Applied Cryptography

Practical Evaluation of the Crypto-Agility Maturity Model
Cryptographic agility is a key prerequisite for maintaining the long-term security of digital communication, particularly in light of …
Leonie Wolf, Samson Umezulike, Gurur Öndarö, Sebastian Schinzel, Fabian Ising
Cite
S/MINE: Collecting and Analyzing S/MIME Certificates at Scale
We report on the first broad analysis of real-world S/MIME certificates for digitally signing and encrypting emails. We collected more …
Gurur Öndarö, Jonas Kaspereit, Samson Umezulike, Christoph Saatjohann, Fabian Ising, Sebastian Schinzel
Cite URL
LanDscAPe: Exploring LDAP Weaknesses and Data Leaks at Internet Scale
The Lightweight Directory Access Protocol (LDAP) is the standard technology to query information stored in directories. These …
Jonas Kaspereit, Gurur Öndarö, Gustavo Luvizotto Cesar, Simon Ebbers, Fabian Ising, Christoph Saatjohann, Ralph Holz, Sebastian Schinzel
Cite URL
Dissertation: Exploring Corner Cases of Modern Applied Cryptography
The advent of instantaneous communication via the Internet in the 80s and 90s has revolutionized the way we communicate. Suddenly, we …
Fabian Ising
PDF Cite
Content-Type: Multipart/Oracle - Tapping into Format Oracles in Email End-to-End Encryption
S/MIME and OpenPGP use cryptographic constructions repeatedly shown to be vulnerable to format oracle attacks in protocols like TLS, …
Fabian Ising, Damian Poddebniak, Tobias Kappert, Christoph Saatjohann, Sebastian Schinzel
Cite URL
Why TLS Is Better without STARTTLS: A Security Analysis of STARTTLS in the Email Context
TLS is one of today’s most widely used and best-analyzed encryption technologies. However, for historical reasons, TLS for email …
Damian Poddebniak, Fabian Ising, Hanno Böck, Sebastian Schinzel
Cite URL
Office Document Security and Privacy
OOXML and ODF are the de facto standard data formats for word processing, spreadsheets, and presentations. Both are XML-based, …
Jens Müller, Fabian Ising, Christian Mainka, Vladislav Mladenov, Sebastian Schinzel, Jörg Schwenk
Cite URL
Efail: Breaking S/MIME and OpenPGP Email Encryption Using Exfiltration Channels
OpenPGP and S/MIME are the two prime standards for providing end-to-end security for emails. We describe novel attacks built upon a …
Damian Poddebniak, Christian Dresen, Jens Müller, Fabian Ising, Sebastian Schinzel, Simon Friedberger, Juraj Somorovsky, Jörg Schwenk
Cite URL