Ashoka University is a private university located in Sonipat, Haryana, India, focusing on liberal arts and sciences. It was established in 2014.&nbsp;It is guided by an academic council of academics and scholars from around the world. The council sets the university&#39;s academic standard, advising on matters of curriculum, faculty hiring and research.&nbsp;

Ashoka University offers a full-time 3 (+ 1) year undergraduate programme. The University comprises of&nbsp;2500 plus students, with a mix of both national and international students.&nbsp; &nbsp;

&nbsp;

&nbsp;

Ashoka University

A single-sign-on (SSO) is an authentication system that allows a user to log in with a single identity and password to any of several related, yet independent, server applications. SSO solutions eliminate the need for users to repeatedly prove their identities to different applications and hold different credentials for each application. Token-based authentication is commonly used to enable a SSO experience on the web and on enterprise networks. A large body of work considers distributed token generation which can protect the long term keys against a subset of breached servers. A recent work (CCS'18) introduced the notion of Password-based Threshold Authentication (PbTA) with the goal of making password-based token generation for SSO secure against server breaches that could compromise both long-term keys and user credentials. They also introduced a generic framework called PASTA that can instantiate a PbTA system. The existing SSO systems built on distributed token generation techniques, including the PASTA framework, do not admit password-update functionality. In this work, we address this issue by proposing a password-update functionality into the PASTA framework. We call the modified framework PAS-TA-U. As a concrete application, we instantiate PAS-TA-U to implement in Python a distributed SSH key manager for enterprise networks (ESKM) that also admits a password-update functionality for its clients. Our experiments show that the overhead of protecting secrets and credentials against breaches in our system compared to a traditional single server setup is low (average 119 ms in a 10-out-of-10 server setting on Internet with 80 ms round trip latency).

World University root node

Department of Computer Science

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

PAS-TA-U: PASsword-Based Threshold Authentication with Password Update

The security of web communication via the SSL/TLS protocols relies on safe distributions of public keys associated with web domains in the form of X.509 certificates. Certificate authorities (CAs) are trusted third parties that issue these certificates. However, the CA ecosystem is fragile and prone to compromises. Starting with Google's Certificate Transparency project, a number of research works have recently looked at adding transparency for better CA accountability, effectively through public logs of all certificates issued by certification authorities, to augment the current X.509 certificate validation process into SSL/TLS. In this paper, leveraging recent progress in blockchain technology, we propose a novel system, called CTB, that makes it impossible for a CA to issue a certificate for a domain without obtaining consent from the domain owner. We further make progress to equip CTB with certificate revocation mechanism. We implement CTB using IBM's Hyperledger Fabric blockchain platform. CTB's smart contract, written in Go, is provided for complete reference.

IEEE International Conference on Data Mining Workshops, ICDMW

Certificate transparency using blockchain

In this paper, we analyze the implementation level fault vulnerabilities of deterministic lattice-based signature schemes. In particular, we extend the practicality of skip-addition fault attacks through exploitation of determinism in Dilithium and qTESLA signature schemes, which are two leading candidates for the NIST standardization of post-quantum cryptography. We show that single targeted faults injected in the signing procedure allow to recover an important portion of the secret key. Though faults injected in the signing procedure do not recover all the secret key elements, we propose a novel forgery algorithm that allows the attacker to sign any given message with only the extracted portion of the secret key. We perform experimental validation of our attack using Electromagnetic fault injection on reference implementations taken from the pqm4 library, a benchmarking and testing framework for post quantum cryptographic implementations for the ARM Cortex-M4 microcontroller. We also show that our attacks break two well known countermeasures known to protect against skip-addition fault attacks. We further propose an efficient mitigation strategy against our attack that exponentially increases the attacker's complexity at almost zero increase in computational complexity.

AsiaCCS 2019 - Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security

Exploiting determinism in lattice-based signatures practical fault attacks on pqm4 implementations of NIST candidates

We show completeness results for secret sharing schemes realizing mNP access structures. We begin by proposing a new, Euclidean-type, division technique for access structures. Using this new technique we obtain several results in characterizing access structures for efficient (unconditionally secure) secret sharing schemes: – We show a useful transformation that achieves efficient schemes for complex access structures using schemes realizing simple access structures. – We show that, assuming every access structure in P ∩ mono admits efficient secret sharing, the existence of an efficient secret sharing for an access structure in mNP that is also complete for mNP under Karp/Levin monotone-reductions implies secret sharing schemes for all of mNP. – We finally improve upon the above completeness result by obtaining the same under ordinary Karp/Levin reductions.