The UMBC Cyber Defense Lab presents
Alan T. Sherman, Enis Golszewski, and Jeremy J. Romanik Romano
UMBC CSEE Department
Joint work with Edward Zieglar, Jonathan D. Fuchs, and William E. Byrd
12:00 noon–1pm Friday, December 12, 2025 via WebEx
We analyze security aspects of the SecureDNA system regarding its system design, engineering, and implementation. This system enables DNA synthesizers to screen order requests against a database of hazards. By applying novel cryptography involving distributed oblivious pseudorandom functions, the system aims to keep order requests and the database of hazards secret. Discerning the detailed operation of the system in part from source code (Version 1.0.8), our analysis examines key management, certificate infrastructure, authentication, and rate-limiting mechanisms. We also perform the first formal-methods analysis of the mutual authentication, basic request, and exemption-handling protocols.
Without breaking the cryptography, our main finding is that SecureDNA's custom mutual authentication protocol SCEP achieves only one-way authentication: the hazards database and keyservers never learn with whom they communicate. This structural weakness violates the principle of defense in depth and enables an adversary to circumvent rate limits that protect the secrecy of the hazards database, if the synthesizer connects with a malicious or corrupted keyserver or hashed database. We point out an additional structural weakness that also violates the principle of defense in depth: inadequate cryptographic bindings prevent the system from detecting if responses, within a TLS channel, from the hazards database were modified. Consequently, if a synthesizer were to reconnect with the database over the same TLS session, an adversary could replay and swap responses from the database without breaking TLS. Although the SecureDNA implementation does not allow such reconnections, it would be stronger security engineering to avoid the underlying structural weakness. We identify these vulnerabilities and suggest and verify mitigations, including adding strong bindings. Software Version 1.1.0 fixes SCEP with our proposed SCEP+ protocol.
Our work illustrates that a secure system needs more than sound mathematical cryptography; it also requires formal specifications, sound key management, proper binding of protocol message components, and careful attention to engineering and implementation details.
Dr. Alan T. Sherman is a professor of computer science at UMBC in the CSEE Department, associate director of UMBC's Cybersecurity Institute, and director of the Cyber Defense Lab. His main research interest is high-integrity voting systems. He has carried out research in election systems, protocol analysis, algorithm design, cryptanalysis, theoretical foundations for cryptography, applications of cryptography, cloud forensics, and cybersecurity education. Dr. Sherman is also a private consultant performing security analyses and serving as an expert witness. Sherman earned the PhD degree in computer science at MIT in 1987, studying under Ronald L. Rivest. His research accomplishments include contributions to the Scantegrity and VoteXX election systems and development and validation of the Cybersecurity Concept Inventory (CCI) and Cybersecurity Curriculum Assessment (CCA). This work has been presented at USENIX Security 2010 and E-VOTE-ID 2025, and won best research paper at SIGSCE 2023. Sherman received approximately $15 million in funding from NSF, NSA, and IBM.
Dr. Enis Golaszewski is a teaching assistant professor of computer science at UMBC in the CSEE Department. He holds weekly workshops in formal-methods analyses of cryptographic protocols using the Cryptographic Protocol Shapes Analyzer (CPSA). His current research projects include analysis of the Coalition for Content Provenance and Authenticity (C2PA) protocol. Golaszewski earned the PhD under Sherman. His dissertation includes the design and development of a tool---ProtoBindGuard---that automatically binds protocol messages to context to prevent protocol-interaction attacks. Golaszewski is a former SFS scholar at UMBC. https://www.csee.umbc.edu/enis-golaszewski/
Jeremy J. Romanik Romano is an MS student in computer science at UMBC. His research interests include cybersecurity, software security, and protocol analysis. His involvement in this project began through being a student in Sherman's INSuRE and cryptology research courses. Romano is a member of the UMBC Protocol Analysis Lab and system administration and cybersecurity clubs on campus.
Support for this event was provided in part by NSF under grants DGE-1753681 and 2438185. ]]>Permanent Private Room for Female @ Westland Gardens
Immediate move-in.
Rent is 636$ +BGE +Wifi
The 2BHK townhouse is fully furnished and includes:
Spacious living room with sofa
Kitchen with oven, microwave, fridge, and dishwasher
In-unit washer and dryer
Dining table with chairs
Central heating and cooling
Location perks:
1-minute walk to the UMBC bus stop
10-minute walk to UMBC campus
Message for details: +1 (443) 703-6282
]]>The UMBC Instructional Technology Update is provided by the Division of Information Technology for students, faculty and staff. If you have questions or need help, please consult the Blackboard Help FAQs or directly at www.umbc.edu/blackboard/help. You can also contact the Technology Support Center at 410.455.3838 or submit an RT (Request Tracker) ticket via the myUMBC Help Menu or directly at my.umbc.edu/help.
HEADLINES
What's New
Digital Accessibility
Training & Professional Development (recording archive | view upcoming events)
In Case You Missed It: Recordings & Tips
Other DoIT & UMBC News
Application Link: https://forms.gle/k3gNEAfn2bdKDJhU8
Dear UMBC faculty,
We are thrilled to invite applications for the Entrepreneurial Learning Lab (ELL)—UMBC's newest professional development experience designed to equip faculty with the tools, frameworks, and confidence to innovate within their teaching, research, and scholarly activities.
The ELL is a hands-on, cohort-based learning community that helps faculty transform ideas into impactful, scalable opportunities. Whether you are exploring the translational potential of your research, reimagining a course, launching a new initiative, or developing your entrepreneurial mindset, this program provides the structure and support to elevate your goals.
A partnership between the Alex. Brown Center for Entrepreneurship and Innovation (ABCEI) and the Engineering and Computing Education Program (ECEP), ELL strengthens faculty capacity to identify opportunities, solve meaningful problems, and expand UMBC's culture of innovation and real-world impact.
Throughout the semester, participants engage in interactive workshops aligned with core entrepreneurial competencies such as:
Opportunity recognition, Value delivery, Entrepreneurial mindset, Storytelling
By the end of the program, each faculty member will complete:
Participants also gain an enhanced ability to integrate innovation into curriculum, proposals, and research, along with access to a cross-disciplinary community of faculty innovators.
The Spring 2026 cohort is open to:
All full-time UMBC faculty (tenured, tenure-track, and non-tenure-track lecturers)
Participants must commit to attending all workshops and completing one project over the semester.
Upon successful completion, faculty receive a $1,500 professional development stipend.
Applicants should discuss their project idea with their department chair before applying. Selected participants must have approval prior to the cohort start.
Workshop dates will be announced after cohort selection.
Beginning late January/early February, five workshops will be held in 2-hour block sessions.
Application Deadline: Tuesday, December 17, 2025 at 11:59 PM
Apply here: https://forms.gle/k3gNEAfn2bdKDJhU8
Notifications will be sent in early January.
Attendance at all workshops is required.
Dr. Jamie Gurganus — jgurganus@umbc.edu
Engineering & Computing Education Program (ECEP) / CIRTL
Kevin Fulmer — kfulmer@umbc.edu
Alex. Brown Center for Entrepreneurship & Innovation