A Perfect Memory: Key Compromise in an Efficiency-centric World - - PowerPoint PPT Presentation

▶

Feb 10, 2023 831 likes •1.04k views

A Perfect Memory: Key Compromise in an Efficiency-centric World Britta Hale NTNU, Norwegian University of Science and Technology A Perfect Memory.... Britta Hale | Crypto vs. Mass Surveillance Workshop Facebook Google Lule, Sweden Britta

SLIDE 1

A Perfect Memory: Key Compromise in an Efficiency-centric World

Britta Hale

NTNU, Norwegian University of Science and Technology

SLIDE 2

Britta Hale | Crypto vs. Mass Surveillance Workshop

A Perfect Memory....

SLIDE 3

Britta Hale | Crypto vs. Mass Surveillance Workshop

Facebook Google

Luleå, Sweden

SLIDE 4

Britta Hale | Crypto vs. Mass Surveillance Workshop

Threat Landscape: Always present adversary Long-term adversary

sk1 sk2 sk3 sk4 sk5 Learn Master K

Are past session keys secure?

SLIDE 5

Britta Hale | Crypto vs. Mass Surveillance Workshop

Perfect Forward Secrecy: Long-term key compromised Past session keys remain secure sk1 sk2 sk3 sk4 sk5 Learn Master K

*Günther, C. G. Eurocrypt ’89

SLIDE 6

Britta Hale | Crypto vs. Mass Surveillance Workshop

forward secrecy in practice

TLS... ?
DHE-RSA / ECDHE-RSA / ...
TLS 1.2 vs. TLS 1.3
TLS 1.3 0-RTT ... What?

SLIDE 7

Britta Hale | Crypto vs. Mass Surveillance Workshop Client Server Client Hello Client Key Exchange Change Cipher Spec. Client Finished Application Data Server Hello Certificate Server Hello Done Change Cipher Spec. Server Finished Application Data

Simplified TLS Handshake Protocol

SLIDE 8

Britta Hale | Crypto vs. Mass Surveillance Workshop

The story of low-latency / 0-RTT protocols... Data is sent encrypted immediately

SLIDE 9

Britta Hale | Crypto vs. Mass Surveillance Workshop

QUIC by ...

(Quick UDP Internet Connections)

SLIDE 10

Britta Hale | Crypto vs. Mass Surveillance Workshop

low-latency key exchange

Server cnf Cache: Server cnf Client Server

[m]temp.sk [m]sk . . .

SLIDE 11

Britta Hale | Crypto vs. Mass Surveillance Workshop

Client Server

(previous communication) SignK(gs) 0-RTT key exchange: gx [0-RTT data]temp.sk gy [further data]sk temp.sk ← gxs temp.sk ← gxs sk ← gxy sk ← gxy

SLIDE 12

Britta Hale | Crypto vs. Mass Surveillance Workshop

QUIC
Presented in 2013
Encrypted data can be sent in the first flow
To be replaced by TLS 1.3
TLS 1.3 draft (version 18): 0-RTT variant
based on a pre-shared key
new forward secrecy concerns

SLIDE 13

Britta Hale | Crypto vs. Mass Surveillance Workshop

Client Server

(previous communication) (previous communication) 0-RTT key exchange:

“temp.sk identity”, *Client key share

[0-RTT data]temp.sk

“temp.sk identity”, *Server key share

[further data]sk temp.sk temp.sk Derive sk Derive sk “This data is not forward secret, as it is encrypted solely under keys derived using the offered PSK.” – TLS 1.3 Draft

SLIDE 14

Britta Hale | Crypto vs. Mass Surveillance Workshop

0-rtt folklore For 0-RTT, there is an “upper bound on the forward security of the connection” – QUIC Crypto Specification Forward secrecy “can’t be done in 0-RTT” – TLS 1.3 mailing list

SLIDE 15

Britta Hale | Crypto vs. Mass Surveillance Workshop

0-RTT Key Exchange with Full Forward Secrecy

Felix Günther1 Britta Hale2 Tibor Jager3 Sebastian Lauer3

1TU Darmstadt 2NTNU, Trondheim 3Ruhr-University Bochum

Server has public/secret key pair (PK, SK),

where SK is updated

Puncturable FS Key Encapsulation Mechanism (PFS-KEM)
Built from a HIBKEM and One-Time Signatures

SLIDE 16

Britta Hale | Crypto vs. Mass Surveillance Workshop

final comments

Forward secrecy is a serious problem

in a world with indefinitely stored data

0-RTT encrypted data is a growing demand:

traffic increase, IoT, ...

Current 0-RTT solutions do not address forward secrecy,
r have simply changed the context
Forward secrecy is possible for 0-RTT data,

despite all previous claims

SLIDE 17

Britta Hale | Crypto vs. Mass Surveillance Workshop

Questions

SLIDE 18