Defense Notices

Modern security relies heavily on public key cryptography, and private keys and secrets in general must be protected from attackers. Against a highly-capable adversary it is ideal to store secrets outside of main memory, which is easy on general purpose systems with the now widely-available Trusted Platform Module (TPM) 2.0. However, the lack of integration between the TPM and the OS makes protecting secrets with automated availability needs difficult. We develop a strategy to authenticate OS entities and protect TPM-stored secrets without restricting access to the TPM, using standard features available on Linux---SELinux, Integrity Measurement Architecture (IMA), Extended Verification Module (EVM), and Linux Unified Key Setup (LUKS).

Modern radar systems are increasingly required to operate in complex, dynamic environments where traditional waveform design and signal processing techniques reach fundamental limitations. To address this, waveform diversity has been utilized to increase design degrees of freedom and improve detection performance in challenging scattering scenarios. This dissertation leverages an information-theoretic framework to implement waveform design and receive processing techniques in pulse-agile radars.

First, a modification of Fishers Information known as Marginal Fishers Information is adapted specifically for application to pulse-agile radars, where the ensuing waveform sets are optimally designed to minimize the error covariance of the scene estimate, improving target detection. This methodology is applied to range-Doppler estimation, where some knowledge of the scattering scene is known a priori. By incorporating the a priori knowledge of the scene into the waveform design, the waveforms are able to inherently suppress the self-interference introduced by pulse-agility.

Second, the information theoretic framework is used to create pulse-agile receive processing techniques for range-only and range-Doppler estimation. The range-only implementation is an iterative minimum mean square error (MMSE) estimator similar to a Kalman filter, where the innovation-based update suited to pulse-agility, mirrors the Kalman filter’s correction step. The range-Doppler implementation leverages the same principles as the range-Doppler waveform design technique, where some knowledge of the scattering scenario a priori is used to suppress self-interference and improve the range-Doppler estimate in a desired region.

Both the waveform design and advanced receive processing techniques are first developed in the fast-time slow-time parameterization space, and then translated to a frequency-domain implementation to reduce computation complexity and improve tractability. Finally, future work is proposed to round out the content of the dissertation.

Advances in high-throughput Next Generation Sequencing (NGS) technologies have transformed our ability to study biological systems. However, a fundamental gap remains between generating data and interpreting it. Sequencing produces genomes, transcriptomes, and cell-derived signals as millions of short, fragmented sequences, resulting in the loss of biological context, specifically the long-range relationships that determine genes, structured RNAs, or regulatory signals. This work investigates computational and experimental approaches to improve functional discovery by reconstructing or preserving biological context. The concept is developed across three interconnected dimensions: sensitivity, scalability, and biological fidelity, demonstrating that context is lost and must be recovered at two distinct stages of the discovery process.

The first contribution handles the loss of context that occurs after sequencing. By representing metagenomic sequencing reads as connected paths in an assembly graph and guiding graph traversal with biological models, this work recovers both protein-coding and non-coding signals that conventional fragment-level analyses fail to detect, thereby revealing functional pathways that would otherwise be missed. The second contribution makes this recovery practical at scale by introducing a significantly faster framework that preserves the sensitivity of graph-based methods while reducing computational costs by over an order of magnitude, thus enabling the analysis of large present-day datasets.

The third contribution studies the loss of context prior to sequencing. Using extracellular vesicles as a model system, the findings show that cells cultured in conventional two-dimensional environments generate signals that differ from their physiological state. In contrast, cells cultured in three-dimensional models produce signals that closely resemble those observed in patients. This shows that an accurate biological model is essential for reliable discovery, since computational methods cannot recover signals that are fundamentally distorted at their origin.

Taken together, these contributions establish a set of methods and principles for extracting meaningful biological information from fragmented, high-throughput genomic data, thereby enabling more accurate functional discovery.

End-to-end encrypted (E2EE) messaging services rely on the service operator to distribute authentic public keys. This arrangement protects users from external attackers, but fails catastrophically when the service itself acts maliciously. A service that distributes a spoofed key can silently decrypt, read, and re-encrypt its users' communications—undetectably, if users simply assume the service is trustworthy.

This thesis proposes and evaluates a state-replicated key directory, a model that decouples key distribution from the messaging service entirely. Instead of a single service controlling the directory, the directory is built and maintained across multiple decentralized nodes that follow a consensus and validation protocol. This design substantially raises the cost of key substitution attacks and, under well-defined assumptions, can prevent them outright.

We make three core contributions. First, we present End2, a fully functional browser-based E2EE messaging application that integrates a state-replicated key directory without modifying the underlying cryptographic session protocol. Second, we implement and compare three distinct key directory backends—centralized, permissionless blockchain (Ethereum), and permissioned blockchain (CometBFT)—and analyze their respective security and performance trade-offs. Third, we provide an empirical evaluation under realistic workloads, including upload and query latency, long-term performance degradation, validator failure resilience, and detection of malicious key insertions.

Our results show that a permissioned, Byzantine fault-tolerant key directory achieves query performance comparable to a centralized directory while providing substantially stronger security guarantees against service-side attacks. State-replicated key directories offer a practical and deployable path toward reducing the excessive trust placed in modern E2EE messaging providers.