Real-World Authenticated Key Exchange Tibor Jager Paderborn - PowerPoint PPT Presentation

Real-World Authenticated Key Exchange Tibor Jager Paderborn University Summer School on Real-World Crypto and Privacy Šibenik, Croatia June 17 th , 2019

Outline • Security of the Diffie-Hellman Key Exchange – Man-in-the-Middle attacks – Forward Security • TLS 1.3 – Overview – The cryptographic core of TLS 1.3 • Real-World Problems – Problems arising from backwards compatibility – Middleboxes and ETS • Further reading, open research problems 2

Diffie-Hellman Key Exchange Public parameters: Group description (G,g,q) a ß {0, …, q-1} b ß {0, …, q-1} t A := g a t B = g b t A t B k AB := t Ab k AB := t Ba 3

Man-in-the-middle Attack on DH a ß {0, …, q-1} b ß {0, …, q-1} t A := g a t B = g b a’ ß {0, …, q-1} t A t A ’ := g a’ t A ’ 4

Man-in-the-middle Attack on DH a ß {0, …, q-1} b ß {0, …, q-1} t A := g a t B = g b a’ ß {0, …, q-1} t A t A ’ := g a’ t A ’ t B ’ t B b’ ß {0, …, q-1} t B ’ := g b’ 5

Man-in-the-middle Attack on DH a ß {0, …, q-1} b ß {0, …, q-1} t A := g a t B = g b a’ ß {0, …, q-1} t A t A ’ := g a’ t A ’ t B ’ t B b’ ß {0, …, q-1} t B ’ := g b’ k AB’ = g ab’ k A’B = g a’b 6

Man-in-the-middle Attack on DH a ß {0, …, q-1} b ß {0, …, q-1} t A := g a t B = g b a’ ß {0, …, q-1} t A t A ’ := g a’ t A ’ t B ’ t B b’ ß {0, …, q-1} t B ’ := g b’ k AB’ = g ab’ k A’B = g a’b • This is an active attack • DH is provably secure against passive (”eavesdropping”) attacks 7

Signed Diffie-Hellman Public parameters: (pk B , sk B ) ß SigKeyGen() Group description (G,g,q) (pk A , sk A ) ß SigKeyGen() pk A , pk B 8

Signed Diffie-Hellman Public parameters: (pk B , sk B ) ß SigKeyGen() Group description (G,g,q) (pk A , sk A ) ß SigKeyGen() pk A , pk B a ß {0, …, q-1} t A := g a s A := Sign(sk A ,t A ) t A , s A 9

Signed Diffie-Hellman Public parameters: (pk B , sk B ) ß SigKeyGen() Group description (G,g,q) (pk A , sk A ) ß SigKeyGen() pk A , pk B a ß {0, …, q-1} b ß {0, …, q-1} t A := g a t B = g b s A := Sign(sk A ,t A ) s B := Sign(sk B ,t B ) t A , s A t B , s B 10

Signed Diffie-Hellman Public parameters: (pk B , sk B ) ß SigKeyGen() Group description (G,g,q) (pk A , sk A ) ß SigKeyGen() pk A , pk B a ß {0, …, q-1} b ß {0, …, q-1} t A := g a t B = g b s A := Sign(sk A ,t A ) s B := Sign(sk B ,t B ) t A , s A t B , s B If Vfy(pk A , t A , s A ) = TRUE then: If Vfy(pk B , t B , s B ) = TRUE then: k AB := t Ab k AB := t Ba 11

Signed Diffie-Hellman Public parameters: (pk B , sk B ) ß SigKeyGen() Group description (G,g,q) (pk A , sk A ) ß SigKeyGen() pk A , pk B a ß {0, …, q-1} b ß {0, …, q-1} t A := g a t B = g b s A := Sign(sk A ,t A ) s B := Sign(sk B ,t B ) t A , s A t B , s B If Vfy(pk A , t A , s A ) = TRUE then: If Vfy(pk B , t B , s B ) = TRUE then: k AB := t Ab k AB := t Ba Security of the signature scheme prevents the MITM attack 12

Forward Security Objective: Make large-scale collection of encrypted data useless 13

Forward Security Objective: Make large-scale collection of encrypted data useless Session 1 Session 3 Session 2 Session 4 with Alice with Charlie with Bob with Alice Time 14

Forward Security Objective: Make large-scale collection of encrypted data useless Secret key Session 1 Session 3 Session 2 Session 4 with Alice with Charlie with Bob with Alice Time 15

Forward Security Objective: Make large-scale collection of encrypted data useless Secret key Session 1 Session 3 Session 2 Session 4 with Alice with Charlie with Bob with Alice Time 16

Forward Security Objective: Make large-scale collection of encrypted data useless Secret key Session 1 Session 3 Session 2 Session 4 with Alice with Charlie with Bob with Alice Time 17

Forward Security Objective: Make large-scale collection of encrypted data useless Secret key Session 1 Session 3 Session 2 Session 4 with Alice with Charlie with Bob with Alice Time • Widely used : • Standard security goal of modern protocols 18

Forward Security of Signed DH Public parameters: Group description (G,g,q) (pk A , sk A ) ß SigKeyGen() (pk B , sk B ) ß SigKeyGen() pk A , pk B a ß {0, …, q-1} b ß {0, …, q-1} t A := g a t B = g b s A := Sign(sk A ,t A ) s B := Sign(sk B ,t B ) t A , s A t B , s B If Vfy(pk Alice , t A , s A ) = TRUE then: If Vfy(pk Bob , t B , s B ) = TRUE then: k AB := t Ab k AB := t Ba Forward secure (if ephemeral exponents are not stored) 19

Are we done? • Signed DH is a beautiful protocol… – Clean and simple – Easy to implement and analyze – Forward Security • … but lacking features considered important in the real world, for instance: – How are public keys distributed? – No key confirmation – Fixed DH groups and signature schemes – Protocol for encryption of payload data not specified 20

Are we done? • Signed DH is a beautiful protocol… – Clean and simple – Easy to implement and analyze – Forward Security • … but lacking features considered important in the real world, for instance: – How are public keys distributed? – No key confirmation – Fixed DH groups and signature schemes – Protocol for encryption of payload data not specified 21

Are we done? • Signed DH is a beautiful protocol… – Clean and simple – Easy to implement and analyze Further issues: – Forward Security • How to deal with errors – Alert messages – Protocol spec. • … but lacking features considered important in • Interoperability the real world, for instance: – Message formats – How are public keys distributed? – Protocol headers • Possible extensions – No key confirmation • Implementational issues – Fixed DH groups and signature schemes • … – Protocol for encryption of payload data not specified 22

Outline • Security of the Diffie-Hellman Key Exchange – Man-in-the-Middle attacks – Forward Security • TLS 1.3 – Overview – The cryptographic core of TLS 1.3 • Real-World Problems – Problems arising from backwards compatibility – Middleboxes and ETS • Further reading, open research problems 23

Transport Layer Security (TLS) Client Server http, smtp, imap, Application Application pop3, ftp, sip, … Transport Transport TLS Network Network Link Link Physical communication Goal: provide confidential , authenticated , integrity-protected channel 24

Transport Layer Security (TLS) Client Server http, smtp, imap, Application Application pop3, ftp, sip, … Transport Transport TLS Network Network Link Link Network communication Goal: provide confidential , authenticated , integrity-protected channel 25

TLS vs. SSL 2006 2008 2018 1994 1995 1999 SSL 1.0 and 2.0 TLS 1.0 (=SSL 3.1) TLS 1.3 (Netscape) TLS 1.1 (IETF standard) TLS 1.2 SSL 3.0 (Netscape & Microsoft PCT) 26

Use of SSL/TLS Versions in Practice June 2019 27 https://www.ssllabs.com/ssl-pulse/

Use of SSL/TLS Versions in Practice June 2019 Standardized in 1999! 28 https://www.ssllabs.com/ssl-pulse/

Use of SSL/TLS Versions in Practice June 2019 Standardized in 1999! Security protocols have an extremely long life time 29 https://www.ssllabs.com/ssl-pulse/

TLS Sessions: Handshake + Record Layer Encryption Server Client 1. Handshake Handshake: • Negotiation of cryptographic algorithms (KE, Sig., Cipher Suite ) • Authentication of comm. partners • Establishment of session key k 30

TLS Sessions: Handshake + Record Layer Encryption Server Client 1. Handshake 2. Record Layer Handshake: Record Layer Encryption: • Negotiation of cryptographic • Data encryption and algorithms (KE, Sig., Cipher Suite ) authentication using key k • Authentication of comm. partners • Establishment of session key k 31

The Cryptographic Core of the The Cryptographic Core of the TLS 1.3 Handshake TLS 1.3 Handshake Optional Server S pk Client pk C Server S pk Client 35 32

The Cryptographic Core of the The Cryptographic Core of the TLS 1.3 Handshake TLS 1.3 Handshake Server S pk Client Server S pk Client 35 33

The Cryptographic Core of the TLS 1.3 Handshake Server S pk ClientHello: Client • Supported cipher suites, sigs, (DH groups) • Client random r C • Diffie-Hellman share g c 34

The Cryptographic Core of the TLS 1.3 Handshake Server S pk ClientHello: Client • Supported cipher suites, sigs, (DH groups) • Client random r C • Diffie-Hellman share g c ServerHello: • Selected Cipher Suite • Server random r S • Diffie-Hellman share g s 35

The Cryptographic Core of the TLS 1.3 Handshake Server S pk ClientHello: Client • Supported cipher suites, sigs, (DH groups) • Client random r C • Diffie-Hellman share g c ServerHello: • Selected Cipher Suite • Server random r S • Diffie-Hellman share g s Replaced with HelloRetryRequest , if necessary 36

The Cryptographic Core of the TLS 1.3 Handshake Server S pk ClientHello: Client • Supported cipher suites, sigs, (DH groups) • Client random r C • Diffie-Hellman share g c ServerHello: k = KDF(g cs , r C , r S ) • Selected Cipher Suite k = KDF(g cs , r C , r S ) • Server random r S k’ = KDF’(g cs , r C , r S ) k’ = KDF’(g cs , r C , r S ) • Diffie-Hellman share g s 37