0-RTT Key Establishment with Full Forward Secrecy Felix Gnther 1 - - PowerPoint PPT Presentation

▶
0 rtt key establishment with full forward secrecy
SMART_READER_LITE
LIVE PREVIEW

0-RTT Key Establishment with Full Forward Secrecy Felix Gnther 1 - - PowerPoint PPT Presentation

Jan 31, 2023 183 likes •707 views

0-RTT Key Establishment with Full Forward Secrecy Felix Gnther 1 Britta Hale 2 Tibor Jager 3 Sebastian Lauer 4 1 Technischen Universitt Darmstadt 2 NTNU Norwegian University of Science and Technology 3 Paderborn University 4 Ruhr-Universitt

slide-1
SLIDE 1

0-RTT Key Establishment with Full Forward Secrecy

Felix Günther1 Britta Hale2 Tibor Jager3 Sebastian Lauer4

1Technischen Universität Darmstadt 2NTNU Norwegian University of Science and Technology 3Paderborn University 4Ruhr-Universität Bochum

Eurocrypt 2017

slide-2
SLIDE 2

Britta Hale | EUROCRYPT 2017 | 2/256

0-RTT with full forward secrecy

Yes, it is possible!

slide-3
SLIDE 3

Britta Hale | EUROCRYPT 2017 | 3/256

key exchange latency Round-Trip Time (RTT)

Client Server 1-RTT 2-RTT

slide-4
SLIDE 4

Britta Hale | EUROCRYPT 2017 | 4/256

key exchange latency TLS+TCP:

Client Server Session Key: K Session Key: K 1-RTT ClientHello ServerHello Enc.Extensions Server Finished Client Finished

slide-5
SLIDE 5

Britta Hale | EUROCRYPT 2017 | 4/256

key exchange latency TLS+TCP:

1-RTT TCP SYN TCP SYN+ACK Client Server Session Key: K Session Key: K 1-RTT ClientHello ServerHello Enc.Extensions Server Finished Client Finished

slide-6
SLIDE 6

Britta Hale | EUROCRYPT 2017 | 5/256

key exchange latency TLS + UDP:

1-RTT TCP SYN TCP SYN+ACK Client Server Session Key: K Session Key: K 1-RTT ClientHello ServerHello Enc.Extensions Server Finished Client Finished

slide-7
SLIDE 7

Britta Hale | EUROCRYPT 2017 | 6/256

Why not send cryptographically protected payload immediately?

slide-8
SLIDE 8

Britta Hale | EUROCRYPT 2017 | 7/256

Zero Round-Trip Time (0-RTT)

Client Server payload 0-RTT

slide-9
SLIDE 9

Britta Hale | EUROCRYPT 2017 | 8/256

  • QUIC by ...
slide-10
SLIDE 10

Britta Hale | EUROCRYPT 2017 | 8/256

  • QUIC by ...

(Quick UDP Internet Connections)

slide-11
SLIDE 11

Britta Hale | EUROCRYPT 2017 | 9/256

QUIC Protocol

(prior session) config: gsk, Sig(sksig, gsk) Client Server (pksig, sksig), sk

slide-12
SLIDE 12

Britta Hale | EUROCRYPT 2017 | 9/256

QUIC Protocol

(prior session) config: gsk, Sig(sksig, gsk) Client Server (pksig, sksig), sk ga Enc(k, payload) a ∈ Zq, k = ga·sk b ∈ Zq Enc(k, gb) K = gab K = gab

slide-13
SLIDE 13

Britta Hale | EUROCRYPT 2017 | 10/256

QUIC Protocol Issues: Replay

Client Server (pksig, sksig), sk ga Enc(k, payload) k = ga·sk

slide-14
SLIDE 14

Britta Hale | EUROCRYPT 2017 | 10/256

QUIC Protocol Issues: Replay

Client Server (pksig, sksig), sk ga Enc(k, payload) k = ga·sk ga Enc(k, payload)

slide-15
SLIDE 15

Britta Hale | EUROCRYPT 2017 | 10/256

QUIC Protocol Issues: Forward Secrecy

Client Server (pksig, sksig), sk ga Enc(k, payload) k = ga·sk

slide-16
SLIDE 16

Britta Hale | EUROCRYPT 2017 | 10/256

QUIC Protocol Issues: Forward Secrecy

Client Server (pksig, sksig), sk ga k = ga·sk Enc(k, payload) k = ga·sk

slide-17
SLIDE 17

Britta Hale | EUROCRYPT 2017 | 11/256

Forward Secrecy Threat Landscape:

slide-18
SLIDE 18

Britta Hale | EUROCRYPT 2017 | 11/256

Forward Secrecy Threat Landscape:

K0

slide-19
SLIDE 19

Britta Hale | EUROCRYPT 2017 | 11/256

Forward Secrecy Threat Landscape:

K0 k1

slide-20
SLIDE 20

Britta Hale | EUROCRYPT 2017 | 11/256

Forward Secrecy Threat Landscape:

K0 k1 K1

slide-21
SLIDE 21

Britta Hale | EUROCRYPT 2017 | 11/256

Forward Secrecy Threat Landscape:

K0 k1 K1

slide-22
SLIDE 22

Britta Hale | EUROCRYPT 2017 | 11/256

Forward Secrecy Threat Landscape:

K0 k1 K1

Learn long-term key

slide-23
SLIDE 23

Britta Hale | EUROCRYPT 2017 | 11/256

Forward Secrecy Threat Landscape:

K0 k1 K1 ki

Learn long-term key

slide-24
SLIDE 24

Britta Hale | EUROCRYPT 2017 | 11/256

Forward Secrecy Threat Landscape:

K0 k1 K1 ki Ki

Learn long-term key

slide-25
SLIDE 25

Britta Hale | EUROCRYPT 2017 | 11/256

Forward Secrecy Threat Landscape:

K0 k1 K1 ki Ki

Learn long-term key

Are past session keys secure?

slide-26
SLIDE 26

Britta Hale | EUROCRYPT 2017 | 11/256

Forward Secrecy Threat Landscape:

K0 k1 K1 ki Ki

Learn long-term key

Are past session keys secure? Perfect Forward Secrecy: Long-term key compromised Past session keys remain secure

slide-27
SLIDE 27

Britta Hale | EUROCRYPT 2017 | 12/256

QUIC

K0 k1 K1 ki Ki

Learn long-term key medium-lived

slide-28
SLIDE 28

Britta Hale | EUROCRYPT 2017 | 13/256

Is Perfect Forward Secrecy even possible for 0-RTT?

slide-29
SLIDE 29

Britta Hale | EUROCRYPT 2017 | 14/256

Yes!

slide-30
SLIDE 30

Britta Hale | EUROCRYPT 2017 | 14/256

Yes!

Our design:

  • Full Forward Secrecy
slide-31
SLIDE 31

Britta Hale | EUROCRYPT 2017 | 14/256

Yes!

Our design:

  • Full Forward Secrecy
  • Replay protection
slide-32
SLIDE 32

Britta Hale | EUROCRYPT 2017 | 14/256

Yes!

Our design:

  • Full Forward Secrecy
  • Replay protection
  • Based on hierarchical ID-based key encapsulation

mechanism (with selective security) and one-time signatures

slide-33
SLIDE 33

Britta Hale | EUROCRYPT 2017 | 14/256

Yes!

Our design:

  • Full Forward Secrecy
  • Replay protection
  • Based on hierarchical ID-based key encapsulation

mechanism (with selective security) and one-time signatures

  • Flexible to different instantiations/assumptions
  • post-quantum
  • pairings
  • etc...
slide-34
SLIDE 34

Britta Hale | EUROCRYPT 2017 | 15/256

Core idea: Server: static public key – private key can be updated → Forward Secret KEM → Forward Secret 0-RTT KE

slide-35
SLIDE 35

Britta Hale | EUROCRYPT 2017 | 16/256

Forward Secure 0-RTT KE Core idea:

Client Server (pk, sk) C (C, K) ← Enc(pk) K ← Dec(sk, C) sk ← Punct(sk, C) ≈ sk/C K K

slide-36
SLIDE 36

Britta Hale | EUROCRYPT 2017 | 17/256

Hierarchical ID-Based KEM

sk sk0 sk1 sk00 sk01 sk10 sk11 sk000 sk001 sk010 sk011 sk100 sk101 sk110 sk111 sk0010 sk0011

slide-37
SLIDE 37

Britta Hale | EUROCRYPT 2017 | 17/256

Hierarchical ID-Based KEM

sk sk0 sk1 sk00 sk01 sk10 sk11 sk000 sk001 sk010 sk011 sk100 sk101 sk110 sk111 sk0010 sk0011

slide-38
SLIDE 38

Britta Hale | EUROCRYPT 2017 | 18/256

Puncturing private key sk

sk sk0 sk1 sk00 sk01 sk10 sk11 sk000 sk001 sk010 sk011 sk100 sk101 sk110 sk111 sk0010 sk0011

slide-39
SLIDE 39

Britta Hale | EUROCRYPT 2017 | 18/256

Puncturing private key sk

sk sk0 sk1 sk00 sk01 sk10 sk11 sk000 sk001 sk010 sk011 sk100 sk101 sk110 sk111 sk0010 sk0011

slide-40
SLIDE 40

Britta Hale | EUROCRYPT 2017 | 19/256

Puncturing private key sk

sk sk0 sk1 sk00 sk01 sk10 sk11 sk000 sk001 sk010 sk011 sk100 sk101 sk110 sk111 sk0010 sk0011

slide-41
SLIDE 41

Britta Hale | EUROCRYPT 2017 | 19/256

Puncturing private key sk

sk sk0 sk1 sk00 sk01 sk10 sk11 sk000 sk001 sk010 sk011 sk100 sk101 sk110 sk111 sk0010 sk0011

  • private key size ≈

#punctures × log (max #punctures/timeslot) + log(#timeslots)

  • #punctures = #sessions
slide-42
SLIDE 42

Britta Hale | EUROCRYPT 2017 | 20/256

Purging the private key: time sync intervals t0, t1, . . .

sk sk0 sk1 sk00 sk01 sk10 sk11 sk000 sk001 sk010 sk011 sk100 sk101 sk110 sk111

slide-43
SLIDE 43

Britta Hale | EUROCRYPT 2017 | 21/256

Purging the private key: time sync intervals t0, t1, . . .

sk sk0 sk1 erase after t0 sk00 sk01 sk10 sk11 sk000 sk001 sk010 sk011 sk100 sk101 sk110 sk111

slide-44
SLIDE 44

Britta Hale | EUROCRYPT 2017 | 22/256

Evaluation:

Barreto-Naehrig elliptic curve P256, bilinear pairing, pk 128bits,

  • ne-time sig pk 256bits, timeslot length 30bits, avg. clock rate 3.2GHz
  • Enc: ms
  • Dec: seconds
  • Puncturing: seconds
slide-45
SLIDE 45

Britta Hale | EUROCRYPT 2017 | 22/256

Evaluation:

Barreto-Naehrig elliptic curve P256, bilinear pairing, pk 128bits,

  • ne-time sig pk 256bits, timeslot length 30bits, avg. clock rate 3.2GHz
  • Enc: ms
  • Dec: seconds
  • Puncturing: seconds → need only selective security

...Room for improvement?

slide-46
SLIDE 46

Britta Hale | EUROCRYPT 2017 | 22/256

Evaluation:

Barreto-Naehrig elliptic curve P256, bilinear pairing, pk 128bits,

  • ne-time sig pk 256bits, timeslot length 30bits, avg. clock rate 3.2GHz
  • Enc: ms
  • Dec: seconds
  • Puncturing: seconds → need only selective security

...Room for improvement?

... vs. Green and Myers S&P ’15:

  • Any HIBE vs. specific bilinear groups
  • CCA-secure in standard model vs. ROM
slide-47
SLIDE 47

Britta Hale | EUROCRYPT 2017 | 23/256

Summary Now:

  • FS 0-RTT key exchange + security model
  • Generic construction + security proof

(from one-time signatures and any hierarchical ID-based KEM with selective security)

slide-48
SLIDE 48

Britta Hale | EUROCRYPT 2017 | 23/256

Summary Now:

  • FS 0-RTT key exchange + security model
  • Generic construction + security proof

(from one-time signatures and any hierarchical ID-based KEM with selective security)

Future:

  • Optimize KEM key delegation
  • Make it practical!
slide-49
SLIDE 49

Britta Hale | EUROCRYPT 2017 | 24/256

Questions ?

slide-50
SLIDE 50

Britta Hale | EUROCRYPT 2017 | 25/256

slide-51
SLIDE 51

Britta Hale | EUROCRYPT 2017 | 26/256

acknowledgements

Some slide designs are based on presentations of the same work by co-authors Felix Günther and Tibor Jager