft.com/ | Y Soft Corporation, a.s.]], and for students participating in this project, there is a possibility to get a financial support from this company. More general information about Y Soft cooperation with students can be found [[https://www.ysoft.com/en/company/university-relations|here]].
+
+
+
**Last update: 19.09.2018**
+
+
**Contact:** Andriy Stetsko <xstetsko@fi.muni.cz> or <andriy.stetsko@ysoft.com>
+
+
** Financial support:**
+
Y Soft Corporation, a.s. will provide financial support (in a form of stipend at the faculty or a part-time job in the company) to students with promising results.
+
+
** Possible topics for cooperation with bachelor students:**
+
* [[https://is.muni.cz/auth/rozpis/tema?balik=1275;tema=336359|OWASP Dependency Check: add support for Go]]
+
* [[https://is.muni.cz/auth/rozpis/tema?balik=1275;tema=336361|OWASP Dependency Check: add support for C]]
+
* [[https://is.muni.cz/auth/rozpis/tema?balik=1275;tema=336378|OWASP Dependency Check: enhance support for JavaScript]]
* 2013-2017: **Tools for dynamic security analysis of web applications**, financial support from Y Soft Corporation
+
* 2015-2016: **Analysis and application of OWASP testing guide**, financial support from Y Soft Corporation
+
* 2015-2016: **Metasploit**, financial support from Y Soft Corporation
+
* 2014-2016: **Secure software development processes**, financial support from Y Soft Corporation
+
* 2012-2016: **Tools for static and dynamic code analysis**, financial support from Y Soft Corporation
+
* 2014-2015: **Security mechanisms of PDF files**
+
* 2014-2015: **Security aspects of Xamarin/Android Platform**
+
* [[http://sourceforge.net/projects/cesta/ | Cesta project]] - security-related transformations of JavaCard source code, financial support from Y Soft Corporation
+
+
+
===== Faster randomness testing =====
+
+
This project is focused on improving the implementation of standard empirical test of randomness since some complete tests (Linear Complexity, Spectral, Overlapping template matching) can take hours on standard computer for usual amount of data. Tests are usually grouped into test batteries (NIST STS, Diehard,TestU01) to provide more complex randomness analysis. Currently we are focusing on optimization of NIST STS battery. Visit our [[https://randomness-tests.fi.muni.cz|online testing service]].
* [2015] [[http://www.imt.ro/romjist/Volum18/Number18_1/pdf/02-MSys.pdf| Sýs, M.; Z. Říha, V. Matyáš, K.Márton, A. Suciu: On the Interpretation of Results from the NIST Statistical Test Suite]], ROMJIST Journal, 2015.
+
* [2014] {{:public:crocs:sys_space_2014.pdf| Sýs, M.; Z. Říha: Faster randomness testing with NIST STS}},SPACE 2014, Fourth International Conference on Security, Privacy, and Applied Cryptography Engineering, 2014.
+
+
===== Attacker strategy evolution (GANet) =====
+
+
**Last update: 08.01.2016**
+
+
**Contact:** Zdenek Říha <zriha@fi.muni.cz>
+
+
**Project description:**
+
This project focuses on automated generation of attacker's strategies against real implementation of various network applications. Currently, we aim to optimize existing Denial of Service attacks (DoS attacks, [[https://en.wikipedia.org/wiki/Denial-of-service_attack|Link]]) in order to achieve maximum impact on the victim webserver.
+
GANet contains source codes we are using - for now, combination of OS apps (Perfmon,...) and Python scripts.
+
+
* Research project [[research:ganet:main| internal wiki pages]]
+
* Project [[https://github.com/crocs-muni/GANet | Github repository]], [[https://github.com/crocs-muni/GANet/wiki | wiki pages]]
**Former participants:** Tatevik Baghdasaryan 2014-2015 (testing simple web server);
+
+
** Selected publications **
+
+
* [2015] {{:public:research:ganet_paper1.pdf|Bukač, V.; Ošťádal, R.; Švenda, P.; Baghdasaryan, T. and Matyáš, V.: Challenges of fiction in network security - perspective of virtualized environments}}, LNCS 9379, pp. 145-151, Springer, 2015.
+
* [2014] {{:public:research:redqueensrace_aptwinwingame.pdf|Bukač, V.; Lorenc, V. and Matyáš, V.: Red Queen's Race: APT win-win game. In Security Protocols XXII - 22nd International Workshop, Revised Selected Papers}}, LNCS 8809, pp. 55-61, Springer, 2014.
+
+
----
+
+
===== Whitebox cryptography =====
+
**Last update: 14.9.2015**
+
+
**Status: Completed/On hold**
+
+
**Contact:** Petr Švenda <svenda@fi.muni.cz>
+
+
**Project description:**
+
This project is focused on design and development of the special implementations of cryptographic functions able to operate in an environment under full control of an attacker and still able to protect used secrets (e.g., encryption keys).
+
+
* Research project [[research:whitebox:main| internal wiki pages]]
+
* Whitebox AES implementation in [[https://github.com/petrs/Whitebox-crypto-AES|Cpp]] and [[https://github.com/xbacinsk/Whitebox-crypto-AES-java|Java]] (GitHub repositories)
+
* SecureFW framework for [[http://www.fi.muni.cz/~xsvenda/securefw.html | source codes and binaries]] - earlier version of whitebox AES implementation in Cpp, secure channel with JavaCard smart card
+
* Explanation of whitebox cryptography, homomorphic encryption and computation with encrypted function/data: {{:public:crocs:WhiteboxCrypto_20130531.pdf|slides}}
+
* List of resources related to [[public:research:whitebox:mobilecrypto| whitebox cryptography]]
We want to map the dark economy behind Denial-Of-Service attack services (DDoSaaS) for hire, the communication between DDoSaaS providers and customers and collect samples of attack traffic from real existing DDoS services. This project is about getting hands-on experience with network attacks in real environment instead of in closed labs, analyzing often neglected economy aspect of network attacks and dipping into the mindset of a cyber-criminal.
+
+
* Research project [[research:ddosaas:main| internal wiki pages]]
* [2015] {{:public:research:serviceindenial.pdf|Bukač, V.; Šťavová, V.; Němec, L.; Říha, Z. and Matyáš, V.: Service in denial – clouds going with the winds}}, In Proceedings of NSS 2015, 9th International Conference on Network and System Security, LNCS 9408, pp. 130-147, Springer, 2015.
+
* [2015] {{:public:research:dostrafficfeatures.pdf|Bukač, V. and Matyáš, V.: Analyzing traffic features of common standalone DoS attack tools}}, In Proceedings of SPACE 2015, 5th International Conference on Security, Privacy, and Applied Cryptography Engineering, LNCS 9354, pp. 21-40, Springer, 2015.
+
* [2015] {{:public:research:ddosaas_ddosjakosluzba.pdf|Bukač, V.; Říha, Z.; Šťavová, V. and Matyáš, V.: DDoSaaS: DDoS jako služba}}, In IS2: From trends to solutions, pp. 35-39, Tate International, 2015.
+
+
+
----
+
===== Android Security =====
+
+
+
**Last update: 14.10.2014**
+
+
**Status: Completed/On hold**
+
+
**Contact:** Zdeněk Říha <zriha@fi.muni.cz> ; Dušan Klinec <ph4r05@mail.muni.cz>
+
+
**Project description:**
+
These activities look at the security issues of the Android installation files (APK). The Android APK files are digitally signed, but the signer can be anybody. Therefore it is possible to to modify the APK files (to include malware, for example) and resign it. This can be done in an automated way. Such a modification/infection can also be done online in the form of the man-in-the-middle attack where the APK package is transparently modified on its way from the server towards the mobile device if no encryption of the communication is done.