• Privacy-Preserving Biometric Matching via Secure Two-Party Computation
  Abstract: Strong user authentication based on biometrics is gaining more and more importance. As a basis for further research in the domain of privacy-friendly usage of biometrics, the goal of this thesis project is to analyze the practical efficiency and performance of existing cryptographic approaches and frameworks based on secure two-party computation for matching biometric features in a privacy-preserving manner. This project will be done in collaboration with AIT.

Kontakt: Omid Mir, Rene Mayrhofer

• Implement an example website (as a normal and as a hidden service) with a database, which is always running on a Tor hidden service (somewhere else!): SQL and NoSQL. Test whether this works or what is needed, how efficient and resilient it is (e.g. reconnections), and do performance tests. Do this for a “classic” webpage as well as a SPA (Single Page Application): the page must load the data via JavaScript (from a Tor service!). Classic page on normal server with hidden DB, Classic page on hidden server with hidden DB, SPA on normal server with hidden API/DB, SPA on hidden server with hidden API/DB.

Kontakt: Michael Sonntag

• Basis-Idee (wäre aber noch zu erweitern/ausarbeiten): Bei Tor können aus dem Schlüssel für Hidden Services weitere Schlüssel abgeleitet werden. Das wird schon beim Directory benützt. Entwurf eines Systems, dass in (abhängig von einem geheimen Startwert) in "zufälligen" Abständen neue Schlüssel generiert. Wenn man dieser Geheimen Wert kennt, kann man auch aus (nur!) dem öffentlichen Schlüssel die zugehörigen abgeleiteten öffentlichen Schlüssel berechnen. Dies würde ein "Hopping" bei Hidden Services erlauben. Implementieren, teste, überlegen wofür das verwendet werden kann, Vor- &Nachteile

Kontakt: Michael Sonntag

• SeFReDoSS: Secure Federated Regular Document Submission Service

Abstract: The problem statement is that regularly (e.g. every month, quarter, year, etc.), some service provider (banks, credit cards, mobile network operators, various utility providers, etc.) need to send updated information such as bills or statements. We propose that “callback URLs” are an appropriate way to deliver these updated information snippets with semantics similar to the well-understood paper letters. As one would register a postal mailing address with a provider, logging into their web interface to register the web equivalent does not compromise security.

This project should implement the concept described as a quick prototype using Nextcloud shares at https://www.mayrhofer.eu.org/post/secure-delivery-of-regular-information/, öffnet eine externe URL in einem neuen Fenster within the Digidow project prototype of "Personal Identity Agents" (PIAs). The goal is to implement PUT-only document submission URLs either within the existing PIA prototype or an associated micro-web-service that interfaces with a PIA. A user-accessible web interface is required to register new submission URLs for a new provider (e.g., by creating a new sub-URL) and their associated policy (e.g., to move incoming documents with timestamped filenames into configurable directories on the local filesystem). The implementation should be done in Rust.

Kontakt: Michael Roland

• Sensor node communication via ephemeral Tor Onion services

Abstract: The goal of this project is to create a library for simple machine-to-machine communication via short-lived hidden Onion services.

Kontakt: Michael Roland
 

•  Mobile driving license reference implementation

Abstract: The goal of this project is to implement the current standard for mobile driving licenses (ISO/IEC 18013-5) on Android.

Kontakt: Michael Roland
 

• Security analysis of the Linux kernel in Mikrotik RouterOS

Abstract: Mikrotik RouterOS is a Linux kernel based embedded operating system for network routers, switches, access points, etc. While the userspace components are closed source, patches and configuration options for the used Linux kernel are available. The goal of this project is to analyze which security vulnerabilities - especially remotely exploitable ones - are publicly known for the user kernel version and if/how they have been patched. Necessary skills for this project include reading/writing C, reading and applying patches to source code, and compiling and testing native C code.

Kontakt: Rene Mayrhofer

• Comparison of DNS results for TOR exit node DNS queries against different providers

As seen by a recent incident at our TOR exit node, where the ISP DNS servers manipulated the outcome of certain DNS queries through a DNS filtering system, interception at the level of DNS results is a popular (though questionable) means to block unwanted web traffic.

In this bachelor's thesis, the outcome of presenting DNS queries performed by our TOR exit node to multiple different providers should be analyzed. Moreover, cases where deviating responses are observed should be further investigated. Interesting deviations would be primarily those caused by filtering/censorship.

Kontakt: Michael Roland

• Implement a VoIP tap for Softphones (i.e. VoIP phones implemented as software running on a PS)

This should copy the network traffic and/or the sound output. This should then be run through libraries (to be obtained: Open Source like https://www.informatik.uni-augsburg.de/lehrstuehle/hcm/projects/tools/emovoice/, öffnet eine externe URL in einem neuen Fenster) and speaker detection. This should then show feedback about who is talking how much (e.g. percent) and the mood of the speakers.

Kontakt: Michael Sonntag

• Reconstructing internet video from a network trace

This should work for IP video telephony, but potentially also for other communications. The main task here is to handle missing parts, e.g. keeping the old picture or replacing it with "white/black screen". The sniffed traffic should then be playable and be accompanied by exact specifications what was found, and what/when there were "holes" filled.

Kontakt: Michael Sonntag

• Online-Nachsuche

Software zur genauen und beweissicheren Dokumentation von Aktionen und Daten, die z.B. beim forensischen Zugriff auf einen fremden Webmail-Account erfolgen

Kontakt: Michael Sonntag

• Asterisk als Anonymisierungsserver

Eingehende Telefonate weitervermitteln, ähnlich zu TOR (evtl. mittels VoIP + Ausgangsserver etc.)

Kontakt: Michael Sonntag