Security engineering papers

Singularity - Microsoft Research (2003)

https://www.microsoft.com/en-us/research/project/singularity/

Nick Sullivan: "A series of works derived from the Midori advanced development OS project."

almost 8 years ago

Straight Talk: New Yorkers on Mobile Messaging and Implications for Privacy - Ame Elliott, Sara Brody (2016)

https://simplysecure.org/resources/techreports/NYC15-MobMsg.pdf

Nick Sullivan: "A revealing field study about security, privacy and surveillance."

almost 8 years ago

Some thoughts on security after ten years of qmail 1.0 - Daniel J. Bernstein (2007)

https://cr.yp.to/qmail/qmailsec-20071101.pdf

Nick Sullivan: "A retrospective of a popular mail transfer agent by the author with best practices learned."

almost 8 years ago

Validation of Elliptic Curve Public Keys - Adrian Antipa et al. (2003)

https://iacr.org/archive/pkc2003/25670211/25670211.pdf

Nick Sullivan: "The first of many papers exploring some of the subtle risks of elliptic curve cryptography."

almost 8 years ago

Survivable Key Compromise in Software Update Systems - Justin Samuel, Nick Mathewson, Justin Cappos, Roger Dingledine (2010)

https://justinsamuel.com/papers/survivable-key-compromise-ccs2010.pdf

Nick Sullivan: "This paper introduces The Update Framework (TUF) for secure software updates."

almost 8 years ago

Programming Satan’s Computer - Ross Anderson and Roger Needham (1995)

https://www.cl.cam.ac.uk/~rja14/Papers/satan.pdf

Nick Sullivan: "An exploration of the adversarial models needed to build secure software."

almost 8 years ago

Ceremony Design and Analysis - Carl Ellison (2007)

https://eprint.iacr.org/2007/399.pdf

Nick Sullivan: "This paper introduces the idea of a ceremony as a generalization of a security protocol, formalizing the often overlooked human element."

almost 8 years ago

Format String Attacks - Tim Newsham (2000)

http://forum.ouah.org/FormatString.PDF

Nick Sullivan: "Still one of the most pervasive security issues, format string vulnerabilities demonstrate the dangers of mixing abstractions."

almost 8 years ago

Return-Oriented Programming - Solar Designer (1997)

http://seclists.org/bugtraq/1997/Aug/63

Nick Sullivan: "A new attack methodology that revolutionized offensive security."

almost 8 years ago

This World of Ours - James Mickens (2014)

https://www.usenix.org/system/files/1401_08-12_mickens.pdf

Nick Sullivan: "A comedic article that helps emphasize the difference between targeted attacks by well-resourced adversaries and the more pedestrian threats faced by the general populace."

almost 8 years ago

Improving SSL Warnings: Comprehension and Adherence - Adrienne Porter Felt et al. (2015)

http://delivery.acm.org/10.1145/2710000/2702442/p2893-felt.pdf?__acm__=1535698623_eb2e8a306c72900fa54b16429e2ce945&acc=OA&id=2702442&ip=185.6.78.166&key=4D4702B0C3E38B35.4D4702B0C3E38B35.4D4702B0C3E38B35.5945DC2EABF3343C

Nick Sullivan: "A data-driven study of how well/poorly user interfaces express security features to users in web browsers."

almost 8 years ago

Lest We Remember: Cold Boot Attacks on Encryption Keys - J. Alex Halderman et al. (2008)

https://jhalderm.com/pub/papers/coldboot-sec08.pdf

Nick Sullivan: "Another security paper that explores the reasons why good encryption software can be insufficient in the face of physical attacks."

almost 8 years ago

Reflections on Trusting Trust - Ken Thompson (1984)

https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf

Nick Sullivan: "This paper succinctly describes the concept that it's not enough to trust software, you also need to trust the software that compiles the software, and the software that compiles the compiler, and so on."

almost 8 years ago

New Directions in Cryptography - Whitfield Diffie and Martin Hellman (1976)

https://ee.stanford.edu/~hellman/publications/24.pdf

Nick Sullivan: "It's hard to emphasize just how revolutionary the concept of public key cryptography is. This paper started it all, introducing D-H key agreement and digital signatures."

almost 8 years ago