Benoit Pommerenke

Isabel Group is a Belgian company that has been founded in 1995 at the initiative of the major banks, the present shareholders, and that has become the leading provider of the multi-bank internet services for professional users in Belgium. Isabel PKI was a custom software developed in 1996 with in-house cryptographic libraries, supporting only 1024 bits RSA keys for clients, 2048 bits RSA keys for the CA and only supporting SHA1 for signature. The goal of the PKI upgrade project is to move to a CA with 4096 bits RSA keys, 2048 bits RSA keys for client and using SHA256 to sign certificates and transactions. o Move the CA legacy code (1996) to OpenSSL o Change the CA code to handle 4096 bits RSA keys for the CA, 2048 bits RSA keys for clients and using SHA256 for signature of client’s certificates and CRLs. o Change the code of the CA to use SafeNet Luna 5 (FIPS 140-2 level 3) from Luna 4 (FIPS 140-1 Level 3). o Help people in charge of applications to move to those keys sizes and hash algorithms o Move custom Isabel SSO from Apache 2.2.x to Apache 2.4.x.

With a footprint in more than 20 countries, 43,700 employees, and external revenue of 7.9 billion euros (2016), T-Systems is one of the world’s leading providers of information and communications technology (ICT).  Undisclosed Client o Design and implement multiple PKI systems (Under NDA)

The presidency asks me to design a safe and cost-effective driver license. o I have used a PVC card (SmartCards form factor) to print on it. What I have printed : o On the left side, the picture of the driver, all the information needed for a driving license o On the right side, a QRCode, inside this QRCode, all the information of the left side, a serial number and all this was in JSON. This JSON was signed (JSON Signature). o I have written an android application using the flutter framework. This application was able to read the QRCode and decode it. After the application verify the signature and whit the serial number open a connection to the backend and grab the picture of the driver and display on the policeman smartphone the driver license.

o moves all the luna5 to luna7 o create a new PKI(OpenTrust) with the Proteccio HSM o TPM Study o Upgrade of theTrustedX eIDAS Platform (Remote signing for individuals)

· Develop and design an IDS for the CAN Bus using an Arduino microcontroller and the unsupervised learning algorithm : IsolationForest. · Studying RAG (Retrieval-Augmented Generation): · Vectorization Algorithm used: Bag of Word, Count Vectorizer, Count Vectorizer with genetic algorithms, TF-IDF, Word2Vec, GloVe, FastText, BERT, RoBerta, Doc2Vec, XLNet · Chunking Algorithm used : Fixed-Size Sliding Window, Sentence-Based Chunking, Semantic Segmentation, Token-Level Chunking, Overlap-Based Chunking, Hierarchical Chunking, Query-Based Chunking, Rule-Based Chunking, ML-Based Chunking, Context-Aware Chunking. · Vector Databases: Milvus, Chroma, ElasticSearch (k-NN) · Prompt used: Basic Information Retrieval Prompt, Summarization Prompt, Query-Augmented Prompt, Context Expansion Prompt, Multi-Document Aggregation Prompt, Chain-of-Thought Prompt, Generative Refinement Prompt, Contextual QA Prompt, Instructional Prompt, Role-Based Prompt, Open-Ended Prompt, Prompt for Contradiction Detection · LLM used : OpenAI, Mistral and Gemini · The corpus used has 25000 documents and can be downloaded at : https://cdn.openai.com/API/examples/data/vector_database_wikipedia_articles_embedded.zip · Make a POC of IOT using: · An Arduino microcontroller · An MQTT broker (mosquito) · Fluentd and OpenSearch(Dashboard) · Create an IDS using fluentd and OpenSearch(Dashboard)

 PAY-NXT (BANCONTACT & PAY-NXT BSP Key Ceremony) PAY-NXT is a Payment Service Provider, specializing in online-, recurring-, and subscription-payments. PAY-NXT serves a wide variation of merchants, ranging from SME's to large corporate billers. PAY-NXT is licensed as a Payment Institution by the Belgian National Bank. o Develop all the tools for the Key Ceremony using SafeNet Luna HSM, OpenSSL and the Luna PKCS11 o Write down the Key Ceremony Procedure o Based on AWS

Oxyliom through NeXus Group, has today the most complete and most integrated offer for user authentication and identification solutions. Oxyliom products and solutions cover the whole spectrum of the Identity and Access Management (IAM), SSO, BYOD and let you associate usability, simplicity, and security.  Deploy an internal Public Key Infrastructure (PKI) for Banque Populaire, Casablanca, Morocco. The PKI is used for: o Signature of in-house documents, this includes:  Digitization of the procedure for granting credit.  Data exchange of transfer orders and billing.  Signature with probative value (according to the Moroccan law 53-05 on the electronic exchange of legal information and its implementing Decree No. 2-08-51.).  Client contract digitization (using OTP and signature of logs) o A retention period of 10 years. o Secure email. o Ensure confidentiality of the most sensitive trade (large amounts exchanged, personal customer data...). o Securing business flow. o Strong authentication. o SSL certificates (https) for client websites (Internet). o Network access control (including Wi-Fi). o Strong authentication of administrators. o Hardware and software token. o Managing more than 10 people (internal and external) The proposed solution is based on the NeXus Certificate Manager Suite.  Design a multifactor authentication (software, hardware and SMS OTP) for web banking (based on J2EE) using the NeXus Hybrid Access Gateway for the Attijariwafa Bank, Casablanca, Morocco.  Oxyliom have received the best mobile application award and the best security solution award at the MED IT 2013.  Create a PKCS15 Smart Card Profile (Electronic ID) for the IDClassic 300 Gemalto Smart Card in accordance with the PKCS11 NeXus middleware.  Design and develop a Smart Card (Electronic ID) renewal tool via the web and integrate the functionality with the Euroclear S.A. IAM and PKI (NeXus Certificate Manager)