We introduce the RT framework, a family of role-based trust management languages for
representing policies and credentials in distributed authorization. RT combines the strengths of …

This book presents a framework for the analysis of syntactic, operational and semantic
properties of programming languages. The framework is based on a mathematical system called …

A methodology is presented for using a general-purpose state enumeration tool, Mur/spl phi/,
to analyze cryptographic and security-related protocols. We illustrate the feasibility of the …

In the early days of the web, content was designed and hosted by a single person, group, or
organization. No longer. Webpages are increasingly composed of content from myriad …

Abstract data type declarations appear in typed programming languages like Ada, Alphard,
CLU and ML. This form of declaration binds a list of identifiers to a type with associated …

Cross-Site Request Forgery (CSRF) is a widely exploited web site vulnerability. In this paper,
we present a new variation on CSRF attacks, login CSRF, in which the attacker forges a …

Web spoofing is a significant problem involving fraudulent email and web sites that trick
unsuspecting users into revealing private information. We discuss some aspects of common …

We describe a browser extension, PwdHash, that transparently produces a different password
for each site, improving web password security and defending against password phishing …

Contextual integrity is a conceptual framework for understanding privacy expectations and
their implications developed in the literature on law, public policy, and political philosophy. …

We give goal-oriented algorithms for discovering credential chains in RT o , a role-based
trust-management language introduced in this paper. The algorithms search credential graphs, …