The Design and Analysis of Cryptographic Application Programming Interfaces for Security Devices
Jolyon Clulow, Jolyon Clulow · 2003
The significance of security devices that protect the numerous transactions, which take place in today’s distributed virtual environment, cannot be underestimated. The importance of such devices will increase as our society continues to evolve into a cashless electronic society. The continuing increase in the number and size of electronic transactions, the advances in the technology utilized and the growing sophistication of the adversary have led to significant resources being invested in the evaluation and analysis of security devices. There has been a transformation of the traditional security analysis from one focused on mathematical primitives and physical engineering solutions to a holistic approach that seeks to protect against subtle interactions between the cryptographic, logical and physical aspects of such devices that can collude to compromise the security thereof. In the above setting, this dissertation investigates the electronic interface to security devices (i.e., the application programming interface or API) as a source of vulnerabilities. A number of innovative attacks are presented with significant implications for our financial transaction systems (e.g. ATM networks) that challenge previous assertions of their security, integrity and robustness. Finally, some design solutions and criteria are presented. No part of this document covered by the copyright hereon may be reproduced or used in any form or by any means graphic, electronic or mechanical, including photocopying, recording, taping or information storage and retrieval systems without the express written permission of the author.