Using Unencrypted HTTP/2 to Circumvent Censorship

How Fragmentation Can Be Extended to the TLS Layer

A Large-Scale Analysis of Cryptographic Dangers with TLS Session Tickets

As a part of the "Frühlings-Uni", Juraj has held a presentation on the importance of IT security and presented CTFs.

a security analysis on the OpenPGP key exchange method Web Key Directory

an overview of the usage of different file formats used for 3D printing

Do you use S/MIME or OpenPGP to secure your emails? Do you think that validating e-mail signatures is easy? If your answer is yes, you should take a look at our study published together with our colleagues from Karlsruhe Institute of Technology, Münster University of Applied Sciences, and Ruhr University Bochum.

Together with our colleagues from the Ruhr University Bochum, we have published our paper on combinatorial testing of TLS implementations. The paper is presented at USENIX Security in Boston this week.

We are searching for two new research candidates, who would like to work in the areas of Web and TLS security.

As a part of the "Herbstuni", Katharina has held a presentation on the importance of IT security and presented CTFs.

Together with Robert Merget, we gave a hands-on tutorial on TLS 1.3 and how you can analyze it with TLS-Attacker. The tutorial was recorded and is now available on YouTube.

We are searching for Java developers for our TLS-Attacker project.

We worked on two papers that are going to be presented at the USENIX Security 2021 conference this week.

We published a new attack called ALPACA. ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. Attackers can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one…

In cooperation with /upb/hack, we organize an IT Security "Stammtisch". The topics in the first months include Content Security Policy, OpenID Connect, and PDF security.