A Modular Treatment of Cryptographic APIs: The Symmetric-Key Case

Abstract

Abstract. Application Programming Interfaces (APIs) to cryptographic tokens like smartcards and Hardware Security Modules (HSMs) provide users with commands to manage and use cryptographic keys stored on trusted hardware. Their design is mainly guided by industrial standards with only informal security promises. In this paper we propose cryptographic models for the security of such APIs. The key feature of our approach is that it enables modular analysis. Specifically, we show that a secure cryptographic API can be obtained by combining a secure API for key-management together with secure implementations of, for instance, encryption or message authentication. Our models are the first to provide such compositional guarantees while considering realistic adversaries that can adaptively corrupt keys stored on tokens. We also provide a proof of concept instantiation (from a deterministic authenticated-encryption scheme) of the key-management portion of cryptographic API.

A Machine-Checked Proof of Security for AWS Key Management Service

“…• We formalize a notion of key secrecy for KMS DMP in the style of cryptographic APIs [23] and extend prior work in this area by i. addressing a substantially more complex (distributed) API; and ii. making explicit which assumptions on the behaviour of human operators are necessary (as otherwise trivial breaks would be possible), whilst excluding all non-trivial breaks as in prior work by reducing to standard cryptographic assumptions.…”

“…The second layer of results proves that the protocol hides all information about domain keys from the adversary' view. This is formalized as a cryptographic API [23] that guarantees domain key secrecy. The model captures the actions of a malicious insider adversary by allowing the domain management operations to consist of multiple adversarially orchestrated steps.…”

“…In this section we describe and justify the security definition we adopted for the DMP, corresponding to the AEAD-service layer as shown in Figure 1. We begin by defining a general syntax for (possibly distributed) cryptographic key management APIs, inspired by the work of Shrimpton, Stam and Warinschi [23]. This formalism abstracts away all the details of the protocol that are not directly related to key operations, and we believe it to be of independent interest to analyse the security of other key management APIs.…”

“…The indistinguishability-based security of a cryptographic API [23] guarantees that cryptographic keys managed by the API remain hidden from the adversary. We adapt this notion to our formalism via a game where, in addition to interacting with the API to create and manage tokens, the adversary gets access to three oracles that capture the key hiding property.…”

“…Shrimpton, Stam and Warinschi [23] also show that the indistinguishability definition of security for cryptographic APIs composes with a natural class of symmetric-key primitives, such as AEAD and MAC in order to provide cryptographic services. The security of these cryptographic services was defined by extending the attack vectors of standard AEAD and MAC security with all the oracles available to the cryptographic API adversary.…”