An Efficient and Generic Construction for Signal’s Handshake (X3DH): Post-Quantum, State Leakage Secure, and Deniable

Hashimoto, Keitaro; Katsumata, Shuichi; Kwiatkowski, Kris; Prest, Thomas

doi:10.1007/978-3-030-75248-4_15

Cited by 16 publications

(2 citation statements)

References 50 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The recent work by Hashimoto, Katsumata, Kwiatkowski, and Prest [48] is closest to ours. Their core protocol is meant to replace the Signal handshake based on (post-quantum) KEMs and signatures.…”

Section: Options For Pq Asynchronous Dakesupporting

confidence: 78%

Post-quantum Asynchronous Deniable Key Exchange and the Signal Handshake

Brendel

Fiedler

Günther

et al. 2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

The key exchange protocol that establishes initial shared secrets in the handshake of the Signal end-to-end encrypted messaging protocol has several important characteristics: (1) it runs asynchronously (without both parties needing to be simultaneously online), (2) it provides implicit mutual authentication while retaining deniability (transcripts cannot be used to prove either party participated in the protocol), and (3) it retains security even if some keys are compromised (forward secrecy and beyond). All of these properties emerge from clever use of the highly flexible Diffie-Hellman protocol.While quantum-resistant key encapsulation mechanisms (KEMs) can replace Diffie-Hellman key exchange in some settings, there is no KEM-based replacement for the Signal handshake that achieves all three aforementioned properties, in part due to the inherent asymmetry of KEM operations. In this paper, we show how to construct asynchronous deniable key exchange by combining KEMs and designated verifier signature (DVS) schemes. There are several candidates for post-quantum DVS schemes, either direct constructions or via ring signatures. This yields a template for an efficient post-quantum realization of the Signal handshake with the same asynchronicity and security properties as the original Signal protocol.

show abstract

Section: Options For Pq Asynchronous Dakesupporting

confidence: 78%

Post-quantum Asynchronous Deniable Key Exchange and the Signal Handshake

Brendel

Fiedler

Günther

et al. 2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…This generalizes the public-key ratchet of Signal's Double Ratchet protocol [49]. The X3DH protocol [50] of the Signal protocol, used to establish the initial secret key required for CKA, is studied in [23,39]. As these works provide a generic construction of each building blocks from post-quantum assumptions, this results in a post-quantum secure messaging for the two-party setting.…”

Section: Related Workmentioning

confidence: 99%

A Concrete Treatment of Efficient Continuous Group Key Agreement via Multi-Recipient PKEs

Hashimoto

Katsumata²,

Postlethwaite

et al. 2021

Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security

Self Cite

View full text Add to dashboard Cite

Continuous group key agreements (CGKAs) are a class of protocols that can provide strong security guarantees to secure group messaging protocols such as Signal and MLS. Protection against device compromise is provided by commit messages: at a regular rate, each group member may refresh their key material by uploading a commit message, which is then downloaded and processed by all the other members. In practice, propagating commit messages dominates the bandwidth consumption of existing CGKAs.We propose Chained CmPKE, a CGKA with an asymmetric bandwidth cost: in a group of N members, a commit message costs O(N ) to upload and O(1) to download, for a total bandwidth cost of O(N ). In contrast, TreeKEM [14,19,52] costs Ω(log N ) in both directions, for a total cost Ω(N log N ). Our protocol relies on generic primitives, and is therefore readily post-quantum.We go one step further and propose post-quantum primitives that are tailored to Chained CmPKE, which allows us to cut the growth rate of uploaded commit messages by two or three orders of magnitude compared to naive instantiations. Finally, we realize a software implementation of Chained CmPKE. Our experiments show that even for groups with a size as large as N = 2 10 , commit messages can be computed and processed in less than 100 ms.

show abstract