Cookies
O website necessita de alguns cookies e outros recursos semelhantes para funcionar. Caso o permita, o INESC TEC irá utilizar cookies para recolher dados sobre as suas visitas, contribuindo, assim, para estatísticas agregadas que permitem melhorar o nosso serviço. Ver mais
Aceitar Rejeitar
  • Menu
Sobre

Sobre

Sou Professor Auxiliar no Departamento de Ciência de Computadores da Faculdade de Ciências da Universidade do Porto (DCC-FCUP) e investigador do HASLab/INESC TEC. Os meus interesses de investigação centram-se na Criptografia e Segurança da Informação e na sua intersecção com a Verificação de Programas.

Sou Doutorado em Electrical and Electronic Engineering pela Newcastle University, e licenciado em Engenharia Electrotécnica e de Computadores pela FEUP. Fui investigador visitante na University of Bristol, IT Porto e na École Normale Supérieure.

Trabalho no desenvolvimento de software criptográfico confiável há 10 anos, com o objectivo de estabelecer uma ligação entre a segurança teórica e a segurança de aplicações reais. Interesso-me particularmente pela segurança demonstrável e a sua ligação à verificação formal de provas de segurança e de implementações de software criptográfico.

Para informação sobre a minha investigação, projectos e publicações, por favor consultar a minha página no HASLab.

Para informação sobre as minhas actividades de ensino, por favor consultar a minha página institucional na FCUP.

Tópicos
de interesse
Detalhes

Detalhes

  • Nome

    Manuel Barbosa
  • Desde

    01 novembro 2011
007
Publicações

2024

Bare PAKE: Universally Composable Key Exchange from Just Passwords

Autores
Barbosa, M; Gellert, K; Hesse, J; Jarecki, S;

Publicação
ADVANCES IN CRYPTOLOGY - CRYPTO 2024, PT II

Abstract
In the past three decades, an impressive body of knowledge has been built around secure and private password authentication. In particular, secure password-authenticated key exchange (PAKE) protocols require only minimal overhead over a classical Diffie-Hellman key exchange. PAKEs are also known to fulfill strong composable security guarantees that capture many password-specific concerns such as password correlations or password mistyping, to name only a few. However, to enjoy both round-optimality and strong security, applications of PAKE protocols must provide unique session and participant identifiers. If such identifiers are not readily available, they must be agreed upon at the cost of additional communication flows, a fact which has been met with incomprehension among practitioners, and which hindered the adoption of provably secure password authentication in practice. In this work, we resolve this issue by proposing a new paradigm for truly password-only yet securely composable PAKE, called bare PAKE. We formally prove that two prominent PAKE protocols, namely CPace and EKE, can be cast as bare PAKEs and hence do not require pre-agreement of anything else than a password. Our bare PAKE modeling further allows to investigate a novel reusability property of PAKEs, i.e., whether n(2) pairwise keys can be exchanged from only n messages, just as the Diffie-Hellman non-interactive key exchange can do in a public-key setting. As a side contribution, this add-on property of bare PAKEs leads us to observe that some previous PAKE constructions relied on unnecessarily strong, reusable building blocks. By showing that non-reusable tools suffice for standard PAKE, we open a new path towards round-optimal post-quantum secure password-authenticated key exchange.

2024

C'est très CHIC: A compact password-authenticated key exchange from lattice-based KEM

Autores
Arriaga, A; Barbosa, M; Jarecki, S; Skrobot, M;

Publicação
IACR Cryptol. ePrint Arch.

Abstract

2024

X-Wing: The Hybrid KEM You've Been Looking For

Autores
Barbosa, M; Connolly, D; Duarte, JD; Kaiser, A; Schwabe, P; Varner, K; Westerbaan, B;

Publicação
IACR Cryptol. ePrint Arch.

Abstract

2024

Formally Verifying Kyber Episode V: Machine-Checked IND-CCA Security and Correctness of ML-KEM in EasyCrypt

Autores
Almeida, JB; Olmos, SA; Barbosa, M; Barthe, G; Dupressoir, F; Grégoire, B; Laporte, V; Lechenet, JC; Low, C; Oliveira, T; Pacheco, H; Quaresma, M; Schwabe, P; Strub, PY;

Publicação
ADVANCES IN CRYPTOLOGY - CRYPTO 2024, PT II

Abstract
We present a formally verified proof of the correctness and IND-CCA security of ML-KEM, the Kyber-based Key Encapsulation Mechanism (KEM) undergoing standardization by NIST. The proof is machine-checked in EasyCrypt and it includes: 1) A formalization of the correctness (decryption failure probability) and IND-CPA security of the Kyber base public-key encryption scheme, following Bos et al. at Euro S&P 2018; 2) A formalization of the relevant variant of the Fujisaki-Okamoto transform in the Random Oracle Model (ROM), which follows closely (but not exactly) Hofheinz, Hovelmanns and Kiltz at TCC 2017; 3) A proof that the IND-CCA security of the ML-KEM specification and its correctness as a KEM follows from the previous results; 4) Two formally verified implementations of ML-KEM written in Jasmin that are provably constant-time, functionally equivalent to the ML-KEM specification and, for this reason, inherit the provable security guarantees established in the previous points. The top-level theorems give self-contained concrete bounds for the correctness and security of ML-KEM down to (a variant of) Module-LWE. We discuss how they are built modularly by leveraging various EasyCrypt features.

2023

Rogue key and impersonation attacks on FIDO2: From theory to practice

Autores
Barbosa, M; Cirne, A; Esquível, L;

Publicação
18TH INTERNATIONAL CONFERENCE ON AVAILABILITY, RELIABILITY & SECURITY, ARES 2023

Abstract
FIDO2 is becoming a defacto standard for passwordless authentication. Using FIDO2 and WebAuthn, web applications can enable users to associate cryptographic credentials to their profiles, and then rely on an external authenticator (e.g., a hardware token plugged into the USB port) to perform strong signature-based authentication when accessing their accounts. The security of FIDO2 has been theoretically validated, but these analyses follow the threat model adopted in the FIDO2 design and explicitly exclude some attack vectors as being out of scope. In this paper we show that two of these attacks, which appear to be folklore in the community, are actually straightforward to launch in practice (user PIN extraction, impersonation and rogue key registration). We demonstrate a deployment over vanilla Linux distributions and commercial FIDO2 authenticators. We discuss the potential impact of our results, which we believe will contribute to the improvement of future versions of the protocol.