Multi-party Off-the-Record Messaging Ian Goldberg glu Berkant - PowerPoint PPT Presentation

Motivation mpOTR Wrap up Multi-party Off-the-Record Messaging Ian Goldberg ∗ glu † Berkant Ustao˘ Matthew D. Van Gundy ‡ Hao Chen ‡ ∗ University of Waterloo † NTT Information Sharing Platform Laboratories ‡ University of California, Davis 16 th ACM Conference on Computer and Communications Security Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 1

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Chicago Outfit Boss Al Capone Bootlegging Gambling Extortion Bugs Moran Paul Ricca Machine Gun Mc Gurn Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 2

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Chicago Outfit The Law Boss Eliot Ness Al Capone Bootlegging Gambling Extortion Bugs Moran Paul Ricca Machine Gun Mc Gurn Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 3

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Chicago Outfit The Law Boss Eliot Ness Al Capone Bootlegging Gambling Extortion Bugs Moran Paul Ricca Machine Gun Mc Gurn Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 4

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon Bugs Ricca Capone McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 5

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon M Bugs Ricca Capone M McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 6

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon Bugs: M M Bugs Ricca Capone M Bugs: M McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 7

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon Bugs: M M Bugs Ricca Capone M Bugs: M Bugs: M McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 8

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon Bugs Ricca Capone Ness here. Ness here. McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 9

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon Bugs Ricca Capone And, . . . Capone. . . McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 10

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon Bugs Ricca Capone Protect me McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 11

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon Bugs Ricca Capone Protect my family Protect me McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 12

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon Bugs Ricca Capone Only you Only you McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 13

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon Ness: Protect family Bugs Ricca Capone Only you Only you McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 14

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon Bugs Ricca Capone Ok Ok McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 15

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon x ∧ ¬ y ¬ x ∧ y Bugs Ricca Capone McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 16

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon x ∧ ¬ y ¬ x ∧ y Bugs Ricca Capone x McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 17

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon x ∧ ¬ y ¬ x ∧ y Bugs Ricca Capone y x McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 18

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon x ∧ ¬ y ¬ x ∧ y Bugs Ricca Capone y x McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 19

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon x ∧ ¬ y ¬ x ∧ y Ness: x Ness: y Bugs Ricca Capone y x McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 20

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon Bugs Ricca Capone M M ′ McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 21

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon Bugs Ricca Capone M M ′ Bugs: M Ricca: M ′ McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 22

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon Bugs Ricca Capone M M ′ Bugs: M Ricca: M ′ Bugs: M Ricca: M ′ McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 23

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon Bugs: M Ricca: M ′ Bugs Ricca Capone M M ′ Bugs: M Ricca: M ′ Bugs: M Ricca: M ′ McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 24

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon Bugs: M Ricca: M ′ Bugs Ricca Capone McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 25

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon Bugs: M Ricca: M ′ Bugs Ricca Capone Bugs: Z Ricca: Z ′ McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 26

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon Bugs: M Ricca: M ′ Bugs Ricca Bugs: Z Ricca: Z ′ Capone Bugs: Z Ricca: Z ′ McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 27

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon Bugs: M Ricca: M ′ Bugs Ricca Bugs: Z Ricca: Z ′ Capone Bugs: M Ricca: Z ′ McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 28

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions The Secret Life of the American Stool Pigeon Bugs: M Ricca: M ′ Bugs Ricca Bugs: Z Ricca: Z ′ Capone Bugs: M Ricca: Z ′ Bugs: M Ricca: Z ′ McGurn Ness Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 29

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions System Requirements and Threat Model Requirements The Adversary ◮ Confidentiality ◮ Has full control of the network ◮ Entity Authentication ◮ Corrupts up to n − 1 participants ◮ Origin Authentication ◮ Delivers wire transcripts and ◮ Consensus corrupt participant state to the ◮ (Limited) Non-Repudiation Judge ◮ Plausible Deniability ◮ Forgeability The Judge ◮ Malleability ◮ Distinguishes legitimate transcripts from forgeries ◮ Given: transcript, corrupt participant state, all long-lived secrets Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 30

Motivation mpOTR Wrap up Introduction Threat Model Partial Solutions Partial Solutions ◮ PGP ◮ Employs digital signatures for non-repudiation ◮ Allows proving authorship to a third-party ◮ Two-party Off-the-Record Communication ◮ All confidentiality and authenticity based on shared secret ◮ Symmetric capabilities allow impersonation Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 31

Motivation mpOTR Wrap up DSKE Initiation Communication Shutdown Overview We achieve Multi-party Off-the-Record Messaging through: ◮ Generate per-session ephemeral signing keys ◮ Deniable signature key exchange (DSKE) ◮ Generate shared group encryption key ◮ Until membership change: ◮ Communicate via authenticated encryption ◮ Detect consensus violations Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 32

Motivation mpOTR Wrap up DSKE Initiation Communication Shutdown Deniable Signature Key Exchange (DSKE) Guarantees Bugs (respectively Ricca) that: ◮ He is indeed talking to Ricca ◮ Ricca has chosen PK R as ephemeral signature key for session sid ◮ Ricca knows private key SK R corresponding to PK R ◮ A corrupt Ricca cannot prove to Capone that PK B is Bugs’s key Given ◮ Deniable Key Exchange (Di Raimondo and Gennaro CCS 2006) ◮ Authenticated Encryption ◮ Secure Public-Key Signature Scheme Goldberg, Ustao˘ glu, Van Gundy, Chen mpOTR CCS 2009 33