The Diana Initiative 2021

As security practitioners, we often hear terms like “leaks” and “leakage” and while some of us have a general notion about what leakage is, there is an established academic framework dedicated to studying information leakage called quantitative information flow (QIF). QIF can help us develop a better understanding of what leakage is, how we can measure it, and how we can build systems with leakage in mind. In this talk, I will introduce the formal concept of information leakage using examples from password checkers to specialized cryptography. What do we mean by leakage and how can we improve security by thinking about it?