Projektbeschreibung
Verschlüsselungslösungen mit geprüfter Sicherheit
Mit der Verbreitung von Blockchains, der bevorstehenden Einführung von Quantencomputern und der weit verbreiteten Sorge um den Datenschutz wenden sich Unternehmen ausgefeilten Verschlüsselungslösungen zu, die auf ihre spezifischen Bedürfnisse zugeschnitten sind. Allerdings ist die Entwicklung und Implementierung von Verschlüsselungslösungen äußerst fehleranfällig und blickt auf eine lange Geschichte von Designfehlern, Implementierungsfehlern und spektakulären Angriffen zurück. Die Ergebnisse des Projekts Circus des Europäischen Forschungsrats bieten einen Ansatz, um kryptografische Software mit maschinell geprüften Sicherheits- und Korrektheitsnachweisen zu erstellen. Das EU-finanzierte Projekt Cryspen schlägt die Gründung eines Unternehmens vor, das die im Rahmen des Circus-Projekts entwickelte Forschungssoftware in produktionsreife, verifizierte kryptografische Lösungen in C, Rust und JavaScript überführt. Das Projekt soll den technischen Transfer der Forschungsergebnisse und die Geschäftsentwicklung des neuen Unternehmens finanzieren.
Ziel
Modern web applications routinely rely on standardized cryptographic protocols and algorithms to protect sensitive user data. Furthermore, with the advent of blockchains, the imminence of quantum computers, and widespread concerns about privacy in an era of surveillance and machine learning algorithms, enterprises are increasingly turning to sophisticated non-standard cryptographic solutions customized for specific usage scenarios. Unfortunately, cryptographic design and implementation is notoriously error-prone with a long history of design flaws, implementation bugs, and high-profile attacks. This leaves software companies with a difficult choice: every time they deploy a new crypto standard or an innovative cryptographic application that improves the security and privacy of their users, they risk exposing embarrassing flaws in their design or code.
The research results of ERC Circus offer a way out of this conundrum by advocating the use of formal verification to build cryptographic software with machine-checked proofs of security and correctness. A landmark output from this project is HACL*, a verified high-performance cryptographic library which is currently used by mainstream software like Mozilla Firefox, Linux Kernel, Tezos Blockchain, and ElectionGuard. We propose to establish a company (called Cryspen) that will transition the research software developed in ERC Circus towards a production-quality ready-to-use verified cryptographic software stack. In addition, Cryspen will offer a developer-friendly verification framework that can be used to build new custom cryptographic solutions in C, Rust, and JavaScript. The goal of this Proof-of-Concept proposal is to fund the initial technical transfer of research software to Cryspen and the business development of this company. Once this transfer is complete, Cryspen will be able to offer long-term service contracts to existing and new users of HACL*, and offer software contracts to enterprises interested in deploying verified cryptographic software.
Wissenschaftliches Gebiet
- natural sciencescomputer and information sciencessoftware
- humanitieshistory and archaeologyhistory
- natural sciencescomputer and information sciencescomputer securitycryptography
- engineering and technologyelectrical engineering, electronic engineering, information engineeringelectronic engineeringcomputer hardwarequantum computers
- natural sciencescomputer and information sciencesartificial intelligencemachine learning
Schlüsselbegriffe
Programm/Programme
- HORIZON.1.1 - European Research Council (ERC) Main Programme
Thema/Themen
Finanzierungsplan
HORIZON-ERC-POC - HORIZON ERC Proof of Concept GrantsGastgebende Einrichtung
78153 Le Chesnay Cedex
Frankreich