Birgit Pfitzmann - Profile on Academia.edu (original) (raw)
Papers by Birgit Pfitzmann
Lecture Notes in Computer Science, 1991
Error- and Collusion-Secure Fingerprinting for Digital Data
Lecture Notes in Computer Science, 2000
Fingerprinting means making copies of the same data identifiable by hiding additional information... more Fingerprinting means making copies of the same data identifiable by hiding additional information (a fingerprint) in the data. Embedding the additional data can be done by watermarking techniques, which are mainly a branch of signal processing. Most watermarking methods, however, do not treat colluding adversaries who have obtained more than one copy, compare their copies, see differences and use this
Federated Identity Management
Data-Centric Systems and Applications, 2007
ABSTRACT The more real business and interaction with public authorities is performed in digital f... more ABSTRACT The more real business and interaction with public authorities is performed in digital form, the more important the handling of identities over open networks becomes. The rise in identity theft as a result of the misuse of global but unprotected identifiers like credit card numbers is one strong indicator of this. Setting up individual passwords between a person and every organization he or she interacts with also offers very limited security in practice. Federated identity management addresses this critical issue. Classic proposals like Kerberos and PKIs never gained wide acceptance because of two problems: actual deployment to end users and privacy. We describe modern approaches that solve these problems. The first approach is browser-based protocols, where the user only needs a standard browser without special settings. We discuss the specific protocol types and security challenges of this protocol class, as well as what level of privacy can and cannot be achieved within this class. The second approach, private credentials, solves the problems that none of the prior solutions could solve, but requires the user to install some local software. Private credentials allow the user to reveal only the minimum information necessary to conduct transactions. In particular, it enables unlinkable transactions even for certified attributes. We sketch the cryptographic solutions and describe how optional properties such as revocability can be achieved, in particular in the idemix system.
Outside security, non-determinism is an important tool for specifying systems without fixing unne... more Outside security, non-determinism is an important tool for specifying systems without fixing unnecessary details. In security, however, normal refinement of non-deterministic specifications is usually not applicable, in particular because it may invalidate secrecy properties. Especially simulatability-based security notions seem to require detailed deterministic or probabilistic specifications. We show how one can nevertheless use the reactive simulatability (RSIM) framework to address non-determinism. In particular we survey its generic distributed scheduling for treating the non-determinism of asynchronous execution, discuss the experiences we made with this, and how it encompasses other recent scheduling approaches. We also show how property-based specifications can play the role of highest-level nondeterminism in the RSIM context, and how functional non-determinism of machines can be captured by the system-from-structure derivations as well as by call-outs to the adversary or more general resolvers.
In Journal of Cryptology 1/1 (1988) 65-75 (= [Chau_88]), David Chaum describes a beautiful techni... more In Journal of Cryptology 1/1 (1988) 65-75 (= [Chau_88]), David Chaum describes a beautiful technique, the DC-net, which should allow participants to send and receive messages anonymously in an arbitrary network. The untraceability of the senders is proved to be unconditional, but that of the recipients implicitly assumes a reliable broadcast network. This assumption is unrealistic in some networks, but it can be removed completely by using the fail-stop key generation schemes by Waidner (these proceedings, = [Waid_89]). In both cases, however, each participant can untraceably and permanently disrupt the entire DC-net.
We present a systematic treatment of the properties of digital payment systems. By properties, we... more We present a systematic treatment of the properties of digital payment systems. By properties, we mean that we abstract from internal details and only consider what kind of service the system offers its users, which may be people or other processes. In particular, the integrity properties are meant as a sketch of a general formal definition of payment systems, which can be filled in with moderate difficulty given previous papers; and there is currently no other comprehensive definition (even of only the integrity and at this degree of detail) of payment systems in the literature.
We present the first idealized cryptographic library that can be used like the Dolev-Yao model fo... more We present the first idealized cryptographic library that can be used like the Dolev-Yao model for automated proofs of cryptographic protocols that use nested cryptographic operations, while coming with a cryptographic implementation that is provably secure under active attacks.
Byzantine agreement means achieving reliable broadcast on a point-to-point network of n processor... more Byzantine agreement means achieving reliable broadcast on a point-to-point network of n processors, of which up to t may be maliciously faulty. A well-known result by Pease, Shostak, and Lamport says that perfect Byzantine agreement is only possible if t < n/3. In contrast, so-called authenticated protocols achieve Byzantine agreement for any t based on computational assumptions, typically the existence of a digital signature scheme, an assumption equivalent to the existence of one-way functions. The "folklore" belief based on these two results is that computational assumptions are necessary to achieve Byzantine agreement for t ≥ n/3.
![signature schemes, active in a more general authen temporal requirements on users, i.e., the entities t processors, are arbitrarily influenced by the attackers, e.g., Restricted active attacks on rec active attacks against them mu in- and outputs in a cryptologic sense, it is assumed that the honest make the inputs to and receive the outputs from they may authenticate messages ipients may sound strange at first, because with ordinary digital attacks are only considered against originators [|G MR88]. However, tication scheme, in which recipien st also be considered. General hat chosen by the attacker or tell the attacker the results of tests. T Note that this scenario in particular prescribes that ho ts’ processors also ly, in the definition have secrets, of fulfilling the correct his is shown in Figu re 1. nest users only use the correct Thus information-theoretic security of a certain requirement against arbitrary active attacks is roughly defined as follows: For all strategies of the honest users and all strategies of the attacker, the probability that the sequence of inputs and outputs of the correct processors does not fulfil the requirement is exponentially small.](https://figures.academia-assets.com/40211099/figure_001.jpg)
](
We present the first Byzantine agreement protocol which tolerates any number of maliciously fault... more We present the first Byzantine agreement protocol which tolerates any number of maliciously faulty processors without relying on computational assumptions (such as the unforgeability of digital signatures).
Die PERSEUS System-Architektur
Unbedingte Unbeobachtbarkeit mit kryprographischer Robustheit
Fail-stop-Signaturen und ihre Anwendung
... Sicherheit konstruiert. Mit „konventionelles Signatursystem“ bezeichnen wir eines gemäß diese... more ... Sicherheit konstruiert. Mit „konventionelles Signatursystem“ bezeichnen wir eines gemäß dieser Definition (darunter fällt auch RSA mit Redundanzprädikat, nur isteben seine Sicherheit bisher nicht bewiesen). Insbesondere ...
Fail-stop Signatures and their Application
... 9, Jeroen van de Graaf: Multiparty Computations Ensuring Privacy of Each Party's Inp... more ... 9, Jeroen van de Graaf: Multiparty Computations Ensuring Privacy of Each Party's Input and - Chaum, Damgard - 1988. ... 5, Breaking the Ong-Schnorr-Shamir Signature Scheme for Quadratic Number Fields - Estes, Adleman, et al. - 1986. ...
Migration to Multi-image Cloud Templates
2011 IEEE International Conference on Services Computing, 2011
ABSTRACT IT management costs increasingly dominate the overall IT costs. The main hope for reduci... more ABSTRACT IT management costs increasingly dominate the overall IT costs. The main hope for reducing them is to standardize software and processes, as this leads to economies of scale in the management services. A key vehicle by which enterprises hope to achieve this is cloud computing, and they start to show interest in clouds outside the initial sweet spot of development and test. As business applications typically contain multiple images with dependencies, one is starting to standardize on multi-image structures. Benefits are ease of deployment of the entire structure and consistent later management services for the business applications. Enterprises have huge investments in their existing busi- ness applications, e.g., their web design, special code, database schemas, and data. The promises of clouds can only be realized if a significant fraction of these existing applications can be migrated into the clouds. We therefore present analysis tech- niques for mapping existing IT environments to multi-image cloud templates. We propose multiple matching criteria, leading to tradeoffs between the number of matches and the migration overhead, and present efficient algorithms for these special graph matching problems. We also present results from analyzing an existing enterprise environment with about 1600 servers. Index Terms—IT services, management costs, migration, clouds, multi-image templates;
Proceeding of the ACM workshop on Privacy in the Electronic Society - WPES '02, 2002
Browser-based attribute-exchange protocols enable users of normal web browsers to conveniently se... more Browser-based attribute-exchange protocols enable users of normal web browsers to conveniently send attributes, such as authentication or demographic data, to web sites. Such protocols might become very common and almost mandatory in general consumer scenarios over the next few years. We derive the privacy requirements on such protocols from general privacy principles and study their consequences for the protocol design. We also survey to what extent proposals like Microsoft's Passport, IBM's e-Community Single Signon, SAML, Shibboleth, the Liberty Alliance specifications and a protocol BBAE of our own conform to these design consequences, and how one could go forward.
Proceedings of the 4th ACM conference on Computer and communications security - CCS '97, 1997
Fingerprinting schemes deter people from illegally redistributing digital data by enabling the or... more Fingerprinting schemes deter people from illegally redistributing digital data by enabling the original merchant of the data to identify the original buyer of a redistributed copy. So-called traitor-tracing schemes have the same goal for keys that can be used to decrypt information that is broadcast in encrypted form. Recently, asymmetric fingerprinting and traitor-tracing schemes were introduced. Here, only the buyer knows the fingerprinted copy after a sale, and if the merchant finds this copy somewhere, he obtains a proof that he found the copy of this particular buyer. First constructions showed the validity of the concept.
Proceedings of the 7th ACM conference on Computer and communications security - CCS '00, 2000
We consider compositional properties of reactive systems that are secure in a cryptographic sense... more We consider compositional properties of reactive systems that are secure in a cryptographic sense. We follow the wellknown simulatability approach, i.e., the specification is an ideal system and a real system should in some sense simulate it. We recently presented the first detailed general definition of this concept for reactive systems that allows abstraction and enables proofs of efficient real-life systems like secure channels or certified mail.
Proceedings 15th IEEE Computer Security Foundations Workshop. CSFW-15, 2002
Important properties of many protocols are liveness or availability, i.e., that something good ha... more Important properties of many protocols are liveness or availability, i.e., that something good happens now and then. In asynchronous scenarios these properties obviously depend on the scheduler, which is usually considered to be fair in this case. Unfortunately, the standard definitions of fairness and liveness based on infinite sequences cannot be applied for most cryptographic protocols since one must restrict the adversary and the runs as a whole to polynomial length. We present the first general definition of polynomial fairness and liveness in asynchronous scenarios which is suited to cope with arbitrary cryptographic protocols. Furthermore, our definitions provide a link to the common approach of simulatability which is used throughout modern cryptography, and we show that polynomial liveness is maintained under simulatability. As an example we present an abstract specification and a secure implementation of secure message transmission with reliable channels, and prove them to fulfill the desired liveness property, i.e., reliability of messages.
Proving a WS-Federation passive requestor profile
Proceedings of the 2004 workshop on Secure web service - SWS '04, 2004
Currently, influential industrial players are in the proces s of realizing identity federation, i... more Currently, influential industrial players are in the proces s of realizing identity federation, in particular the authenti cation of browser users across administrative domains. WS-Federation is a joint protocol framework for Web Services clients and browser clients. While browser-based federation protocols, including Microsoft Passport, OASIS SAML, and Liberty be- sides WS-Federation, are already widely deployed, their secu- rity is still unproven and has been challenged by several anal- yses. One reason is a lack of cryptographically precise pro- tocol definitions, which impedes explicit design for securi ty as well as proofs. Another reason is that the security proper- ties depend on the browser and even on the browser user. We rigorously formalize a strict instantiation of the current WS- Federation Passive Requestor Interop profile and make expli cit assumptions for its general use. On this basis, we prove that the protocol provides authenticity and secure channel estab- lishment in a realistic trust scenario. This constitutes th e first positive security result for a browser-based identity fede ration protocol.
Lecture Notes in Computer Science, 1991
Error- and Collusion-Secure Fingerprinting for Digital Data
Lecture Notes in Computer Science, 2000
Fingerprinting means making copies of the same data identifiable by hiding additional information... more Fingerprinting means making copies of the same data identifiable by hiding additional information (a fingerprint) in the data. Embedding the additional data can be done by watermarking techniques, which are mainly a branch of signal processing. Most watermarking methods, however, do not treat colluding adversaries who have obtained more than one copy, compare their copies, see differences and use this
Federated Identity Management
Data-Centric Systems and Applications, 2007
ABSTRACT The more real business and interaction with public authorities is performed in digital f... more ABSTRACT The more real business and interaction with public authorities is performed in digital form, the more important the handling of identities over open networks becomes. The rise in identity theft as a result of the misuse of global but unprotected identifiers like credit card numbers is one strong indicator of this. Setting up individual passwords between a person and every organization he or she interacts with also offers very limited security in practice. Federated identity management addresses this critical issue. Classic proposals like Kerberos and PKIs never gained wide acceptance because of two problems: actual deployment to end users and privacy. We describe modern approaches that solve these problems. The first approach is browser-based protocols, where the user only needs a standard browser without special settings. We discuss the specific protocol types and security challenges of this protocol class, as well as what level of privacy can and cannot be achieved within this class. The second approach, private credentials, solves the problems that none of the prior solutions could solve, but requires the user to install some local software. Private credentials allow the user to reveal only the minimum information necessary to conduct transactions. In particular, it enables unlinkable transactions even for certified attributes. We sketch the cryptographic solutions and describe how optional properties such as revocability can be achieved, in particular in the idemix system.
Outside security, non-determinism is an important tool for specifying systems without fixing unne... more Outside security, non-determinism is an important tool for specifying systems without fixing unnecessary details. In security, however, normal refinement of non-deterministic specifications is usually not applicable, in particular because it may invalidate secrecy properties. Especially simulatability-based security notions seem to require detailed deterministic or probabilistic specifications. We show how one can nevertheless use the reactive simulatability (RSIM) framework to address non-determinism. In particular we survey its generic distributed scheduling for treating the non-determinism of asynchronous execution, discuss the experiences we made with this, and how it encompasses other recent scheduling approaches. We also show how property-based specifications can play the role of highest-level nondeterminism in the RSIM context, and how functional non-determinism of machines can be captured by the system-from-structure derivations as well as by call-outs to the adversary or more general resolvers.
In Journal of Cryptology 1/1 (1988) 65-75 (= [Chau_88]), David Chaum describes a beautiful techni... more In Journal of Cryptology 1/1 (1988) 65-75 (= [Chau_88]), David Chaum describes a beautiful technique, the DC-net, which should allow participants to send and receive messages anonymously in an arbitrary network. The untraceability of the senders is proved to be unconditional, but that of the recipients implicitly assumes a reliable broadcast network. This assumption is unrealistic in some networks, but it can be removed completely by using the fail-stop key generation schemes by Waidner (these proceedings, = [Waid_89]). In both cases, however, each participant can untraceably and permanently disrupt the entire DC-net.
We present a systematic treatment of the properties of digital payment systems. By properties, we... more We present a systematic treatment of the properties of digital payment systems. By properties, we mean that we abstract from internal details and only consider what kind of service the system offers its users, which may be people or other processes. In particular, the integrity properties are meant as a sketch of a general formal definition of payment systems, which can be filled in with moderate difficulty given previous papers; and there is currently no other comprehensive definition (even of only the integrity and at this degree of detail) of payment systems in the literature.
We present the first idealized cryptographic library that can be used like the Dolev-Yao model fo... more We present the first idealized cryptographic library that can be used like the Dolev-Yao model for automated proofs of cryptographic protocols that use nested cryptographic operations, while coming with a cryptographic implementation that is provably secure under active attacks.
Byzantine agreement means achieving reliable broadcast on a point-to-point network of n processor... more Byzantine agreement means achieving reliable broadcast on a point-to-point network of n processors, of which up to t may be maliciously faulty. A well-known result by Pease, Shostak, and Lamport says that perfect Byzantine agreement is only possible if t < n/3. In contrast, so-called authenticated protocols achieve Byzantine agreement for any t based on computational assumptions, typically the existence of a digital signature scheme, an assumption equivalent to the existence of one-way functions. The "folklore" belief based on these two results is that computational assumptions are necessary to achieve Byzantine agreement for t ≥ n/3.
We present the first Byzantine agreement protocol which tolerates any number of maliciously fault... more We present the first Byzantine agreement protocol which tolerates any number of maliciously faulty processors without relying on computational assumptions (such as the unforgeability of digital signatures).
Die PERSEUS System-Architektur
Unbedingte Unbeobachtbarkeit mit kryprographischer Robustheit
Fail-stop-Signaturen und ihre Anwendung
... Sicherheit konstruiert. Mit „konventionelles Signatursystem“ bezeichnen wir eines gemäß diese... more ... Sicherheit konstruiert. Mit „konventionelles Signatursystem“ bezeichnen wir eines gemäß dieser Definition (darunter fällt auch RSA mit Redundanzprädikat, nur isteben seine Sicherheit bisher nicht bewiesen). Insbesondere ...
Fail-stop Signatures and their Application
... 9, Jeroen van de Graaf: Multiparty Computations Ensuring Privacy of Each Party's Inp... more ... 9, Jeroen van de Graaf: Multiparty Computations Ensuring Privacy of Each Party's Input and - Chaum, Damgard - 1988. ... 5, Breaking the Ong-Schnorr-Shamir Signature Scheme for Quadratic Number Fields - Estes, Adleman, et al. - 1986. ...
Migration to Multi-image Cloud Templates
2011 IEEE International Conference on Services Computing, 2011
ABSTRACT IT management costs increasingly dominate the overall IT costs. The main hope for reduci... more ABSTRACT IT management costs increasingly dominate the overall IT costs. The main hope for reducing them is to standardize software and processes, as this leads to economies of scale in the management services. A key vehicle by which enterprises hope to achieve this is cloud computing, and they start to show interest in clouds outside the initial sweet spot of development and test. As business applications typically contain multiple images with dependencies, one is starting to standardize on multi-image structures. Benefits are ease of deployment of the entire structure and consistent later management services for the business applications. Enterprises have huge investments in their existing busi- ness applications, e.g., their web design, special code, database schemas, and data. The promises of clouds can only be realized if a significant fraction of these existing applications can be migrated into the clouds. We therefore present analysis tech- niques for mapping existing IT environments to multi-image cloud templates. We propose multiple matching criteria, leading to tradeoffs between the number of matches and the migration overhead, and present efficient algorithms for these special graph matching problems. We also present results from analyzing an existing enterprise environment with about 1600 servers. Index Terms—IT services, management costs, migration, clouds, multi-image templates;
Proceeding of the ACM workshop on Privacy in the Electronic Society - WPES '02, 2002
Browser-based attribute-exchange protocols enable users of normal web browsers to conveniently se... more Browser-based attribute-exchange protocols enable users of normal web browsers to conveniently send attributes, such as authentication or demographic data, to web sites. Such protocols might become very common and almost mandatory in general consumer scenarios over the next few years. We derive the privacy requirements on such protocols from general privacy principles and study their consequences for the protocol design. We also survey to what extent proposals like Microsoft's Passport, IBM's e-Community Single Signon, SAML, Shibboleth, the Liberty Alliance specifications and a protocol BBAE of our own conform to these design consequences, and how one could go forward.
Proceedings of the 4th ACM conference on Computer and communications security - CCS '97, 1997
Fingerprinting schemes deter people from illegally redistributing digital data by enabling the or... more Fingerprinting schemes deter people from illegally redistributing digital data by enabling the original merchant of the data to identify the original buyer of a redistributed copy. So-called traitor-tracing schemes have the same goal for keys that can be used to decrypt information that is broadcast in encrypted form. Recently, asymmetric fingerprinting and traitor-tracing schemes were introduced. Here, only the buyer knows the fingerprinted copy after a sale, and if the merchant finds this copy somewhere, he obtains a proof that he found the copy of this particular buyer. First constructions showed the validity of the concept.
Proceedings of the 7th ACM conference on Computer and communications security - CCS '00, 2000
We consider compositional properties of reactive systems that are secure in a cryptographic sense... more We consider compositional properties of reactive systems that are secure in a cryptographic sense. We follow the wellknown simulatability approach, i.e., the specification is an ideal system and a real system should in some sense simulate it. We recently presented the first detailed general definition of this concept for reactive systems that allows abstraction and enables proofs of efficient real-life systems like secure channels or certified mail.
Proceedings 15th IEEE Computer Security Foundations Workshop. CSFW-15, 2002
Important properties of many protocols are liveness or availability, i.e., that something good ha... more Important properties of many protocols are liveness or availability, i.e., that something good happens now and then. In asynchronous scenarios these properties obviously depend on the scheduler, which is usually considered to be fair in this case. Unfortunately, the standard definitions of fairness and liveness based on infinite sequences cannot be applied for most cryptographic protocols since one must restrict the adversary and the runs as a whole to polynomial length. We present the first general definition of polynomial fairness and liveness in asynchronous scenarios which is suited to cope with arbitrary cryptographic protocols. Furthermore, our definitions provide a link to the common approach of simulatability which is used throughout modern cryptography, and we show that polynomial liveness is maintained under simulatability. As an example we present an abstract specification and a secure implementation of secure message transmission with reliable channels, and prove them to fulfill the desired liveness property, i.e., reliability of messages.
Proving a WS-Federation passive requestor profile
Proceedings of the 2004 workshop on Secure web service - SWS '04, 2004
Currently, influential industrial players are in the proces s of realizing identity federation, i... more Currently, influential industrial players are in the proces s of realizing identity federation, in particular the authenti cation of browser users across administrative domains. WS-Federation is a joint protocol framework for Web Services clients and browser clients. While browser-based federation protocols, including Microsoft Passport, OASIS SAML, and Liberty be- sides WS-Federation, are already widely deployed, their secu- rity is still unproven and has been challenged by several anal- yses. One reason is a lack of cryptographically precise pro- tocol definitions, which impedes explicit design for securi ty as well as proofs. Another reason is that the security proper- ties depend on the browser and even on the browser user. We rigorously formalize a strict instantiation of the current WS- Federation Passive Requestor Interop profile and make expli cit assumptions for its general use. On this basis, we prove that the protocol provides authenticity and secure channel estab- lishment in a realistic trust scenario. This constitutes th e first positive security result for a browser-based identity fede ration protocol.