Modern software installation tools often use packages from more than one repository, presenting a unique set of security challenges. Such a configuration increases the risk of repository compromise and introduces attacks like dependency confusion and repository fallback. In this paper, we offer the first exploration of attacks that specifically target multiple repository update systems, and propose a unique defensive strategy we call articulated trust. Articulated trust is a principle that allows software installation tools to specify trusted developers and repositories for each package. To implement articulated trust, we built Artemis, a framework that introduces several new security techniques, such as per-package prioritization of repositories, multi-role delegations, multiple-repository consensus, and key pinning. These techniques allow for a greater diversity of trust relationships while eliminating the security risk of single points of failure.

Private Information Retrieval (PIR) allows users to retrieve information from a database without revealing the content of these queries to anyone. The traditional information-theoretic PIR schemes utilize multiple servers to download single data block, thus incur high communication overhead and high computation burden. In this paper, we develop an Information- theoretic multi-block PIR scheme that significantly reduce the client communication and computation overheads by downloading multiple data blocks at a time. The design of k-safe binary matrices insures the information will not be revealed even if up to k servers collude. Our scheme has much lower overhead than the classic PIR schemes. The implementation of fast XOR operations benefits both servers and clients in reducing coding and decoding time. Our work demonstrates that multi-block PIR scheme can be optimized to simultaneously achieve low communication and computation overhead, comparable to even non-PIR systems, while maintaining a high level of privacy.

While the cellular revolution has made voice connectivity ubiquitous in the developing world, data services are largely absent or are prohibitively expensive. In this paper, we present Hermes1, a point-to-point data connectivity solution that works by modulating data onto acoustic signals that are sent over a cellular voice call. The main challenge is that most voice codecs greatly distort signals that are not voice-like; furthermore, the backhaul can be highly heterogeneous and of low quality, thereby introducing unpredictable distortions. Hermes modulates data over the extremely narrow-band approximately 3kHz bandwidth) acoustic carrier, while being severely constrained by the requirement that the resulting sound signals are voice-like, as far as the voice codecs are concerned. Hermes uses a robust data transcoding and modulation scheme to detect and correct errors in the face of bit flips, insertions and deletions; it also adapts the modulation parameters to the observed bit error rate on the actual voice channel. Through real-world experiments, we show that Hermes achieves approximately 1.2 kbps goodput which when compared to SMS, improves throughput by a factor of 5× and reduces the cost-per-byte by over a factor of 50x