Published:
For my Master’s thesis, I analyzed cloud storage systems at the Applied Cryptography Group at ETH Zurich. During this project, we analyzed MEGA, the biggest cloud provider that offers end-to-end encryption at the time, and found serious flaws in their cryptographic design. We submitted this work to IEEE S&P 2023.
Published:
The European Cyber Security Challenge 2021 in Prague is over! This is a yearly reoccuring event with around 20 (mostly) European countries. Every year, a different state hosts the onsite CTF competition. This year, we had two competition days with over 50 challenges in the categories crypto, reversing, web, forensics, misc, and hardware. Furthermore, there was an escape room and international team challenges.
Published:
In the context of the Advanced Systems Lab, my group and I created an optimized implementation of Bernstein’s Elligator 1 mapping. Some of our major optimizations, including exponentiation with constant exponents close to a power of two, can be applied to other problems: they are often useful in modular inversion with prime modulus or finding the quadratic residue. Furthermore, we provide conceptual implementations of Elligator 1 in C, Python, and Sage. The C implementation features a custom Big Integer library, which we optimized for Elligator 1.
Published:
This project revisits cache side-channels on contemporary hardware and contributes CacheSC, a tool for L1 and L2 Prime+Probe attacks. Furthermore, we apply it to AES lookup tables, AES key scheduling, and acquire first insights on Argon2.
Published:
In this course, our task was to implement a typical IT system based on a set of functional and security requirements in a team of four people. For this purpose, we needed to design a certificate authority for a fictional company while analyzing the security and take appropriate measures. Furthermore, we needed to introduce two backdoors in the system. In the middle of the semester, we switched to analyze another team’s system and assess their security. This, of course, included finding their backdoors as well as any other vulnerabilities.
Published:
For my Bachelor’s thesis I investigated instruction time measurements with the System Security Group at ETH Zurich. Our findings led to various improvements over existing measurement tools and the discovery of a new side-channel attack, the Frontal Attack.