Keys to the Cloud: Formal Analysis and Concrete Attacks on Encrypted Web Storage

Chetan Bansal (1) , Karthikeyan Bhargavan (2) , Antoine Delignat-Lavaud (2) , Sergio Maffeis (3)

1 Microsoft Research [Redmond]
2 PROSECCO - Programming securely with cryptography
3 Department of Computing [London]

To protect sensitive user data against server-side attacks, a number of security-conscious web applications have turned to client-side encryption, where only encrypted user data is ever stored in the cloud. We formally investigate the security of a number of such applications, including password managers, cloud storage providers, an e-voting website and a conference management system. We find that their security relies on both their use of cryptography and the way it combines with common web security mechanisms as implemented in the browser. We model these applications using the WebSpi web security library for ProVerif, we discuss novel attacks found by automated formal analysis, and we propose robust countermeasures.

Domaines: Cryptographie et sécurité [cs.CR]

Chetan Bansal, Karthikeyan Bhargavan, Antoine Delignat-Lavaud, Sergio Maffeis. Keys to the Cloud: Formal Analysis and Concrete Attacks on Encrypted Web Storage. 2nd Conference on Principles of Security and Trust (POST 2013), 2013, Rome, Italy. pp.126--146. ⟨hal-00863375⟩