Why Cryptosystems Fail

Communications of the ACM

Volumn 37, Issue 11, 1994, Pages 32-40

  Anderson, Ross J ^a  

^a UNIVERSITY OF CAMBRIDGE   (United Kingdom)

Author keywords

[No Author keywords available]

Indexed keywords

AUTOMATIC TELLER MACHINES; COMPUTER OPERATING SYSTEMS; COMPUTER SYSTEMS; COMPUTERS; DATA COMMUNICATION SYSTEMS; ERRORS; FAILURE ANALYSIS; MATHEMATICAL MODELS; NETWORK PROTOCOLS; SECURITY OF DATA; SYSTEMS ANALYSIS; TECHNOLOGY;

ROBUST SECURITY DESIGN; SECURITY ENGINEERING; SECURITY FAILURES; THREAT MODEL;

CRYPTOGRAPHY;

EID: 0028532579     PISSN: 00010782     EISSN: 15577317     Source Type: Journal    
DOI: 10.1145/188280.188291     Document Type: Article

References (24)

1. Abadí, M., and Needham, R.M. Prudent Engineering Practice for Cryptographic Protocols. Tech. Rep. 125, DEC SRC, June 1994.
2. Anderson, R.J. UEPS-A Second Generation Electronic Wallet. In Computer Security-ESORICS 92. Lecture Notes in Computer Science, vol. 648 Springer-Verlag, New York, pp. 411-418.
3. Anderson. R.J. Why cryptosystems fail. In Proceedings of the 1993 ACM Conference in Computer and Communications Security, pp. 215-227.
4. Anderson. R.J. The classification of hash functions. In Proceedings of the 4th IMA Conference in Cryptography and Coding (1993). To be published.
5. Baskerville, R. Information systems security design methods: implications for information systems development. ACM Computing Surveys 25, 4 (Dec. 1993), 375-414.
6. Boyd, C., and Mao, W.B. Limitations of logical analysis of cryptographic protocols. In Pre-Proceedings of Eurocrypt 93, pp. T88-T96.
7. Brooks, E.P. The Mythical Man-Month: Essays on Software Engineering. Addison-Wesley, Reading, Mass., 1975.
8. Bull, J.A., Gong, L., and Sollins, K. Towards security in an open systems federation. In Proceedings of ESORICS 92. Lecture Notes in Computer Science, vol. 648. Springer-Verlag, New York, pp. 3-20.
9. Burrows, M., Abadi, M., and Needham, R.M. A logic of authentication. In Proceedings of the Royal Society of London A, vol. 426, 1989, pp. 233-271.
10. Butler, R.W., and Finelli, G.B. The infeasibility of experimental quantification of life-critical software reliability. In Proceedings of the ACM Symposium on Software for Critical Systems. New Orleans, La., Dec. 1991, pp. 00-7 b.
11. Faigin, D.P., Donndelinger, J.J., and Jones, J.R. A rigorous approach to determining objects. In Proceedings of the 9th Annual Computer Security Applications Conference, IEEE, 1993, pp. 159-168.
12. Gong, E. Thoughts on cryptographic protocols. In Proceedings of the 1993 Cambridge Protocols Workshop. Lecture Notes in Computer Science. Springer-Verlag, New York. To be published.
13. Highland, H.J. Perspectives in information technology security. In Proceedings of the 1992 IFIP Congress, 'Education and Society’, IFIP A-13 vol. 2, 1992, pp. 440-446.
14. Jack, R.B. (chairman), Banking services: law and practice report by the Review Committee, HMSO, London, 1989.
15. Kahn, D. Ehe Codebreakers. Macmillan, New York, 1967.
16. Landwehr, C.E., Bull, A.R., McDermou. J.P., and Choi, W.S. A taxonomy of computer program security flaws, with examples. U.S. Naval Research Laboratory report NRL/FR/5542-93-9591.
17. Lewis. B. How to rob a bank the cash-card way, The Sunday Telegraph, 25 April 1993, p. 5.
18. Macrae, N. Sir Humphrey fudges his half-reforms. The Sunday Times 17 July 1994, sec. 4, p. 4.
19. McDermid, J.A. Issues in the development of safely critical systems, Public Lecture, Cambridge, 3 Feb. 1993.
20. Meyer, C.H., and Matyas, S.M. Cryptography: A New Dimension in Computer Data Security, John Wiley & Sons, New York, 1982.
21. Morris, R. In Proceedings of the 1993 Cambridge Protocols Workshop. Lecture Notes in Computer Science. Springer-Verlag, New York. To be published.
22. U.S. Department of Defense, Trusted Computer System Evaluation Criteria, 5200.28-STD, December 1985.
23. Wiener, M.J. Efficient DES Key Search, Technical report TR-244, School of Computer Science, Carleton University, Ottawa. May 1994.
24. Woo, T.Y.C., and Lam, S.S. A semantic model for authentication protocols. In Proceedings of the 1993 IEEE Computer Society Symposium on Research in Security and Privacy, pp. 178-194.