KEYNOTES


Professor ADI SHAMIR


BIOGRAPHY: Professor Adi Shamir is currently a professor of the Faculty of Mathematics and Computer Science at the Weizmann Institute, Israel, as well as an invited professor at Ecole Normale Superieure in Paris, France. Professor Adi Shamir is worldwide well-known for being a co-inventor of the public key RSA scheme. He is also a co-inventor of the Feige-Fiat-Shamir identification scheme, and one of the inventors of differential cryptanalysis. In addition to RSA, Shamir's other numerous inventions and contributions to cryptography include the Shamir secret sharing scheme, the breaking of the Merkle-Hellman knapsack cryptosystem, visual cryptography, and the TWIRL and TWINKLE factoring devices. Together with Eli Biham, he discovered differential cryptanalysis, a general method for attacking block ciphers. Shamir has also made contributions to computer science outside of cryptography, such as finding the first linear time algorithm for 2-satisfiability and showing the equivalence of the complexity classes PSPACE and IP.

TITLE: Towards Quantitative Analysis of Cyber Security

ABSTRACT: Cyber security had become an extremely hot topic in the last few years, but almost all the research results published so far had been qualitative in nature: they do not formulate a precise mathematical model of the problem, do not numerically compare alternatives, and do not try to find optimal solutions for cyber security problems. In this paper I will describe some initial attempts (developed jointly with Bar-On Dinur Dunkelman Hod Keller and Ronen) to create such a quantitative theory of some particular subproblems in cyber security. In particular, I will consider the problem of how to protect a computer system against cyber and ransomware attacks by choosing an optimal backup scheme using k storage devices. While in standard backup schemes it is beneficial to backup as frequently as possible, in the case of sophisticated cyber attacks any attempt to connect a backup device to an already infected computer is likely to stealthily corrupt its data and thus make it unusable when the actual attack happens. Our formalization of the problem casts it as a special case of an online/offline optimization problem, in which the defender tries to minimize the maximal extra cost caused by his lack of knowledge about the time of the infection, and the strategies he can use resemble a pebbling game with k tokens which can be placed anywhere along the timeline. However, the optimal solution of this simple pebbling game is surprisingly complicated: concrete provably optimal backup strategies are known only for k<10, and only asymptotically optimal strategies are known for larger k.

Mr. THAI DUONG


BIOGRAPHY: Thai Duong is a vulnerability researcher with an interest in applied crypto, best known for discovering the BEAST, CRIME and POODLE SSL attacks. In 2010 he found and developed an exploit for a padding oracle vulnerability in the ASP.NET framework that powered more than 20% websites on the Internet. After serving for six years as Chief Security Officer at DongA Bank in Vietnam, Thai is residing in California, working at Google as a security and crypto lead. He led the development of Project Wycheproof and end-to-end encryption in Google Allo.

TITLE: Security at Scale: Shipping Secure Software at Google

ABSTRACT: Insecure software are eating the world. The phones in your pockets probably have as many vulnerabilities as the number of applications. The companies and organizations that you entrust with your data probably were breached without them knowing. The only security that the Internet is providing is job security for hackers. To add insult to injury, the Internet of Things is coming fast, but if it promises anything, it is that Alice and Bob soon would be at the mercy of the Mallories of the world.

With seven products having more than one billion users made with two billion lines of code produced by tens of thousands of software engineers, Google has our fair share of software security problems. This talk cannot show you a silver bullet that can magically make all software secure – If such a thing exists, it has not been seen yet. What the talk is going to be shared are some challenges that we have encountered, and a set of techniques and open source tools that have vastly improved the security of our products. Solutions that work for us do not work for everyone, but as usual knowing which problems to work on is more important than knowing which solutions exist.

This talk consists of three parts. In the first part, the scale, pace, and constraints at which Google is operating and the challenges that they brought are presented. The second part focuses on the most common and severe security issues, which we have seen in our software, as well as how we have prevented or mitigated them. An example of how we made it harder for our engineers to use crypto incorrectly and made it easier for them to use it correctly is discussed then. As a conclusion, a wishlist of tools and techniques that could use some help from the research community is recommended.