Automated Detection of Side Channels in Cryptographic Protocols: DROWN the ROBOTs! - Drees, Jan Peter; Gupta, Pritha; Hüllermeier, Eyke; Jager, Tibor; Konze, Alexander; Priesterjahn, Claudia; Ramaswamy, Arunselvan; Somorovsky, Juraj (14th ACM Workshop on Artificial Intelligence and Security)

Analysis of DTLS Implementations Using Protocol State Fuzzing - Fiterau-Brostean, Paul; Jonsson, Bengt; Merget, Robert; de Ruiter, Joeri; Sagonas, Konstantinos; Somorovsky, Juraj (29th USENIX Security Symposium (USENIX Security 20))

Mitigation of Attacks on Email End-to-End Encryption - Schwenk, Jörg; Brinkmann, Marcus; Poddebniak, Damian; Müller, Jens; Somorovsky, Juraj; Schinzel, Sebastian (Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security)
OpenPGP and S/MIME are two major standards for securing email communication introduced in the early 1990s. Three recent classes of attacks exploit weak cipher modes (EFAIL Malleability Gadgets, or EFAIL-MG), the flexibility of the MIME email structure (EFAIL Direct Exfiltration, or EFAIL-DE), and the Reply action of the email client (REPLY attacks). Although all three break message confidentiality by using standardized email features, only EFAIL-MG has been mitigated in IETF standards with the introduction of AEAD algorithms. So far, no uniform and reliable countermeasures have been adopted by email clients to prevent EFAIL-DE and REPLY attacks. Instead, email clients implement a variety of different ad-hoc countermeasures which are only partially effective, cause interoperability problems, and fragment the secure email ecosystem.We present the first generic countermeasure against both REPLY and EFAIL-DE attacks by checking the decryption context including SMTP headers and MIME structure during decryption. The decryption context is encoded into a string DC and used as Associated Data (AD) in the AEAD encryption. Thus the proposed solution seamlessly extends the EFAIL-MG countermeasures. The decryption context changes whenever an attacker alters the email source code in a critical way, for example, if the attacker changes the MIME structure or adds a new Reply-To header. The proposed solution does not cause any interoperability problems and legacy emails can still be decrypted. We evaluate our approach by implementing the decryption contexts in Thunderbird/Enigmail and by verifying their correct functionality after the email has been transported over all major email providers, including Gmail and iCloud Mail.
Keywords: decryption contexts; EFAIL; OpenPGP; S/MIME; AEAD

"Johnny, you are fired!" -- Spoofing OpenPGP and S/MIME Signatures in Emails - Müller, Jens; Brinkmann, Marcus; Poddebniak, Damian; Böck, Hanno; Schinzel, Sebastian; Somorovsky, Juraj; Schwenk, Jörg (28th USENIX Security Symposium (USENIX Security 19))

Scalable Scanning and Automatic Classification of TLS Padding Oracle Vulnerabilities - Merget, Robert; Somorovsky, Juraj; Aviram, Nimrod; Young, Craig; Fliegenschmidt, Janis; Schwenk, Jörg; Shavitt, Yuval (28th USENIX Security Symposium (USENIX Security 19))

Security Analysis of XAdES Validation in the CEF Digital Signature Services (DSS) - Engelbertz, Nils; Mladenov, Vladislav; Somorovsky, Juraj; Herring, David; Erinola, Nurullah; Schwenk, Jörg (Open Identity Summit 2019)

Prime and Prejudice: Primality Testing Under Adversarial Conditions - Albrecht, Martin R.; Massimo, Jake; Paterson, Kenneth G.; Somorovsky, Juraj (Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security)

Attacking Deterministic Signature Schemes Using Fault Attacks - Poddebniak, Damian; Somorovsky, Juraj; Schinzel, Sebastian; Lochter, Manfred; Rosler, Paul (2018 IEEE European Symposium on Security and Privacy (EuroS&P))

On The (In-)Security Of JavaScript Object Signing And Encryption - Detering, Dennis; Somorovsky, Juraj; Mainka, Christian; Mladenov, Vladislav; Schwenk, Jörg (Proceedings of the 1st Reversing and Offensive-oriented Trends Symposium on - ROOTS)

Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels - Poddebniak, Damian; Dresen, Christian; Müller, Jens; Ising, Fabian; Schinzel, Sebastian; Friedberger, Simon; Somorovsky, Juraj; Schwenk, Jörg (27th USENIX Security Symposium (USENIX Security 18))