Visible to the public Biblio

Filters: Keyword is secure communication  [Clear All Filters]
2021-07-07
Suciu, George, Hussain, Ijaz, Petrescu, Gabriel.  2020.  Role of Ubiquitous Computing and Mobile WSN Technologies and Implementation. 2020 International Conference on Electrical, Communication, and Computer Engineering (ICECCE). :1–6.
Computing capabilities such as real time data, unlimited connection, data from sensors, environmental analysis, automated decisions (machine learning) are demanded by many areas like industry for example decision making, machine learning, by research and military, for example GPS, sensor data collection. The possibility to make these features compatible with each domain that demands them is known as ubiquitous computing. Ubiquitous computing includes network topologies such as wireless sensor networks (WSN) which can help further improving the existing communication, for example the Internet. Also, ubiquitous computing is included in the Internet of Things (IoT) applications. In this article, it is discussed the mobility of WSN and its advantages and innovations, which make possible implementations for smart home and office. Knowing the growing number of mobile users, we place the mobile phone as the key factor of the future ubiquitous wireless networks. With secure computing, communicating, and storage capacities of mobile devices, they can be taken advantage of in terms of architecture in the sense of scalability, energy efficiency, packet delay, etc. Our work targets to present a structure from a ubiquitous computing point of view for researchers who have an interest in ubiquitous computing and want to research on the analysis, to implement a novel method structure for the ubiquitous computing system in military sectors. Also, this paper presents security and privacy issues in ubiquitous sensor networks (USN).
2021-05-05
Chalkiadakis, Nikolaos, Deyannis, Dimitris, Karnikis, Dimitris, Vasiliadis, Giorgos, Ioannidis, Sotiris.  2020.  The Million Dollar Handshake: Secure and Attested Communications in the Cloud. 2020 IEEE 13th International Conference on Cloud Computing (CLOUD). :63—70.

The number of applications and services that are hosted on cloud platforms is constantly increasing. Nowadays, more and more applications are hosted as services on cloud platforms, co-existing with other services in a mutually untrusted environment. Facilities such as virtual machines, containers and encrypted communication channels aim to offer isolation between the various applications and protect sensitive user data. However, such techniques are not always able to provide a secure execution environment for sensitive applications nor they offer guarantees that data are not monitored by an honest but curious provider once they reach the cloud infrastructure. The recent advancements of trusted execution environments within commodity processors, such as Intel SGX, provide a secure reverse sandbox, where code and data are isolated even from the underlying operating system. Moreover, Intel SGX provides a remote attestation mechanism, allowing the communicating parties to verify their identity as well as prove that code is executed on hardware-assisted software enclaves. Many approaches try to ensure code and data integrity, as well as enforce channel encryption schemes such as TLS, however, these techniques are not enough to achieve complete isolation and secure communications without hardware assistance or are not efficient in terms of performance. In this work, we design and implement a practical attestation system that allows the service provider to offer a seamless attestation service between the hosted applications and the end clients. Furthermore, we implement a novel caching system that is capable to eliminate the latencies introduced by the remote attestation process. Our approach allows the parties to attest one another before each communication attempt, with improved performance when compared to a standard TLS handshake.

2021-04-08
Guerrini, F., Dalai, M., Leonardi, R..  2020.  Minimal Information Exchange for Secure Image Hash-Based Geometric Transformations Estimation. IEEE Transactions on Information Forensics and Security. 15:3482—3496.
Signal processing applications dealing with secure transmission are enjoying increasing attention lately. This paper provides some theoretical insights as well as a practical solution for transmitting a hash of an image to a central server to be compared with a reference image. The proposed solution employs a rigid image registration technique viewed in a distributed source coding perspective. In essence, it embodies a phase encoding framework to let the decoder estimate the transformation parameters using a very modest amount of information about the original image. The problem is first cast in an ideal setting and then it is solved in a realistic scenario, giving more prominence to low computational complexity in both the transmitter and receiver, minimal hash size, and hash security. Satisfactory experimental results are reported on a standard images set.
2021-03-15
Khalid, W., Yu, H..  2020.  Residual Energy Analysis with Physical-Layer Security for Energy-Constrained UAV Cognitive Radio Systems. 2020 International Conference on Electronics, Information, and Communication (ICEIC). :1–3.
Unmanned aerial vehicles (UAVs) based cognitive radio (CR) systems improve the sensing performance. However, such systems demand secure communication with lower power consumption. Motivated by these observations, we consider an energy-constraint yet energy harvesting (EH) drone flying periodically in the circular track around primary transmitter in the presence of an eavesdropper with an aim to use the licensed band opportunistically. Considering the trade-off between the residual energy and secondary link performance, we formulate the constrained optimization problem, i.e., maximizing residual energy under the constraint of secondary secrecy outage. Simulation results verify the proposed theoretical analysis.
2021-02-23
Wang, L., Guo, D..  2020.  Secure Communication Based on Reliability-Based Hybrid ARQ and LDPC Codes. 2020 Prognostics and Health Management Conference (PHM-Besançon). :304—308.
This paper designs a re-transmission strategy to intensify the security of communication over the additive white Gaussian noise (AWGN) wire-tap channel. In this scheme, irregular low-density parity-check (LDPC) codes work with reliability-based hybrid automatic repeat-request (RB-HARQ). For irregular LDPC codes, the variable nodes have different degrees, which means miscellaneous protection for the nodes. In RB-HARQ protocol, the legitimate receiver calls for re-transmissions including the most unreliable bits at decoder's outputting. The bits' reliability can be evaluated by the average magnitude of a posteriori probability log-likelihood ratios (APP LLRs). Specifically, this scheme utilizes the bit-error rate (BER) to assess the secrecy performance. Besides, the paper gives close analyses of BER through theoretical arguments and simulations. Results of numerical example demonstrate that RB-HARQ protocol with irregular LDPC codes can hugely reinforce the security performance of the communication system.
2021-01-20
Shi, F., Chen, Z., Cheng, X..  2020.  Behavior Modeling and Individual Recognition of Sonar Transmitter for Secure Communication in UASNs. IEEE Access. 8:2447—2454.

It is necessary to improve the safety of the underwater acoustic sensor networks (UASNs) since it is mostly used in the military industry. Specific emitter identification is the process of identifying different transmitters based on the radio frequency fingerprint extracted from the received signal. The sonar transmitter is a typical low-frequency radiation source and is an important part of the UASNs. Class D power amplifier, a typical nonlinear amplifier, is usually used in sonar transmitters. The inherent nonlinearity of power amplifiers provides fingerprint features that can be distinguished without transmitters for specific emitter recognition. First, the nonlinearity of the sonar transmitter is studied in-depth, and the nonlinearity of the power amplifier is modeled and its nonlinearity characteristics are analyzed. After obtaining the nonlinear model of an amplifier, a similar amplifier in practical application is obtained by changing its model parameters as the research object. The output signals are collected by giving the same input of different models, and, then, the output signals are extracted and classified. In this paper, the memory polynomial model is used to model the amplifier. The power spectrum features of the output signals are extracted as fingerprint features. Then, the dimensionality of the high-dimensional features is reduced. Finally, the classifier is used to recognize the amplifier. The experimental results show that the individual sonar transmitter can be well identified by using the nonlinear characteristics of the signal. By this way, this method can enhance the communication safety of the UASNs.

2020-12-28
Zhang, Y., Weng, J., Ling, Z., Pearson, B., Fu, X..  2020.  BLESS: A BLE Application Security Scanning Framework. IEEE INFOCOM 2020 - IEEE Conference on Computer Communications. :636—645.
Bluetooth Low Energy (BLE) is a widely adopted wireless communication technology in the Internet of Things (IoT). BLE offers secure communication through a set of pairing strategies. However, these pairing strategies are obsolete in the context of IoT. The security of BLE based devices relies on physical security, but a BLE enabled IoT device may be deployed in a public environment without physical security. Attackers who can physically access a BLE-based device will be able to pair with it and may control it thereafter. Therefore, manufacturers may implement extra authentication mechanisms at the application layer to address this issue. In this paper, we design and implement a BLE Security Scan (BLESS) framework to identify those BLE apps that do not implement encryption or authentication at the application layer. Taint analysis is used to track if BLE apps use nonces and cryptographic keys, which are critical to cryptographic protocols. We scan 1073 BLE apps and find that 93% of them are not secure. To mitigate this problem, we propose and implement an application-level defense with a low-cost \$0.55 crypto co-processor using public key cryptography.
2020-09-28
Zhang, Shuaipeng, Liu, Hong.  2019.  Environment Aware Privacy-Preserving Authentication with Predictability for Medical Edge Computing. 2019 International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery (CyberC). :90–96.
With the development of IoT, smart health has significantly improved the quality of people's life. A large amount of smart health monitoring system has been proposed, which provides an opportunity for timely and efficient diagnosis. Nevertheless, most of them ignored the impact of environment on patients' health. Due to the openness of the communication channel, data security and privacy preservation are crucial problems to be solved. In this work, an environment aware privacy-preserving authentication protocol based on the fuzzy extractor and elliptic curve cryptography (ecc) is designed for health monitoring system with mutual authentication and anonymity. Edge computing unit can authenticate all environmental sensors at one time. Fuzzy synthetic evaluation model is utilized to evaluate the environment equality with the patients' temporal health index (THI) as an assessment factor, which can help to predict the appropriate environment. The session key is established for secure communication based on the predicted result. Through security analysis, the proposed protocol can prevent common attacks. Moreover, performance analysis shows that the proposed protocol is applicable for resource-limited smart devices in edge computing health monitoring system.
2020-09-18
Simpson, Oluyomi, Sun, Yichuang.  2019.  A Stochastic based Physical Layer Security in Cognitive Radio Networks: Cognitive Relay to Fusion Center. 2019 IEEE 38th International Performance Computing and Communications Conference (IPCCC). :1—7.
Cognitive radio networks (CRNs) are found to be, without difficulty wide-open to external malicious threats. Secure communication is an important prerequisite for forthcoming fifth-generation (5G) systems, and CRs are not exempt. A framework for developing the accomplishable benefits of physical layer security (PLS) in an amplify-and-forward cooperative spectrum sensing (AF-CSS) in a cognitive radio network (CRN) using a stochastic geometry is proposed. In the CRN the spectrum sensing data from secondary users (SU) are collected by a fusion center (FC) with the assistance of access points (AP) as cognitive relays, and when malicious eavesdropping SU are listening. In this paper we focus on the secure transmission of active APs relaying their spectrum sensing data to the FC. Closed expressions for the average secrecy rate are presented. Analytical formulations and results substantiate our analysis and demonstrate that multiple antennas at the APs is capable of improving the security of an AF-CSSCRN. The obtained numerical results also show that increasing the number of FCs, leads to an increase in the secrecy rate between the AP and its correlated FC.
2020-09-08
Peng, Peng, Li, Suoping, An, Xinlei, Wang, Fan, Dou, Zufang, Xu, Qianyu.  2019.  Synchronization for three chaotic systems with different structures and its application in secure communication. 2019 IEEE 3rd Advanced Information Management, Communicates, Electronic and Automation Control Conference (IMCEC). :1485–1489.
Based on the Lyapunov stability theory, a novel adaptive synchronization method is proposed for three chaotic systems with different orders. Then the proposed method is applied to secure communication. This paper designs a novel multistage chaotic synchronized secure communication system in which the encrypted information signal is transmitted to the receiver after two chaotic masking, and then recovered at the synchronized receiver. Numerical results show the success in transmitting a continuous signal and a discrete signal through three synchronized systems.
2020-06-26
Savitri, Nadia, Johan, Ahmad Wali Satria Bahari, Al Islama A, Firnanda, Utaminingrum, Fitri.  2019.  Efficient Technique Image Encryption with Cipher Block Chaining and Gingerbreadman Map. 2019 International Conference on Sustainable Information Engineering and Technology (SIET). :116—119.

Digital image security is now a severe issue, especially when sending images to telecommunications networks. There are many ways where digital images can be encrypted and decrypted from secure communication. Digital images contain data that is important when captured or disseminated to preserve and preserve data. The technique of encryption is one way of providing data on digital images. A key cipher block chaining and Gingerbreadman Map are used in our search to encrypt images. This new system uses simplicity, high quality, enhanced by the vehicle's natural efficiency and the number of the chain. The proposed method is performed for experimental purposes and the experiments are performed in- depth, highly reliable analysis. The results confirm that by referring to several known attacks, the plan cannot be completed. Comparative studies with other algorithms show a slight rise in the security of passwords with the advantages of security of the chain. The results of this experiment are a comparison of button sensitivity and a comparison after encryption and decryption of the initial image using the amount of pixel change rate and unified average change intensity.

2020-05-26
Junnarkar, Aparna A., Singh, Y. P., Deshpande, Vivek S..  2018.  SQMAA: Security, QoS and Mobility Aware ACO Based Opportunistic Routing Protocol for MANET. 2018 4th International Conference for Convergence in Technology (I2CT). :1–6.
The QoS performance of MANET routing protocols is significantly affected by the mobility conditions in network. Secondly, as MANET open nature network, there is strong possibility of different types of vulnerabilities such as blackhole attack, malicious attack, DoS attacks etc. In this research work, we are designing the novel opportunistic routing protocol in order to address the challenges of network security as well as QoS improvement. There two algorithms designed in this paper. First we proposed and designed novel QoS improvement algorithm based on optimization scheme called Ant Colony Optimization (ACO) with swarm intelligence approach. This proposed method used the RSSI measurements to determine the distance between two mobile nodes in order to select efficient path for communication. This new routing protocol is named as QoS Mobility Aware ACO (QMAA) Routing Protocol. Second, we designed security algorithm for secure communication and user's authentication in MANET under the presence attackers in network. With security algorithm the QoS aware protocol is proposed named as Secure-QMAA (SQMAA). The SQMAA achieved secure communications while guaranteed QoS performance against existing routing protocols. The simulation results shows that under the presence of malicious attackers, the performance of SQMAA are efficient as compared to QMAA and state-of-art routing protocol.
2020-04-06
Demir, Mehmet özgÜn, Kurty, GÜne Karabulut, Dartmannz, Guido, Ascheidx, Gerd, Pusane, Ali Emre.  2018.  Security Analysis of Forward Error Correction Codes in Relay Aided Networks. 2018 Global Information Infrastructure and Networking Symposium (GIIS). :1–5.

Network security and data confidentiality of transmitted information are among the non-functional requirements of industrial wireless sensor networks (IWSNs) in addition to latency, reliability and energy efficiency requirements. Physical layer security techniques are promising solutions to assist cryptographic methods in the presence of an eavesdropper in IWSN setups. In this paper, we propose a physical layer security scheme, which is based on both insertion of an random error vector to forward error correction (FEC) codewords and transmission over decentralized relay nodes. Reed-Solomon and Golay codes are selected as FEC coding schemes and the security performance of the proposed model is evaluated with the aid of decoding error probability of an eavesdropper. The results show that security level is highly based on the location of the eavesdropper and secure communication can be achieved when some of channels between eavesdropper and relay nodes are significantly noisier.

2020-03-18
Hłobaż, Artur.  2019.  Statistical Analysis of Enhanced SDEx Encryption Method Based on SHA-256 Hash Function. 2019 IEEE 44th Conference on Local Computer Networks (LCN). :238–241.
In the paper, the author provides a statistical analysis of the enhanced SDEx method based on SHA-256 hash function, which is used to secure end-to-end encryption in data transferring. To examine the quality of the enhanced SDEx encryption algorithm, the ciphertext files were tested to check if they fulfill the conditions of pseudo-randomness. To test the pseudo-randomness of the encrypted files, a test package shared by NIST was used for this purpose. In addition, compression tests on ciphertext files were performed using the WinRAR software.
2020-02-17
Alfaleh, Faleh, Alfehaid, Haitham, Alanzy, Mohammed, Elkhediri, Salim.  2019.  Wireless Sensor Networks Security: Case study. 2019 2nd International Conference on Computer Applications Information Security (ICCAIS). :1–4.
Wireless Sensor Networks (WSNs) are important and becoming more important as we integrate wireless sensor networks and the internet with different things, which has changed our life, and it is affected everywhere in our life like shopping, storage, live monitoring, smart home etc., called Internet of Things (IoT), as any use of the network physical devices that included in electronics, software, sensors, actuators, and connectivity which makes available these things to connect, collect and exchange data, and the most importantly thing is the accuracy of the data that has been collected in the Internet of Things, detecting sensor data with faulty readings is an important issue of secure communication and power consumption. So, requirement of energy-efficiency and integrity of information is mandatory.
2020-02-10
Nikolov, Neven, Nakov, Ognyan.  2019.  Research of Secure Communication of Esp32 IoT Embedded System to.NET Core Cloud Structure Using MQTTS SSL/TLS. 2019 IEEE XXVIII International Scientific Conference Electronics (ET). :1–4.

This paper studies and describes encrypted communication between IoT cloud and IoT embedded systems. It uses encrypted MQTTS protocol with SSL/TLS certificate. A JSON type data format is used between the cloud structure and the IoT device. The embedded system used in this experiment is Esp32 Wrover. The IoT embedded system measures temperature and humidity from a sensor DHT22. The architecture and software implementation of the experimental stage are also presented.

2020-01-27
Takahashi, Ririka, Tanizawa, Yoshimichi, Dixon, Alexander.  2019.  A High-Speed Key Management Method for Quantum Key Distribution Network. 2019 Eleventh International Conference on Ubiquitous and Future Networks (ICUFN). :437–442.

Quantum Key Distribution (QKD) is a technique for sharing encryption keys between two adjacent nodes. It provides unconditional secure communication based on the laws of physics. From the viewpoint of network research, QKD is considered to be a component for providing secure communication in network systems. A QKD network enables each node to exchange encryption keys with arbitrary nodes. However previous research did not focus on the processing speed of the key management method essential for a QKD network. This paper focuses on the key management method assuming a high-speed QKD system for which we clarify the design, propose a high-speed method, and evaluate the throughput. The proposed method consists of four modules: (1) local key manager handling the keys generated by QKD, (2) one-time pad tunnel manager establishing the transparent encryption link, (3) global key manager generating the keys for application communication, and (4) web API providing keys to the application. The proposed method was implemented in software and evaluated by emulating QKD key generation and application key consumption. The evaluation result reveals that it is capable of handling the encryption keys at a speed of 414 Mb/s, 185 Mb/s, 85 Mb/s and 971 Mb/s, for local key manager, one-time pad tunnel manager, global key manager and web API, respectively. These are sufficient for integration with a high-speed QKD system. Furthermore, the method allows the high-speed QKD system consisting of two nodes to expand corresponding to the size of the QKD network without losing the speed advantage.

2020-01-07
Radhakrishnan, Vijayanand, Durairaj, Devaraj, Balasubramanian, Kannapiran, Kamatchi, Kartheeban.  2019.  Development Of A Novel Security Scheme Using DNA Biocryptography For Smart Meter Data Communication. 2019 3rd International Conference on Computing and Communications Technologies (ICCCT). :237-244.

Data security is a major requirement of smart meter communication to control server through Advanced Metering infrastructure. Easy access of smart meters and multi-faceted nature of AMI communication network are the main reasons of smart meter facing large number of attacks. The different topology, bandwidth and heterogeneity in communication network prevent the existing security mechanisms in satisfying the security requirements of smart meter. Hence, advanced security mechanisms are essential to encrypt smart meter data before transmitting to control server. The emerging biocryptography technique has several advantages over existing techniques and is most suitable for providing security to communication of low processing devices like smart meter. In this paper, a lightweight encryption scheme using DNA sequence with suitable key management scheme is proposed for secure communication of smart meter in an efficient way. The proposed 2-phase DNA cryptography provides confidentiality and integrity to transmitted data and the authentication of keys is attained by exchanging through Diffie Hellman scheme. The strength of proposed encryption scheme is analyzed and its efficiency is evaluated by simulating an AMI communication network using Simulink/Matlab. Comparison of simulation results with various techniques show that the proposed scheme is suitable for secure communication of smart meter data.

2019-12-05
Hayashi, Masahito.  2018.  Secure Physical Layer Network Coding versus Secure Network Coding. 2018 IEEE Information Theory Workshop (ITW). :1-5.

Secure network coding realizes the secrecy of the message when the message is transmitted via noiseless network and a part of edges or a part of intermediate nodes are eavesdropped. In this framework, if the channels of the network has noise, we apply the error correction to noisy channel before applying the secure network coding. In contrast, secure physical layer network coding is a method to securely transmit a message by a combination of coding operation on nodes when the network is given as a set of noisy channels. In this paper, we give several examples of network, in which, secure physical layer network coding realizes a performance that cannot be realized by secure network coding.

2019-09-23
Moon, J., Lee, Y., Yang, H., Song, T., Won, D..  2018.  Cryptanalysis of a privacy-preserving and provable user authentication scheme for wireless sensor networks based on Internet of Things security. 2018 International Conference on Information Networking (ICOIN). :432–437.
User authentication in wireless sensor networks is more complex than normal networks due to sensor network characteristics such as unmanned operation, limited resources, and unreliable communication. For this reason, various authentication protocols have been presented to provide secure and efficient communication. In 2017, Wu et al. presented a provable and privacy-preserving user authentication protocol for wireless sensor networks. Unfortunately, we found that Wu et al.'s protocol was still vulnerable against user impersonation attack, and had a problem in the password change phase. We show how an attacker can impersonate an other user and why the password change phase is ineffective.
2019-09-09
Almohaimeed, A., Asaduzzaman, A..  2019.  A Novel Moving Target Defense Technique to Secure Communication Links in Software-Defined Networks. 2019 Fifth Conference on Mobile and Secure Services (MobiSecServ). :1–4.
Software-defined networking (SDN) is a recently developed approach to computer networking that brings a centralized orientation to network control, thereby improving network architecture and management. However, as with any communication environment that involves message transmission among users, SDN is confronted by the ongoing challenge of protecting user privacy. In this “Work in Progress (WIP)” research, we propose an SDN security model that applies the moving target defense (MTD) technique to protect communication links from sensitive data leakages. MTD is a security solution aimed at increasing complexity and uncertainty for attackers by concealing sensitive information that may serve as a gateway from which to launch different types of attacks. The proposed MTD-based security model is intended to protect user identities contained in transmitted messages in a way that prevents network intruders from identifying the real identities of senders and receivers. According to the results from preliminary experiments, the proposed MTD model has potential to protect the identities contained in transmitted messages within communication links. This work will be extended to protect sensitive data if an attacker gets access to the network device.
2019-04-01
Alibadi, S. H., Sadkhan, S. B..  2018.  A Proposed Security Evaluation Method for Bluetooth E0Based on Fuzzy Logic. 2018 International Conference on Advanced Science and Engineering (ICOASE). :324–329.

The security level is very important in Bluetooth, because the network or devices using secure communication, are susceptible to many attacks against the transmitted data received through eavesdropping. The cryptosystem designers needs to know the complexity of the designed Bluetooth E0. And what the advantages given by any development performed on any known Bluetooth E0Encryption method. The most important criteria can be used in evaluation method is considered as an important aspect. This paper introduce a proposed fuzzy logic technique to evaluate the complexity of Bluetooth E0Encryption system by choosing two parameters, which are entropy and correlation rate, as inputs to proposed fuzzy logic based Evaluator, which can be applied with MATLAB system.

2019-03-25
Xiao, Lili, Xuan, Guixin, Wu, Yongbin.  2018.  An Improved Digital Chaotic Encoder. Proceedings of the 3rd International Conference on Multimedia Systems and Signal Processing. :114–118.
Aiming at the defect that the decoder does not need to be initialized before decoding and the attackers can easily reconstruct the decoder structure, a new method of codec improvement is proposed. The improved decoder can restore the original information sequence correctly only when the initial state of the coder and decoder is the same. The simulation results show that the improved chaotic codec structure has better confidentiality than the original structure.
2019-01-21
Kittmann, T., Lambrecht, J., Horn, C..  2018.  A privacy-aware distributed software architecture for automation services in compliance with GDPR. 2018 IEEE 23rd International Conference on Emerging Technologies and Factory Automation (ETFA). 1:1067–1070.

The recently applied General Data Protection Regulation (GDPR) aims to protect all EU citizens from privacy and data breaches in an increasingly data-driven world. Consequently, this deeply affects the factory domain and its human-centric automation paradigm. Especially collaboration of human and machines as well as individual support are enabled and enhanced by processing audio and video data, e.g. by using algorithms which re-identify humans or analyse human behaviour. We introduce most significant impacts of the recent legal regulation change towards the automations domain at a glance. Furthermore, we introduce a representative scenario from production, deduce its legal affections from GDPR resulting in a privacy-aware software architecture. This architecture covers modern virtualization techniques along with authorization and end-to-end encryption to ensure a secure communication between distributes services and databases for distinct purposes.

2018-11-28
Schliep, Michael, Kariniemi, Ian, Hopper, Nicholas.  2017.  Is Bob Sending Mixed Signals? Proceedings of the 2017 on Workshop on Privacy in the Electronic Society. :31–40.

Demand for end-to-end secure messaging has been growing rapidly and companies have responded by releasing applications that implement end-to-end secure messaging protocols. Signal and protocols based on Signal dominate the secure messaging applications. In this work we analyze conversational security properties provided by the Signal Android application against a variety of real world adversaries. We identify vulnerabilities that allow the Signal server to learn the contents of attachments, undetectably re-order and drop messages, and add and drop participants from group conversations. We then perform proof-of-concept attacks against the application to demonstrate the practicality of these vulnerabilities, and suggest mitigations that can detect our attacks. The main conclusion of our work is that we need to consider more than confidentiality and integrity of messages when designing future protocols. We also stress that protocols must protect against compromised servers and at a minimum implement a trust but verify model.