Stephen Farrell

LetsEncrypt is currently the most important X.509 CA issueing (free) certificates for web servers. Web servers interact with LetsEncrypt via the ACME protocol (RFC8555). Since the basic ACME RFC was published (in 2019) a number of extensions and profiles have been defined by the IETF’s ACME working group. The project here is to survey those … Read more

The project is to check what (various) browsers and/or other DNS stubs/recursives and public recursives (e.g. quad-1,8,9) support and use in terms of TLS 0-RTT when DoT/DoH /DoQ are used. Having established the state of current deployments, the next goal is to check whether or not a 0-RTT replay attack works or fails in common … Read more

Due to the potential damage a cryptrographically relevant quantum computer could do to uses of widely used asymmetric cryptographic algorithms, a range of new “post-quantum” algorithms have been developed and are being widely deployed, e.g. in TLS in web browsers. This project is to investigate potential timing issues with implementations of such algorithms, likely reproducing … Read more

Email is inherently a delay-tolerant application. However, modern email deployments involve online checks used by anti-spam mechanisms, non-standard UA/MS interactions, MFA client authentication and hop-by-hop encryption all of which can be problematic in the face of high delays or disruptions, and perhaps especially at scale. The scenario here is where we want to do email … Read more

Scanning public-facing Internet services in order to detect security- and privacy-relevant patterns and problems is becomming well-trodden ground. Typical studies attempt Internet-scale IPv4 scans, e.g., to detect uses of outdated ciphers in uses of the Transport Layer Security (TLS) protocol. More local scans (e.g., https://eprint.iacr.org/2018/299) could however produce results that are easier to translate into … Read more

The project is to survey censorship measurement tools and data sets (e.g. https://ooni.org/ and similar), to compare and contrast those, and then use some subset of the identified tooling and data to compare the censorship situation for Internet users based in Ireland against the position of users based in some other country, to be agreed … Read more