In privacy-preserving cross-device federated learning, users train a global model on their local data and submit encrypted local models, while an untrusted central server aggregates the encrypted models to obtain an updated global model. Prior work has demonstrated how to verify the correctness of aggregation in such a setting. However, such verification relies on strong assumptions, such as a trusted setup among all users under unreliable network conditions, or it suffers from expensive cryptographic operations, such as bilinear pairing. In this paper, we scrutinize the verification mechanism of prior work and propose a model recovery attack, demonstrating that most local models can be leaked within a reasonable time (e.g., 98% of encrypted local models are recovered within 21 h). Then, we propose VerSA, a verifiable secure aggregation protocol for cross-device federated learning. VerSA does not require any trusted setup for verification between users while minimizing the verification cost by enabling both the central server and users to utilize only a lightweight pseudorandom generator to prove and verify the correctness of model aggregation. We experimentally confirm the efficiency of VerSA under diverse datasets, demonstrating that \textsc{VerSA} is orders of magnitude faster than verification in prior work.

A cache side-channel attack retrieves victim’s sensitive information from a system by exploiting shared cache of CPUs. Since conventional cache side-channel attacks such as FLUSH+RELOAD and PRIME+PROBE are likely to incur numerous cache events, such as cache hits and misses, many previous strategies have focused on monitoring cache events for attack detection. However, as recently proposed attacks such as PRIME+ABORT have exploited the other events as side-channels, it has become challenging to detect them by monitoring only cache events. In this paper, we investigate PRIME+ABORT attack and identifies Intel TSX hardware events are tightly coupled with it as well as cache events. Based on our finding, we propose a novel deep learning-based cache side-channel attack detection method called FRIME . It can concurrently detect not only the conventional attacks such as FLUSH+RELOAD, PRIME+PROBE, but also PRIME+ABORT by leveraging both event types. In order to demonstrate the efficacy of our cache side-channel attack detection scheme in diverse workload conditions in the real world, we implement it using MLP, RNN, and LSTM deep learning models, demonstrating LSTM-based method outperforms the other implementations in terms of detection accuracy.

In the PKI system, revoking problematic certificates in a timely manner is essential for secure communications on the Internet. Regrettably, the primary revocation schemes have shown limitations in various aspects such as privacy and scalability. Although many state-of-the-art revocation techniques have been proposed to overcome such limitations, the implications of their deployment in practice in each aspect have not been deeply studied. This article aims to systematically classify and comparatively analyze the existing schemes in terms of security, efficiency, and practicality. Based on our evaluation, we also provide insight into securing the revocation systems, and finally discuss their future directions.

A passive neutron coincidence counter was developed for the nondestructive measurements of the nuclear materials in the Advanced Spent Fuel Conditioning Process (ACP) facility at the Korea Atomic Energy Research Institute (KAERI). A hot test of the neutron counter was performed with spent fuel rod-cuts to obtain the calibration curve for ²⁴⁴Cm in 2007. The source terms were analyzed by using the ORIGEN-ARP code. There was a considerable difference in the neutron counting rates between the measurements and the MCNPX simulation results. This difference was systematic and came from the errors in the declared ²⁴⁴Cm mass obtained by using the burnup code. To correct the calibration curve, a self-multiplication correction method was applied, and the corrected singles and doubles rates as well as the expected ²⁴⁴Cm mass of each rod-cut were obtained as a result. The differences in the calibration constants between the measurements and the MCNPX results were - 33% and - 34% for the singles and doubles rates, respectively. However, those differences between the self-multiplication correction and MCNPX results were reduced to - 1% and - 5% for the singles and doubles rates, respectively.

Mail user agent (MUA) programs provide an integrated interface for email services. Many MUAs support email encryption functionality to ensure the confidentiality of emails. In practice, they encrypt the content of an email using email encryption standards such as OpenPGP or S/MIME, mostly implemented using GnuPG. Despite their widespread deployment, there has been insufficient research on their software structure and the security dependencies among the software components of MUA programs. In order to understand the security implications of the structures and analyze any possible vulnerabilities of MUA programs, we investigated a number of MUAs that support email encryption. As a result, we found severe vulnerabilities in a number of MUAs that allow cache side-channel attacks in virtualized desktop environments. Our analysis reveals that the root cause originates from the lack of verification and control over the third-party cryptographic libraries that they adopt. In order to demonstrate this, we implemented a cache side-channel attack on RSA in GnuPG and then conducted an evaluation of the vulnerability of 13 MUAs that support email encryption in Ubuntu 14.04, 16.04 and 18.04. Based on our experiment, we found that 10 of these MUA programs (representing approximately 77% of existing MUA programs) allow the installation of a vulnerable version of GnuPG, even when the latest version of GnuPG, which is secure against most cache side-channel attacks, is in use. In order to substantiate the importance of the vulnerability we discovered, we conducted a FLUSH+RELOAD attack on these MUA programs and demonstrated that the attack restored 92% of the bits of the 2048-bit RSA private key when the recipients read a single encrypted email.