Public-Key 0-RTT Protocols Tibor Jager Paderborn University Summer - - PowerPoint PPT Presentation

▶
public key 0 rtt protocols
SMART_READER_LITE
LIVE PREVIEW

Public-Key 0-RTT Protocols Tibor Jager Paderborn University Summer - - PowerPoint PPT Presentation

Nov 08, 2023 99 likes •1.07k views

Public-Key 0-RTT Protocols Tibor Jager Paderborn University Summer School on Real-World Crypto and Privacy ibenik, Croatia June 20 th , 2019 Outline Mass surveillance and Forward Security 0-RTT Protocols and their Forward Security

slide-1
SLIDE 1

Public-Key 0-RTT Protocols

Tibor Jager Paderborn University Summer School on Real-World Crypto and Privacy Šibenik, Croatia June 20th, 2019

slide-2
SLIDE 2

Outline

  • Mass surveillance and Forward Security
  • 0-RTT Protocols and their Forward Security

– Challenges – Impossibility?

  • Forward-Secure 0-RTT Protocols

– Rather theoretical solution (EUROCRYPT 2017) – Somewhat practical solution (EUROCRYPT 2018) – Practical solution for TLS 1.3 (EUROCRYPT 2019)

2

slide-3
SLIDE 3

Internet

Before ca. 2011

3

Encrypted = Not encrypted =

slide-4
SLIDE 4

Internet

Before ca. 2011

4

J

Encrypted = Not encrypted =

slide-5
SLIDE 5

5 https://searchengineland.com/google-to-begin-encrypting-searches-outbound-clicks-by-default-97435

slide-6
SLIDE 6

6 https://searchengineland.com/google-to-begin-encrypting-searches-outbound-clicks-by-default-97435 https://www.facebook.com/notes/facebook-engineering/secure- browsing-by-default/10151590414803920/

slide-7
SLIDE 7

7 https://searchengineland.com/google-to-begin-encrypting-searches-outbound-clicks-by-default-97435 https://blog.whatsapp.com/10000618/end-to-end-encryption?l=en https://www.facebook.com/notes/facebook-engineering/secure- browsing-by-default/10151590414803920/ April 5, 2016

slide-8
SLIDE 8

Internet

Today

8

L

Encrypted = Not encrypted =

slide-9
SLIDE 9

Internet

Mass Surveillance of Encrypted Data

9

Encrypted = Not encrypted = Database

slide-10
SLIDE 10

Internet

Mass Surveillance of Encrypted Data

10

Encrypted = Not encrypted =

Google, we need your secret key.

Database

slide-11
SLIDE 11

Internet

Mass Surveillance of Encrypted Data

11

Encrypted = Not encrypted =

Google, we need your secret key.

Database

slide-12
SLIDE 12

Lavabit

12

slide-13
SLIDE 13

https://en.wikipedia.org/wiki/Lavabit#Connection_to_Edward_Snowden

Lavabit

13

slide-14
SLIDE 14

https://en.wikipedia.org/wiki/Lavabit#Connection_to_Edward_Snowden

Lavabit

14 https://arstechnica.com/tech-policy/2014/04/lavabit-held-in-contempt-of-court-for- printing-crypto-key-in-tiny-font/

slide-15
SLIDE 15

Mass Surveillance Everywhere

15 https://techcrunch.com/2016/01/14/no-backdoors-but-uk-government- still-wants-encryption-decrypted-on-request/ https://www.forbes.com/sites/kenrapoza/2017/10/16/russia-fines- cryptocurrency-worlds-preferred-messaging-app-telegram/#767569eef765 https://zoomapps.club/whatsapp-threema-and-co- seehofer-wants-to-enforce-decryption-of-chats/

slide-16
SLIDE 16

Forward Security*

Time

16

Secret key Session 1 with Alice Session 3 with Charlie Session 2 with Bob Session 4 with Alice

Makes large-scale collection of encrypted data useless

*aka. Forward Secrecy, aka. Perfect Forward Secrecy/Security, aka. pre-compromise security

slide-17
SLIDE 17

Outline

  • Mass surveillance and Forward Security
  • 0-RTT Protocols and their Forward Security

– Challenges – Impossibility?

  • Forward-Secure 0-RTT Protocols

– Rather theoretical solution (EUROCRYPT 2017) – Somewhat practical solution (EUROCRYPT 2018) – Practical solution for TLS 1.3 (EUROCRYPT 2019)

17

slide-18
SLIDE 18

Server S

Key Establishment with TLS 1.3

Client

18

ServerHello ClientHello Cert, Cert Vfy., SFIN Client Finished CFIN

Compute session key k

Enck(Payload)

slide-19
SLIDE 19

Server S

Key Establishment with TLS 1.3

Client

19

ServerHello ClientHello Cert, Cert Vfy., SFIN Client Finished CFIN

1 RTT Compute session key k

Enck(Payload)

slide-20
SLIDE 20

Server S

Key Establishment with TLS 1.3

Client

20

ServerHello ClientHello Cert, Cert Vfy., SFIN Client Finished CFIN

1 RTT Compute session key k

SYN SYN/ACK ACK

1 RTT

Enck(Payload)

slide-21
SLIDE 21

Server S

Key Establishment with TLS 1.3

Client

21

ServerHello ClientHello Cert, Cert Vfy., SFIN Client Finished CFIN

1 RTT Compute session key k

SYN SYN/ACK ACK

1 RTT

2 RTTs before first payload message can be sent Is this really necessary?

Enck(Payload)

slide-22
SLIDE 22

Server S

Key Establishment with TLS 1.3

Client

22

ServerHello ClientHello Cert, Cert Vfy., SFIN Client Finished CFIN

1 RTT Compute session key k

Enck(Payload)

Using UDP instead of TCP saves one RTT

SYN SYN/ACK ACK

1 RTT

Enck(Payload)

slide-23
SLIDE 23

Server S

Key Establishment with TLS 1.3

Client

23

ServerHello ClientHello Cert, Cert Vfy., SFIN Client Finished CFIN

1 RTT Compute session key k

Enck(Payload)

Using UDP instead of TCP saves one RTT Objective: send cryptographically protected payload in first message from client to server (“0-RTT KE”)

SYN SYN/ACK ACK

1 RTT

Enck(Payload)

slide-24
SLIDE 24

Why 0-RTT?

  • Delay page delivery by 100 ms

⇒ -1% revenue

(Amazon, 2006)

  • 500 ms RTT not unusual for*

– Mobile internet – Satellite internet – Rural broadband connections

  • Why not!

24

(*) http://glinden.blogspot.se/2006/11/marissa-mayer-at-web-20.html

slide-25
SLIDE 25

Why 0-RTT?

  • Delay page delivery by 100 ms

⇒ -1% revenue

(Amazon, 2006)

  • 500 ms RTT not unusual for*

– Mobile internet – Satellite internet – Rural broadband connections

  • Why not!

25

(*) http://glinden.blogspot.se/2006/11/marissa-mayer-at-web-20.html

Yearly revenue in 2018: 232.9 billion USD

slide-26
SLIDE 26

Why 0-RTT?

  • Delay page delivery by 100 ms

⇒ -1% revenue

(Amazon, 2006)

  • 500 ms RTT not unusual for*

– Mobile internet – Satellite internet – Rural broadband connections

  • Why not!

26

(*) http://glinden.blogspot.se/2006/11/marissa-mayer-at-web-20.html

Yearly revenue in 2018: 232.9 billion USD

slide-27
SLIDE 27

Why 0-RTT?

  • Delay page delivery by 100 ms

⇒ -1% revenue

(Amazon, 2006)

  • 500 ms RTT not unusual for*

– Mobile internet – Satellite internet – Rural broadband connections

  • Latency requirements of

applications

27

(*) http://glinden.blogspot.se/2006/11/marissa-mayer-at-web-20.html

Yearly revenue in 2018: 232.9 billion USD

slide-28
SLIDE 28

Trivial Protocol

C = Encpk(k) SymEnc(k, payload) k = Decsk(C)

28

(pk, sk) Client Server

slide-29
SLIDE 29

Trivial Protocol

C = Encpk(k) SymEnc(k, payload) k = Decsk(C)

29

Major deficiencies:

  • 1. No Forward Secrecy
  • 2. Vulnerable to replay attacks

(pk, sk) Client Server

slide-30
SLIDE 30

Replay Attack

C = Encpk(k) SymEnc(k, payload) (pk, sk) k = Decsk(C)

30

slide-31
SLIDE 31

Replay Attack

C = Encpk(k) SymEnc(k, payload) (pk, sk) k = Decsk(C) C = Encpk(k) SymEnc(k, payload)

31

slide-32
SLIDE 32

Replay Attack

C = Encpk(k) SymEnc(k, payload) (pk, sk) k = Decsk(C) C = Encpk(k) SymEnc(k, payload) C = Encpk(k) SymEnc(k, payload)

32

slide-33
SLIDE 33

Breaking Confidentiality with a Replay Attack

33

Web Server GoodCitizensManual.pdf DissidentsHandbook.pdf Colm MacCárthaigh, Security Review of TLS1.3 0-RTT, https://github.com/tlswg/tls13-spec/issues/1001

slide-34
SLIDE 34

Breaking Confidentiality with a Replay Attack

34

GET DissidentsHandbook.pdf Web Server GoodCitizensManual.pdf DissidentsHandbook.pdf Colm MacCárthaigh, Security Review of TLS1.3 0-RTT, https://github.com/tlswg/tls13-spec/issues/1001

slide-35
SLIDE 35

Breaking Confidentiality with a Replay Attack

35

GET DissidentsHandbook.pdf Web Server GoodCitizensManual.pdf DissidentsHandbook.pdf DissidentsHandbook.pdf Colm MacCárthaigh, Security Review of TLS1.3 0-RTT, https://github.com/tlswg/tls13-spec/issues/1001

slide-36
SLIDE 36

Breaking Confidentiality with a Replay Attack

36

GET DissidentsHandbook.pdf Web Server GoodCitizensManual.pdf DissidentsHandbook.pdf DissidentsHandbook.pdf GET DissidentsHandbook.pdf Colm MacCárthaigh, Security Review of TLS1.3 0-RTT, https://github.com/tlswg/tls13-spec/issues/1001

slide-37
SLIDE 37

Breaking Confidentiality with a Replay Attack

37

GET DissidentsHandbook.pdf Web Server GoodCitizensManual.pdf DissidentsHandbook.pdf GET DissidentsHandbook.pdf DissidentsHandbook.pdf Colm MacCárthaigh, Security Review of TLS1.3 0-RTT, https://github.com/tlswg/tls13-spec/issues/1001

slide-38
SLIDE 38

Breaking Confidentiality with a Replay Attack

38

GET DissidentsHandbook.pdf Web Server GoodCitizensManual.pdf DissidentsHandbook.pdf GET DissidentsHandbook.pdf DissidentsHandbook.pdf Colm MacCárthaigh, Security Review of TLS1.3 0-RTT, https://github.com/tlswg/tls13-spec/issues/1001

slide-39
SLIDE 39

Breaking Confidentiality with a Replay Attack

39

GET DissidentsHandbook.pdf Web Server GoodCitizensManual.pdf DissidentsHandbook.pdf GET DissidentsHandbook.pdf ERROR 404 not found DissidentsHandbook.pdf Colm MacCárthaigh, Security Review of TLS1.3 0-RTT, https://github.com/tlswg/tls13-spec/issues/1001

slide-40
SLIDE 40

Preventing replays for 0-RTT Protocols

  • Server may remember all received messages

– Difficult in applications with multiple servers (load balancing, multiple data centers, …)

  • Alternatively, use this only for applications

where replay attacks are “not harmful”™

  • Eric Rescorla in a talk(*) about TLS 1.3 0-RTT:

– “Difficult application integration issue” – “But too big a win not to do”

40

(*) http://web.stanford.edu/class/ee380/Abstracts/151118-slides.pdf

slide-41
SLIDE 41

Preventing replays for 0-RTT Protocols

  • Server may remember all received messages

– Difficult in applications with multiple servers (load balancing, multiple data centers, …)

  • Or use only for applications where replay

attacks are “not harmful”™

  • Eric Rescorla in a talk(*) about TLS 1.3 0-RTT:

– “Difficult application integration issue” – “But too big a win not to do”

41

(*) http://web.stanford.edu/class/ee380/Abstracts/151118-slides.pdf

slide-42
SLIDE 42

Preventing replays for 0-RTT Protocols

  • Server may remember all received messages

– Difficult in applications with multiple servers (load balancing, multiple data centers, …)

  • Or use only for applications where replay

attacks are “not harmful”™

  • Eric Rescorla in a talk(*) about TLS 1.3 0-RTT:

– “Difficult application integration issue” – “But too big a win not to do”

42

(*) http://web.stanford.edu/class/ee380/Abstracts/151118-slides.pdf

slide-43
SLIDE 43

Objective

Construct a protocol that allows to send cryptographically protected payload in first message from client to server

  • Without replay attacks
  • With forward security

(A priori not even clear that such protocols exist)

43

slide-44
SLIDE 44

Impossible to achieve forward security for 0-RTT KE?

C SymEnc(k, payload) (C, k) = F(pk) (pk, sk) k = G(C, sk) Corruption of sk allows to compute k

44

“What about PFS? Can't be done in 0-RTT.”

(https://mailarchive.ietf.org/arch/msg/tls/OZwGgVhySbVhU36BMX1elQ9x0GE)

slide-45
SLIDE 45

Impossible to achieve forward security for 0-RTT KE?

  • Is it possible to evolve sk, s.t.

G(C, sk) can be computed “only once”?

– Forward-secure encryption [EC:CanHalKat03] – Puncturable encryption [SP:GreMie15]

C SymEnc(k, payload) (C, k) = F(pk) (pk, sk) k = G(C, sk) Corruption of sk allows to compute k

45

slide-46
SLIDE 46

Outline

  • Mass surveillance and Forward Security
  • 0-RTT Protocols and their Forward Security

– Challenges – Impossibility?

  • Forward-Secure 0-RTT Protocols

– Rather theoretical solution (EUROCRYPT 2017) – Somewhat practical solution (EUROCRYPT 2018) – Practical solution for TLS 1.3 (EUROCRYPT 2019)

46

slide-47
SLIDE 47

Idea: Use Puncturable Encryption

(Günther, Hale, Jager, Lauer; EUROCRYPT 2017)

k = Decsk(C)

47

C = Encpk(k) Enc(k, data)

slide-48
SLIDE 48

Idea: Use Puncturable Encryption

(Günther, Hale, Jager, Lauer; EUROCRYPT 2017)

k = Decsk(C) sk\C = Puncture(sk, C) Delete sk

48

C = Encpk(k) Enc(k, data)

slide-49
SLIDE 49

Idea: Use Puncturable Encryption

(Günther, Hale, Jager, Lauer; EUROCRYPT 2017)

  • sk\C decrypts all ciphertexts except for C
  • Repeated puncturing is possible

– sk\C1 = Puncture(sk, C1) – sk\C1,C2 = Puncture(sk\C1, C2) – ... – sk\C1,C2 can not be used to decrypt C1, C2

k = Decsk(C) sk\C = Puncture(sk, C) Delete sk

49

C = Encpk(k) Enc(k, data)

slide-50
SLIDE 50
  • sk\C decrypts all ciphertexts except for C
  • Repeated puncturing is possible

– sk\C1 = Puncture(sk, C1) – sk\C1,C2 = Puncture(sk\C1, C2) – ... – sk\C1,C2 can not be used to decrypt C1, C2

k = Decsk(C) sk\C = Puncture(sk, C) Delete sk

50

C = Encpk(k) Enc(k, data)

Idea: Use Puncturable Encryption

(Günther, Hale, Jager, Lauer; EUROCRYPT 2017)

slide-51
SLIDE 51
  • sk\C decrypts all ciphertexts except for C
  • Repeated puncturing is possible

– sk\C1 = Puncture(sk, C1) – sk\C1,C2 = Puncture(sk\C1, C2) – ...

  • sk\C1,C2 can not be used to decrypt C1 or C2

k = Decsk(C) sk\C = Puncture(sk, C) Delete sk

51

C = Encpk(k) Enc(k, data)

Idea: Use Puncturable Encryption

(Günther, Hale, Jager, Lauer; EUROCRYPT 2017)

slide-52
SLIDE 52

First Theoretical Construction

(Günther, Hale, Jager, Lauer; EUROCRYPT 2017)

  • First 0-RTT protocol with full forward security

– Provably secure – Low communication complexity

  • Main drawbacks:

– |sk|: hundreds of MBs/GBs – Puncturing: several minutes

52

slide-53
SLIDE 53
  • First 0-RTT protocol with full forward security

– Provably secure – Low communication complexity

  • Main drawbacks:

– |sk|: hundreds of MBs/GBs – Puncturing: several minutes

53

First Theoretical Construction

(Günther, Hale, Jager, Lauer; EUROCRYPT 2017)

slide-54
SLIDE 54
  • First 0-RTT protocol with full forward security

– Provably secure – Low communication complexity

  • Main drawbacks:

– |sk|: hundreds of MBs/GBs – Puncturing: several minutes

54

First Theoretical Construction

(Günther, Hale, Jager, Lauer; EUROCRYPT 2017)

slide-55
SLIDE 55
  • First 0-RTT protocol with full forward security

– Provably secure – Low communication complexity

  • Main drawbacks:

– |sk|: hundreds of MBs/GBs – Puncturing: several minutes

  • But clean design approach

– Will be useful for applications to TLS 1.3, too!

55

First Theoretical Construction

(Günther, Hale, Jager, Lauer; EUROCRYPT 2017)

slide-56
SLIDE 56

Hierarchical Key Delegation

skε sk0 sk1 sk000 sk001 sk010 sk011

sk

0000

sk

0001

sk

0010

sk

0011

sk

0100

sk

0110

sk

0111

sk

1000

sk

1001

sk

1010

sk

1011

sk

1100

sk

1101

sk

1110

sk

1111

sk100 sk101 sk110 sk111 sk00 sk01 sk10 sk11

56

sk

0101

pk

slide-57
SLIDE 57

Hierarchical Key Delegation

skε sk0 sk1 sk000 sk001 sk010 sk011

sk

0000

sk

0001

sk

0010

sk

0011

sk

0100

sk

0110

sk

0111

sk

1000

sk

1001

sk

1010

sk

1011

sk

1100

sk

1101

sk

1110

sk

1111

sk100 sk101 sk110 sk111 sk00 sk01 sk10 sk11

57

sk

0101

Can be realized with

  • Cryptographic hash functions
  • Hierarchical identity-based encryption

pk

slide-58
SLIDE 58

Puncturing skε

(Inspired by constrained PRFs [BW13, BGI13, KPTZ13])

skε sk0 sk1 sk000 sk001 sk010 sk011

sk

0000

sk

0001

sk

0010

sk

0011

sk

0100

sk

0110

sk

0111

sk

1000

sk

1001

sk

1010

sk

1011

sk

1100

sk

1101

sk

1110

sk

1111

sk100 sk101 sk110 sk111 sk00 sk01 sk10 sk11

58

sk

0101

pk

slide-59
SLIDE 59

Puncturing skε

(Inspired by constrained PRFs [BW13, BGI13, KPTZ13])

skε sk0 sk1 sk000 sk001 sk010 sk011

sk

0000

sk

0001

sk

0010

sk

0011

sk

0100

sk

0110

sk

0111

sk

1000

sk

1001

sk

1010

sk

1011

sk

1100

sk

1101

sk

1110

sk

1111

sk100 sk101 sk110 sk111 sk00 sk01 sk10 sk11

59

sk

0101

pk

slide-60
SLIDE 60

Puncturing skε

(Inspired by constrained PRFs [BW13, BGI13, KPTZ13])

skε sk0 sk1 sk000 sk001 sk010 sk011

sk

0000

sk

0001

sk

0010

sk

0011

sk

0100

sk

0110

sk

0111

sk

1000

sk

1001

sk

1010

sk

1011

sk

1100

sk

1101

sk

1110

sk

1111

sk100 sk101 sk110 sk111 sk00 sk01 sk10 sk11

60

sk

0101

pk

slide-61
SLIDE 61

Puncturing skε

(Inspired by constrained PRFs [BW13, BGI13, KPTZ13])

skε sk0 sk1 sk000 sk001 sk010 sk011

sk

0000

sk

0001

sk

0010

sk

0011

sk

0100

sk

0101

sk

0110

sk

0111

sk

1000

sk

1001

sk

1010

sk

1011

sk

1100

sk

1101

sk

1110

sk

1111

sk100 sk101 sk110 sk111 sk00 sk01 sk10 sk11

61

pk

slide-62
SLIDE 62

Puncturing skε

(Inspired by constrained PRFs [BW13, BGI13, KPTZ13])

skε sk0 sk1 sk000 sk001 sk010 sk011

sk

0000

sk

0001

sk

0010

sk

0011

sk

0100

sk

0101

sk

0110

sk

0111

sk

1000

sk

1001

sk

1010

sk

1011

sk

1100

sk

1101

sk

1110

sk

1111

sk100 sk101 sk110 sk111 sk00 sk01 sk10 sk11

|sk\0101| ≈ 2*secpar

62

pk

slide-63
SLIDE 63

Puncturing again

skε sk0 sk1 sk000 sk001 sk010 sk011

sk

0000

sk

0001

sk

0010

sk

0011

sk

0100

sk

0101

sk

0110

sk

0111

sk

1000

sk

1001

sk

1010

sk

1011

sk

1100

sk

1101

sk

1110

sk

1111

sk100 sk101 sk110 sk111 sk00 sk01 sk10 sk11

63

pk

slide-64
SLIDE 64

Puncturing again

skε sk0 sk1 sk000 sk001 sk010 sk011

sk

0000

sk

0001

sk

0010

sk

0011

sk

0100

sk

0101

sk

0110

sk

0111

sk

1000

sk

1001

sk

1010

sk

1011

sk

1100

sk

1101

sk

1110

sk

1111

sk100 sk101 sk110 sk111 sk00 sk01 sk10 sk11

|sk| ≤ 2*secpar*|punctures|

64

pk

slide-65
SLIDE 65

What have we achieved so far?

  • Full forward secrecy ✓
  • Security against replay attacks ✓
  • |sk|≥ total number of sessions ✗

65

slide-66
SLIDE 66

What have we achieved so far?

  • Full forward secrecy ✓
  • Security against replay attacks ✓
  • |sk|≥ total number of sessions ✗

66

Potential approaches:

  • 1. Replace pk frequently
  • 2. Non-interactive purging of sk
slide-67
SLIDE 67

Purging the secret key from time to time [EC:CanHalKat03]

skε sk0 sk1 sk000 sk001 sk010 sk011

sk

0000

sk

0001

sk

0010

sk

0011

sk

0100

sk

0101

sk

0110

sk

0111

sk

1000

sk

1001

sk

1010

sk

1011

sk

1100

sk

1101

sk

1110

sk

1111

sk100 sk101 sk110 sk111 sk00 sk01 sk10 sk11 4 Time slots

67

pk

slide-68
SLIDE 68

skε sk0 sk1 sk000 sk001 sk010 sk011

sk

0000

sk

0001

sk

0010

sk

0011

sk

0100

sk

0101

sk

0110

sk

0111

sk

1000

sk

1001

sk

1010

sk

1011

sk

1100

sk

1101

sk

1110

sk

1111

sk100 sk101 sk110 sk111 sk00=t00 sk01 sk10 sk11 Puncture here at “time 1” 4 Time slots

68

Purging the secret key from time to time

Following [CHK03]

pk

slide-69
SLIDE 69

skε sk0 sk1 sk000 sk001 sk010 sk011

sk

0000

sk

0001

sk

0010

sk

0011

sk

0100

sk

0101

sk

0110

sk

0111

sk

1000

sk

1001

sk

1010

sk

1011

sk

1100

sk

1101

sk

1110

sk

1111

sk100 sk101 sk110 sk111 sk00=t00 sk01 sk10 sk11 Puncture here at “time 2” 4 Time slots

69

Purging the secret key from time to time

Following [CHK03]

pk

slide-70
SLIDE 70

skε sk0 sk1 sk000 sk001 sk010 sk011

sk

0000

sk

0001

sk

0010

sk

0011

sk

0100

sk

0101

sk

0110

sk

0111

sk

1000

sk

1001

sk

1010

sk

1011

sk

1100

sk

1101

sk

1110

sk

1111

sk100 sk101 sk110 sk111 sk00=t00 sk01 sk10 sk11 Puncture here at “time 2” 4 Time slots

70

Purging the secret key from time to time

Following [CHK03]

Non-interactive:

  • no update of pk
  • loosely synchronized clocks

pk

slide-71
SLIDE 71

Bloom Filter Encryption

(Derler, Jager, Slamanig, Striecks; EUROCRYPT 2018)

71

  • New approach to construct 0-RTT protocols
  • Features:

– Provably secure – Low communication complexity – |sk|: hundreds of MBs/GBs – Very efficient puncturing

  • Ready for practical deployment

– But not yet in all applications

slide-72
SLIDE 72

Bloom Filter Encryption

(Derler, Jager, Slamanig, Striecks; EUROCRYPT 2018)

72

  • New approach to construct 0-RTT protocols
  • Features:

– Provably secure – Low communication complexity – |sk|: hundreds of MBs/GBs – Very efficient puncturing

  • Ready for practical deployment

– But not yet in all applications

slide-73
SLIDE 73

Bloom Filter Encryption

(Derler, Jager, Slamanig, Striecks; EUROCRYPT 2018)

73 pk1 pk2 pk3 … pkm … … … … … … … … … sk1 sk2 sk3 … skm … … … … … … … … …

Secret key = Public key =

slide-74
SLIDE 74

Bloom Filter Encryption

(Derler, Jager, Slamanig, Striecks; EUROCRYPT 2018)

74 pk1 pk2 pk3 … pkm … … … … … … … … … sk1 sk2 sk3 … skm … … … … … … … … …

Secret key = Public key = Can be compressed to a single pk using e.g. IBE

slide-75
SLIDE 75

75 pk1 pk2 pk3 … pkm … … … … … … … … … sk1 sk2 sk3 … skm … … … … … … … … …

  • Each ciphertext is associated to n public/secret

keys pairs (here n = 3)

– Determined by universal hashing (“Bloom filter”)

  • C can only be decrypted with matching sk

Bloom Filter Encryption

(Derler, Jager, Slamanig, Striecks; EUROCRYPT 2018)

Ciphertext C

Secret key = Public key =

slide-76
SLIDE 76

76 pk1 pk2 pk3 … pkm … … … … … … … … … sk1 sk3 … … … … … … … … …

Puncture(sk,C):

  • Delete the secret keys

associated to C

Bloom Filter Encryption

(Derler, Jager, Slamanig, Striecks; EUROCRYPT 2018)

Ciphertext C

Secret key = Public key =

slide-77
SLIDE 77

77 pk1 pk2 pk3 … pkm … … … … … … … … … sk1 sk3 … … … … … … … … …

Puncture(sk,C):

  • Delete the secret keys

associated to C

Bloom Filter Encryption

(Derler, Jager, Slamanig, Striecks; EUROCRYPT 2018)

L

Ciphertext C

Secret key = Public key =

slide-78
SLIDE 78

78 pk1 pk2 pk3 … pkm … … … … … … … … … sk1 sk3 … … … … … … … … …

  • Decryption of CB possible, if

at least one associated secret key is not yet deleted

  • Error probability can be arbitrarily small via choice of

Bloom filter parameters

Bloom Filter Encryption

(Derler, Jager, Slamanig, Striecks; EUROCRYPT 2018)

Ciphertext C Ciphertext CB

Secret key = Public key =

slide-79
SLIDE 79

How practical is this?

  • 1 million sessions/key

(low-traffic services)

  • Pr[Dec. error] ≤ 10-3
  • |sk| ≈ 700 MB

79

slide-80
SLIDE 80

How practical is this?

  • 1 million sessions/key

(low-traffic services)

  • Pr[Dec. error] ≤ 10-3
  • |sk| ≈ 700 MB

80

Requirements of :

  • 2000 sessions/s
  • Very short 0-RTT key lifetime

(one hour = 7.2 M sessions/key)

  • Pr[Dec. error] ≤ 10-2
  • |sk|≈ 2.2 GB
slide-81
SLIDE 81

0-RTT in TLS 1.3

(Aviram, Gellert, Jager; EUROCRYPT 2019)

81

  • Alternative approach to construct 0-RTT protocols

– Based on “TLS 1.3 approach”

  • Not really 0-RTT session initiation
  • Rather: 0-RTT session resumption
  • Features:

– Provably secure – Low communication complexity – |sk|: a few MBs – Quite efficient puncturing

  • Ready for practical deployment

– But not yet in all applications

slide-82
SLIDE 82

0-RTT in TLS 1.3

  • Two different approaches:

– Session tickets – Session caches

  • Indistinguishable on client side
  • Server may choose

– (And use other variants that are not described in the standard)

82

slide-83
SLIDE 83

0-RTT in TLS 1.3 with Session Caches

(High-level idea)

83

Server Client (pk,sk) Tag Key T1 k1 T2 k2 … …

slide-84
SLIDE 84

0-RTT in TLS 1.3 with Session Caches

(High-level idea)

84

Server Client Initial protocol session (not 0-RTT) Store: (k, T) T (pk,sk) Tag Key T1 k1 T2 k2 … …

slide-85
SLIDE 85

0-RTT in TLS 1.3 with Session Caches

(High-level idea)

85

Server Client Initial protocol session (not 0-RTT) Store: (k, T) T, SymEnc(k, 0-RTT payload) kßDec(tk,T) T (pk,sk) Tag Key T1 k1 T2 k2 … …

slide-86
SLIDE 86

0-RTT in TLS 1.3 with Session Caches

(High-level idea)

86

Server Client Initial protocol session (not 0-RTT) Store: (k, T) T, SymEnc(k, 0-RTT payload), ga kßDec(tk,T) gb, SymEnc(gab, payload) T (pk,sk) Tag Key T1 k1 T2 k2 … …

slide-87
SLIDE 87

0-RTT in TLS 1.3 with Session Caches

(High-level idea)

87

Server Client Initial protocol session (not 0-RTT) Store: (k, T) T, SymEnc(k, 0-RTT payload), ga kßDec(tk,T)

  • 0-RTT key establishment session resumption ?
  • Forward secrecy for 0-RTT payload ✓
  • Replay prevention ✓
  • Server-side storage ✗

gb, SymEnc(gab, payload) T (pk,sk) Tag Key T1 k1 T2 k2 … …

slide-88
SLIDE 88

0-RTT in TLS 1.3 with Session Caches

(High-level idea)

88

Server Client Initial protocol session (not 0-RTT) Store: (k, T) T, SymEnc(k, 0-RTT payload), ga kßDec(tk,T)

  • 0-RTT key establishment session resumption ?
  • Forward secrecy for 0-RTT payload ✓
  • Replay prevention ✓
  • Server-side storage ✗

gb, SymEnc(gab, payload) T (pk,sk) Tag Key T1 k1 T2 k2 … …

“Opaque” message type à may contain arbitrary data

slide-89
SLIDE 89

0-RTT in TLS 1.3 with Session Tickets

(High-level idea)

89

Server Client Initial protocol session (not 0-RTT) Store: (k, T) T = Enc(tk, k) (pk,sk) Token key tk

slide-90
SLIDE 90

0-RTT in TLS 1.3 with Session Tickets

(High-level idea)

90

Server Client Initial protocol session (not 0-RTT) Store: (k, T) T, SymEnc(k, 0-RTT payload), ga kßDec(tk,T) gb, SymEnc(gab, payload) T = Enc(tk, k) (pk,sk) Token key tk

slide-91
SLIDE 91

0-RTT in TLS 1.3 with Session Tickets

(High-level idea)

91

Server Client Initial protocol session (not 0-RTT) Store: (k, T) T, SymEnc(k, 0-RTT payload), ga kßDec(tk,T)

  • 0-RTT key establishment session resumption ?
  • Replay prevention: server remembers that T was redeemed

during life time of k (✓)

  • Server-side storage ✓
  • Forward secrecy for 0-RTT payload ✗

gb, SymEnc(gab, payload) T = Enc(tk, k) (pk,sk) Token key tk

slide-92
SLIDE 92

“Puncturable Session Tickets”

(High-level idea)

92

Server Client Initial protocol session (not 0-RTT) Store: (k, T) T, SymEnc(k, 0-RTT payload), ga kßDec(tk,T) gb, SymEnc(gab, payload) T = Enc(tk, k) (pk,sk) Ticket key tk tk\C = Puncture(sk, C) Delete tk

slide-93
SLIDE 93

“Puncturable Session Tickets”

(High-level idea)

93

Server Client Initial protocol session (not 0-RTT) Store: (k, T) T, SymEnc(k, 0-RTT payload), ga kßDec(tk,T) gb, SymEnc(gab, payload) T = Enc(tk, k) (pk,sk) Ticket key tk tk\C = Puncture(sk, C) Delete tk

Best of both worlds:

  • Same forward security as Session Caches
  • Session ticket approach à Less secure memory on server
slide-94
SLIDE 94

Further Contributions

  • New construction of a Puncturable Pseudorandom

Function

– Particularly suitable for efficient use in TLS 1.3 – Puncturing ≈ RSA signature

  • Definition of general “session resumption” protocols

– Security model – Formal security analysis

  • See https://eprint.iacr.org/2019/228

94

slide-95
SLIDE 95

Summary and Open Problems

  • Fully forward-secret 0-RTT protocols exist!

– New techniques – Very simple protocols – Reasonably efficient for servers with moderate requirements (number of sessions)

  • Can we make this more practical?

– Suitable for very large-scale applications

  • Beyond key exchange?

95

slide-96
SLIDE 96

Summary and Open Problems

  • Fully forward-secret 0-RTT protocols exist!

– New techniques – Very simple protocols – Reasonably efficient for servers with moderate requirements (number of sessions)

  • Can we make this more practical?

– Suitable for very large-scale applications

  • Beyond key exchange?

96