Joseph Kilcullen

2papers

2 Papers

CRNov 27, 2015
Authentication Based Solutions to Counterfeiting of Manufactured Goods

Joseph Kilcullen

Counterfeiting of manufactured goods is presented as the theft of intellectual property, patents, copyright etc. accompanied by identity theft. The purpose of the identity theft is to facilitate the intellectual property theft. Without it the intellectual property theft would be obvious and the products would be confiscated and destroyed. Authentication solutions, to prevent identity theft, were then developed for the two categories of manufactured goods i.e. goods which can be subjected to destructive screening strategies and goods which cannot e.g. pharmaceutical drugs and currencies, respectively. The solutions developed were found to be analogous to digital signatures. Tamper proof packaging on pharmaceutical drugs is analogous to encryption because it prevents Mallory from interfering with the product. Breaking the tamper proof packaging is a one-way function. Concealed inside the packaging a one-time password, which can be used to authenticate the product over the internet. The name of the authentication website must be common knowledge, just like a public key for authenticating digital signatures. Otherwise the counterfeiters will specify their own authentication website. This solution can be altered for currencies i.e. the one-way function, equivalent to opening the tamper proof packaging, becomes the method of manufacture of the currency.

CRNov 12, 2015
The Game of Phishing

Joseph Kilcullen

The current implementation of TLS involves your browser displaying a padlock, and a green bar, after successfully verifying the digital signature on the TLS certificate. Proposed is a solution where your browser's response to successful verification of a TLS certificate is to display a login window. That login window displays the identity credentials from the TLS certificate, to allow the user to authenticate Bob. It also displays a 'user-browser' shared secret i.e. a specific picture from your hard disk. This is not SiteKey, the image is shared between the computer user and their browser. It is never transmitted over the internet. Since sandboxed websites cannot access your hard disk this image cannot be counterfeited by phishing websites. Basically if you view the installed software component of your browser as an actor in the cryptography protocol, then the solution to phishing attacks is classic cryptography, as documented in any cryptography textbook.