Nadia Heninger

Nadia Heninger is an American cryptographer, computer security expert, and computational number theorist at the University of Pennsylvania.[1]

Contributions

Heninger is known for her work on freezing powered-down security devices to slow their fading memories and allow their secrets to be recovered via a cold boot attack,[2][A] for her discovery that weak keys for the RSA cryptosystem are in widespread use by internet routers and other embedded devices,[3][B] for her research on how failures of forward secrecy in bad implementations of the Diffie–Hellman key exchange may have allowed the National Security Agency to decrypt large amounts of internet traffic via the Logjam vulnerability,[4][C] and for the DROWN attack, a weakness in internet servers that can let attackers force them to use an old and weak cryptographic protocol.[5][D]

Heninger's other research contributions include an analysis of the strength of the RSA cryptosystem against quantum computers,[6] an attack on implementations of the ANSI X9.31 cryptographically secure pseudorandom number generator that use hard-coded seed keys to initialize the generator,[7] and the discovery of a side-channel attack against some versions of the libgcrypt cryptography library.[8]

Education and career

Heninger graduated from the University of California, Berkeley in 2004, with a bachelor's degree in electrical engineering and computer science.[9] She completed her doctorate in 2011 at Princeton University; her dissertation, Error Correction and the Cryptographic Key, was supervised by Bernard Chazelle.[9][10] After postdoctoral research at the University of California, San Diego and Microsoft Research in New England, she became Magerman Term Assistant Professor at the University of Pennsylvania in 2013.

Recognition

Heninger's work on weak keys and on forward secrecy of Diffie–Hellman won best paper awards at the conferences at which they were presented, as have several of Heninger's other publications.[9] She is one of the 2016 recipients of the Applied Networking Research Prize of the Internet Research Task Force.[11]

She was an invited speaker at Asiacrypt 2016, speaking on "The reality of cryptographic deployments on the internet".[12]

Selected publications

A.Halderman, J. Alex; Schoen, Seth D.; Heninger, Nadia; Clarkson, William; Paul, William; Calandrino, Joseph A.; Feldman, Ariel J.; Appelbaum, Jacob; Felten, Edward W. (May 2009), "Lest we remember: Cold-boot attacks on encryption keys", Communications of the ACM, 52 (5): 91–98, doi:10.1145/1506409.1506429
B.Heninger, Nadia; Durumeric, Zakir; Wustrow, Eric; Halderman, J. Alex (2012), "Mining your Ps and Qs: Detection of widespread weak keys in network devices" (PDF), Proceedings of the 21st USENIX Conference on Security Symposium (Security'12), Berkeley, CA, USA: USENIX Association, pp. 35:1–35:16
C.Adrian, David; Bhargavan, Karthikeyan; Durumeric, Zakir; Gaudry, Pierrick; Green, Matthew; Halderman, J. Alex; Heninger, Nadia; Springall, Drew; Thomé, Emmanuel; Valenta, Luke; VanderSloot, Benjamin; Wustrow, Eric; Zanella-Béguelin, Santiago; Zimmermann, Paul (2015), "Imperfect forward secrecy: How Diffie-Hellman fails in practice", Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security (CCS '15), New York, NY, USA: ACM, pp. 5–17, doi:10.1145/2810103.2813707, ISBN 978-1-4503-3832-5
D.Aviram, Nimrod; Schinzel, Sebastian; Somorovsky, Juraj; Heninger, Nadia; Dankel, Maik; Steube, Jens; Valenta, Luke; Adrian, David; Halderman, J. Alex; Dukhovni, Viktor; Käsper, Emilia; Cohney, Shaanan; Engels, Susanne; Paar, Christof; Shavitt, Yuval (August 2016), "DROWN: Breaking TLS with SSLv2" (PDF), 25th USENIX Security Symposium

References

  1. ↑ Rosenbloom, Stephanie (June 4, 2014), "How not to pay the price for free Wi-Fi", The New York Times
  2. ↑ Mills, Elinor (July 30, 2008), Disk encryption is no silver bullet, researchers say: Researchers tell how to steal disk encryption key and sensitive data off memory in laptops in cold-boot attack on hibernating computer, CNET
  3. ↑ Leyden, John (February 16, 2012), "'Predictably random' public keys can be cracked - crypto boffins: Battling researchers argue over whether you should panic", The Register
  4. ↑ Doctorow, Cory (October 16, 2015), "Now we know the NSA blew the black budget breaking crypto, how can you defend yourself?", Boing Boing
  5. ↑ Mott, Nathaniel (March 2, 2016), "Drown attack: how weakened encryption jeopardizes 'secure' sites: Researchers warn sites such as Yahoo, BuzzFeed and Flickr would be susceptible to attack, and credit card info, passwords and other data could be compromised", The Guardian
  6. ↑ Kim, Mark H. (May 15, 2017), "Why quantum computers might not break cryptography", Quanta Magazine
  7. ↑ Chirgwin, Richard (October 25, 2017), "Holy DUHK! Boffins name bug that could crack crypto wide open: Hard-coded keys and pseudorandom numbers flay Fortinet first, other vendors probably also in play", The Register
  8. ↑ Chirgwin, Richard (July 4, 2017), "GnuPG crypto library cracked, look for patches: Boffins bust libgcrypt via side-channel", The Register
  9. 1 2 3 Curriculum vitae (PDF), University of Pennsylvania, retrieved 2018-09-18
  10. ↑ Nadia Heninger at the Mathematics Genealogy Project
  11. ↑ Applied Networking Research Prize, Internet Research Task Force, retrieved 2018-09-18
  12. ↑ "Program", Asiacrypt 2016, retrieved 2018-09-18
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.