Many face to face and paper transactions have nowadays digital counterparts: home banking, electronic commerce, e-voting, ... and even partially our social life. A direct consequence of this digitalization is that large amounts of sensitive data transits on network and is stored on servers. It is therefore essential to protect communications and transactions against malicious parties, which we generically refer to as attackers. Cryptography and cryptographic protocols play an essential role to achieve this protection. However, vulnerabilities keep being found and attacks are frequent. This is due to an inherent asymmetry when building secure systems: while a designer needs to defend against all possible attacks, an attacker only needs to find a single point of failure.
Therefore, we advocate the use of formal and principled approaches to reason about security: given a mathematical abstraction of the system, the attacker and the security properties, we attest that the security property is ensured by the system even in presence of the attacker. Such a security proof, or principled security analysis, does not guarantee an absolute notion of security: an attacker may always act outside the attacker model and exploit aspects of the system that are not reflected in the abstract model. However, we can systematically exclude whole classes of attacks when no vulnerability is detected.
The aim of the project is to build formal models and computer-aided techniques for analysis and design of security protocols, cryptographic primitives and mechanisms. We structure our research around four axes:
Before being able to analyse and properly design security protocols, it is essential to have a model with a precise semantics of the protocols themselves, the attacker and its capabilities, as well as the properties a protocol must ensure.
Most current languages for protocol specification are quite basic and do not provide support for global state, loops, or complex data structures such as lists, or Merkle trees. As an example we may cite Hardware Security Modules that rely on a notion of mutable
global state which does not arise in traditional protocols, see
e.g. the discussion by Herzog 49.
Similarly, the properties a protocol should satisfy are generally not precisely defined, and stating the “right” definitions is often a challenging task in itself. In the case of authentication, many protocol attacks were due to the lack of a precise meaning, cf. 47. While the case of authentication has been widely studied, the recent digitalisation of all kinds of transactions and services introduces a plethora of new properties, including for instance anonymity in e-voting, untraceability of RFID tokens, verifiability of computations that are out-sourced, as well as sanitisation of data in social networks. We expect that many privacy and anonymity properties may be modelled as particular observational equivalences in process calculi 41, or indistinguishability between cryptographic games 2; sanitisation of data may also rely on information-theoretic measures.
We also need to take into account that the attacker model
changes. While historically the attacker was considered to control the
communication network, we may nowadays argue that even (part of) the
host executing the software may be compromised through, e.g., malware.
This situation motivates the use of secure elements and multi-factor
authentication with out-of-band channels. A typical example occurs in
e-commerce: to validate an online payment a user needs to enter an
additional code sent by the bank via SMS to the user's mobile phone.
Such protocols require the possession of a physical device in addition
to the knowledge of a password which could have been leaked on an
untrusted platform. The fact that data needs to be copied by a human
requires these data to be short, and hence amenable to
brute-force attacks by an attacker or guessing.
Most automated tools for verifying security properties rely on
techniques stemming from automated deduction. Often existing
techniques do however not apply directly, or do not scale up due to
state explosion problems. For instance, the use of Horn clause
resolution techniques requires dedicated resolution
methods 33, 37. Another example is
unification modulo equational theory, which is a key technique in
several tools, e.g. 46. Security protocols however
require to consider particular equational theories that are not
naturally studied in classical automated reasoning. Sometimes, even
new concepts have been introduced. One example is the finite variant
property 39, which is used in several tools, e.g.,
Akiss 37, Maude-NPA 46 and
TAMARIN 52. Another example is the notion of asymmetric
unification 45 which is a variant of unification
used in Maude-NPA to perform important syntactic pruning
techniques of the search space, even when reasoning modulo an
equational theory. For each of these topics we need to design
efficient decision procedures for a variety of equational theories.
We design dedicated techniques for automated protocol verification. While existing techniques for security protocol verification are efficient and have reached maturity for verification of confidentiality and authentication properties (or more generally safety properties), our goal is to go beyond these properties and the standard attacker models, verifying the properties and attacker models identified in Section 3.1. This includes techniques that:
These goals are beyond the scope of most current analysis tools and require both theoretical advances in the area of verification, as well as the design of new efficient verification tools.
Given our experience in formal analysis of security protocols, including both protocol proofs and finding of flaws, it is tempting to use our experience to design protocols with security in mind and security proofs. This part includes both provably secure design techniques, as well as the development of new protocols.
Design techniques include composition results that allow
one to design protocols in a modular way 40, 38. Composition results come in many flavours: they may
allow one to compose protocols with different objectives, e.g. compose a
key exchange protocol with a protocol that requires a shared key or
rely on a protocol for secure channel establishment, compose different
protocols in parallel that may re-use some key material, or compose
different sessions of the same protocol.
Another area where composition is of particular importance is Service Oriented Computing, where an “orchestrator” must combine some available component services, while guaranteeing some security properties. In this context, we work on the automated synthesis of the orchestrator or monitors for enforcing the security goals. These problems require the study of new classes of automata that communicate with structured messages.
We also design new protocols. Application areas that seem of particular importance are:
Security protocols, such as TLS, Kerberos, ssh or AKA (mobile communication), are the main tool for securing our communications. The aim of our work is to improve their security guarantees. For this, we propose models that are expressive enough to formally represent protocol executions in the presence of an adversary, formal definitions of the security properties to be satisfied by these protocols, and automated tools able to analyse them and possibly exhibit design flaws.
Many techniques for symbolic verification of security properties are rooted in automated reasoning. A typical example is equational reasoning used to model the algebraic properties of a cryptographic primitive. Our work therefore aims to improve and adapt existing techniques or propose new ones when needed for reasoning about security.
Electronic elections have in the last years been used in several countries for politically binding elections. The use in professional elections and associations is even more widespread. The aim of our work is to increase our understanding of the security properties needed for secure elections, propose techniques for analysing e-voting protocols, design of state-of-the-art voting protocols, but also to highlight the limitations of e-voting solutions.
The treatment of information released by users on social networks can violate a user's privacy. The goal of our work is to allow users to control the information released while guaranteeing their privacy.
In 2023, 3 out of the 11 elections of deputies had to be re-run for the French from abroad. As in 2022, Cortier, Gaudry, and Glondu acted as third party w.r.t. verifiability for the elections conducted with Internet voting. Concretely, we were involved in two steps:
Our work consolidates the introduction of more verifiability in French, political, elections. In particular, we obtained that a (partial) specification of the system was made public and that the hash of received ballots were made public as well.
We participate in a working group led by ANSSI, the purpose of which is to help the governmental actors (CNIL, ANSSI) in defining the next documents regulating the use of electronic voting in France. A first meeting was held on July, 2023. We also provide feedback on intermediate working documents.
Belenios is an open-source online voting system that provides vote confidentiality and verifiability. End-to-end verifiability relies on the fact that the ballot box is public (voters can check that their ballots have been received) and on the fact that the tally is publicly verifiable (anyone can recount the votes). Vote confidentiality relies on the encryption of the votes and the distribution of the decryption key (no one detains the secret key).
Belenios supports various kind of elections. In the standard mode, Belenios supports simple elections where voters simply select one or more candidates. It also supports arbitrary counting functions at the cost of a slightly more complex tally procedure for the authorities. For example, Belenios supports Condorcet, STV, and Majority Judgement, where voters rank candidates and grade them.
Belenios is available in several languages for the voters as well as the administrators of an election. More languages can be freely added by users.
In 2023, our platform was used to run about 1500 elections, with about 175,000 registered voters and 55,000 ballots counted.
Some of the improvements made during this year are invisible for users. This includes the use of elliptic curves instead of finite fields, as a base group where the discrete logarithm problem is supposed to be hard. The use of elliptic curve allows to decrease the size of ballots and improve time efficiency. Also, some modifications have been made, so that the server can handle larger elections. This was successfully tested, with a real election of more than 30,000 voters.
Other changes are visible to users. A new election administration interface based on a REST API is now available for beta-testing to the users. Also, the voter's journey has been slightly simplified, without impact on security. Finally, the STV counting system for preferential voting is now fully supported.
Several interns worked on Tamarin and implemented multiple improvements concerning in particular the tool's error handling and graph visualization.
An extension to Tamarin that allows to model imperfect cryptographic hash functions was also developed. In extensive case studies using this methodology, the extended tool rediscovers all attacks that were previously reported for several vulnerable protocols and discovers several new variants.
The Jasmin programming language smoothly combines high-level and low-level constructs, so as to support “assembly in the head” programming. Programmers can control many low-level details that are performance-critical: instruction selection and scheduling, what registers to spill and when, etc. The language also features high-level abstractions (variables, functions, arrays, loops, etc.) to structure the source code and make it more amenable to formal verification. The Jasmin compiler produces predictable assembly and ensures that the use of high-level abstractions incurs no run-time penalty.
The semantics is formally defined to allow rigorous reasoning about program behaviors. The compiler is formally verified for correctness (the proof is machine-checked by the Coq proof assistant). This ensures that many properties can be proved on a source program and still apply to the corresponding assembly program: safety, termination, functional correctness…
Jasmin programs can be automatically checked for safety and termination (using a trusted static analyzer). The Jasmin workbench leverages the EasyCrypt toolset for formal verification. Jasmin programs can be extracted to corresponding EasyCrypt programs to prove functional correctness, cryptographic security, or security against side-channel attacks (constant-time).
2023.06.0 is a major release of Jasmin. It contains a few noteworthy changes that follows. Local functions now use call and ret instructions. The ARMv7 (i.e., Cortex-M4) architecture is now experimentally supported. A few aspects of the safety checker can be finely controlled through annotations or command-line flags. Shift and rotation operators have a simpler semantics.
As usual, it also brings in various fixes and improvements, such as bit rotation operators and automatic slicing of the input program.
Security properties of cryptographic protocols are typically expressed as reachability or equivalence properties. Secrecy and authentication are examples of reachability properties while privacy properties such as untraceability, vote secrecy, or anonymity are generally expressed as behavioral equivalence in a process algebra that models security protocols.
Cheval (Inria Paris), Crubillé and Kremer study probabilistic process equivalences for security protocols. Symbolic models are classically purely non-deterministic. Indeed, generating random keys and nonces, or using randomized cryptographic primitives (like any secure encryption scheme) is idealized in symbolic models, replacing random numbers that can be guessed with only a negligible probability with perfectly fresh values that cannot be guessed at all. This abstraction has been widely used and has shown its usefulness. Another source of randomness may however come from the control flow. Typically, protocols aiming at anonymity, such as the Dining Cryptographers protocol, require users to take one action or another probabilistically. In this work we propose an extension of the applied pi calculus with a probabilistic choice operator (randomized, as non-randomized schedulers lead to definitions that have undesirable properties. We for instance show that typical behavioral relations would not be transitive and point out a flaw in the main theorem of a previous framework 48 that chose non-randomized schedulers. Mixing non-determinism and probabilistic choices generally leads to unsatisfactory behavioral equivalences: as the non-deterministic choices can leak the probabilistic choices, the resulting equivalences is too strong, modeling unrealistic attacker capabilities. We therefore investigate two sub-classes of protocols. We first consider the class of protocols that do not make any probabilistic choices, but allow the attacker to do so. Even though the honest processes may be purely non-deterministic, as the attacker is probabilistic, the resulting may testing equivalence is strictly stronger. We show that for a bounded number of sessions may-testing with a probabilistic attacker coincides with purely possibilistic similarity. Second, we consider a class of simple processes, with a very limited non-determinism. For this class, we show that trace equivalence coincides with may-testing where attackers are sequential processes (no parallel, nor non-deterministic choice) 7.
In collaboration with Erbatur (UT Dallas, USA) and Marshall (Univ Mary Washington, USA), Ringeissen studies reasoners and solvers for equational theories used in protocol analysis. In 22, the same authors plus Dwyer Satterfield (Univ Mary Washington, USA) have identified a class of term rewrite systems including the subterm convergent ones where the deduction problem and the static equivalence problem can be decided in a uniform way just like in the particular subterm convergent case. This class includes many theories of practical interest for which both deduction and static equivalence were decided until now on an individual basis. Beyond the decision problems related to equational unification and (intruder) theories, Ringeissen is also working on SMT (Satisfiability Modulo Theories) solvers to model verification conditions. In collaboration with Sheng (Stanford U.), Zohar (Bar Ilan U.), Reynolds (U. of Iowa), Barrett (Stanford U.) and Tinelli (U. of Iowa), Ringeissen published a journal paper on improving polite combination in presence of stably infinite theories 8. Christophe Ringeissen and Laurent Vigneron are also working on the definition of decision procedures based on congruence closure that could combine several equational theories.
Most cryptographic protocols use cryptographic hash functions as a building block. The security analyses of these protocols typically assume that the hash functions are perfect (such as in the random oracle model). However, in practice, most widely deployed hash functions are far from perfect – and as a result, the analysis may miss attacks that exploit the gap between the model and the actual hash function used.
In collaboration with Cremers (CISPA), Cheval (Inria Paris), Dax (CISPA) and Jacomme (Inria Paris), Hirschi and Kremer develop the first methodology to systematically discover attacks on security protocols that exploit weaknesses in widely deployed hash functions. We achieve this by revisiting the gap between theoretical properties of hash functions and the weaknesses of real-world hash functions, from which we develop a lattice of threat models. For all of these threat models, we develop fine-grained symbolic models.
Our methodology's fine-grained models cannot be directly encoded in existing state-of-the-art analysis tools by just using their equational reasoning. We therefore develop extensions for the two leading tools, TAMARIN and ProVerif. In extensive case studies using our methodology, the extended tools rediscover all attacks that were previously reported for these protocols and discover several new variants. These results have been presented at USENIX'23 14.
Unlinkability is a privacy property of crucial importance for several systems such as mobile phones or RFID chips. Analysing this security property is very complex, and highly error-prone. Therefore, formal verification with machine support is desirable. Unfortunately, existing tools perform over-approximations which eventually lead to false attacks, and thus prevent direct and automatic security proofs of unlinkability. To overcome this limitation, different techniques have been developed: either verifying a (maybe) weaker notion of unlinkability (e.g., 44) or following an indirect approach that consists in proving sufficient conditions (e.g., 36, 50, 32). If these last properties avoid the main limitations of the tools, they still appear difficult to prove and often require non-negligible protocol abstractions.
In collaboration with Baelde (IRISA) and Delaune (IRISA), Debant develops a new approach that allows direct and automatic proofs of unlinkability 12. They overcome the limitations of the tool ProVerif by defining a simple transformation that will exploit some of its specific features recently introduced in 34. This transformation, together with some generic axioms, allows the tool to successfully conclude on several case studies. They have implemented their approach, effectively obtaining direct proofs of unlinkability on several protocols that were, until now, out of reach of automatic verification tools. This approach is also promising to prove anonymity properties but this application remains a future work.
In collaboration with Jacomme (Inria Paris) Klein, Kremer and Racouchot have analyzed EDHOC. EDHOC is a key exchange proposed by IETF's Lightweight Authenticated Key Exchange (LAKE) Working Group (WG). Its design focuses on small message sizes to be suitable for constrained IoT communication technologies. We provide an in-depth formal analysis of EDHOC–draft version 12, taking into account the different proposed authentication methods and various options. For our analysis we use the SAPIC protocol platform that allows to compile a single specification to three state-of-the-art protocol verification tools (ProVerif, TAMARIN and DeepSec) and take advantage of the strengths of each of the tools. In our analysis we consider a large variety of compromise scenarios, and also exploit recent results that allow to model existing weaknesses in cryptographic primitives, relaxing the perfect cryptography assumption, common in symbolic analysis. While our analysis confirmed security for the most basic threat models, a number of weaknesses were uncovered in the current design when more advanced threat models were taken into account. These weaknesses have been acknowledged by the LAKE WG and the mitigations we propose (and prove secure) have been included in version 14 of the draft 23.
WireGuard is a Virtual Private Network (VPN), presented at NDSS 2017, recently integrated into the Linux Kernel and paid commercial VPNs such as NordVPN, Mullvad and ProtonVPN. It proposes a different approach from other classical VPN such as IPsec or OpenVPN because it does not let users configure cryptographic algorithms. The protocol inside WireGuard is a dedicated extension of IKpsk2 protocol from Noise Framework. Different analyses of WireGuard and IKpsk2 protocols have been proposed, in both the symbolic and the computational model, with or without computer-aided proof assistants. These analyses however consider different adversarial models or refer to incomplete versions of the protocols. In this work, we propose a unified formal model of WireGuard protocol in the symbolic model. Our model uses the automatic cryptographic protocol verifiers SAPIC, ProVerif and TAMARIN. We consider a complete protocol execution, including cookie messages used for resistance against denial of service attacks. We model a precise adversary that can read or set static, ephemeral or pre-shared keys, read or set ecdh pre-computations, control key distribution. Eventually, we present our results in a unified and interpretable way, allowing comparisons with previous analyses. Finally, thanks to our models, we give necessary and sufficient conditions for security properties to be compromised, we confirm a flaw on the anonymity of the communications and point an implementation choice which considerably weakens its security. We propose a remediation that we prove secure using our models.
Critical and widely used cryptographic protocols have repeatedly been found to contain flaws in their design and their implementation. A prominent class of such vulnerabilities is logical attacks, i.e., attacks that solely exploit flawed protocol logic. Automated formal verification methods, based on the Dolev-Yao (DY) attacker, excel at finding such flaws, but operate only on abstract specification models. Fully automated verification of existing protocol implementations is today still out of reach. This leaves open whether widely used protocol implementations are secure. Unfortunately, this blind spot hides numerous attacks, notably recent logical attacks on widely used TLS implementations introduced by implementation bugs.
In collaboration with Max Ammann (former master student), Hirschi and Kremer propose a novel and effective technique that we call DY model-guided fuzzing, which precludes logical attacks against protocol implementations 10. The main idea is to consider as possible test cases the set of abstract DY executions of the DY attacker, and use a mutation-based fuzzer to explore this set. The DY fuzzer concretizes each abstract execution to test it on the program under test. This approach enables reasoning at a more structural and security-related level of messages (e.g., decrypt a message and re-encrypt it with a different key) as opposed to random bit-level modifications that are much less likely to produce relevant logical adversarial behaviors. We implement a full-fledged and modular DY protocol fuzzer, dubbed puffin. We demonstrate its effectiveness by fuzzing three popular TLS implementations, resulting in the discovery of four novel vulnerabilities in WolfSSL, a lightweight implementation widely used by IoT and embedded devices, and able to run on OSs and CPUs otherwise not supported. Each of them has been responsibly disclosed to and fixed by WolfSSL. They have also been filed as CVEs.
Timing side-channels are arguably one of the main sources of vulnerabilities in cryptographic implementations. One effective mitigation against timing side-channels is to write programs complying with the “cryptographic constant-time” discipline. This source-level mitigation aims to enforce that program execution does not leak secrets, where leakage is defined by a formal leakage model. In practice, different leakage models coexist, sometimes even within a single library, both to reflect different architectures and to accommodate different security-efficiency trade-offs.
Constant-timeness is popular and can be checked automatically by many tools. However, most sound tools are focused on a baseline (BL) leakage model in which branches and memory accesses leak. Moreover, usual leakage models do not capture leakage during speculative execution, as exemplified by the Spectre attacks. Thus, Laporte and his co-authors have designed a type-system such that well-typed programs are secure against Spectre attacks. We implemented an efficient type-checker that is precise enough to automatically verify a comprehensive library of high-speed cryptographic implementations 9.
Compilers play a key role in implementations; their formal verification provides a strong justification to source-level reasoning: a verified compiler can be trusted to enforce at target-level properties that are proved at the level of source code.
We are developing an approach for building cryptographic implementations, delivering assembly code that is provably functionally correct, protected against side-channels, and as efficient as hand-written assembly. Laporte and his co-authors have successfully applied to the efficient implementation of Kyber, a post-quantum primitive for key encapsulation 11. This has required to extend Jasmin and correspondingly update its verified compiler.
Quentin Yang, co-supervised by Cortier and Gaudry (project-team Caramba), has defended his PhD thesis 27. Florian Moser, co-supervised by Cortier and Debant, has started in June 2023 and has proposed 30 a protocol based on code-voting for the context of Switzerland. It guarantees vote secrecy even against a dishonest voting client and still guarantees cast-as-intended, individual and universal verifiability under the trust assumptions of the Swiss Chancellery. Moser is designing a model in ProVerif to support these claims. Léo Louistisserand , co-supervised by Cortier and Gaudry (project-team Caramba), has started in September 2023. He has designed a protocol for a postal voting, that achieves both verifiability and vote privacy.
Belenios is the main voting protocol developed by the team, as described in Section 7.1.1.
Until now, a missing feature was the cast-as-intended property, that allows a voter to check that their vote has been sent as intended, even when their device is malicious and tries to vote for another candidate.
Reusing some of the ideas proposed in the Themis protocol,
Cortier, Debant, Gaudry (project-team Caramba), and Glondu are designing a variant of Belenios, called BeleniosCaI, that offers cast-as-intended, without requiring voters to use code sheets nor a second device 15.
Goestchmann and Cortier, in a joint work with Gaudry (Caramba) and Lemonnier (Larsen), conducted a first user study of BeleniosCaI, to analyze whether the protocol was usable in practice and how well it protects vote privacy and verifiability.
Anyone should be able to check that ballots have been cast by legitimate voters only. However, in practice, voters are often authenticated through a login and password sent through email or text messages, which offers low guarantee and no verifiability. Cortier, Debant, Hirschi, and Goetschmann have shown that it is possible to use the well-spread OpenID authentication protocol and to turn it into a protocol that offers eligibility verifiability. The first main idea is to use the signature of the identity provider as a proof of eligibility. Then, they show how to replace this signature by a zk-SNARK proof of knowledge of this signature, to avoid leaking any additional information provided by the OpenID protocol. A PoC implementation shows that computing such proofs remain feasible for large scale elections.
Yang, in collaboration with Devillez, Pereira, and Peters (UCL Louvain), has explored 19 the interaction between receipt-freeness and cast-as-intended. They demonstrate that it is impossible to obtain a receipt-free voting protocol with cast-as-intended if the voting process is non-interactive, unless a trusted authority is available. They also demonstrate that, if a trusted voter registration authority is available, then cast-as-intended verifiability and receipt-freeness can be obtained. Furthermore, the same security properties can be obtained using an interactive voting process.
The JCJ voting scheme 51 is the reference paradigm when designing
a coercion-resistant protocol. Cortier, Gaudry (project-team Caramba), and Yang noticed a weakness in JCJ that is
also present in all the systems following its general structure.
This comes from the procedure that precedes the tally, where the
trustees remove the ballots that should not be counted. This phase
leaks more information than necessary, leading to potential threats
for the coerced voters. Fixing this leads to the notion of cleansing-hiding, that they apply to form a variant of JCJ,
called CHide.
One reason for the problem not being seen before is the
fact that the associated formal definition of coercion-resistance was
too weak.
They propose a definition that can take into account more
behaviors such as revoting or the addition of fake ballots by authorities, and prove that CHide is coercion-resistant
w.r.t. this definition 17.
End-to-end verifiability can be expressed as follows: the result of an election should count the votes of all voters (at least those who have verified their vote) plus at most count the votes, which seemed out of reach of tools like ProVerif. Cheval (Inria Paris), Cortier, and Debant show that end-to-end verifiability can be (equivalently) expressed with two simple injectives queries, with no loss of generality. These two simple injective queries can immediately be expressed in ProVerif. Yet, they may be hard to prove. They therefore developed a framework using most of the new features of ProVerif (e.g. counters and lemmas) in order to prove E2E-verifiability in ProVerif. They applied this approach to usual protocols like Helios and Belenios but also to industrial-scale protocols like CHVote and SwissPost 13.
For the 2022 French legislative elections, Cortier (together with Gaudry and Glondu) was mandated as third party to check correctness of the cryptographic material produced during the election 16. They required that the specification of the protocol, used for our work, was made public.
With this (sadly incomplete) specification as a starting point, Debant and Hirschi conducted 18 a security analysis of the underlying e-voting protocol. Due to a lack of system and threat model specifications, they built and contributed such specifications by studying the French legal framework and by reverse-engineering the code base accessible to the voters. Their analysis revealed that this protocol is affected by two design-level and implementation level vulnerabilities. They shown how those allow a standard voting server attacker and even more so a channel attacker to defeat the election integrity and ballot privacy due to 5 attack variants. They proposed and discussed 5 fixes to prevent those attacks. The specifications, the attacks, and the fixes were acknowledged by the relevant stakeholders during the responsible disclosure. They implemented the fixes to prevent the attacks for future elections.
Roenne, in collaboration with Sutopo and Haines, studied 25 the IVXV system used for municipal and national elections in Estonia as well as European Parliament elections. It appears that, despite the code being public for over five years, the cryptographic protocol has not seen much scrutiny at the code level. A previously unknown vulnerability was discovered, which contradicts the claimed individual verifiability of the system; this vulnerability should be patched in the next version of IVXV system.
In a joint project between LORIA and BETA labs, Abdessamad Imine and Yamina Tadjeddine-Fourneyron (Pr in economics, UL) plan to explore fraud detection in crypto-assets. Based on peer-to-peer networks, crypto-assets are currently very popular and at the heart of several financial transactions/services such as foreign currency loans, crypto-asset exchanges, and international money transfers. The challenge is to design techniques to accurately assess whether crypto-asset fraud is due to a lack of regulation, vulnerabilities in IT infrastructure/protocols, or both. Such techniques will require a classification of fraud and security methods, through a bi-disciplinary collaboration, namely economics and computer science.
With the increasing use of software services in daily life, the data collected by service providers is
massive and sensitive. Although current big data analytics frameworks provide enormous data processing capacity, obtaining appropriate and private responses to large-scale queries quickly and without revealing sensitive information remains a challenging problem.
It is clear that Approximate Query Processing (AQP) achieves faster execution with reasonable accuracy loss and Differential Privacy (DP) is popular for enforcing privacy by noising answers to queries.
We have addressed the problem of combining AQP and DP in multidimensional data based on range queries. We have presented our private approximation system called DiApprox which takes into account online sampling to accelerate the execution of range queries and minimizes the noise to be injected into the samples and query results in order to preserve the data privacy. Through empirical evaluation, we have showed that DiApprox is able to approximate aggregation on large datasets over
In a joint project with the Resist project-team and the Numeryx company, Lahmadi (Resist) and Rusinowitch have developed algorithms to automatically distribute and compress filtering rules on a set of switches of limited capacity. Now they investigate with Zahwa a more adaptive and autonomous approach based on reinforcement learning, as well as heuristics, aiming an application to self-configurating firewalls 26.
We have several contracts with industrial partners interested in the design of electronic voting systems:
A CIFRE contract with Numeryx has started with the Resist project-team and Pesto, to develop algorithms for optimizing sets of filtering rules in Software-defined Networks.
In 2023, Stéphane Glondu has joined the Inria Startup Studio program to prepare the creation of a society to exploit commercially the Belenios software, together with a person with a business background. The society, called VCast, is to be launched in the first semester of 2024. Véronique Cortier and Pierrick Gaudry (project-team Caramba), as co-founders of Belenios, were involved in the discussions concerning this creation.
ANR JCJC ProtoFuzz Cryptographic Protocol
Logic Fuzz Testing, duration:
January 2023 – December 2026, leader: Lucca Hirschi.
State-of-the-art formal methods for the verification of cryptographic protocols provide no guarantee on implementations, which are the end products that must be secure. Testing, especially fuzzing, is usable by practitioners, operates on implementations and has been very successful at finding low-level flaws but is unable to capture logical flaws. Therefore, effective techniques to preclude logical flaws from protocol implementations are desperately lacking.
To fill this gap, we will develop the foundations, the design, and the implementation
of an innovative hybrid, synergetic framework combining symbolic verification and fuzzing.
In particular, we will (i) devise a simple protocol language and model extractor
that enable extracting formal models from lightly annotated implementations
and then refining those models based on functional correctness counter-examples and
(ii)
develop a novel testing methodology, symbolic-model-guided fuzzing,
that, assisted by symbolic verifiers, efficiently captures logical attacks.
The former will leverage a novel hybrid framework where symbolic formal models and implementations are tied together and
can animate each other via dual executions.
This project's ambitions are to significantly advance fuzzing and to establish hybrid frameworks combining fuzzing and symbolic verification as a new research topic, as well as to attack and improve the security of real-world, high-profile cryptographic protocols.
ANR Chaire IA ASAP Tools for automated, symbolic analysis
of real-world cryptographic protocols, duration:
September 2020 – August 2024, leader: Steve Kremer.
The goal of this project is the development of efficient algorithms and tools for automated verification of cryptographic protocols, that are able to comprehensively analyse detailed models of real-world protocols building on techniques from automated reasoning. Automated reasoning is the subfield of AI whose goal is the design of algorithms that enable computers to reason automatically, and these techniques underlie almost all modern verification tools. Current analysis tools for cryptographic protocols do however not scale well, or require to (over)simplify models, when applied on real-world, deployed cryptographic protocols. We aim at overcoming these limitations: we therefore design new, dedicated algorithms, include these algorithms in verification tools, and use the resulting tools for the security analyses of real-world cryptographic protocols.
ANR SEVERITAS Secure and Verifiable Test and Assessment System,
duration: Mai 2021 – April 2025, local coordinator: Jannik Dreier, other
partners: LIG/University Grenoble Alpes (coordinator France), SnT/University of Luxembourg (coordinator Luxembourg), LIMOS/Université Clermont Auvergne.
SEVERITAS advances information socio-technical security for Electronic Test and Assessment Systems (e-TAS). These systems measure skills and performances in education and training. They improve management, reduce time-to-assessment, reach larger audiences, but they do not always provide security by design. This project recognizes that the security aspects for e-TAS are still mostly unexplored. We fill these gaps by studying current and other to-be-defined security properties. We develop automated tools to advance the formal verification of security and show how to validate e-TAS security rigorously. We develop new secure, transparent, verifiable and lawful e-TAS procedures and protocols. We also deploy novel run-time monitoring strategies to reduce frauds and study the user experience about processes to foster e-TAS usable security. Thanks to connections with players in the business of e-TAS, such as OASYS, this project will contribute to the development of secure e-TAS.
PEPR CyberSecurity - SVP Verification of Security
Protocols.
duration: July 2022 – July 2028, local coordinator: Véronique
Cortier, other partners: SPICY - Irisa (coordinator), Prosecco -
Inria Paris, INSPIRE - LMF/ Université Paris-Saclay, STAMP - Inria
Sophia
The SVP project aims at enabling the analysis of protocols (either already deployed or in the design phase) at the level of abstract specifications as well as implementations. The goal is to develop techniques and tools allowing the implementation of solutions whose security will not be questioned in a cyclic way. To achieve this challenge, building on the work already done in the community of formal methods for security protocol verification, we notably plan to take the following steps : (i) developing new functionalities in existing tools to allow the analysis of more and more complex protocols ; (ii) building bridges between the different existing proof techniques and associated tools in order to take advantage of the strengths of each of them ; (iii) validate the techniques and tools developed within this project on widely deployed protocols and on more recent, fast-growing applications, such as Internet voting.
Véronique Cortier.
Unifying speaker at ETAPS 2023, Paris, France, April 22-27, 2023.
Keynote speaker at ABZ 2023, Nancy, France, May 30 – June 2, 2023.
Seminar at the Summer School on real-world crypto and privacy 2023, Vodice, Croatia, 5-9 June 2023.
Invited speaker at EVoteID 2023, Luxembourg City, Luxembourg, 3-6 October 2023.
Lucca Hirschi.
Contributed talk at Real World Crypto Symposium, March 2023, Tokyo, France.
Invited talk at GDR Sécurité annual workshop, July 2023, Paris, France.
Invited talk at Apple Tech Talk, November 2023 (virtual).
Vincent Laporte.
Lecturer at the Summer School on Security Testing and Verification (ST&V), September 2023, Leuven, Belgium.
Invited speaker at GdR Informatique Mathématique annual workshop (RAIM), November 2023, Nancy, France.
Licence:
J. Dreier, Introduction to Logic, 50 hours (ETD), TELECOM Nancy
J. Dreier, Formal Language Theory, 34 hours (ETD), TELECOM Nancy
J. Dreier, Awareness for Cybersecurity, 7.5 hours (ETD), TELECOM Nancy
L. Hirschi, Introduction to Theoretical Computer Science (Logic, Languages, Automata), 32 hours (ETD), TELECOM Nancy
V. Laporte, Introduction to Theoretical Computer Science (Logic, Languages, Automata), 2023, 64 hours (ETD), TELECOM Nancy
Master:
J. Dreier, Cryptography and Authentication, 30 hours (ETD), M1 Computer Science, TELECOM Nancy
J. Dreier, Introduction to Cryptography, 37 hours (ETD), M1 Computer Science, TELECOM Nancy
J. Dreier, Protocol Security and Verification, 45 hours (ETD), M2 Computer Science, TELECOM Nancy
J. Dreier, Advanced Cryptography, 32 hours (ETD), M2 Computer Science, TELECOM Nancy
A. Imine, Security for XML Documents, 12 hours (ETD), M1, Univ Lorraine
L. Hirschi, Protocol Security Theory, 24 hours (ETD), M2 Computer science, Univ Lorraine
L. Vigneron, Security of information systems, 24 hours (ETD), M2 MIAGE – Audit and Design of Information Systems, Univ Lorraine
PhD defended in 2023:
Quentin Yang, Design of a cast-as-intended, verifiable, and coercion-resistant electronic voting protocol 27, June 26th 2023, Univ. Lorraine (V. Cortier and P. Gaudry (project-team Caramba))
PhD in progress:
Vincent Diemunsch, Formal Analysis of Industrial Protocols, started in June 2022. (L. Hirschi and S. Kremer)
Tom Gouville, Fuzzing of Cryptographic Protocols, started in November 2023. (L. Hirschi and S. Kremer)
Elise Klein, Automatic Synthesis of Cryptographic Protocols, started in October 2021. (J. Dreier and S. Kremer)
Ala Eddine Laouir, Privacy-Preserving Big Data Management and Analytics in Distributed Environments, started in 2021. (A. Imine)
Léo Louistisserand, Remote Voting Protocols, started in September 2023. (V. Cortier and P. Gaudry (project-team Caramba))
Dhekra Mahmoud, Security of Electronic Exams, started in 2022. (P. Lafourcade (LIMOS, Univ Clermont Auvergne) and J. Dreier)
Florian Moser, Provably Secure Internet Voting, started in July 2023. (A. Debant and V. Cortier)
Maïwenn Racouchot, Automated Learning of Proof Strategies in Tamarin, started in October 2021. (J. Dreier and S. Kremer)
Wafik Zahwa, Building Self-Driven Network Functions, started in October 2022. (A. Lahmadi (project-team Resist) and M. Rusinowitch)
Wail Zellagui, started in November 2023. (A. Imine)