1. Research Overview Nitesh Saxena nsaxena@poly.edu Research areas: computer and network security, applied cryptography

2. Research Group 5 Ph.D. students 2 M.S. students 1 undergraduate student You?  if you is creative  if you likes math (at least not math-phobic)  if you is good at programming  if you does not like being spoon-fed  if you is a team player  if you have a life beyond work

3. Collaboration NYU-Poly NYU Nokia Research, Finland INRIA, France UC Irvine CMU University of Split, Croatia

4. Secure Device Pairing

5. The Problem How to bootstrap secure communication between Alice’s and Bob’s devices when they have  no prior context  no common trusted CA or TTP Examples  Pairing a bluetooth cell phone with a headset  Pairing a WiFi laptop with an access point Idea  make use of a physical channel between devices  with least involvement from Alice and Bob Audio; Visual; Tactile

6. Research Challenges OOB channels are low-bandwidth Devices may be constrained in terms of interfaces User is constrained - Usability Multiple devices  Sensor network initialization  Group formation Ohh! I cannot even pair my socks!

7. RFID Security and Privacy

8. The Privacy Problem Good tags, Bad readers 500 Euros in wallet Serial numbers: 597387,389473… Wig model #4456 (cheap polyester) 30 items of lingerie Das Kapital and Communist- party handbook Viagra medical drug #459382

9. The Authentication Problem Good readers, Bad tags 500 Euros in wallet Serial numbers: 597387,389473… Wig model #4456 (cheap polyester) 30 items of lingerie Das Kapital and Communist- party handbook Viagra medical drug #459382 Counterfeit!!

10. Relay Attacks (e.g., Ghost-and-Leech Attacks) challenge response

11. Research Challenges Very limited resources  a $0.03 tag can’t do much computationally  only and-or-xor operations might be feasible  has only ~2,000 gates for security operations  few bits to few bytes of memory No user interfaces Atypical usage model Studying real-world deployments

12. Other Ongoing Projects Mobile Phone Assisted Strong Password Authentication Password-Protected Secret Sharing and Distributed Function Computation Privacy of Web Search Security and Privacy of P2P Systems Inference of Private Attributes on Facebook Games and Security

13. Thanks! More details: http://cis.poly.edu/~nsaxena/research.html http://cis.poly.edu/~nsaxena/research.html