Kevin Fu Assistant Professor Department of Computer Science University of Massachusetts Amherst Email: kevinfu PGP Key Bio Computer Science Building 140 Governors Drive Amherst, MA 01003-9264 Phone: (413) 545-4006 Fax: (413) 545-1249

My primary research interests include security and privacy in pervasive and invasive computation: implantable medical devices and RFID. My research often involves cryptography and file systems. I am the coordinator of the RFID Consortium for Security and Privacy (RFID CUSP). I am a faculty member in PRISMS, the UMass Amherst Center for Advanced RFID Research, and SUMA.

Publications

Talks, Panels, Demos

• Panel.
  MITRE Privacy Technical Exchange: RFID Privacy, June 2007.

• Invited talk.
  Data Security Risks: RFID Lab Research,
  Boston Federal Reserve Bank, Emerging Payments Research Group, May 2007.

• Panel.
  Ubiquitous Computing in the Retail Store of the Future,
  17th Annual Computers, Freedom and Privacy Conference (CFP2007), May 2007.

• Panel.
  Wireless ID Issues: Privacy, Efficiency and Security,
  Dartmouth College Centers Forum on Freedom and Technology, April 2007.

• Invited talk.
  Vulnerabilities in First-Generation RFID-Enabled Credit Cards,
  Berkeley TRUST seminar, March 2007.

• Panel.
  RFID: How Can Security and Privacy be Built into the Technology,
  RFID and Ubiquitous Computing, Trans Atlantic Consumer Dialog (TACD), Brussels, Belgium, March 2007.

• Panel.
  RFID Security and Privacy, Financial Cryptography, February 2007.

• Invited talk.
  Computer system security and medical devices,
  U.S. Food and Drug Administration Center for Devices and Radiological Health (FDA CDRH), October 2006.

• Tutorial.
  RFID security and privacy, by Kevin Fu, Ari Juels, and Adam Stubblefield.
  USENIX Security Tutorial, August 2006.

• Invited talk.
  Building RFID applications with security and privacy,
  Workshop on RFID Security, July 2006.

• Lecture.
  Special topics in RFID security,
  TU Graz RFID Summer School, July 2006.

• Demo.
  RFID-enabled espresso machine by Hee-Jin Chae, Benessa Defend, and Kevin Fu.
  MIT RFID Academic Convocation, January 2006.

• Faculty candidate talk.
  Secure content distribution using untrusted servers, February-April 2005

• Invited talk.
  "Dos and Don'ts of Client Authentication on the Web,"
  Harvard Extension School, Building Programs with Graphical Interfaces, Cambridge, MA, April 6, 2006;
  MIT Network and Computer Security (6.857), Cambridge, MA, October 12, 2005 and September 23, 2004 [slides];
  Johns Hopkins Network Security (CS 600.324/424), Baltimore, Maryland, November 11, 2003;
  Hope College Computer Science Colloquium, Holland, Michigan, March 3, 2003;
  UC San Diego CSE Speakers Series, San Diego, California, February 10, 2003;
  Stanford Security Seminar and HP Labs, Palo Alto, California, March 18, 2002 [PDF, Gzipped PS];
  MIT Network and Computer Security (6.857), Cambridge, Massachusetts, September 11, 2001.

• Seminar.
  Concepts in Computer and Network Insecurity by Roger Dingledine, Andy Ellis, Kevin Fu.
  MIT Network Security Team seminar, Cambridge, MA, January 2002.

• Seminar.
  Why on Earth would Software Engineers Study the Classics? by Ian Anderson and Kevin Fu.
  National Junior Classical League, New Orleans, LA, July 19, 2001.

• Presentation.
  Code Breaking: From Latin to Web Security, Harvard Latin B, April 20, 2001. [PDF, Source code]

• Invited talk.
  The Failure of Client Authentication the Web,
  MIT Lincoln Laboratory. Invited speaker. April 18, 2001. [PDF]

• Invited talk.
  Computer Insecurity, Northeastern University College of Computer Science. February 26, 2001. [PDF]

• Seminar.
  Concepts in Computer and Network Insecurity by Roger Dingledine, Kevin Fu.
  MIT Network Security Team seminar, Cambridge, MA, January 10, 2001. [postscript]

• Seminar.
  Concepts in Computer and Network Insecurity by Roger Dingledine, Kevin Fu.
  MIT Network Security Team seminar, Cambridge, MA, January 18, 2000. [postscript]

• Seminar.
  Practical Security for UNIX by Kevin Fu, Geoff Goodell, Angie Kelic.
  MIT Network Security Team seminar, Cambridge, MA, January 19, 2000. [postscript]

Software and hardware

• C++ implementation of the SFS read-only file system, key regression, and Chefs cryptographic file system as part of SFS
• C++ proxy re-encryption library for use in the proxy re-encryption file system
• Java implementation of the RSA threshold signature scheme
• Intel 8051 assembly code and circuit schematics for a cryptographic phone made out of breadboard, chips, and a bunch of messy wire.
• The X-File System

News media

• RFID-enabled credit cards
  • John Schwartz. The New York Times. Researchers See Privacy Pitfalls in No-Swipe Credit Cards, October 23, 2006.
  • "No-Swipe Credit Cards Could Make ID Theft Easier" on ABC Good Morning America, October 24, 2006.
  • "'Smart' cards are quick, but are they safe?" on NBC Today Show, October 26, 2006.
• Simson Garfinkel. The Evil Side of Automatic Software Updates, CSO Magazine, October 2006.
• Buyer Beware: Online Shopping Hazards Exposed by UMass Amherst Computer Scientist, February 21, 2006.
• Lee Gomes. Portals: More scary tales involving big holes in Web-site security. Wall Street Journal CCXLII, 17 (Monday, February 2, 2004), page B1.
• Lee Gomes. Portals: Biggest Web problem isn't about privacy, it's sloppy security. Wall Street Journal CCXLII, 17 (Monday, January 26, 2004), page B1.
• The Cookie Dilemma. Continental Airlines In-Flight Magazine, July 2002.
• Privacy hole found in Verizon Wireless Web site, ComputerWorld, September 6, 2001.
• Secure Sockets Layer is not a Magic Bullet, NetworkMagazine.com, January 5, 2001.
• The Failure of SSL and the Pervasive Reality of Server Attacks, HostingTech, June 2000.
• What's the Password? Hackers May Already Know, BusinessWeek Magazine, November 15, 1999.

Security advisories

• Circumvent SSL client authentication in RSA's SSLJ library
  [Photo of happy engineers who just received free T-Shirts. RSA sent us a thank you letter.]
• We explained to Dow Jones' Wall Street Journal Interactive Edition how to circumvent the user login process.
  The VP sent us a thank you note.
• Use of Akamai hosts to circumvent SSL server authentication
• Misleading warning causes failure of Netscape SSL server authentication
• Wireless web phones can leak your phone number to untrusted web sites.

Articles and notes

• Are you gullible?, rec.humor.funny, June 2000.
• General editor, ACM Crossroads Magazine, November 1998-September 2000.
• In Memory of David Huffman. ACM Crossroads Magazine, Issue 6.3 Data Compression, Spring 2000.
• RTLinux: An Interview with Victor Yodaiken. ACM Crossroads Magazine, Issue 6.1 Linux, Fall 1999.
• Guest editor for the Linux Fall 1999 issue of ACM's Crossroads Magazine
• Summaries of the 1999 USENIX Security Symposium, published in the IEEE Electronic Cipher and USENIX ;login: magazine, August 1999.
• Guest editor for the Winter 1998 issue of ACM's Crossroads Magazine
• Summaries of the 1998 USENIX Electronic Commerce Workshop, ;login:, December 1998.
• Summaries of the 1998 USENIX Annual Technical Conference, ;login:, October 1998.
• Summaries of 1998 USENIX Security Symposium
• Underground Guide to VI-A (MIT-only)
• Jered Floyd, Kevin Fu, Peter Sun, "Differential Fault Analysis of RC5," December 1996. (PDF, compressed PS)
• Summaries of the Computers, Freedom, and Privacy 1996 Conference
• Security and Chocolate, Web Review, Internet World, 1995 (warning, abnormally high cheese factor)
• One-and-two-liner contest (really weak encryption), Nibble Magazine, 1991.
• Kevin Fu. "A Fine Weigh to See World," The Dow Jones National Observer, p. 17, March 19, 1977.

Technical book reviewing

Publishers hire technical reviewers to give feedback to authors before the final version of a book goes on sale. You won't see our reviews in print, but you'll see the results.

• RFID: Applications, Security, and Privacy by Simson Garfinkel, Beth Rosenberg (editors)
• Fighting Malicious Code by Ed Skoudis with Lenny Zeltser
• Computer Networks, 4th edition by Andrew Tanenbaum
• Network Security: Private Communication in a Public World, 2nd edition by Charles Kaufman, Radia Perlman, Mike Spiciner
• Web Security, Privacy and Commerce, Second Edition by Simson Garfinkel, Gene Spafford
• Operating Systems, Fourth Edition by William Stallings