Jump to Content
Arnar Birgisson

Arnar Birgisson

Arnar is a Software Engineer at Google and works on security protocols. He studied Language-Based Security at Chalmers University of Technology, Gothenburg, Sweden, and Theoretical Computer Science at Reykjavik University.
Authored Publications
Google Publications
Other Publications
Sort By
  • Title
  • Title, desc
  • Year
  • Year, desc
    Macaroons: Cookies with Contextual Caveats for Decentralized Authorization in the Cloud
    Joe Gibbs Politz
    Úlfar Erlingsson
    Ankur Taly
    Mark Lentczner
    Network and Distributed System Security Symposium, Internet Society (2014)
    Preview abstract Controlled sharing is fundamental to distributed systems; yet, on the Web, and in the Cloud, sharing is still based on rudimentary mechanisms. More flexible, decentralized cryptographic authorization credentials have not been adopted, largely because their mechanisms have not been incrementally deployable, simple enough, or efficient enough to implement across the relevant systems and devices. This paper introduces macaroons: flexible authorization credentials for Cloud services that support decentralized delegation between principals. Macaroons are based on a construction that uses nested, chained MACs (e.g., HMACs) in a manner that is highly efficient, easy to deploy, and widely applicable. Although macaroons are bearer credentials, like Web cookies, macaroons embed caveats that attenuate and contextually confine when, where, by who, and for what purpose a target service should authorize requests. This paper describes macaroons and motivates their design, compares them to other credential systems, such as cookies and SPKI/SDSI, evaluates and measures a prototype implementation, and discusses practical security and application considerations. In particular, it is considered how macaroons can enable more fine-grained authorization in the Cloud, e.g., by strengthening mechanisms like OAuth2, and a formalization of macaroons is given in authorization logic. View details
    Differential privacy with information flow control
    Frank McSherry
    PLAS (2011), pp. 2
    An implementation and semantics for transactional memory introspection in Haskell
    Úlfar Erlingsson
    Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security, ACM, New York, NY, USA (2009), pp. 87-99