CSE Colloquium: Christina Garman

Securing Deployed Cryptographic Systems

In 2015 more than 150 million records and $400 billion were lost due to publicly-reported criminal and nation-state cyberattacks in the United States alone.  The failure of our existing security infrastructure motivates the need for improved technologies, and cryptography provides a powerful tool for doing this.  There is a misperception that the cryptography we use today is a “solved problem” and the real security weaknesses are in software or other areas of the system.  This is, in fact, not true at all, and over the past several years we have seen a number of serious vulnerabilities in the cryptographic pieces of systems, some with large consequences.

In this talk I will discuss two aspects of securing deployed cryptographic systems.  I will first talk about the evaluation of systems in the wild, using the example of how to efficiently and effectively recover user passwords submitted over TLS encrypted with RC4, with applications to many methods of web authentication as well as the popular IMAP protocol for email.  I will then address my work on developing tools to design and create cryptographic systems and bridge the often large gap between theory and practice by introducing AutoGroup+, a tool that automatically translates cryptographic schemes from the mathematical setting used in the literature to that typically used in practice, giving both a secure and optimal output.