Security of TLS 1.2 The ACCE model TLS Crypto Seminar February 7, - - PowerPoint PPT Presentation

▶

Sep 12, 2022 333 likes •481 views

Security of TLS 1.2 The ACCE model TLS Crypto Seminar February 7, 2019 Joseph Jaeger UC San Diego some slides & formatting stolen from Felix Gnther February 7, 2019 | Security of TLS | TLS Crypto Seminar, Winter 2019 Quarter, UC

SLIDE 1

Security of TLS ≤1.2

The ACCE model

TLS Crypto Seminar

February 7, 2019

Joseph Jaeger

UC San Diego

some slides & formatting stolen from Felix Günther

February 7, 2019 | Security of TLS| TLS Crypto Seminar, Winter 2019 Quarter, UC San Diego Joseph Jaeger 1

SLIDE 2

Today's Plan Goal

What is the ACCE security model? Why was it needed for studying

TLS?

Dig into the details of the formalism.

Part I Background

Stateful Length-Hiding Authenticated Encryption
Authenticated Key Exchange

Part II ACCE Security Model

Authenticated and Confidential Channel Establishment
TLS 1.2 Security Results (Time Permitting)

February 7, 2019 | Security of TLS| TLS Crypto Seminar, Winter 2019 Quarter, UC San Diego Joseph Jaeger 2

SLIDE 3

Background

February 7, 2019 | Security of TLS| TLS Crypto Seminar, Winter 2019 Quarter, UC San Diego Joseph Jaeger 3

SLIDE 4

TLS Components

February 7, 2019 | Security of TLS| TLS Crypto Seminar, Winter 2019 Quarter, UC San Diego Joseph Jaeger 4

From the first lecture: Security Typically Desired:

Handshake Protocol = Authenticated Key Exchange
Record Protocol = Stateful Length Hiding Authenticated

Encryption

SLIDE 5

Formalisms

February 7, 2019 | Security of TLS| TLS Crypto Seminar, Winter 2019 Quarter, UC San Diego Joseph Jaeger 5

Formalisms based on:

SLIDE 6

sLHAE Definition

February 7, 2019 | Security of TLS| TLS Crypto Seminar, Winter 2019 Quarter, UC San Diego Joseph Jaeger 6

Syntax

SLIDE 7

sLHAE Definition

February 7, 2019 | Security of TLS| TLS Crypto Seminar, Winter 2019 Quarter, UC San Diego Joseph Jaeger 7

Security Security Typically Desired:

All-in-one definition requiring left-right IND-CPA and INT-CTXT

style security

SLIDE 8

Key Exchange Definition

February 7, 2019 | Security of TLS| TLS Crypto Seminar, Winter 2019 Quarter, UC San Diego Joseph Jaeger 8

Previously

SLIDE 9

TLS Example

February 7, 2019 | Security of TLS| TLS Crypto Seminar, Winter 2019 Quarter, UC San Diego Joseph Jaeger 9

SLIDE 10

ACCE

February 7, 2019 | Security of TLS| TLS Crypto Seminar, Winter 2019 Quarter, UC San Diego Joseph Jaeger 10

SLIDE 11

ACCE

February 7, 2019 | Security of TLS| TLS Crypto Seminar, Winter 2019 Quarter, UC San Diego Joseph Jaeger 11

Main Idea:

Squish encryption and key exchange security together into single notion.

SLIDE 12

Results

February 7, 2019 | Security of TLS| TLS Crypto Seminar, Winter 2019 Quarter, UC San Diego Joseph Jaeger 12

Main Result:

TLS-DHE is secure in this model

SLIDE 13

Results

February 7, 2019 | Security of TLS| TLS Crypto Seminar, Winter 2019 Quarter, UC San Diego Joseph Jaeger 13

Main Result:

TLS-RSA is secure in this model. (Under OW-PCA assumption.) TLS-DH is secure in this model. (Under PRF-ODH assumption.) TLS would be secure in this model with CCA secure encryption

Model:

Closely related to discussed ACCE model. No client authentication. No forward security.

SLIDE 14