Information Security Theory and Practice

Maryline Laurent, Thanassis Giannetsos

► To cite this version:

Maryline Laurent, Thanassis Giannetsos. Information Security Theory and Practice: 13th IFIP WG 11.2 International Conference, WISTP 2019, Paris, France, December 11-12, 2019, Proceedings. Springer, LNCS-12024, pp.(X-253), 2020, Lecture Notes in Computer Science, 978-3-030-41701-7. 10.1007/978-3-030-41702-4. hal-03173895

HAL Id: hal-03173895

https://inria.hal.science/hal-03173895

Submitted on 18 Mar 2021

**HAL** is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Founding Editors

Gerhard Goos

Karlsruhe Institute of Technology, Karlsruhe, Germany

Juris Hartmanis

Cornell University, Ithaca, NY, USA

Editorial Board Members

Elisa Bertino

Purdue University, West Lafayette, IN, USA

Wen Gao

Peking University, Beijing, China

Bernhard Steffen

TU Dortmund University, Dortmund, Germany

Gerhard Woeginger

RWTH Aachen, Aachen, Germany

Moti Yung

Columbia University, New York, NY, USA
More information about this series at http://www.springer.com/series/7410
Maryline Laurent · Thanassis Giannetsos (Eds.)

Information Security
Theory and Practice

13th IFIP WG 11.2 International Conference, WISTP 2019
Paris, France, December 11–12, 2019
Proceedings

<figure><img src="image_2.png" /></figure>

Springer
Editors

Maryline Laurent
Telecom SudParis
Evry, France

Thanassis Giannetsos
Technical University of Denmark
Lyngby, Denmark

ISSN 0302-9743
Lecture Notes in Computer Science

ISBN 978-3-030-41701-7

https://doi.org/10.1007/978-3-030-41702-4

LNCS Sublibrary: SL4 - Security and Cryptology

© IFIP International Federation for Information Processing 2020

This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed.

The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use.

The publisher, the authors and the editors are safe to assume that the advice and information in this book are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or the editors give a warranty, expressed or implied, with respect to the material contained herein or for any errors or omissions that may have been made. The publisher remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

This Springer imprint is published by the registered company Springer Nature Switzerland AG
The registered company address is: Gewerbestrasse 11, 6330 Cham, Switzerland
# Preface

It was our great pleasure to organize the 13th International Conference on Information Security Theory and Practice (WISTP 2019), held December 2019 at Conservatoire National des Arts et Métiers (CNAM) in Paris, France. This year marked the 13th edition of the conference, and we were thrilled to continue fostering collaboration among researchers and practitioners to discuss the various facets of cyber- and information-security. WISTP covers a wide range of topics on theoretical and practical aspects of security and privacy, as well as experimental studies of fielded systems, and thus benefits the cyber-security community by encouraging the emergence of novel research avenues of the aforementioned areas. The conference considered all complex facets and double-edged sword aspects of the cyber-security ecosystem, in particular, how new security algorithms and technologies can impact the security posture of existing and future ICT systems.

The WISTP 2019 call for papers attracted submissions from 24 countries, from a wide variety of academic and corporate institutions. In total, we received 42 valid submissions, of which 12 papers were selected as full papers and 2 were accepted as short papers after a double-blind review by our Program Committee comprised of 44 members, leading to a full acceptance rate of 28.5% and an overall acceptance rate of 33.3%. These papers cover a wide range of topics on the pressing challenges of security and privacy, including authentication, software security, threats and attacks, post-quantum cryptography, security analysis and proofs, and combining theoretical expertise and practical experiments that rely on emerging technologies (like Blockchain) with direct application of and impact on emerging domains of Internet of Things.

Two papers received extra praise: “Fault Injection Characterization on modern CPUs - From the ISA to the Micro-Architecture” by Thomas Trouchkine, Guillaume Bouffard, and Jessy Clediere received the Best Student Paper Award; and “Threat Analysis of Poisoning Attack against Ethereum Blockchain” by Teppei Sato, Mitsuyoshi Imamura, and Kazumasa Omote received the Best Paper Award.

The program also included two invited talks by David Naccache (ENS, France) on “How to Compartment Secrets - Trust Everybody, but Cut the Cards -” and Pascal Paillier (CryptoExperts, France) on “Homomorphic encryption for deep learning: a revolution in the making.”

Putting together WISTP 2019 was a team effort. We first thank all the authors for the quality of their submissions. We are grateful to the Program Committee who worked very hard in reviewing papers and providing valuable feedback to authors. In addition, we would like to thank the General Chairs, Wojciech Mazurczyk from Warsaw University of Technology (WUT), Poland, and Samia Bouzefrane from Conservatoire National des Arts et Métiers (CNAM), France, for their valuable support and help with the planning and organization of the conference, as well as the Steering Committee, especially Damien Sauveron from the University of Limoges, France, for their
continuous efforts in making the event evolve throughout the years. Finally, special thanks to the Local Organizing Committee, Yulliwas Ameur (CNAM, France), Abou-Bakr Djaker (University of Oran, Algeria), Xiaotian Fu (CNAM, France), Thiziri Saad (CNAM, France), and Mamoudou Sangaré (CNAM, France) for hosting the conference in a beautiful and historical location.

We also want to thank the IDfix project, whose support helped to keep registration fees as low as possible and for providing great prizes to the best paper awards winners, as well as the IFIP WG 11.2: Pervasive Systems Security for their continued confidence in the organization of the WISTP editions.

January 2020

Maryline Laurent

Thanassis Giannetsos
# Organization

## Program Committee Chairs

Maryline Laurent
Thanassis Giannetsos

Télécom SudParis, France
Danmarks Tekniske Universitet, Denmark

## Steering Committee

Angelos Bilas
Olivier Blazy
Konstantinos Markantonakis
Joachim Posegga
Jean-Jacques Quisquater
Damien Sauveron
Chan Yeob Yeun

University of Crete, Greece
University of Limoges, France
Royal Holloway University of London, UK
University of Passau, Germany
Catholic University of Louvain, Belgium
University of Limoges, France
Khalifa University, UAE

## Program Committee

Raja Naeem Akram
Claudio Ardagna
Kadri Benamar
Olivier Blazy
Samia Bouzefrane
Xavier Bultel
Serge Chaumette
Liqun Chen
Céline Chevalier
Emmanuel Conchon
Mauro Conti
Gabriele Costa
Tassos Dimitriou
Ruggero Donida Labati
Sara Foresti
Thanassis Giannetsos
Johann Groszschaedl
Yong Guan
Nesrine Kaaniche
Süleyman Karda
Mehmet Sabir Kiraz
Ioannis Krontiris
Andrea Lanzi
Albert Levi

Royal Holloway University of London, UK
University of Milan, Italy
University of Tlemcen, Algeria
University of Limoges, France
Conservatoire National des Arts et Métiers, France
University of Auvergne, France
University of Bordeaux, France
University of Surrey, UK
University of Pantheon-Assas Paris II, France
University of Limoges, France
University of Padua, Italy
IMT Lucca, Italy
Computer Technology Institute, Greece
University of Milan, Italy
University of Milan, Italy
Danmarks Tekniske Universitet, Denmark
University of Luxembourg, Luxembourg
Iowa State University, USA
The University of Sheffield, UK
Batman University, Turkey
De Montfort University, UK
Huawei Technologies, Germany
University of Milan, Italy
Sabanci University, Turkey
<table><tr><td>Olivier Levillain</td><td>Télécom SudParis, France</td></tr><tr><td>Javier Lopez</td><td>NICS Lab, Spain</td></tr><tr><td>Sjouke Mauw</td><td>University of Luxembourg, Luxembourg</td></tr><tr><td>Keith Mayes</td><td>Royal Holloway University of London, UK</td></tr><tr><td>Alessio Merlo</td><td>University of Genoa, Italy</td></tr><tr><td>Antonios Michalas</td><td>Tampere University of Technology, Finland</td></tr><tr><td>Jiaxin Pan</td><td>Norwegian University of Science and Technology, Norway</td></tr><tr><td>Joachim Posegga</td><td>University of Passau, Germany</td></tr><tr><td>Kouichi Sakurai</td><td>Kyushu University, Japan</td></tr><tr><td>Pierangela Samarati</td><td>University of Milan, Italy</td></tr><tr><td>Siraj A. Shaikh</td><td>Coventry University, UK</td></tr><tr><td>Dave Singelee</td><td>Catholic University of Louvain, Belgium</td></tr><tr><td>Denis Trcek</td><td>University of Ljubljana, Slovenia</td></tr><tr><td>Umut Uludag</td><td>TUBITAK-BILGEM-UEKAE, Turkey</td></tr><tr><td>Paulo Verissimo</td><td>University of Luxembourg, Luxembourg</td></tr><tr><td>Anjia Yang</td><td>Jinan University, China</td></tr><tr><td>Stefano Zanero</td><td>Politecnico di Milano, Italy</td></tr><tr><td>Gongxuan Zhang</td><td>Nanjing University of Science and Technology, China</td></tr></table>

## Additional Reviewers

<table><tr><td>Angèle Bossuat</td><td>Eleonora Losiouk</td></tr><tr><td>Stefano Cecconello</td><td>Shahid Mahmood</td></tr><tr><td>Luca Demetrio</td><td>Ameer Mohammed</td></tr><tr><td>Atif Hussain</td><td>Paolo Montesel</td></tr><tr><td>Elif Bilge Kavun</td><td>Enrico Russo</td></tr><tr><td>Rhys Kirk</td><td>Korbinian Spielvogel</td></tr><tr><td>Felix Klement</td><td>Federico Turrin</td></tr><tr><td>Huimin Lao</td><td>Andrea Valenza</td></tr><tr><td>Yuxian Li</td><td>Axin Wu</td></tr><tr><td>Stefano Longari</td><td>Yuriy Zacchia Lun</td></tr></table>

## Sponsor

<figure><img src="image_3.png" /></figure>
<table><tr><td>A Template-Based Method for the Generation of Attack Trees<br>Jeremy Bryans, Lin Shen Liew, Hoang Nga Nguyen,<br>Giedre Sabaliauskaitė, Siraj Shaikh, and Fengjun Zhou</td><td>155</td></tr></table>

## Cybersecurity

<table><tr><td>Analysis of QUIC Session Establishment and Its Implementations.<br>Eva Gagliardi and Olivier Levillain</td><td>169</td></tr></table>

<table><tr><td>CompactFlow: A Hybrid Binary Format for Network Flow Data.<br>Michal Piskozub, Riccardo Spolaor, and Ivan Martinovic</td><td>185</td></tr></table>

<table><tr><td>SSI-AWARE: Self-sovereign Identity Authenticated Backup<br>with Auditing by Remote Entities<br>Philipp Jakubeit, Albert Dercksen, and Andreas Peter</td><td>202</td></tr></table>

## Internet of Things

<table><tr><td>Automated Security Analysis of IoT Software Updates<br>Nicolas Dejon, Davide Caputo, Luca Verderame, Alessandro Armando,<br>and Alessio Merlo</td><td>223</td></tr></table>

<table><tr><td>Towards a Context-Aware Security and Privacy as a Service<br>in the Internet of Things<br>Tidiane Sylla, Mohamed Aymen Chalouf, Francine Krief,<br>and Karim Samaké</td><td>240</td></tr></table>

<table><tr><td>Author Index</td><td>253</td></tr></table>