The advent of decentralized trading markets introduces a number of new challenges for consensus protocols. In addition to the 'usual' attacks -- a subset of the validators trying to prevent agreement -- there is now the possibility of financial fraud, which can abuse properties not normally considered critical in consensus protocols. We investigate the issues of attackers manipulating or exploiting the order in which transactions are scheduled in the blockchain. More concretely, we look into order fairness, i.e., ways we can assure that the order of transactions relative to each other is fair. We show that one of the more intuitive definitions of fairness is impossible to achieve. We then present Wendy, a group of low overhead protocols that can implement different concepts of fairness. Wendy acts as an additional widget for an existing blockchain, and is largely agnostic to the underlying blockchain and its security assumptions, as long as they provide a known and always active set of validators. Furthermore, it is possible to implement fairness for some subsets of the transactions, and thus run several independent fair markets (as well as some unfair ones) on the same chain.

The Open Smart Grid Protocol (OSGP) is currently deployed in various countries in large-scale Smart Metering projects. The protocol was developed by the OSGP Alliance and published as a standard by the European Telecommunications Standards Institute (ETSI). We identify several security issues in the OSG Protocol, primarily the use of a weak digest function and the way the protocol utilizes the RC4 algorithm for encryption. A straight-forward oracle attack triggers the leakage of key material of the digest function. We outline how an attacker can make use of the simple protocol structure to send maliciously altered messages with valid authentication tags to the meters.

In the last year, the digitalization of the power grids has been pushed further, creating an ever increasing need for security approaches in this domain. One of the most prominent and visible aspects are smart meters, which are being deployed in millions of homes with the intend to optimize billing, but also to generate data for energy saving, load balancing, and other use cases. The first session of the workshop focuses on the privacy of smart meter data, which is an important precondition for a successful and widely accepted rollout, and to make efficient use of the smart metering data. For the overall smartgrid, the workshop takes a higher level view, discussing risk analysis and overall security strategy approaches towards a secure grid. Finally, the topic addresses issues of implementations, discussing new findings on weaknesses in smart grid deployments as well as testing tools.

The Smart Energy Grid Security (SEGS) Workshop aims to foster innovative research and discussion about smart energy grid security and privacy challenges, issues, approaches, and solutions. SEGS publications offer perspectives from both academia and industry, and present novel research on theoretical and practical aspects of smart grid security and privacy, including design, analysis, experimentation, and fielded systems. SEGS also includes presentations from other communities, such as law, economics, and HCI, that present these communities' perspectives on technological issues. The scope of the workshop encompasses all aspects of the smart grid, including distribution, transmission, generation, metering, e-mobility, and integration of distributed energy resources.

With the utilization of TPM-based trusted platforms in real applications, and the subsequent adaption of the specification to the experience gained from such utilization, it increasingly appears that the TPM architecture has some fundamental flaws that result in more and more complex and expensive hardware requirements. In this paper, we propose a new architecture that resets the trust boundary to a much smaller scale, thus allowing for much simpler and more flexible TPM implementations, without sacrificing the security gains from a classical TPM.

Recent investigations have found a massively increasing professionalisation and organization of attacks executed on consumer computing systems. Simultaneously, the systems we are trying to defend are getting more and more complex and networked, while promising security technologies---such as trusted boot and strong process isolation---appear to have troubles finding their way into mainstream devices.

In this paper, we propose an alternative DRM technology for next-generation optical media. Instead of implementing a hard access control mechanism, we propose a scheme that monitors the behavior of users in a privacy-preserving manner, detects potential infringement actions and reacts in a graceful way, which is dependent on the severity of infringements. The scheme is based on blacklists of known unauthorized content and compromised players, which are maintained by content providers and shipped alongside the content. Most of the functionality is implemented by content code provided on the disc, allowing for player independent and flexible reactions.

Verifiable secret sharing is an important primitive in distributed cryptography. With the growing interest in the deployment of threshold cryptosystems in practice, the traditional assumption of a synchronous network has to be reconsidered and generalized to an asynchronous model. This paper proposes the first practical verifiable secret sharing protocol for asynchronous networks. The protocol creates a discrete logarithm-based sharing and uses only a quadratic number of messages in the number of participating servers. It yields the first asynchronous Byzantine agreement protocol in the standard model whose efficiency makes it suitable for use in practice. Proactive cryptosystems are another important application of verifiable secret sharing. The second part of this paper introduces proactive cryptosystems in asynchronous networks and presents an efficient protocol for refreshing the shares of a secret key for discrete logarithm-based sharings.

The paper considers the Byzantine agreement problem in a fully asynchronous network, where some participants may be actively malicious. This is an important building block for fault-tolerant applications in a hostile environment, and a non-trivial problem: An early result by Fischer et al. (1985) shows that there is no deterministic solution in a fully asynchronous network subject to even a single crash failure. The paper introduces an optimistic protocol that combines the two best known techniques to solve agreement, randomization and timing. The timing information is used only to increase performance; safety and liveness of the protocol are guaranteed independently of timing. Under certain "normal" conditions, the protocol decides quickly and deterministically without using public-key cryptography, approximately as fast as a timed protocol subject to crash failures does. Otherwise, a randomized fallback protocol ensures safety and liveness. For this, we present an optimized version of the randomized Byzantine agreement protocol of Cachin et al. (2000), which is computationally less expensive and not only tolerates malicious parties, but also some loss of messages; it might therefore be of independent interest.

This paper summarizes our work on group communication in a fully asynchronous Byzantine environment. Instead of failure detectors or timing information, our protocols use randomization to circumvent the impossibility result by Fischer, Lynch and Paterson. This is the first time this technique is used for a real system; thanks to modern cryptography, our protocols are practical and fast enough to be used in practice. To cleanly combine cryptography with fault tolerance, a new model had to be developed that might be of independent interest.

Byzantine agreement requires a set of parties in a distributed system to agree on a value even if some parties are corrupted. A new protocol for Byzantine agreement in a completely asynchronous network is presented that makes use of cryptography, specifically of threshold signatures and coin-tossing protocols. These cryptographic protocols have practical and provably secure implementations in the “random oracle” model. In particular, a coin-tossing protocol based on the Diffie-Hellman problem is presented and analyzed.