Search

Item does not contain fulltext EvoApplications 2023

Item does not contain fulltext

Lists, multisets and partitions are fundamental datatypes in mathematics and computing. There are basic transformations from lists to multisets (called "accumulation") and also from lists to partitions (called "matching"). We show how these transformations arise systematically by forgetting/abstracting away certain aspects of information, namely order (transposition) and identity (substitution). Our main result is that suitable restrictions of these transformations are isomorphisms: This reveals fundamental correspondences between elementary datatypes. These restrictions involve "incremental" lists/multisets and "non-crossing" partitions/lists. While the process of forgetting information can be precisely spelled out in the language of category theory, the relevant constructions are very combinatorial in nature. The lists, partitions and multisets in these constructions are counted by Bell numbers and Catalan numbers. One side-product of our main result is a (terminating) rewriting system that turns an arbitrary partition into a non-crossing partition, without improper nestings., LIPIcs, Vol. 252, 31st EACSL Annual Conference on Computer Science Logic (CSL 2023), pages 28:1-28:15

Contains fulltext : 292103.pdf (Publisher’s version ) (Closed access) CHI EA '23

Item does not contain fulltext 03 april 2023

Contains fulltext : 292052.pdf (Publisher’s version ) (Closed access) 13 april 2023

Contains fulltext : 294211.pdf (Publisher’s version ) (Open Access) Side channels are electronic device interfaces that can unintentionally reveal information about the device's state or processing. They have become a source of vulnerabilities in cryptographic algorithms, leading to side-channel attacks that can compromise sensitive information. Deep learning models have emerged as effective tools for side-channel evaluation due to their ability to interpret side-channel information. However, designing an efficient deep learning network for side-channel attack evaluation requires consideration of various factors, such as network architecture and hyperparameters selection. Furthermore, a single deep learning model cannot evaluate multiple cryptographic implementations, which limits its practicality. To address these challenges, this thesis proposes new processes and methodologies to improve the training process of deep learning models and modify their architecture for side-channel analysis evaluation. The research focuses on integrating Six Sigma methodology, early stopping framework, feature reduction, and transfer learning approaches to enhance the training process. Additionally, new ways to design the architecture of the deep learning model are proposed. The aim is to improve the efficiency of side-channel evaluation by designing deep learning models that can evaluate multiple cryptographic implementations. Radboud University, 06 juli 2023 Promotor : Batina, L. Co-promotores : Armendariz, I., Buhan, I.R. xxxiii, 216 p.

This paper describes an ECC implementation computing the X25519 keyexchange protocol on the Arm Cortex-M4 microcontroller. For providing protections against various side-channel and fault attacks we first review known attacks and countermeasures, then we provide software implementations that come with extensive mitigations, and finally we present a preliminary side-channel evaluation. To our best knowledge, this is the first public software claiming affordable protection against multiple classes of attacks that are motivated by distinct real-world application scenarios. We distinguish between X25519 with ephemeral keys and X25519 with static keys and show that the overhead to our baseline unprotected implementation is about 37% and 243%, respectively. While this might seem to be a high price to pay for security, we also show that even our (most protected) static implementation is at least as efficient as widely-deployed ECC cryptographic libraries, which offer much less protection.

competencia digital docente, se centra en el aprendizaje, práctica y uso de la tecnología en la profesión docente. Es una competencia en la que quien forma a otros, pone en juego una serie de capacidades cognitivas, prácticas y actitudinales hacia y para el uso de la tecnología. Su apropiación permite llevar a cabo una práctica en el aula acorde a las necesidades que la sociedad digital exige en la formación de ciudadanos digitalmente responsables. Es considerada un factor clave para la enseñanza y otras funciones docentes, y después de la pandemia del COVID 19 se ha consolidado como pilar fundamental para la educación actual y del futuro. Hasta hace poco, la mayor parte de las investigaciones sobre la competencia digital de futuros docentes o estudiantes de magisterio han estudiado de forma genérica e integradas, las cinco áreas de la competencia digital docente del marco europeo. Esta investigación centra su atención en el área de seguridad como hilo conductor. Adopta un enfoque educativo orientado hacia la apropiación de conocimientos, habilidades y actitudes para un uso más responsable de Internet, como un aspecto clave para mejorar la conciencia y paliar muchos problemas generados por el uso de la tecnología. Su propósito general es acercar y ampliar su conocimiento mediante la evaluación de la competencia digital de futuros docentes en aspectos relacionados con el uso seguro y responsable de Internet. Es una investigación con estudios exploratorios y descriptivos que analizan cómo perciben, conocen, practican y se apropian los futuros docentes de los conocimientos, habilidades y actitudes para mejorar en esta área competencial. Para ello, se utilizan estudios previos, indicadores del marco de la competencia digital docente del Instituto Nacional de Tecnología Educativa para la formación del profesorado (INTEF) de España y de otros marcos de referencia. Para lograr el propósito se realizan cuatro estudios donde participan un total de 824 estudiantes de grados de maestro. A partir de él, se plantean cuatro objetivos concretos, orientados a evaluar la competencia digital sobre el uso seguro y responsable de Internet y a explorar el estado actual de la formación de los futuros profesores en el ámbito de la seguridad digital. Se utiliza un enfoque mixto con diseño e instrumentos tanto cualitativos como cuantitativos. El cumplimiento de objetivos ha dado lugar a una visión de conjunto sobre el tema cuyos resultados publicados se presentan en esta tesis en el formato de agrupación de publicaciones. La primera publicación es una revisión sistemática basada en la declaración Preferred Reporting Items for Systematic Reviewers and Meta-Analyses (PRISMA) con la que se busca identificar la presencia de indicadores de evaluación y estudio relacionados con la seguridad. El análisis de 31 publicaciones seleccionadas en las tres bases de datos científicas más importantes en investigación educativa muestra resultados que permiten confirmar la pertinencia de este estudio y los diferentes enfoques utilizados en trabajos previos para evaluar esta área competencial, que van desde la mera autopercepción de los futuros docentes hasta los diseños de intervención para su formación en este tema. Con un estudio transversal y descriptivo, la segunda publicación evalúa —mediante un cuestionario de diseño propio— la competencia en el área de seguridad de 317 estudiantes de magisterio de España y Portugal. Sus resultados permiten identificar tres niveles competenciales: docentes digitalmente seguros, docentes en riesgo medio y docentes en riesgo digital. Cada uno con características muy particulares en cuanto a los conocimientos, prácticas y actitudes hacia los indicadores relacionados con el uso seguro y responsable de Internet. Aunque la mayoría de los participantes se ubican en el nivel alto en las siete dimensiones, dentro de ellas, se observan diferencias importantes como en protección de la salud, gestión de identidad digital, comportamiento en línea y protección de datos. Los resultados analizados con diferentes análisis estadísticos muestran que el nivel competencial en todos los casos es mejorable y que la formación es una medida necesaria y demandada. De las cuatro dimensiones del área de seguridad de la competencia digital docente (CDD), la protección de datos personales es el tema que desde 2016 ha adquirido mayor atención y ha suscitado más preocupación en el ámbito educativo, en especial por el tratamiento de datos de menores y datos sensibles que se recogen en los centros escolares. Con base en ello, se plantea el objetivo de la tercera publicación. Este estudio basado en un cuestionario creado a propósito, describe los niveles de percepción de riesgo y los conocimientos que los futuros docentes tienen sobre la protección de datos personales en educación. Los resultados muestran, entre otras cosas, una alta percepción de riesgo en prácticas donde los datos personales son expuestos en Internet y además un desconocimiento sobre el tipo de datos de menores y sus familias que pueden compartir y tratar. La falta de formación e información surge como importante conclusión de la que se derivan sugerencias de actuaciones necesarias al respecto. La cuarta publicación plantea el diseño de una intervención educativa que tuvo como propósito general describir la autopercepción de futuros docentes de su competencia en seguridad digital. Ofrece resultados que confirman que, en su mayoría, dicen tener un nivel intermedio tanto los hombres como las mujeres. Por otra parte, en la valoración de su experiencia en el taller, ofrecen opiniones positivas sobre las actividades realizadas, las cuales han permitido reflexionar y experimentar situaciones asociadas a problemas cercanos y conocidos. Incluso quienes manifestaron tener conocimientos y manejo seguro de la tecnología y de Internet reconocieron la necesidad, como futuros educadores, de una mejor formación en este tema. En general, tanto hombres como mujeres manifestaron contar con información y estrategias para afrontar mejor preparados sus futuras prácticas educativas. Los resultados de las cuatro publicaciones llevan a plantear conclusiones sobre la investigación realizada y abrir nuevas líneas de estudio que ampliarán el conocimiento acerca del uso seguro y responsable de Internet en el ámbito de la formación de docentes (que puede ser ampliado a todas las áreas de la educación superior y de la ciudadanía en su conjunto), así como reconocer limitaciones de diferente tipo a la que esta investigación ha estado sujeta., Digital competence in teaching focuses on the learning, practice and use of technology in the teaching profession. It is a competence in which those who train others bring into action a series of cognitive, practical and attitudinal skills towards and for the use of technology. Its appropriation enables classroom practice to be carried out in accordance with the needs that the digital society demands in the training of digitally responsible citizens. It is considered a key factor for teaching and other educational functions, and after the COVID 19 pandemic it has been consolidated as a fundamental pillar for current and future education. Until recently, most research on the digital competence of prospective teachers or student teachers has looked at the five areas of digital competence in the European framework in a generic and integrated way. This research focuses on a little-studied area whose common thread is the security area of digital competence. It adopts an educational approach oriented towards the appropriation of knowledge, skills and attitudes for a more responsible use of the Internet, as a key aspect to improve awareness and alleviate many problems generated by the use of technology. Its general purpose is to approach and expand their knowledge by assessing the digital competence of future teachers in aspects related to the safe and responsible use of the Internet. It is a research with exploratory and descriptive studies that analyse how future teachers perceive, know, practice and appropriate the knowledge, skills and attitudes to improve in this competence area. For this purpose, previous studies, indicators from the framework of digital competence in teaching of the National Institute of Educational Technology for teacher training (INTEF) of Spain and other reference frameworks are used. In order to achieve this purpose, four studies are carried out involving a total of 824 teacher degree students. From it, four specific objectives are set out, aimed at assessing digital competence on safe and responsible use of the Internet and exploring the current state of future teachers’ training in the field of digital safety. A mixed approach with both qualitative and quantitative design and instruments is used. The fulfilment of objectives has resulted in an overview of the topic, the published results of which are presented in this thesis in the format of collection of articles. The first publication is a systematic review based on the Preferred Reporting Items for Systematic Reviewers and Meta-Analyses (PRISMA) statement which seeks to identify the presence of safety-related evaluation and study indicators. The analysis of 31 publications selected from the three most important scientific databases in educational research shows results that confirm the relevance of this research and the different approaches used in previous studies to assess this area of competence, ranging from the mere self-perception of future teachers to intervention designs for their training in this area. With a cross-sectional and descriptive study, the second publication assesses — by means of a questionnaire of its own design — the competence levels of 317 student teachers in Spain and Portugal. The results allow us to identify three levels of competence: digitally safe teachers, teachers at medium risk and teachers at digital risk. Each with very particular characteristics in terms of knowledge, practices and attitudes towards indicators related to safe and responsible use of the Internet. Although most of the participants are at the high level in all seven dimensions, within these dimensions, important differences can be observed, such as in health protection, digital identity management, online behaviour and data protection. The results analysed with different statistical analyses show that the competence level in all cases can be improved and that training is a necessary and demanded measure. Of the four dimensions of the security area of digital competence in teaching (CDD), data protection is the issue that has gained the most attention and concern in the educational field since 2017, especially due to the processing of children’s data and sensitive data collected in schools. The aim of the third publication is based on this. This study based on a purposebuilt questionnaire describes the levels of risk perception and knowledge that prospective teachers have about the protection of personal data in education. The results show, among other things, a high perception of risk in practices where personal data are exposed on the Internet and also a lack of knowledge about the type of data of children and their families that can be shared and processed. The lack of training and information emerges as an important conclusion from which suggestions for necessary actions in this respect are derived. The fourth publication proposes the design of an educational intervention whose general purpose was to describe the self-perception of future teachers of their competence in digital safety. The results confirm that most of them say that both men and women have an intermediate level. On the other hand, in the evaluation of their experience in the workshop, they offer positive opinions about the activities carried out, which have allowed them to reflect on and experience situations associated with close and familiar problems. Even those who reported knowledge and safe use of technology and the Internet recognised the need, as future educators, for better training in this area. In general, both men and women reported having information and strategies and being better prepared for their future educational practices. The results of the four publications lead to conclusions about the research carried out and open up new lines of research that will expand knowledge about the safe and responsible use of the Internet in the field of teacher training (which can be extended to higher education and citizenship as a whole), as well as recognising limitations of different types to which this research has been subject., Tesis Univ. Granada., Ministerio de Educación, Cultura y Deporte del Gobierno de España (Referencia FPU17/05164)

Contains fulltext : 294516.pdf (Publisher’s version ) (Closed access) CSCW '23

A sufficient statistic is a deterministic function that captures an essential property of a probabilistic function (channel, kernel). Being a sufficient statistic can be expressed nicely in terms of string diagrams, as Tobias Fritz showed recently, in adjoint form. This reformulation highlights the role of split idempotents, in the Fisher-Neyman factorisation theorem. Examples of a sufficient statistic occur in the literature, but mostly in continuous probability. This paper demonstrates that there are also several fundamental examples of a sufficient statistic in discrete probability. They emerge after some combinatorial groundwork that reveals the relevant dagger split idempotents and shows that a sufficient statistic is a deterministic dagger epi.

Item does not contain fulltext 10 januari 2023

Item does not contain fulltext 309 p.

Contains fulltext : 289645.pdf (Publisher’s version ) (Open Access) HICSS 2023

Contains fulltext : 293144.pdf (Publisher’s version ) (Open Access) MADWeb 2023

Contains fulltext : 288644.pdf (Publisher’s version ) (Open Access) Human decisions are increasingly supported by decision support systems (DSS). Humans are required to remain "on the loop," by monitoring and approving/rejecting machine recommendations. However, use of DSS can lead to overreliance on machines, reducing human oversight. This paper proposes "reflection machines" (RM) to increase meaningful human control. An RM provides a medical expert not with suggestions for a decision, but with questions that stimulate reflection about decisions. It can refer to data points or suggest counterarguments that are less compatible with the planned decision. RMs think against the proposed decision in order to increase human resistance against automation complacency. Building on preliminary research, this paper will (1) make a case for deriving a set of design requirements for RMs from EU regulations, (2) suggest a way how RMs could support decision-making, (3) describe the possibility of how a prototype of an RM could apply to the medical domain of chronic low back pain, and (4) highlight the importance of exploring an RM’s functionality and the experiences of users working with it. 10 januari 2023 10 p.

В условиях перехода к цифровой экономике возрастает значимость цифровых компе- тенций студенческой молодежи, которые необходимы для дальнейшей профессио- нальной деятельности, безопасного нахождения в цифровой среде. В статье пред- ставлен обзор и систематизация научных подходов, раскрывающих содержание цифровой грамотности. Предложено соотношение научных категорий «цифровая грамотность» и «цифровая компетенция». Конкретными фактами подтверждается использование в обра- зовании цифровых технологий, предполагающих наличиt цифровых компетенций у студен- тов. Установлено, что цифровая грамотность предполагает формирование навыков поиска, анализа, оценки полученной информации; активное использование образовательных плат- форм, цифровых технологий медиабезопасности в цифровой среде. В связи с этим цель авторского исследования заключается в определении уровня формирования цифровых компетенций студентов в системе высшего образования. Научная новизна исследования заключается в теоретическом обосновании содержания цифровой грамотности и система- тизации подходов на основе компетентносного подхода. В данном контексте представляют интерес результаты опроса студентов Тюменского индустриального вуза, направленного на выявление проблем формирования цифровых компетенций в высшей школе. Результа- ты исследования могут служить важным методологическим инструментом в определении групп риска касательно уровня развития цифровых компетенций среди обучающихся, при- менения методов безопасного использования контента, предупреждения распростране- ния деструктивных интернет-практик в студенческой среде., In the context of the transition to a digital economy, the importance of the digital competencies of students, which are necessary for further professional activities and safe presence in the digital environment, is growing. The article presents an overview and systematization of scientific approaches that reveal the content of digital literacy. The ratio of scientific categories «digital literacy» and «digital competence» is proposed. Specific facts confirm the use of digital technologies in education, which implies the presence of digital competencies in students. It has been established that digital literacy involves the formation of skills for searching, analyzing, evaluating the information received; active use of educational platforms, digital media security technologies in the digital environment. In this regard, the purpose of the author’s research is to determine the level of formation of digital competencies of students in the system of higher education. The scientific novelty of the study lies in the theoretical substantiation of the content of digital literacy and the systematization of approaches based on a competency-based approach. In this context, of interest are the results of a survey of students of the Tyumen Industrial University, aimed at identifying problems in the formation of digital competencies in higher education. The results of the study can serve as an important methodological tool in determining risk groups regarding the level of development of digital competencies among students, the application of methods for the safe use of content, and the prevention of the spread of destructive Internet practices among students., ВЕСТНИК СУРГУТСКОГО ГОСУДАРСТВЕННОГО ПЕДАГОГИЧЕСКОГО УНИВЕРСИТЕТА, Выпуск 2 (83) 2023, Pages 102-109

Dynamic searchable symmetric encryption (DSSE) enables users to delegate the keyword search over dynamically updated encrypted databases to an honest-but-curious server without losing keyword privacy. This paper studies a new and practical security risk to DSSE, namely, secret key compromise (e.g., a user's secret key is leaked or stolen), which threatens all the security guarantees offered by existing DSSE schemes. To address this open problem, we introduce the notion of searchable encryption with key-update (SEKU) that provides users with the option of non-interactive key updates. We further define the notion of post-compromise secure with respect to leakage functions to study whether DSSE schemes can still provide data security after the client's secret key is compromised. We demonstrate that post-compromise security is achievable with a proposed protocol called ``Bamboo". Interestingly, the leakage functions of Bamboo satisfy the requirements for both forward and backward security. We conduct a performance evaluation of Bamboo using a real-world dataset and compare its runtime efficiency with the existing forward-and-backward secure DSSE schemes. The result shows that Bamboo provides strong security with better or comparable performance.

Contains fulltext : 293150.pdf (Publisher’s version ) (Open Access)

Contains fulltext : 292083.pdf (Publisher’s version ) (Closed access) Article 162 CHI EA '23

Our thanks go to all the future teachers at the University of Granada (Campus Ceuta, Spain) who selflessly participated in this study by responding to the questionnaire., A key aspect of future teacher training in this highly digitalized period of education requires a specific focus on digital skills, especially in the area of security. This study delves into this issue by means of a quantitative, theoretical and systematic review of future teachers currently in training at the Faculty of Education, Economy and Technology of Ceuta of the University of Granada (Spain). The specific intention is to determine their perception of the instruction they receive on digital matters, concretely on cybersecurity during their phase of pre-service. To carry out the project, the study resorted to a descriptive method by submitting the participants to a specifically designed questionnaire entitled “Digital Security Competence Required for Teachers”. Examinations of the psychometric properties of the questionnaire reveal its relevance and reliability. The intention, after applying descriptive and inferential statistics tests, was to determine whether students in pre-service training really feel competent on digital matters or if they feel need more theoretical-practical training, especially in the area of security. The general findings reveal that future female teachers pursuing a university degree in Early Childhood Education, although competent from the techno-pedagogical viewpoint, indicate that attaining a high level of competence in digital security requires more theoretical and practical training. Future male Primary Education teachers, by contrast, perceive themselves as competent in digital security. This perhaps stems from their training (courses and workshops) in Information and Communication Technologies (ICT) and the theoretical and practical instruction they received at the university during courses or during a practicum. This aspect deserves further research because, as highlighted elsewhere, higher education institutions must prioritize instruction on digital security in their teacher programs., Plan of Initiation to Research accorded by the Vice President of Research and Transfer of the University of Granada

Mobile instant messengers such as WhatsApp use delivery status notifications in order to inform users if a sent message has successfully reached its destination. This is useful and important information for the sender due to the often asynchronous use of the messenger service. However, as we demonstrate in this paper, this standard feature opens up a timing side channel with unexpected consequences for user location privacy. We investigate this threat conceptually and experimentally for three widely spread instant messengers. We validate that this information leak even exists in privacy-friendly messengers such as Signal and Threema. Our results show that, after a training phase, a messenger user can distinguish different locations of the message receiver. Our analyses involving multiple rounds of measurements and evaluations show that the timing side channel persists independent of distances between receiver locations -- the attack works both for receivers in different countries as well as at small scale in one city. For instance, out of three locations within the same city, the sender can determine the correct one with more than 80% accuracy. Thus, messenger users can secretly spy on each others' whereabouts when sending instant messages. As our countermeasure evaluation shows, messenger providers could effectively disable the timing side channel by randomly delaying delivery confirmations within the range of a few seconds. For users themselves, the threat is harder to prevent since there is no option to turn off delivery confirmations., 33 pages, 23 figures, 9 tables, NDSS 2023

Side-channel attacks represent a realistic and serious threat to the security of embedded devices for already almost three decades. A variety of attacks and targets they can be applied to have been introduced, and while the area of side-channel attacks and their mitigation is very well-researched, it is yet to be consolidated. Deep learning-based side-channel attacks entered the field in recent years with the promise of more competitive performance and enlarged attackers’ capabilities compared to other techniques. At the same time, the new attacks bring new challenges and complexities to the domain, making the systematization of knowledge (SoK) even more critical. We first dissect deep learning-based side-channel attacks according to the different phases they can be used in and map those phases to the efforts conducted so far in the domain. For each phase, we identify the weaknesses and challenges that triggered the known open problems. We also connect the attacks to the threat models and evaluate their advantages and drawbacks. Finally, we provide a number of recommendations to be followed in deep learning-based side-channel attacks.

The choice of activation functions can significantly impact the performance of neural networks. Due to an ever-increasing number of new activation functions being proposed in the literature, selecting the appropriate activation function becomes even more difficult. Consequently, many researchers approach this problem from a different angle, in which instead of selecting an existing activation function, an appropriate activation function is evolved for the problem at hand. In this paper, we demonstrate that evolutionary algorithms can evolve new activation functions for side-channel analysis (SCA), outperforming ReLU and other activation functions commonly applied to that problem. More specifically, we use Genetic Programming to define and explore candidate activation functions (neuroevolution) in the form of mathematical expressions that are gradually improved. Experiments with the ASCAD database show that this approach is highly effective compared to results obtained with standard activation functions and that it can match the state-of-the-art results from the literature. More precisely, the obtained results for the ASCAD fixed key dataset demonstrate that the evolved activation functions can improve the current state-of-the-art by achieving a guessing entropy of 287 for the Hamming weight model and 115 for the Identity leakage model, compared to 447 and 120 obtained in the literature.

Contains fulltext : 282737.pdf (Author’s version preprint ) (Closed access) SP 2023

Item does not contain fulltext INDOCRYPT 2022

Item does not contain fulltext 17 juni 2023

В статье предложены двенадцать стратегических направлений развития региона в области информационной безопасности, а также проведен анализ цифрового развития Владимирской области как типичного региона России., The article proposes twelve strategic directions for the development of the region in the field of information security, as well as an analysis of the digital development of the Vladimir region as a typical region of Russia., Экономика и предпринимательство, Выпуск 11 (148) 2023, Pages 564-569

Item does not contain fulltext 06 juli 2023

Deep learning is a powerful direction for profiling side-channel analysis as it can break targets protected with countermeasures even with a relatively small number of attack traces. Still, it is necessary to conduct hyperparameter tuning to reach strong attack performance, which can be far from trivial. Besides many options stemming from the machine learning domain, recent years also brought neural network elements specially designed for side-channel analysis. The loss function, which calculates the error or loss between the actual and desired output, is one of the most important neural network elements. The resulting loss values guide the weights update associated with the connections between the neurons or filters of the deep learning neural network. Unfortunately, despite being a highly relevant hyperparameter, there are no systematic comparisons among different loss functions regarding their effectiveness in side-channel attacks. This work provides a detailed study of the efficiency of different loss functions in the SCA context. We evaluate five loss functions commonly used in machine learning and three loss functions specifically designed for SCA. Our results show that an SCA-specific loss function (called CER) performs very well and outperforms other loss functions in most evaluated settings. Still, categorical cross-entropy represents a good option, especially considering the variety of neural network architectures.

Item does not contain fulltext IFIP WG

Item does not contain fulltext EvoCOP 2023

Item does not contain fulltext EUROCRYPT 2023

В статье проводится компаративный анализ развития цифровизации в России, Китае и Южной Корее. Сформулированы основные проблемы цифровизации в контексте глобальной цифровизации и стоящих перед странами задач. Показаны необходимость и возможность сотрудничества между странами в цифровой сфере., The article provides a comparative analysis of the development of digitalization in Russia, China and South Korea. The main problems of digitalization in the context of global digitalization and the challenges facing countries are formulated. The necessity and possibility of cooperation between countries in the digital sphere are shown., Экономика и предпринимательство, Выпуск 3 (152) 2023, Pages 190-192

Item does not contain fulltext EUROCRYPT 2023

Contains fulltext : 292304.pdf (Publisher’s version ) (Closed access)

International audience; The current gold standard of cryptographic software is to write efficient libraries with systematic protections against timing attacks. In order to meet this goal, cryptographic engineers increasingly use high-assurance cryptography tools. These tools guide programmers and provide rigorous guarantees that can be verified independently by library users. However, high-assurance tools reason about overly simple execution models that elide transient execution leakage. Thus, implementations validated by high-assurance cryptography tools remain potentially vulnerable to transient execution attacks such as Spectre or Meltdown. Moreover, proposed countermeasures are not used in practice due to performance overhead. We propose, analyze, implement and evaluate an approach for writing efficient cryptographic implementations that are protected against Spectre v1 attacks. Our approach ensures speculative constant-time, an information flow property which guarantees that programs are protected against Spectre v1. Speculative constant-time is enforced by means of a (valuedependent) information flow type system. The type system tracks security levels depending on whether execution is misspeculating. We implement our approach in the Jasmin framework for high-assurance cryptography, and use it for protecting all implementations of an experimental cryptographic library that includes highly optimized implementations of symmetric primitives, of elliptic-curve cryptography, and of Kyber, a latticebased KEM recently selected by NIST for standardization. The performance impact of our protections is very low; for example, less than 1% for Kyber and essentially zero for X25519.

Cet article propose une analyse de la résistance et de l’adaptation des militants des ONG de défense des droits humains et des journalistes indépendants à la progressive souverainisation de l’Internet en Russie. Nous cherchons à comprendre comment évoluent les représentations et les pratiques de sécurité numérique de ces acteurs, ainsi que le rôle joué dans ces redéfinitions par les experts en sécurité numérique. Nous montrerons comment et en quoi l’écosystème des formations en sécurité numérique tel qu’il s’est formé depuis les années 2010 se trouve perturbé sous l’effet dissociatif des mesures stigmatisantes et répressives des autorités russes. Dépassant leur attitude ordinaire vis-à-vis de la sécurité (dont l’extrême se résume par un « je n’ai rien à cacher ») ces militants, aidés par leurs formateurs, sont amenés à une prise de conscience, moyennant une série d’incidents parfois traumatisants, d’un danger plus réel que jamais émanant des autorités russes. Face à de nouveaux défis, notamment liés aux classements stigmatisants en tant qu’ « agent de l’étranger » ou « organisation indésirable », ainsi qu’à l’exil massif, les pratiques de sécurité se réorganisent, des outils autrefois considérés comme fiables sont mis en doute. Des débats, quant à l’anonymat et au recueil de données, animent des communautés en voie de reconstitution. This article proposes an analysis of the resistance and adaptation of human rights NGO activists and independent journalists to the progressive sovereignization of the Internet in Russia. We try to understand how the representations and practices of digital security of these actors are evolving, as well as the role played in these by digital security « experts ». We will show how and in which way the ecosystem of digital security trainings as it has been formed since the 2010s is being disrupted under the dissociative effect of the stigmatizing and repressive measures of the Russian authorities. Overcoming their ordinary attitude towards security (the ultimate one being « I have nothing to hide »), these activists, helped by their trainers, are becoming aware, through a series of sometimes traumatic incidents, of a more real danger than ever emanating from the Russian Leviathan. In the face of new challenges, including stigmatizing classifications as « foreign agents » or « undesirable organizations », as well as mass exile, security practices are being reorganized, and tools once considered reliable are being questioned. Debates about anonymity and data collection arise in rebuilding communities.

Contains fulltext : 288628.pdf (Publisher’s version ) (Closed access)

Purpose Nascent firms and startups are often subject to challenges that their more mature counterparts can avoid. While cybersecurity is an issue that all firms contend with, it is especially challenging for new entrepreneurial ventures who lack the resources and capabilities of established firms. The purpose of this paper is to seek to delve deeper into the cybersecurity and risk management needs of small firms and startups. Design/methodology/approach Extant literature and available tools are explored to develop a usable framework applicable to small firms and new entrepreneurial ventures. Findings The liabilities of newness and smallness make entrepreneurial ventures a unique context in which to study the significance of cybersecurity and data privacy risk management. The authors offer an overview of issues and potential solutions relevant to entrepreneurial ventures. Research limitations/implications While offering practical insights, the work is a theoretical framework. The framework will enable researchers to develop more nuanced theory when it comes to cybersecurity and data privacy risk management. Practical implications The framework illustrates four distinct contexts for cybersecurity and risk management when it comes to the needs of small firms and startups. Adoption levels are explained, and small business operators and entrepreneurs can thus use the framework to determine the most appropriate approach for their enterprise. Originality/value The authors develop a framework illustrating adoption of different security and risk management practices by entrepreneurial ventures based on their specific needs and context. The authors thus offer practical solutions for startups and nascent firms regarding cybersecurity and privacy management.

Tibet is one of the most restrictive places in the world for press freedom, with information online and offline tightly controlled and censored by the Chinese government. Foreign correspondents are restricted from travelling to and reporting in Tibetan areas, while Tibetans who act as sources are often persecuted. Despite this level of repression, Tibetans still find ways to tell the rest of the world what is happening in Tibet. This paper explores how it is possible to authoritatively report on events in one of the world’s most restrictive places for press freedom. Instead of relying on a single individual or news organisation, we find that reporting is conducted through journalistic networks consisting of sources in Tibet, Tibetan exile journalists, and source intermediaries called ‘communicators’. Based on fieldwork and semi-structured interviews with Tibetan journalists and communicators we explore how they develop and maintain journalistic authority, while being in exile and having to deal with severe constraints to press freedom.

Digital currency is primarily designed on problems that are computationally hard to solve using traditional computing techniques. However, these problems are now vulnerable due to the computational power of quantum computing. For the postquantum computing era, there is an immense need to reinvent the existing digital security measures. Problems that are computationally hard for any quantum computation will be a possible solution to that. This research summarizes the current security measures and how the new way of solving hard problems will trigger the future protection of the existing digital currency from the future quantum threat.

In this paper, we study the gate depth complexity of (vectorial) Boolean functions in the basis of {NAND, NOR, INV} as a new metric, called latency complexity, to mathematically measure the latency of Boolean functions. We present efficient algorithms to find all Boolean functions with low-latency complexity, or to determine the latency complexity of the (vectorial) Boolean functions, and to find all the circuits with the minimum latency complexity for a given Boolean function. Then, we present another algorithm to build bijective S-boxes with low-latency complexity which with respect to the computation cost, this algorithm overcomes the previous methods of building S-boxes.As a result, for latency complexity 3, we present n-bit S-boxes of 3 ≤ n ≤ 8 with linearity 2n−1 and uniformity 2n−2 (except for 5-bit S-boxes for whose the minimum achievable uniformity is 6). Besides, for latency complexity 4, we present several n-bit S-boxes of 5 ≤ n < 8 with linearity 2n−2 and uniformity 2n−4.

Contains fulltext : 288631.pdf (Publisher’s version ) (Closed access) FDTC 2022

Azerbaijan is an authoritarian regime, whose government maintains a tight grip over the media landscape. Independent and opposition media are regularly persecuted, with journalists and their family members intimidated by law enforcement agencies via arrests, beating, threats and other forms of persecution. Defamation is considered a criminal offence. This paper addresses the impact of this restrictive media environment on reporting about Azerbaijan. As scores of journalists have fled the country in search of safety, a community of exiled journalists has emerged and a number of news media websites operate in exile. Together they continue reporting on Azerbaijan with the help of a handful of journalists remaining on the ground. This paper explores how reporting on Azerbaijan continues despite a highly restricted media environment and what this means for other media systems facing authoritarian rule.

In 2020, a Dutch court passed judgment in a case about a digital welfare fraud detection system called Systeem Risico Indicatie (SyRI). The court ruled that the SyRI legislation is unlawful because it does not comply with the right to privacy under the European Convention of Human Rights. In this article we analyse the judgment and its implications. This ruling is one of first in which a court has invalidated a welfare fraud detection system for breaching the right to privacy. We show that the immediate effects of the judgment are limited. The judgment does not say much about automated fraud detection systems in general, because it is limited to the circumstances of the case. Still, the judgment is important. The judgment reminds policymakers that fraud detection must happen in a way that respects data protection principles and the right to privacy. The judgment also confirms the importance of transparency if personal data are used.

In April 2021, the European Commission proposed a Regulation on Artificial Intelligence, known as the AI Act. We present an overview of the Act and analyse its implications, drawing on scholarship ranging from the study of contemporary AI practices to the structure of EU product safety regimes over the last four decades. Aspects of the AI Act, such as different rules for different risk-levels of AI, make sense. But we also find that some provisions of the Draft AI Act have surprising legal implications, whilst others may be largely ineffective at achieving their stated goals. Several overarching aspects, including the enforcement regime and the risks of maximum harmonisation pre-empting legitimate national AI policy, engender significant concern. These issues should be addressed as a priority in the legislative process.

This study was partly funded by the autonomous city of Melilla, Spain, through PROMESA and the UGR-Enterprise Foundation., The Spanish autonomous city of Melilla, located in northwest Africa, has one of the highest academic failure and abandonment rates in Europe. An effective way to improve this situation would be to improve students’ digital competence. In order to do so, teachers must have competent digital skills themselves and also be able to teach them. To determine teachers’ level of digital competence, the Spanish adaptation of the European Framework for Digital Competence of Educators was used to analyse the self-assessment responses of teachers in training at the Faculty of Education and Sport Sciences in Melilla, Spain. Several quantitative techniques were used to analyse data collected from a questionnaire based on the items in the framework. Indicators were given to each competence using a factor analysis to contrast differences between undergraduate and postgraduate students. Correlations between some of the students’ characteristics and the competences were estimated using OLS. The results show students’ self-assessment level of digital competence in different areas and differences between the bachelor’s and master’s programmes. Digital competence gaps were also detected in teacher training, especially in security. The conclusions highlight the need to improve digital security and facilitate a higher level of digital skills in line with the framework. Indeed, more hours of training in digital competence are required while taking into account the educational context and the technological, pedagogical and content knowledge needed to teach. Equally, the same skills must be developed by educators in order for them to transmit digital competence to their students and support them in educational centres., autonomous city of Melilla, Spain, through PROMESA, UGR-Enterprise Foundation