TU Darmstadt / ULB / TUprints

PrivateDrop: Practical Privacy-Preserving Authentication for Apple AirDrop

Heinrich, Alexander ; Hollick, Matthias ; Schneider, Thomas ; Stute, Milan ; Weinert, Christian (2022):
PrivateDrop: Practical Privacy-Preserving Authentication for Apple AirDrop. (Publisher's Version)
In: Proceedings of the 30th USENIX Security Symposium, pp. 3577-3594,
Darmstadt, USENIX Association, 30th USENIX Security Symposium (USENIX Security 21), Virtual event, 11.-13.08.2021, ISBN 978-1-939133-24-3,
DOI: 10.26083/tuprints-00020599,
[Conference or Workshop Item]

[img] Text
sec21-heinrich.pdf
Available under: CC BY 4.0 International - Creative Commons, Attribution.

Download (847kB)
[img] Slideshow
sec21_slides_heinrich-alexander_0.pdf
Available under: CC BY 4.0 International - Creative Commons, Attribution.

Download (3MB)
Item Type: Conference or Workshop Item
Origin: Secondary publication service
Status: Publisher's Version
Title: PrivateDrop: Practical Privacy-Preserving Authentication for Apple AirDrop
Language: English
Abstract:

Apple's offline file-sharing service AirDrop is integrated into more than 1.5 billion end-user devices worldwide. We discovered two design flaws in the underlying protocol that allow attackers to learn the phone numbers and email addresses of both sender and receiver devices. As a remediation, we study the applicability of private set intersection (PSI) to mutual authentication, which is similar to contact discovery in mobile messengers. We propose a novel optimized PSI-based protocol called PrivateDrop that addresses the specific challenges of offline resource-constrained operation and integrates seamlessly into the current AirDrop protocol stack. Using our native PrivateDrop implementation for iOS and macOS, we experimentally demonstrate that PrivateDrop preserves AirDrop's exemplary user experience with an authentication delay well below one second. We responsibly disclosed our findings to Apple and open-sourced our PrivateDrop implementation.

Book Title: Proceedings of the 30th USENIX Security Symposium
Place of Publication: Darmstadt
Publisher: USENIX Association
Classification DDC: 000 Allgemeines, Informatik, Informationswissenschaft > 004 Informatik
Divisions: 20 Department of Computer Science > Cryptography and Privacy Engineering (ENCRYPTO)
20 Department of Computer Science > Sichere Mobile Netze
DFG-Graduiertenkollegs > Research Training Group 2050 Privacy and Trust for Mobile Users
Profile Areas > Cybersecurity (CYSEC)
LOEWE > LOEWE-Zentren > emergenCITY
DFG-Collaborative Research Centres (incl. Transregio) > Collaborative Research Centres > CRC 1119: CROSSING – Cryptography-Based Security Solutions: Enabling Trust in New and Next Generation Computing Environments
Event Title: 30th USENIX Security Symposium (USENIX Security 21)
Event Location: Virtual event
Event Dates: 11.-13.08.2021
Date Deposited: 15 Jun 2022 12:12
Last Modified: 15 Jun 2022 12:12
DOI: 10.26083/tuprints-00020599
Corresponding Links:
URN: urn:nbn:de:tuda-tuprints-205994
Additional Information:

Presentation: 21 slides

Presentation video: https://youtu.be/sFEUlmcj36k

URI: https://tuprints.ulb.tu-darmstadt.de/id/eprint/20599
PPN:
Export:
Actions (login required)
View Item View Item