Oakland 2011
Tuần sau tôi sẽ trình bày ở hội thảo Oakland 2011 với paper "Cryptography in the Web: The Case of Cryptographic Design Flaws in ASP.NET": This paper discusses how cryptography is misused in the security design of a large part of the Web. Our focus is on ASP.NET, the web application framework developed by Microsoft that powers 25% of all Internet web sites. We show that attackers can abuse multiple cryptographic design flaws to compromise ASP.NET web applications. We describe practical and highly efficient attacks that allow attackers to steal cryptographic secret keys and forge authentication tokens to access sensitive information. The attacks combine decryption oracles, unauthenticated encryptions, and the reuse of keys for different encryption purposes. Finally, we give some reasons why cryptography is often misused in web technologies, and recommend steps to avoid these mistakes. Lần này thay đổi không khí, nộp paper cho một hội thảo hàn lâm, may mắn là không những họ khôn...