Bletchley Park from GEMS Academy in Abu Dhabi and LIGHT from Delhi Private School in Dubai were our top finalists. The two teams receive dan expense-paid trip to New York City and competed in the 2015 CSAW @ NYU HSF competition in November of 2015. We thank all the students and their mentor teachers for participating in the High School Forensics challenge. This year’s HSF competition has been one of the largest high school cyber security events in the world! We had over 35 teams from all across the UAE register for HSF’15. We hope everyone had fun and found the challenge to be a worthwhile learning activity.

In today’s world security requirements of various information disciplines, e.g., networking, telecommunications, database systems, and mobile applications, has caused applied cryptography to gain immense importance. In order to satisfy the high throughput requirements of such applications, the cryptographic systems are implemented either as cryptographic accelerators (ASIC and FPGA implementations), or as cryptographic libraries (optimized software routines). The complex hardware and software implementations are raising concerns regarding their security and reliability.
In this talk, we first present Differential Fault Analysis (DFA) on AES which can be used to obtain the key using a single fault induction. Subsequently, we extend these attacks to multiple byte faults, using a new fault model based on the diagonals of the AES state matrix. The work shows that the cipher can be attacked if one, two or three diagonals are affected needing 2, 2 or 4 faulty ciphertexts respectively to uniquely obtain the key. In order to thwart such powerful attacks, fault tolerance is introduced in block ciphers through either detection or infective schemes. However, there is a gap!
While conventional fault tolerance offers large amount of reliability under the assumption that all faults are equally likely, an attacker is equipped with a biased fault injection mechanism, which can threaten most existing fault tolerant architectures. We demonstrate that bias in the fault injections can be used to break popular detection schemes, which rely on redundancy using a technique known as the Differential Fault Intensity Analysis (DFIA) that combines principles of differential power analysis with fault attacks. We formalize the notion of bias of a fault model using the variance of the fault distribution. We also investigate infective countermeasures against fault attacks where there is no explicit comparison step unlike the detection schemes. However, even such schemes can be countered via stronger attack models like instruction skip. Finally, we present a fault tolerant implementation of the infective countermeasure using Idempotent Instructions, which reduces the threat of such skips significantly. Overall, we claim to increase significantly the security margin against several known fault models.

Dr. Debdeep Mukhopadhyay

Dr. Debdeep Mukhopadhyay is currently an Associate Professor at the Department of Computer Science and Engineering, Indian Institute of Technology at Kharagpur, India. At IIT Kharagpur he initiated the Secured Embedded Architecture Laboratory (SEAL), with a focus on Embedded Security and Side Channel Attacks. Prior to this he worked as a visiting Associate Professor of NYU-Shanghai. He had also served as an Assistant Professor at IIT Madras, India and as a Visiting Researcher at NYU Polytechnic School of Engineering under the Indo-US STF Fellowship. He holds a PhD, an MS, and a B. Tech from IIT Kharagpur, India. Dr. Mukhopadhyay’s research interests are Cryptography, Hardware Security, and VLSI. His books include Cryptography and Network Security (Mc Graw Hills), Hardware Security: Design, Threats, and Safeguards (CRC Press), and Timing Channels in Cryptography (Springer). He has written more than 100 papers in peer-reviewed conferences and journals and has collaborated with several Indian and Foreign Organizations. Dr. Mukhopadhyay is the recipient of the prestigious Young Scientist award from the Indian National Science Academy, the Young Engineer award from the Indian National Academy of Engineers, and is the Young Associate of the Indian Academy of Science. He was also awarded the Outstanding Young Faculty fellowship in 2011 from IIT Kharagpur, and the Techno-Inventor Best PhD award by the Indian Semiconductor Association.

Guest Speaker

Monther Aldwairi

Monther Aldwairi is an associate professor at the College of Technological Innovation at Zayed University since the fall of 2014. He received his B.S. in electrical engineering from Jordan University of Science and University (JUST) in 1998, and his M.S. and PhD in computer engineering from North Carolina State University (NCSU), Raleigh, NC, in 2001 and 2006, respectively. Prior to joining ZU, he was an Assistant and then Associate Professor of Computer Engineering at Jordan University of Science and Technology. He served as the Vice Dean of the Faculty of Computer and Information Technology from 2010 to 2012 and was the Assistant Dean for Student Affairs in 2009. In addition, he was an Adjunct Professor at New York Institute of Technology (NYiT-AMM) from 2009 to 2012. He worked at NCSU as Post-Doctoral Research Associate in 2007 and as a research assistant from 2001 to 2006. He worked as a system integration engineer for ARAMEX from 1998 to 2000. Dr. Aldwairi’s research interests are in network and web security, intrusion detection and forensics, cloud computing, reconfigurable architectures, artificial intelligence and pattern matching.

CCS-AD has been working in the past year to develop a high quality research program that addresses challenges relevant to the UAE and the region. To address this goal CRISSP-AD in conjunction with KUSTAR are organizing a day long meeting to explore research collaborations among researchers in UAE universities who work in the broad field of cyber security and privacy. The goal of this meeting is to develop ambitious and high impact research projects and to explore how they can be supported to generate research results of highest quality. More specifically, we would like to discuss how to develop joint funding proposals, build testbeds, and gain access to data that could be used for evaluating our research results.