乐胖代购免代理版

{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2023,1,2]],"date-time":"2023-01-02T05:20:03Z","timestamp":1672636803933},"reference-count":53,"publisher":"Association for Computing Machinery (ACM)","issue":"2","funder":[{"name":"Adams Fellowship Program of the Israel Academy of Sciences and Humanities"},{"DOI":"10.13039\/501100005386","name":"Israeli Centers of Research Excellence","doi-asserted-by":"crossref","award":["4\/11"],"id":[{"id":"10.13039\/501100005386","id-type":"DOI","asserted-by":"crossref"}]},{"name":"US-Israel Binational Science Foundation","award":["2014632"]},{"name":"European Union\u2019s Horizon 2020 Framework Program","award":["714253"]},{"DOI":"10.13039\/501100003977","name":"Israel Science Foundation","doi-asserted-by":"crossref","award":["483\/13"],"id":[{"id":"10.13039\/501100003977","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Priv. Secur."],"published-print":{"date-parts":[[2020,5,31]]},"abstract":"Faced with the threats posed by man-in-the-middle attacks, messaging platforms rely on \u201cout-of-band\u201d authentication, assuming that users have access to an external channel for authenticating one short value. For example, assuming that users recognizing each other\u2019s voice can authenticate a short value, Telegram and WhatApp ask their users to compare 288-bit and 200-bit values, respectively. The existing protocols, however, do not take into account the plausible behavior of users who may be \u201clazy\u201d and only compare parts of these values (rather than their entirety).<\/jats:p>\n Motivated by such a security-critical user behavior, we study the security of lazy users in out-of-band authentication. We start by showing that both the protocol implemented by WhatsApp and the statistically optimal protocol of Naor, Segev, and Smith (CRYPTO\u201906) are completely vulnerable to man-in-the-middle attacks when the users consider only a half of the out-of-band authenticated value. In this light, we put forward a framework that captures the behavior and security of lazy users. Our notions of security consider both statistical security and computational security, and for each flavor we derive a lower bound on the tradeoff between the number of positions that are considered by the lazy users and the adversary\u2019s forgery probability.<\/jats:p>\n Within our framework, we then provide two authentication protocols. First, in the statistical setting, we present a transformation that converts any out-of-band authentication protocol into one that is secure even when executed by lazy users. Instantiating our transformation with a new refinement of the protocol of Naor et\u00a0al. results in a protocol whose tradeoff essentially matches our lower bound in the statistical setting. Then, in the computational setting, we show that the computationally optimal protocol of Vaudenay (CRYPTO\u201905) is secure even when executed by lazy users\u2014and its tradeoff matches our lower bound in the computational setting.<\/jats:p>","DOI":"10.1145\/3377849","type":"journal-article","created":{"date-parts":[[2020,5,4]],"date-time":"2020-05-04T07:04:40Z","timestamp":1588575880000},"page":"1-32","update-policy":"http:\/\/dx.doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["The Security of Lazy Users in Out-of-Band Authentication"],"prefix":"10.1145","volume":"23","author":[{"given":"Moni","family":"Naor","sequence":"first","affiliation":[{"name":"Weizmann Institute of Science, Rehovot, Israel"}]},{"given":"Lior","family":"Rotem","sequence":"additional","affiliation":[{"name":"Hebrew University, Jerusalem, Israel"}]},{"given":"Gil","family":"Segev","sequence":"additional","affiliation":[{"name":"Hebrew University, Jerusalem, Israel"}]}],"member":"320","published-online":{"date-parts":[[2020,4,17]]},"reference":[{"key":"e_1_2_1_1_1","volume-title":"Symposium on Usable Privacy and Security (SOUPS). 297--308","author":"Alghamdi Deena","year":"2015"},{"key":"e_1_2_1_2_1","doi-asserted-by":"crossref","unstructured":"Jo\u00ebl Alwen Sandro Coretti and Yevgeniy Dodis. 2019. The double ratchet: Security notions proofs and modularization for the Signal protocol. In Advances in Cryptology \u2013 EUROCRYPT\u201919. 129--158. Jo\u00ebl Alwen Sandro Coretti and Yevgeniy Dodis. 2019. The double ratchet: Security notions proofs and modularization for the Signal protocol. In Advances in Cryptology \u2013 EUROCRYPT\u201919. 129--158.","DOI":"10.1007\/978-3-030-17653-2_5"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1109\/SFCS.2002.1181957"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/168588.168596"},{"key":"e_1_2_1_5_1","volume-title":"Joseph Jaeger, Maya Nyayapati, and Igors Stepanovs.","author":"Bellare Mihir","year":"2017"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/18.272497"},{"key":"e_1_2_1_7_1","volume-title":"Computer security impaired by legitimate users. Computers 8 Security 23, 3","author":"Besnard Denis","year":"2004"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2017.27"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243747"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1137\/S0097539795291562"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/2858036.2858214"},{"key":"e_1_2_1_14_1","volume-title":"Proceedings of the 6th USENIX Security Symposium. 7--7.","author":"Ellison Carl M.","year":"1996"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.41"},{"key":"e_1_2_1_16_1","doi-asserted-by":"crossref","volume-title":"Modern Cryptography, Probabilistic Proofs and Pseudorandomness","author":"Goldreich Oded","DOI":"10.1007\/978-3-662-12521-2"},{"key":"e_1_2_1_17_1","volume-title":"Foundations of Cryptography \u2013 Volume 1: Basic Techniques","author":"Goldreich Oded"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/1993636.1993729"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/FOCS.2012.47"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/2897518.2897657"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/FOCS.2014.13"},{"key":"e_1_2_1_22_1","volume-title":"Retrieved on","author":"Green Matthew","year":"2018"},{"key":"e_1_2_1_23_1","article-title":"WhatsApp security flaws could allow snoops to slide into group chats","author":"Greenberg Andy","year":"2018","journal-title":"Wired Magazine. Retrieved on"},{"key":"e_1_2_1_24_1","volume-title":"Symposium on Usable Privacy and Security (SOUPS). 213--230","author":"Harbach Marian","year":"2014"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/1719030.1719050"},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/3046055.3046059"},{"key":"e_1_2_1_27_1","doi-asserted-by":"crossref","unstructured":"Joseph Jaeger and Igors Stepanovs. 2018. Optimal channel security against fine-grained state compromise: The safety of messaging. In Advances in Cryptology \u2013 CRYPTO\u201918. 33--62. Joseph Jaeger and Igors Stepanovs. 2018. Optimal channel security against fine-grained state compromise: The safety of messaging. In Advances in Cryptology \u2013 CRYPTO\u201918. 33--62.","DOI":"10.1007\/978-3-319-96884-1_2"},{"key":"e_1_2_1_28_1","doi-asserted-by":"crossref","unstructured":"Daniel Jost Ueli Maurer and Marta Mularczyk. 2019. Efficient ratcheting: Almost-optimal guarantees for secure messaging. In Advances in Cryptology \u2013 EUROCRYPT\u201919. 159--188. Daniel Jost Ueli Maurer and Marta Mularczyk. 2019. Efficient ratcheting: Almost-optimal guarantees for secure messaging. In Advances in Cryptology \u2013 EUROCRYPT\u201919. 159--188.","DOI":"10.1007\/978-3-030-17653-2_6"},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2017.38"},{"key":"e_1_2_1_30_1","unstructured":"S. J. Li and Heung-Yeung Shum. 2003. Secure human-computer identification against peeping attacks (SecHCI): A survey. S. J. Li and Heung-Yeung Shum. 2003. Secure human-computer identification against peeping attacks (SecHCI): A survey."},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/1536414.1536442"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/1993636.1993730"},{"key":"e_1_2_1_33_1","volume-title":"Medium. Retrieved on","author":"Membe Tina","year":"2017"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1007\/BF00196774"},{"key":"e_1_2_1_35_1","doi-asserted-by":"crossref","unstructured":"Moni Naor Gil Segev and Adam Smith. 2006. Tight bounds for unconditional authentication protocols in the manual channel and shared key models. In Advances in Cryptology \u2013 CRYPTO\u201906. 214--231. Moni Naor Gil Segev and Adam Smith. 2006. Tight bounds for unconditional authentication protocols in the manual channel and shared key models. In Advances in Cryptology \u2013 CRYPTO\u201906. 214--231.","DOI":"10.1007\/11818175_13"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIT.2008.921691"},{"key":"e_1_2_1_37_1","doi-asserted-by":"crossref","unstructured":"Omkant Pandey Rafael Pass and Vinod Vaikuntanathan. 2008. Adaptive one-way functions and applications. In Advances in Cryptology \u2013 CRYPTO\u201908. 57--74. Omkant Pandey Rafael Pass and Vinod Vaikuntanathan. 2008. Adaptive one-way functions and applications. In Advances in Cryptology \u2013 CRYPTO\u201908. 57--74.","DOI":"10.1007\/978-3-540-85174-5_4"},{"key":"e_1_2_1_38_1","doi-asserted-by":"crossref","unstructured":"Sylvain Pasini and Serge Vaudenay. 2006. An optimal non-interactive message authentication protocol. In Topics in Cryptology \u2013 CT-RSA\u201906. 280--294. Sylvain Pasini and Serge Vaudenay. 2006. An optimal non-interactive message authentication protocol. In Topics in Cryptology \u2013 CT-RSA\u201906. 280--294.","DOI":"10.1007\/11605805_18"},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1137\/060671553"},{"key":"e_1_2_1_40_1","doi-asserted-by":"crossref","unstructured":"Rafael Pass and Hoeteck Wee. 2010. Constant-round non-malleable commitments from sub-exponential one-way functions. In Advances in Cryptology \u2013 EUROCRYPT\u201910. 638--655. Rafael Pass and Hoeteck Wee. 2010. Constant-round non-malleable commitments from sub-exponential one-way functions. In Advances in Cryptology \u2013 EUROCRYPT\u201910. 638--655.","DOI":"10.1007\/978-3-642-13190-5_32"},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/765891.766146"},{"key":"e_1_2_1_42_1","volume-title":"Retrieved on","author":"Perrin Trevor","year":"2016"},{"key":"e_1_2_1_43_1","doi-asserted-by":"crossref","unstructured":"Bertram Poettering and Paul R\u00f6sler. 2018. Towards bidirectional ratcheted key exchange. In Advances in Cryptology \u2013 CRYPTO\u201918. 3--32. Bertram Poettering and Paul R\u00f6sler. 2018. Towards bidirectional ratcheted key exchange. In Advances in Cryptology \u2013 CRYPTO\u201918. 3--32.","DOI":"10.1007\/978-3-319-96884-1_1"},{"key":"e_1_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/358027.358053"},{"key":"e_1_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2018.00036"},{"key":"e_1_2_1_46_1","doi-asserted-by":"crossref","unstructured":"Lior Rotem and Gil Segev. 2018. Out-of-band authentication in group messaging: Computational statistical optimal. In Advances in Cryptology \u2013 CRYPTO\u201918. 63--89. Lior Rotem and Gil Segev. 2018. Out-of-band authentication in group messaging: Computational statistical optimal. In Advances in Cryptology \u2013 CRYPTO\u201918. 63--89.","DOI":"10.1007\/978-3-319-96884-1_3"},{"key":"e_1_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/3139550.3139568"},{"key":"e_1_2_1_48_1","volume-title":"Retrieved on","year":"2020"},{"key":"e_1_2_1_49_1","volume-title":"Retrieved on","year":"2020"},{"key":"e_1_2_1_50_1","volume-title":"Retrieved on","year":"2020"},{"key":"e_1_2_1_51_1","doi-asserted-by":"crossref","unstructured":"Serge Vaudenay. 2005. Secure communications over insecure channels based on short authenticated strings. In Advances in Cryptology \u2013 CRYPTO\u201905. 309--326. Serge Vaudenay. 2005. Secure communications over insecure channels based on short authenticated strings. In Advances in Cryptology \u2013 CRYPTO\u201905. 309--326.","DOI":"10.1007\/11535218_19"},{"key":"e_1_2_1_52_1","volume-title":"Retrieved on","author":"Encryption Viber","year":"2020"},{"key":"e_1_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1109\/FOCS.2010.87"},{"key":"e_1_2_1_54_1","volume-title":"Retrieved on","author":"Encryption WhatsApp","year":"2017"},{"key":"e_1_2_1_55_1","volume-title":"Retrieved on","year":"2020"}],"container-title":["ACM Transactions on Privacy and Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3377849","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T13:21:23Z","timestamp":1672579283000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3377849"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,4,17]]},"references-count":53,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2020,5,31]]}},"alternative-id":["10.1145\/3377849"],"URL":"https:\/\/doi.org\/10.1145\/3377849","relation":{},"ISSN":["2471-2566","2471-2574"],"issn-type":[{"value":"2471-2566","type":"print"},{"value":"2471-2574","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,4,17]]},"assertion":[{"value":"2019-02-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2019-12-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2020-04-17","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}