| MEGA: Malleable Encryption Goes Awry M Backendal, M Haller, KG Paterson 2023 IEEE Symposium on Security and Privacy (SP), 146-163, 2023 | 39 | 2023 |
| The Fiat-Shamir zoo: relating the security of different signature variants M Backendal, M Bellare, J Sorrell, J Sun Secure IT Systems: 23rd Nordic Conference, NordSec 2018, Oslo, Norway …, 2018 | 25 | 2018 |
| When Messages are Keys: Is HMAC a dual PRF? M Backendal, M Bellare, F Günther, M Scarlata 43rd International Cryptology Conference (CRYPTO 2023), 2023 | 21 | 2023 |
| A Formal Treatment of End-to-End Encrypted Cloud Storage M Backendal, H Davis, F Günther, M Haller, KG Paterson Annual International Cryptology Conference, 40-74, 2024 | 15 | 2024 |
| Puncturable Key Wrapping and Its Applications M Backendal, F Günther, KG Paterson Advances in Cryptology–ASIACRYPT 2022: 28th International Conference on the …, 2023 | 13 | 2023 |
| Share with Care: Breaking E2EE in Nextcloud MR Albrecht, M Backendal, D Coppola, KG Paterson 2024 IEEE 9th European Symposium on Security and Privacy (EuroS&P), 828-840, 2024 | 10 | 2024 |
| End-to-End Encrypted Cloud Storage M Backendal, M Haller, K Paterson IEEE Security & Privacy 22 (2), 69-74, 2024 | 7 | 2024 |
| Key derivation functions without a grain of salt M Backendal, S Clermont, M Fischlin, F Günther Annual International Conference on the Theory and Applications of …, 2025 | 4 | 2025 |
| MFKDF: Multiple Factors Knocked Down Flat M Scarlata, M Backendal, M Haller 33rd USENIX Security Symposium (USENIX Security 24), 4301-4318, 2024 | 4 | 2024 |
| Puncturable symmetric KEMs for forward-secret 0-RTT key exchange M Backendal | 3 | 2019 |
Kenny PatersonProfessor of Computer Science, ETH ZurichVerified email at inf.ethz.ch
