Publications

Not so Smart: On Smart TV Apps

2015 - Marcus Niemietz, Juraj Somorovsky, Christian Mainka, Jörg Schwenk

International Workshop on Secure Internet of Things (SIoT 2015, Vienna, Austria) [pdf]

Waiting for CSP — Securing Legacy Web Applications with JSAgents

2015 - Mario Heiderich, Marcus Niemietz, Jörg Schwenk

Waiting for CSP — Securing Legacy Web Applications with JSAgents, ESORICS 2015, 20th European Symposium on Research in Computer Security [ESORICS 2015] [PDF file]

How to Break XML Encryption - Automatically

2015 - Dennis Kupser, Christian Mainka, Jörg Schwenk, Juraj Somorovsky

In Proceedings of the 9th USENIX Workshop on Offensive Technologies (WOOT), 2015 [pdf]

Semi-Automated Fuzzy MCDM and Lattice Solutions for WS-Policy Intersection

2015 - Abeer El­sa­fie, Jörg Schwenk

IEEE 5th International Workshop on Security and Privacy Engineering SPE2015, within IEEE SERVICES 2015 June 27 and July 2, 2015, New York, NY, USA

Owning Your Home Network: Router Security Revisited

2015 - Marcus Niemietz, Jörg Schwenk

W2SP 2015: Web 2.0 Security & Privacy 2015 (San Jose, California) [Workshop] [PDF]

Tightly Secure Authenticated Key Exchange

2015 - Christoph Bader, Dennis Hofheinz, Tibor Jager, Eike Kiltz, Yong Li

TCC 2015 [paper]

On the Selective Opening Security of Practical Public-Key Encryption Schemes

2015 - Felix Heuer, Tibor Jager, Eike Kiltz, Sven Schäge

PKC 2015

Your Software at my Service

2014 - Vladislav Mladenov, Christian Mainka, Florian Feldmann, Julian Krautwald, Jörg Schwenk

ACM CCSW 2014 in conjunction with the ACM Conference on Computer and Communications Security (CCS) November 7, 2014, The Scottsdale Plaza Resort, Scottsdale, Arizona, USA. [paper]

Multi-Ciphersuite Security of the Secure Shell (SSH) Protocol

2014 - Florian Bergsma, Benjamin Dowling, Florian Kohlar, Jörg Schwenk, Douglas Stebila

ACM Conference on Computer and Communications Security - Best Student Paper Award - [Webseite]

How Secure is TextSecure?

2014 - Tilman Frosch, Christian Mainka, Christoph Bader, Florian Bergsma, Jörg Schwenk, Thorsten Holz

Cryptology ePrint Archive, Report 2014/904, 31 Oct 2014 [pdf]

On the Security of Holder-of-Key Single Sign-On

2014 - Andreas Mayer, Vladislav Mladenov, Jörg Schwenk

Sicherheit 2014: Sicherheit, Schutz und Zuverlässigkeit, Beiträge der 7. Jahrestagung des Fachbereichs Sicherheit der Gesellschaft für Informatik e.V. (GI), 19.-21. März 2014, Wien, Österreich [pdf]

Strengthening Web Authentication through TLS - Beyond TLS Client Certificates

2014 - Vladislav Mladenov, Florian Feldmann, Christopher Meyer, Andreas Mayer, Jörg Schwenk

Open Iden­ti­ty Sum­mit 2014 Sep­tem­ber 4th - 6th 2014, Frauenhofer IZS, Stuttgart, Ger­ma­ny, http://?openidentity.?eu

Guardians of the Clouds: When Identity Providers Fail

2014 - Andreas Mayer, Marcus Niemietz, Vladislav Mladenov, Jörg Schwenk

ACM CCSW 2014 in conjunction with the ACM Conference on Computer and Communications Security (CCS) November 7, 2014, The Scottsdale Plaza Resort, Scottsdale, Arizona, USA. [paper]

Efficient Signatures with Tight Real World Security in the Random-Oracle Model

2014 - Christoph Bader

In Proceedings of the 13th International Conference, CANS 2014 [paper]

Revisiting SSL/TLS Implementations: New Bleichenbacher Side Channels and Attacks

2014 - Christopher Meyer, Juraj Somorovsky, Jörg Schwenk, Eugen Weiss, Sebastian Schinzel, Erik Tews

USENIX Security 2014 [Slides] [pdf]

Scriptless Timing Attacks on Web Browser Privacy

2014 - Bin Liang, Wei You, Liangkun Liu, Wenchang Shi, Mario Heiderich

2014 44th Annual IEEE/IFIP International Conference on Dependable Systems and Networks [PDF]

New Modular Compilers for Authenticated Key Exchange

2014 - Yong Li, Sven Schäge, Zheng Yang, Christoph Bader, Jörg Schwenk

In Proceedings the 12th International Conference, ACNS 2014 [Paper]

Scriptless attacks: Stealing more pie without touching the sill

2014 - Mario Heiderich, Marcus Niemietz, Felix Schuster, Thorsten Holz, Jörg Schwenk

Journal of Computer Security, Volume 22, Number 4 / 2014, Web Application Security – Web @ 25 [URL]

On the Security of the Pre-Shared Key Ciphersuites of TLS

2014 - Yong Li, Sven Schäge, Zheng Yang, Florian Kohlar, Jörg Schwenk

In Proceedings of the 17th International Conference on Practice and Theory in Public-Key Cryptography (PKC), 2014 [Paper]

SAML Privacy-Enhancing Profile

2014 - Moritz Horsch, Max Tuengerthal, Tobias Wich

Open Identity Summit 2014 [PDF]

Secure Fallback Authentication and the Trusted Friend Attack

2014 - Ashar Javed, David Bletgen, Florian Kohlar, Markus Dürmuth, Jörg Schwenk

Proceedings International Conference on Distributed Computing Systems Workshops (ICDCS Workshops), 2014.

One Bad Apple: Backwards Compatibility Attacks on State-of-the-Art Cryptography

2013 - Tibor Jager, Kenneth G. Paterson, Juraj Somorovsky

In Proceedings of the Network and Distributed System Security Symposium (NDSS), 2013 [CryptoChallenge] [paper]

Strongly Secure One-round Group Authenticated Key Exchange in the Standard Model

2013 - Yong Li, Zheng Yang

In Proceedings of the 12th International Conference, CANS 2013 [Paper]

mXSS Attacks: Attacking well-secured Web-Applications by using innerHTML Mutations

2013 - Mario Heiderich, Jörg Schwenk, Tilman Frosch, Jonas Magazinius, Edward Z. Yang

20th ACM Conference on Computer and Communications Security (CCS), Berlin, Germany, November 2013 [PDF]

On the security of TLS renegotiation

2013 - Florian Bergsma, Florian Kohlar, Douglas Stebila

ACM Conference on Computer and Communications Security

Options for Integrating eID and SAML

2013 - Hühnlein, Detlef, Jörg Schwenk, Tobias Wich, Vladislav Mladenov, Florian Feldmann, Andreas Mayer, Schmölz, Johannes, Bruegger, Bud P., Horsch, Moritz

CCS 2013 Post-Conference Workshop, Digital Identity Management (DIM)

Sicherer Schlüssel- und Informationsaustausch mit SAML

2013 - Dennis Felsch, Thorsten Schreiber, Christopher Meyer, Florian Feldmann, Jörg Schwenk

In Proceedings of the DACH Security 2013, Nürnberg, Germany [Paper]

How to authenticate mobile devices in a web environment - The SIM-ID approach

2013 - Florian Feldmann, Jörg Schwenk

Open Identity Summit 2013 September 9th - 11th 2013, Kloster Banz, Germany http://openidentity.eu [Paper] [Presentation]

On the Insecurity of XML Security

2013 - Juraj Somorovsky

PhD Thesis Supervisors: Jörg Schwenk, Kenneth G. Paterson [pdf]

A Footprint of Third-Party Tracking on Mobile Web

2013 - Ashar Javed

[POSTER] In 20th ACM Conference on Computer and Communications Security (ACM CCS), November 4-8, 2013 Berlin, Germany [poster]

SoK: Lessons Learned From SSL/TLS Attacks

2013 - Christopher Meyer, Jörg Schwenk

In Proceedings of "The 14th International Workshop on Information Security Applications (WISA2013)" [Paper] [Slides]

Towards Elimination of Cross-Site Scripting on Mobile Versions of Web Applications

2013 - Ashar Javed, Jörg Schwenk

In Pro­cee­dings of The 14th International Workshop on Information Security Applications (WISA2013), August 19-21 (2013), Jeju Island, Korea [paper]

A new Approach towards DoS Penetration Testing on Web Services

2013 - Andreas Falkenberg, Christian Mainka, Juraj Somorovsky, Jörg Schwenk

IEEE 20th International Conference on Web Services (IEEE ICWS 2013) [PDF]

Secure Bindings for Browser-based Single Sign-On

2013 - Andreas Mayer, Florian Kohlar, Lijun Liao, Jörg Schwenk

In 13. Deutscher IT-Sicherheitskongress des BSI: Informationssicherheit stärken --- Vertrauen in die Zukunft schaffen, Seiten 375--390, SecuMedia Verlag

Practical Signatures From Standard Assumptions

2013 - Florian Böhl, Dennis Hofheinz, Tibor Jager, Jessica Koch, Jae Hong Seo, Christoph Striecks

Eurocrypt 2013 [pdf] [link]

Penetration Test Tool for XML-based Web Services

2013 - Christian Mainka, Vladislav Mladenov, Juraj Somorovsky, Jörg Schwenk

International Symposium on Engineering Secure Software and Systems 2013 [PDF]

Randomly Failed! The State of Randomness in Current Java Implementations

2013 - Kai Michaelis, Christopher Meyer, Jörg Schwenk

Cryptography track at RSA Conference 2013 (CT-RSA 2013) [Paper] [Slides]

A new approach for WS-Policy Intersection using Partial Ordered Sets

2013 - Abeer El­sa­fie, Christian Mainka, Jörg Schwenk

5th Central European Workshop on Services and their Composition, ZEUS 2013 February 21-22, 2013, Rostock, Germany [PDF]

Tightly secure signatures and public-key encryption

2012 - Dennis Hofheinz, Tibor Jager

CRYPTO 2012 [Full Version]

Waters signatures with optimal security reduction

2012 - Dennis Hofheinz, Tibor Jager, Edward Knapp

PKC 2012 [Full Version]

Down to the Bare Metal: Using Processor Features for Binary Analysis

2012 - Carsten Willems, Ralf Hund, Amit Vasudevan, Andreas Fobian, Dennis Felsch, Thorsten Holz

Annual Computer Security Applications Conference (ACSAC), Orlando, FL, December 2012 [pdf]

UI Redressing Attacks on Android Devices

2012 - Marcus Niemietz, Jörg Schwenk

Black Hat Abu Dhabi 2012

Sometimes it's better to be STUCK! - SAML Transportation Unit for Cryptographic Keys

2012 - Christopher Meyer, Florian Feldmann, Jörg Schwenk

15th Annual International Conference on Information Security and Cryptology, ICISC 2012 [Slides] [Paper]

SS-FP: Browser Fingerprinting using HTML Parser Quirks

2012 - Erwan Abgrall, Yves Le Traon, Martin Monperrus, Sylvain Gombault, Mario Heiderich, Alain Ribault

[Cornell University]

Scriptless Attacks – Stealing the Pie Without Touching the Sill

2012 - Mario Heiderich, Marcus Niemietz, Felix Schuster, Thorsten Holz, Jörg Schwenk

19th ACM Conference on Computer and Communications Security (CCS), Raleigh, NC, October 2012 [PDF]

On the Security of TLS-DHE in the Standard Model

2012 - Tibor Jager, Florian Kohlar, Sven Schäge, Jörg Schwenk

In Advances in Cryptology – CRYPTO 2012, Lecture Notes in Computer Science, 2012, Volume 7417/2012, 273-293, DOI: 10.1007/978-3-642-32009-5_17 [Full_Version]

On the Fragility and Limitations of Current Browser-provided Clickjacking Protection Schemes

2012 - Sebastian Lekies, Mario Heiderich, Dennis Appelt, Thorsten Holz, Martin Johns

6th USENIX Workshop on Offensive Technologies (WOOT), Bellevue, WA, August 2012 [PDF]
Page: