#WeKnowCybersecurity

Cybersecurity Blog of Fraunhofer AISEC

Trusted Electronics
Kevin Schneider

Fault Attacks on ECC Signature Verification

Digital signatures used in embedded systems are often based on elliptic curve cryptography (ECC) thanks to its performance and low memory profile. In secure boot processes they provide the cryptographic foundation for guaranteeing the authenticity of a firmware image. At the same time, these resource-constraints and the physical exposure of such devices makes them prime targets for fault attacks. Prior work studied faults on signature generation in depth, yet nobody had systematically asked how vulnerable signature verification is to fault attacks combined with carefully crafted signature inputs. That is exactly the gap we set out to close.

Read Article »
Kevin Schneider 20. August 2026
Visual of the Blog Post: How Secure Is Europe's Rail System? A Systematic Cybersecurity Risk Analysis of the ERTMS
‚Industrial Security‘
Sebastian N. Peters

How Secure Is Europe’s Rail System? A Systematic Cybersecurity Risk Analysis of the European Rail Traffic Management System (ERTMS)

The European Rail Traffic Management System (ERTMS) is designed to make Europe’s railways interoperable and safe. The system, which has been mandatory since 2002, combines standardized signaling, radio communication, and train control – but how well is it protected against cyberattacks? Using MoRA, our modular risk assessment approach, we systematically model the ERTMS and evaluate cybersecurity risks. We compare current and future configurations to identify the assets with the largest attack surface. Our overview of the entire system – from GSM-R, balises, FRMCS, ETCS levels, and ATO to key management – provides a concise preview of risk profiles and attack tree scenarios, and highlights practical countermeasures that significantly improve cybersecurity.

Read Article »
Sebastian N. Peters 7. August 2026
Viisual for blog post: Codyze: Automated Analysis of Cybersecurity Requirements in Software
Cybersecurity
Alexander Küchler

Codyze: Automated Analysis of Cybersecurity Requirements in Software

Manually verifying compliance with requirements such as the Cyber Resilience Act is not scalable. Our code analysis tool, Codyze, translates product-centric regulatory requirements into verifiable rules and automatically assesses whether the product’s source code fulfills them – across languages and microservices. Codyze makes all analysis results transparent to developers, security teams, and auditors.

Read Article »
Alexander Küchler 1. July 2026
IoT Security
Michael Weiß

Secure System-On-Chip: Protecting Operating Systems and Hardware

How can we trust chips and operating systems that power IoT, industry and the cloud? In this interview, Fraunhofer AISEC cybersecurity researcher Dr. Michael Weiß explains how GyroidOS, secure system-on-chip and open standards like RISC-V create verifiable, tamper-resistant platforms for tomorrow’s critical infrastructure.

Read Article »
Michael Weiß 12. March 2026
‚Industrial Security‘
Patrick Wagner

Mastering Cross-Divisional Cybersecurity Risk Management in the Automotive Industry

Modern cars are interconnected systems of software, sensors, and cloud services. As automotive companies divide their work across engineering, production, and backend divisions, cybersecurity risks often fall through the cracks. While standards such as ISO/SAE 21434, the ISO/IEC 27000 family, and the IEC 62443 series provide important building blocks, none fully explain how to align cybersecurity across divisions. Our research at Fraunhofer AISEC reveals the consequences: hard-to-compare risk assessments, unclear communication, and fragmented security strategies. The solution lies in a cross-divisional approach that connects processes, tools, and terminology. Based on a structured analysis of key cybersecurity standards and interviews with experts from six automotive manufacturers, this article contrasts what the standards expect with how organizations work today – and outlines concrete steps to close the gaps.

Read Article »
Patrick Wagner 27. January 2026
Cybersecurity
Christian Banse

Automated cloud certification with EMERALD: Architecture, evidence, and trustworthy security

In the face of growing complexity and regulatory requirements, the security of cloud services is becoming increasingly challenging. However, conventional certification procedures require considerable financial and time investment to meet these requirements. That is why the EU research project EMERALD is pursuing a new approach: It is developing a framework for continuous, automated security certification based on semantically structured evidence. This article will discuss the concepts, methods, and validation approaches of the EMERALD platform.

Read Article »
Christian Banse 30. October 2025
Quantum Computing
Sebastian Issel

Towards Classical Software Verification using Quantum Computers

In this post, we explore the possibility of accelerating the formal verification of classical programs using quantum computers. Common programming errors, such as null-pointer dereference and out-of-bound access, are prevalent sources of security flaws. Our approach involves generating a Satisfiability (SAT) instance from code snippets, which is satisfiable if the undesired behavior exists. This instance is then converted into an optimization problem, solved using quantum algorithms, thus potentially achieving asymptotically polynomial speedup.

Read Article »
Sebastian Issel 13. August 2025
‚Industrial Security‘
Sebastian N. Peters

Gateway to the Danger Zone: Secure and Authentic Remote Reset in Machine Safety 

Modern manufacturing is rapidly digitizing, unlocking new business models and unprecedented efficiency. While remote operation has become commonplace, machine safety has still required hands-on, local intervention — until now. Our latest work at Fraunhofer AISEC bridges this gap with a secure, authentic remote reset system for safety events, blending future-proof cryptography and robust safety design. Here’s how we’re redefining the boundaries of safe, remote manufacturing.

Read Article »
Sebastian N. Peters 22. July 2025
Secure Digital Identities
Dariush Wahdany

Using Prototypes for Private Machine Learning 

How can machine learning respect privacy without sacrificing fairness? Discover DPPL, a prototype-based method that provides strong privacy guarantees while boosting accuracy for underrepresented groups. By addressing bias in differentially private models, this approach ensures ethical and inclusive AI development without compromising performance.

Read Article »
Dariush Wahdany 30. May 2025
Post-quantum Cryptography
Thomas Bellebaum

Multi-Party Computation in the Head – an Introduction

In 2016, the National Institute of Standards and Technology (NIST) announced a standardization process for quantum-secure cryptographic primitives. The goal was to find secure key encapsulation mechanisms (KEM) and signature schemes. One unique approach was the PICNIC signature scheme, a scheme utilizing the MPC-in-the-Head (MPCitH) paradigm. This made PICNIC an interesting approach, since its security relies on well researched block ciphers and hash functions. PICNIC was announced as an alternative candidate by NIST. A lot of follow-up schemes based on PICNIC, like BBQ, Banquet, and FEAST, were proposed using different block ciphers and variations on the original construction paradigm. In 2022, NIST announced a second call specifically for signature schemes. MPC-in-the-Head-based signature schemes became their own category, with multiple submissions in this call. This articel explains the core idea and functionality of early MPCitH based signature schemes and how we at Fraunhofer AISEC make use of the concepts.

Read Article »
Thomas Bellebaum 30. April 2025
Trusted Artificial Intelligence
Nicolas Müller

How to build suitable datasets for successful detection of audio deepfakes

Deepfakes are a significant threat to democracy as well as private individuals and companies. They make it possible to spread disinformation, to steal intellectual property and to commit fraud, to name but a few. While robust AI detection systems offer a possible solution, their effectiveness depends largely on the quality of the underlying data, simply put: »Garbage in, garbage out.« But how do you create a dataset that is well suited to identifying the ever-evolving deepfakes and enables robust detection? And what constitutes high-quality training data?

Read Article »
Nicolas Müller 31. March 2025
‚Industrial Security‘
Stefan Tatschner

Parsing X.509 Certificates: How Secure Are TLS Libraries?

Digital certificates like X.509 are essential for secure internet communication by enabling authentication and data integrity. However, differences in how they are parsed by various TLS libraries can introduce security risks. A recent study by Fraunhofer AISEC analyzed six widely used X.509 parsers with real-world certificates. The findings reveal inconsistencies that could impact security-critical applications. In this article, we summarize the key results and explain why companies need to scrutinize their cryptographic libraries.

Read Article »
Stefan Tatschner 26. February 2025
Post-quantum Cryptography
Ivan Gavrilan

Fortifying Cryptography with Impeccable Circuits: Impeccable Keccak Explained

Cybersecurity threats are evolving, and cryptographic implementations face growing risks from fault injection attacks. Fraunhofer AISEC’s research introduces Impeccable Keccak, a new approach to secure SPHINCS+, a post-quantum cryptography digital signature scheme that has been standardized by NIST in 2024. By leveraging impeccable circuits and ensuring active security, this represents a new approach to fault-resilient cryptography.

Read Article »
Ivan Gavrilan 13. January 2025
Quantum Computing
Maximilian Wendlinger

Quantum and Classical AI Security: How to Build Robust Models Against Adversarial Attacks

The rise of quantum machine learning (QML) brings exciting advancements such as higher levels of efficiency or the potential to solve problems intractable for classical computers. Yet how secure are quantum-based AI systems against adversarial attacks compared to classical AI? A study conducted by Fraunhofer AISEC explores this question by analyzing and comparing the robustness of quantum and classical machine learning models under attack. Our findings about adversarial vulnerabilities and robustness in machine learning models form the basis for practical methods to defend against these attacks, which are introduced in this article.

Read Article »
Maximilian Wendlinger 13. December 2024
Trusted Electronics
Felix Oberhansl

Fraunhofer AISEC commissioned by the German Federal Office for Information Security (BSI): New study on the synthesis of cryptographic hardware implementations

The study by Fraunhofer AISEC on the security of cryptographic hardware implementations focuses on physical attacks on hardware, such as side-channel attacks and fault attacks, as well as measures to defend against them. These protective mechanisms can potentially be compromised by optimizations in the chip design process. The study shows that protective measures should be integrated into complex design processes and taken into account in hardware design synthesis in order to be resilient to hardware attacks. The findings will help hardware designers to develop robust and secure chips.

Read Article »
Felix Oberhansl 7. November 2024
Cybersecurity
Christian Banse

Faster detection and rectification of security vulnerabilities in software with CSAF

The Common Security Advisory Framework (CSAF) is a machine-readable format for security notices and plays a crucial role in implementing the security requirements of the Cyber Resilience Act (CRA): Security vulnerabilities can be detected and rectified faster by automatically creating and sharing security information. Fraunhofer AISEC has now published the software library »kotlin-csaf«, which implements the CSAF standard in the Kotlin programming language.

Read Article »
Christian Banse 16. October 2024

Most Popular

Never want to miss a post?

Please submit your e-mail address to be notified about new blog posts.
 
Bitte füllen Sie das Pflichtfeld aus.
Bitte füllen Sie das Pflichtfeld aus.
Bitte füllen Sie das Pflichtfeld aus.

* Mandatory

* Mandatory

By filling out the form you accept our privacy policy.
Linkedin Youtube Instagram Rss
WordPress Cookie Plugin by Real Cookie Banner