Cryptography, security, and privacy (CrySP)

Overview

The Cryptography, Security, and Privacy (CrySP) research group carries out research in a wide variety of topics, from designing cryptographic protocols to the evaluation of their effectiveness and usability in deployed systems. Some examples are:

• Security and privacy in machine learning. Analyzing and preventing the leakage of private information from machine learning models, enabling provenance verification of machine learning models, analyzing model theft and security-relevant failure modes of machine learning models (N. Asokan, F. Kerschbaum, X. Shen, U. Hengartner).
• Secure systems. Designing, analyzing, building (and occasionally breaking) secure and privacy-preserving systems. A key consideration is building systems that are simultaneously secure, easy to use and inexpensive to deploy (N. Asokan).
• Data security and privacy. Confidentiality and integrity in data science, data collection, preparation and management (F. Kerschbaum).
• Applied Cryptography. Secure multi-party computation, homomorphic and functional encryption, private information retrieval, differential privacy, zero-knowledge proofs (F. Kerschbaum, I. Goldberg, M. Hajiabadi).
• AI misuse. Characterizing and mitigating real-world misuse of AI systems, covering models, agents, and the broader AI ecosystem (X. Shen).
• Online safety. Developing data-driven methods to measure and mitigate online harms, such as hate speech, unsafe images, and malicious deepfakes (X. Shen).
• Privacy-preserving communications networks. Creating privacy-preserving communications networks with better security, privacy, efficiency, and scalability properties than existing ones (I. Goldberg, D. Barradas).
• Privacy-preserving computation. Creating mechanisms to achieve private computations, though multiparty computation, trusted execution environments, oblivious algorithms, and homomorphic encryption (I. Goldberg, M. Hajiabadi, F. Kerschbaum).
• Censorship Resistance. Designing, developing, and deploying censorship resistance technologies, enabling access to the free and open Internet even from locations where the Internet is censored (I. Goldberg, D. Barradas).
• Blackout resistance. Designing private communication tools that run over mobile mesh networks during state-imposed Internet shutdowns, allowing users to reliably and securely share information and assess its trustworthiness without relying on centralized infrastructure (D. Barradas).
• Behavioural Biometrics. Investigating the usability, security, and practical deployment of behavioural biometric authentication, with a focus on smartphone and web authentication (U. Hengartner).
• Context-Aware Authentication. Designing and evaluating authentication technologies that adapt to users' contextual information and circumstances (U. Hengartner).
• Cryptographic lower bounds. Understanding the limitations of cryptographic assumptions in constructing primitives (e.g., when assumption A is insufficient to realize primitive B), as well as proving efficiency lower bounds on constructions, such as the minimum number of oracle calls required (M. Hajiabadi).
• Security Analysis of Appified Ecosystems. Develop hybrid security analysis techniques combining program analysis and LLM-based reasoning to systematically assess the security of diverse appified ecosystems, including agent-integrated applications, traditional mobile applications, automotive, and wearable, and super-app mini-programs, with a focus on identifying and mitigating vulnerabilities in access control and privilege delegation and escalation (Y. Aafer).
• Security Analysis of AI Agent Integration into Smart Platforms. Investigate emerging security and privacy risks arising from the integration of AI agents into smart platforms, focusing on platform-level modifications that expose system resources and capabilities to agents, as well as vulnerabilities across the end-to-end interaction pipeline, from interpreting user commands to executing privileged system actions (Y. Aafer).
• Confidential Data Deduplication. Develop scalable confidential data deduplication techniques that leverage trusted execution environments and combine the benefits of deduplication before and after encryption, reducing storage and bandwidth overhead while preserving data confidentiality (Y. Aafer).
• Automated vulnerability discovery and repair. Developing program analysis, fuzzing, and repair tools to find and fix vulnerabilities in operating systems, firmware, and other critical software (M. Xu).
• Smart contract security and verification. Developing specification, testing, and formal verification tools to improve the security and correctness of smart contracts, with a focus on the Move language (M. Xu).
• Runtime defenses. Designing memory protection, software diversification, and isolation mechanisms to mitigate exploitation of software vulnerabilities (M. Xu).
• Security, privacy and end-of-use electronics. Studying what people do with old devices once they stop using them, why they store rather than dispose of them, and how security and privacy concerns such as leftover personal data shape those decisions, using surveys, interviews, usability studies and interventions designed to change behaviour (S. Watson).

CrySP is part of the Cybersecurity and Privacy Institute (CPI) at the University of Waterloo and collaborates with other groups within the Cheriton School of Computer Science, such as Algorithms and Complexity, Human–Computer Interaction, Systems and Networking, and Data Systems.

CrySP Speakers Series on Privacy

The CrySP Speaker Series on Privacy are periodic lectures made possible by an anonymous charitable donation in memory of cypherpunks and privacy advocates Len Sassaman, Hugh Daniel, Hal Finney, and Caspar Bowden.

Since 2012, this speaker series has been video recorded. Please visit the CrySP Speaker Series on Privacy for a list of past speakers and videos of the presentations they gave.

A YouTube playlist of speaker series talks is also available.