Description
Depuis plusieurs années, les grands acteurs du web travaillent à l’amélioration des communications entre leurs utilisateurs et leurs services. Ces améliorations peuvent porter sur la vitesse des connexions ou sur la sécurité des échanges. QUIC fait partie des efforts en cours. Il s’agit d’un protocole en cours de standardisation à l’IETF, qu’on peut résumer à un protocole sur UDP fournissant les services de TCP/SCTP, TLS 1.3 et HTTP/2.Comme QUIC est destiné à remplacer le couple TLS/HTTP pour un certain nombre de cas d’usage, il nous a semblé intéressant de nous y intéresser, et d’étudier les implémentations existantes.Les travaux que nous avons menés ont consisté à réimplémenter des portions des standards QUIC avec scapy, ce qui nous a permis de nous forger une opinion sur la complexité de QUIC, puis de tester les implémentations existantes vis-à-vis de contraintes de sécurité (implicites ou explicites) tirées des drafts IETF. Bien que nous n’ayons pas mis au jour de problème majeur, nos conclusions sont d’une part que QUIC est trop complexe et d’autre part que la majorité des implémentations sont fragiles et réagissent de manière incorrecte à certains de nos stimuli.
Infos pratiques
Prochains exposés
-
Towards privacy-preserving and fairness-aware federated learning framework
Orateur : Nesrine Kaaniche - Télécom SudParis
Federated Learning (FL) enables the distributed training of a model across multiple data owners under the orchestration of a central server responsible for aggregating the models generated by the different clients. However, the original approach of FL has significant shortcomings related to privacy and fairness requirements. Specifically, the observation of the model updates may lead to privacy[…]-
Cryptography
-
SoSysec
-
Privacy
-
Machine learning
-
-
NEAT: A Nile-English Aligned Translation Corpus based on a Robust Methodology for Intent Based Networking and Security
Orateur : Pierre Alain - IUT de Lannion
The rise of Intent Based Networking (IBN) has paved the way for more efficient network and security management, reduced errors, and accelerated deployment times by leveraging AI processes capable of translating natural language intents into policies or configurations. Specialized neural networks could offer a promising solution at the core of translation operations. Still, they require dedicated,[…]-
SoSysec
-
Network
-
Security policies
-
-
Black-Box Collision Attacks on Widely Deployed Perceptual Hash Functions and Their Consequences
Orateur : Diane Leblanc-Albarel - KU Leuven
Perceptual hash functions identify multimedia content by mapping similar inputs to similar outputs. They are widely used for detecting copyright violations and illegal content but lack transparency, as their design details are typically kept secret. Governments are considering extending the application of these functions to Client-Side Scanning (CSS) for end-to-end encrypted services: multimedia[…]-
Cryptography
-
SoSysec
-
-
Malware Detection with AI Systems: bridging the gap between industry and academia
Orateur : Luca Demetrio - University of Genova
With the abundance of programs developed everyday, it is possible to develop next-generation antivirus programs that leverage this vast accumulated knowledge. In practice, these technologies are developed with a mixture of established techniques like pattern matching, and machine learning algorithms, both tailored to achieve high detection rate and low false alarms. While companies state the[…]-
SoSysec
-
Intrusion detection
-
Machine learning
-