The Experts below are selected from a list of 45 Experts worldwide ranked by ideXlab platform

P. C. Van Oorschot - One of the best experts on this subject based on the ideXlab platform.

  • baton Certificate agility for android s decentralized Signing infrastructure
    Wireless Network Security, 2014
    Co-Authors: David Barrera, Daniel Mccarney, Jeremy Clark, P. C. Van Oorschot
    Abstract:

    Android's trust-on-first-use application Signing model associates developers with a fixed code Signing Certificate, but lacks a mechanism to enable transparent key updates or Certificate renewals. The model allows application updates to be recognized as authorized by a party with access to the original Signing key. However, changing keys or Certificates requires that end users manually uninstall/reinstall apps, losing all non-backed up user data. In this paper, we show that with appropriate OS support, developers can securely and without user intervention transfer Signing authority to a new Signing key. Our proposal, Baton, modifies Android's app installation framework enabling key agility while preserving backwards compatibility with current apps and current Android releases. Baton is designed to work consistently with current UID sharing and signature permission requirements. We discuss technical details of the Android-specific implementation, as well as the applicability of the Baton protocol to other decentralized environments.

  • WISEC - Baton: Certificate agility for android's decentralized Signing infrastructure
    Proceedings of the 2014 ACM conference on Security and privacy in wireless & mobile networks - WiSec '14, 2014
    Co-Authors: David Barrera, Daniel Mccarney, Jeremy Clark, P. C. Van Oorschot
    Abstract:

    Android's trust-on-first-use application Signing model associates developers with a fixed code Signing Certificate, but lacks a mechanism to enable transparent key updates or Certificate renewals. The model allows application updates to be recognized as authorized by a party with access to the original Signing key. However, changing keys or Certificates requires that end users manually uninstall/reinstall apps, losing all non-backed up user data. In this paper, we show that with appropriate OS support, developers can securely and without user intervention transfer Signing authority to a new Signing key. Our proposal, Baton, modifies Android's app installation framework enabling key agility while preserving backwards compatibility with current apps and current Android releases. Baton is designed to work consistently with current UID sharing and signature permission requirements. We discuss technical details of the Android-specific implementation, as well as the applicability of the Baton protocol to other decentralized environments.

  • Baton: Key Agility for Android without a Centralized Certificate Infrastructure
    2013
    Co-Authors: David Barrera, Daniel Mccarney, Jeremy Clark, P. C. Van Oorschot
    Abstract:

    Android’s trust-on-first-use application Signing model associates developers with a fixed Signing key, but lacks a mechanism to transparently update the key or renew their Signing Certificate. As an advantage, this feature allows application updates to be recognized as authorized by a party with access to the original Signing key. Changing keys or Certificates requires that end-users manually uninstall/reinstall apps, losing all non-backed up user data. In this paper, we show that with appropriate OS support, developers can securely and without user intervention transfer Signing authority to a new Signing key. Our proposal, Baton, modifies Android’s app installation framework enabling key agility while preserving backwards compatibility with current apps and current Android releases. Baton is designed to work consistently with current UID sharing and signature permission requirements. We discuss the technical changes made to Android, and remaining open issues such as key loss and Signing authority revocation on Android.

David Barrera - One of the best experts on this subject based on the ideXlab platform.

  • Baton: Certificate Agility for Android’s Decentralized Signing Infrastructure
    2016
    Co-Authors: David Barrera, Daniel Mccarney, Jeremy Clark, Paul C. Oorschot
    Abstract:

    Android’s trust-on-first-use application Signing model asso-ciates developers with a fixed code Signing Certificate, but lacks a mechanism to enable transparent key updates or cer-tificate renewals. The model allows application updates to be recognized as authorized by a party with access to the original Signing key. However, changing keys or Certificates requires that end users manually uninstall/reinstall apps, losing all non-backed up user data. In this paper, we show that with appropriate OS support, developers can securely and without user intervention transfer Signing authority to a new Signing key. Our proposal, Baton, modifies Android’s app installation framework enabling key agility while pre-serving backwards compatibility with current apps and cur-rent Android releases. Baton is designed to work consistently with current UID sharing and signature permission require-ments. We discuss technical details of the Android-specific implementation, as well as the applicability of the Baton protocol to other decentralized environments

  • baton Certificate agility for android s decentralized Signing infrastructure
    Wireless Network Security, 2014
    Co-Authors: David Barrera, Daniel Mccarney, Jeremy Clark, P. C. Van Oorschot
    Abstract:

    Android's trust-on-first-use application Signing model associates developers with a fixed code Signing Certificate, but lacks a mechanism to enable transparent key updates or Certificate renewals. The model allows application updates to be recognized as authorized by a party with access to the original Signing key. However, changing keys or Certificates requires that end users manually uninstall/reinstall apps, losing all non-backed up user data. In this paper, we show that with appropriate OS support, developers can securely and without user intervention transfer Signing authority to a new Signing key. Our proposal, Baton, modifies Android's app installation framework enabling key agility while preserving backwards compatibility with current apps and current Android releases. Baton is designed to work consistently with current UID sharing and signature permission requirements. We discuss technical details of the Android-specific implementation, as well as the applicability of the Baton protocol to other decentralized environments.

  • WISEC - Baton: Certificate agility for android's decentralized Signing infrastructure
    Proceedings of the 2014 ACM conference on Security and privacy in wireless & mobile networks - WiSec '14, 2014
    Co-Authors: David Barrera, Daniel Mccarney, Jeremy Clark, P. C. Van Oorschot
    Abstract:

    Android's trust-on-first-use application Signing model associates developers with a fixed code Signing Certificate, but lacks a mechanism to enable transparent key updates or Certificate renewals. The model allows application updates to be recognized as authorized by a party with access to the original Signing key. However, changing keys or Certificates requires that end users manually uninstall/reinstall apps, losing all non-backed up user data. In this paper, we show that with appropriate OS support, developers can securely and without user intervention transfer Signing authority to a new Signing key. Our proposal, Baton, modifies Android's app installation framework enabling key agility while preserving backwards compatibility with current apps and current Android releases. Baton is designed to work consistently with current UID sharing and signature permission requirements. We discuss technical details of the Android-specific implementation, as well as the applicability of the Baton protocol to other decentralized environments.

  • Baton: Key Agility for Android without a Centralized Certificate Infrastructure
    2013
    Co-Authors: David Barrera, Daniel Mccarney, Jeremy Clark, P. C. Van Oorschot
    Abstract:

    Android’s trust-on-first-use application Signing model associates developers with a fixed Signing key, but lacks a mechanism to transparently update the key or renew their Signing Certificate. As an advantage, this feature allows application updates to be recognized as authorized by a party with access to the original Signing key. Changing keys or Certificates requires that end-users manually uninstall/reinstall apps, losing all non-backed up user data. In this paper, we show that with appropriate OS support, developers can securely and without user intervention transfer Signing authority to a new Signing key. Our proposal, Baton, modifies Android’s app installation framework enabling key agility while preserving backwards compatibility with current apps and current Android releases. Baton is designed to work consistently with current UID sharing and signature permission requirements. We discuss the technical changes made to Android, and remaining open issues such as key loss and Signing authority revocation on Android.

Jeremy Clark - One of the best experts on this subject based on the ideXlab platform.

  • Baton: Certificate Agility for Android’s Decentralized Signing Infrastructure
    2016
    Co-Authors: David Barrera, Daniel Mccarney, Jeremy Clark, Paul C. Oorschot
    Abstract:

    Android’s trust-on-first-use application Signing model asso-ciates developers with a fixed code Signing Certificate, but lacks a mechanism to enable transparent key updates or cer-tificate renewals. The model allows application updates to be recognized as authorized by a party with access to the original Signing key. However, changing keys or Certificates requires that end users manually uninstall/reinstall apps, losing all non-backed up user data. In this paper, we show that with appropriate OS support, developers can securely and without user intervention transfer Signing authority to a new Signing key. Our proposal, Baton, modifies Android’s app installation framework enabling key agility while pre-serving backwards compatibility with current apps and cur-rent Android releases. Baton is designed to work consistently with current UID sharing and signature permission require-ments. We discuss technical details of the Android-specific implementation, as well as the applicability of the Baton protocol to other decentralized environments

  • baton Certificate agility for android s decentralized Signing infrastructure
    Wireless Network Security, 2014
    Co-Authors: David Barrera, Daniel Mccarney, Jeremy Clark, P. C. Van Oorschot
    Abstract:

    Android's trust-on-first-use application Signing model associates developers with a fixed code Signing Certificate, but lacks a mechanism to enable transparent key updates or Certificate renewals. The model allows application updates to be recognized as authorized by a party with access to the original Signing key. However, changing keys or Certificates requires that end users manually uninstall/reinstall apps, losing all non-backed up user data. In this paper, we show that with appropriate OS support, developers can securely and without user intervention transfer Signing authority to a new Signing key. Our proposal, Baton, modifies Android's app installation framework enabling key agility while preserving backwards compatibility with current apps and current Android releases. Baton is designed to work consistently with current UID sharing and signature permission requirements. We discuss technical details of the Android-specific implementation, as well as the applicability of the Baton protocol to other decentralized environments.

  • WISEC - Baton: Certificate agility for android's decentralized Signing infrastructure
    Proceedings of the 2014 ACM conference on Security and privacy in wireless & mobile networks - WiSec '14, 2014
    Co-Authors: David Barrera, Daniel Mccarney, Jeremy Clark, P. C. Van Oorschot
    Abstract:

    Android's trust-on-first-use application Signing model associates developers with a fixed code Signing Certificate, but lacks a mechanism to enable transparent key updates or Certificate renewals. The model allows application updates to be recognized as authorized by a party with access to the original Signing key. However, changing keys or Certificates requires that end users manually uninstall/reinstall apps, losing all non-backed up user data. In this paper, we show that with appropriate OS support, developers can securely and without user intervention transfer Signing authority to a new Signing key. Our proposal, Baton, modifies Android's app installation framework enabling key agility while preserving backwards compatibility with current apps and current Android releases. Baton is designed to work consistently with current UID sharing and signature permission requirements. We discuss technical details of the Android-specific implementation, as well as the applicability of the Baton protocol to other decentralized environments.

  • Baton: Key Agility for Android without a Centralized Certificate Infrastructure
    2013
    Co-Authors: David Barrera, Daniel Mccarney, Jeremy Clark, P. C. Van Oorschot
    Abstract:

    Android’s trust-on-first-use application Signing model associates developers with a fixed Signing key, but lacks a mechanism to transparently update the key or renew their Signing Certificate. As an advantage, this feature allows application updates to be recognized as authorized by a party with access to the original Signing key. Changing keys or Certificates requires that end-users manually uninstall/reinstall apps, losing all non-backed up user data. In this paper, we show that with appropriate OS support, developers can securely and without user intervention transfer Signing authority to a new Signing key. Our proposal, Baton, modifies Android’s app installation framework enabling key agility while preserving backwards compatibility with current apps and current Android releases. Baton is designed to work consistently with current UID sharing and signature permission requirements. We discuss the technical changes made to Android, and remaining open issues such as key loss and Signing authority revocation on Android.

Daniel Mccarney - One of the best experts on this subject based on the ideXlab platform.

  • Baton: Certificate Agility for Android’s Decentralized Signing Infrastructure
    2016
    Co-Authors: David Barrera, Daniel Mccarney, Jeremy Clark, Paul C. Oorschot
    Abstract:

    Android’s trust-on-first-use application Signing model asso-ciates developers with a fixed code Signing Certificate, but lacks a mechanism to enable transparent key updates or cer-tificate renewals. The model allows application updates to be recognized as authorized by a party with access to the original Signing key. However, changing keys or Certificates requires that end users manually uninstall/reinstall apps, losing all non-backed up user data. In this paper, we show that with appropriate OS support, developers can securely and without user intervention transfer Signing authority to a new Signing key. Our proposal, Baton, modifies Android’s app installation framework enabling key agility while pre-serving backwards compatibility with current apps and cur-rent Android releases. Baton is designed to work consistently with current UID sharing and signature permission require-ments. We discuss technical details of the Android-specific implementation, as well as the applicability of the Baton protocol to other decentralized environments

  • baton Certificate agility for android s decentralized Signing infrastructure
    Wireless Network Security, 2014
    Co-Authors: David Barrera, Daniel Mccarney, Jeremy Clark, P. C. Van Oorschot
    Abstract:

    Android's trust-on-first-use application Signing model associates developers with a fixed code Signing Certificate, but lacks a mechanism to enable transparent key updates or Certificate renewals. The model allows application updates to be recognized as authorized by a party with access to the original Signing key. However, changing keys or Certificates requires that end users manually uninstall/reinstall apps, losing all non-backed up user data. In this paper, we show that with appropriate OS support, developers can securely and without user intervention transfer Signing authority to a new Signing key. Our proposal, Baton, modifies Android's app installation framework enabling key agility while preserving backwards compatibility with current apps and current Android releases. Baton is designed to work consistently with current UID sharing and signature permission requirements. We discuss technical details of the Android-specific implementation, as well as the applicability of the Baton protocol to other decentralized environments.

  • WISEC - Baton: Certificate agility for android's decentralized Signing infrastructure
    Proceedings of the 2014 ACM conference on Security and privacy in wireless & mobile networks - WiSec '14, 2014
    Co-Authors: David Barrera, Daniel Mccarney, Jeremy Clark, P. C. Van Oorschot
    Abstract:

    Android's trust-on-first-use application Signing model associates developers with a fixed code Signing Certificate, but lacks a mechanism to enable transparent key updates or Certificate renewals. The model allows application updates to be recognized as authorized by a party with access to the original Signing key. However, changing keys or Certificates requires that end users manually uninstall/reinstall apps, losing all non-backed up user data. In this paper, we show that with appropriate OS support, developers can securely and without user intervention transfer Signing authority to a new Signing key. Our proposal, Baton, modifies Android's app installation framework enabling key agility while preserving backwards compatibility with current apps and current Android releases. Baton is designed to work consistently with current UID sharing and signature permission requirements. We discuss technical details of the Android-specific implementation, as well as the applicability of the Baton protocol to other decentralized environments.

  • Baton: Key Agility for Android without a Centralized Certificate Infrastructure
    2013
    Co-Authors: David Barrera, Daniel Mccarney, Jeremy Clark, P. C. Van Oorschot
    Abstract:

    Android’s trust-on-first-use application Signing model associates developers with a fixed Signing key, but lacks a mechanism to transparently update the key or renew their Signing Certificate. As an advantage, this feature allows application updates to be recognized as authorized by a party with access to the original Signing key. Changing keys or Certificates requires that end-users manually uninstall/reinstall apps, losing all non-backed up user data. In this paper, we show that with appropriate OS support, developers can securely and without user intervention transfer Signing authority to a new Signing key. Our proposal, Baton, modifies Android’s app installation framework enabling key agility while preserving backwards compatibility with current apps and current Android releases. Baton is designed to work consistently with current UID sharing and signature permission requirements. We discuss the technical changes made to Android, and remaining open issues such as key loss and Signing authority revocation on Android.

Jim Schaad - One of the best experts on this subject based on the ideXlab platform.

  • Signing Certificate Attribute Specification
    1998
    Co-Authors: Jim Schaad
    Abstract:

    A set of attacks on SignedData objects have been identified relating to the fact that the Certificate to be used when verifying the signature in a SignerInfo is not cryptographically bound into the signature. This leads to a set of attacks where the Certificate used to verify the signature is altered leading to possible incorrect results. This document describes these attacks and provides ways to deal with some of the attacks. This draft is being discussed on the "ietf-smime" mailing list. To join the list, send a message to with the single word "subscribe" in the body of the message. Also, there is a Web site for the mailing list at .

  • Signing Certificate attribute specification
    1998
    Co-Authors: Jim Schaad
    Abstract:

    A set of attacks on SignedData objects have been identified relating to the fact that the Certificate to be used when verifying the signature in a SignerInfo is not cryptographically bound into the signature. This leads to a set of attacks where the Certificate used to verify the signature is altered leading to possible incorrect results. This document describes these attacks and provides ways to deal with some of the attacks. This draft is being discussed on the "ietf-smime" mailing list. To join the list, send a message to with the single word "subscribe" in the body of the message. Also, there is a Web site for the mailing list at .