From Stateless to Stateful: Generic Authentication and Authenticated Encryption Constructions with Application to TLS

Boyd, Colin; Hale, Britta; Mjølsnes, Stig Frode; Stebila, Douglas

doi:10.1007/978-3-319-29485-8_4

Cited by 22 publications

(11 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Our definition corresponds most closely to level-4 (stateful) LHAE of [17]. In both definitions the requirement is that decrypt only successfully decrypted a prefix of what was sent.…”

Section: From Aead To Stream Encryption (Stae)mentioning

confidence: 99%

Implementing and Proving the TLS 1.3 Record Layer

Delignat-Lavaud

Fournet²,

Kohlweiss³

et al. 2017

2017 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

The record layer is the main bridge between TLS applications and internal sub-protocols. Its core functionality is an elaborate form of authenticated encryption: streams of messages for each sub-protocol (handshake, alert, and application data) are fragmented, multiplexed, and encrypted with optional padding to hide their lengths. Conversely, the sub-protocols may provide fresh keys or signal stream termination to the record layer. Compared to prior versions, TLS 1.3 discards obsolete schemes in favor of a common construction for Authenticated Encryption with Associated Data (AEAD), instantiated with algorithms such as AES-GCM and ChaCha20-Poly1305. It differs from TLS 1.2 in its use of padding, associated data and nonces. It also encrypts the content-type used to multiplex between sub-protocols. New protocol features such as early application data (0-RTT and 0.5-RTT) and late handshake messages require additional keys and a more general model of stateful encryption. We build and verify a reference implementation of the TLS record layer and its cryptographic algorithms in F , a dependently typed language where security and functional guarantees can be specified as pre-and post-conditions. We reduce the high-level security of the record layer to cryptographic assumptions on its ciphers. Each step in the reduction is verified by typing an F module; for each step that involves a cryptographic assumption, this module precisely captures the corresponding game. We first verify the functional correctness and injectivity properties of our implementations of onetime MAC algorithms (Poly1305 and GHASH) and provide a generic proof of their security given these two properties. We show the security of a generic AEAD construction built from any secure onetime MAC and PRF. We extend AEAD, first to stream encryption, then to length-hiding, multiplexed encryption. Finally, we build a security model of the record layer against an adversary that controls the TLS sub-protocols. We compute concrete security bounds for the AES_128_GCM, AES_256_GCM, and CHACHA20_POLY1305 ciphersuites, and derive recommended limits on sent data before re-keying. We plug our implementation of the record layer into the miTLS library, confirm that they interoperate with Chrome and Firefox, and report initial performance results. Combining our functional correctness, security, and experimental results, we conclude that the new TLS record layer (as described in RFCs and cryptographic standards) is provably secure, and we provide its first verified implementation.

show abstract

“…Our definition corresponds most closely to level-4 (stateful) LHAE of [17]. In both definitions the requirement is that decrypt only successfully decrypted a prefix of what was sent.…”

Section: From Aead To Stream Encryption (Stae)mentioning

confidence: 99%

Implementing and Proving the TLS 1.3 Record Layer

Delignat-Lavaud

Fournet²,

Kohlweiss³

et al. 2017

2017 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

show abstract

“…We follow [13,41] in extending the stateful authenticated encryption notion of Bellare et al [7] to capture a hierarchy of stateful AEAD security notions based on different authentication levels. The following definitions are the same as [13], except that we exclude the length-hiding property proposed by Paterson et al [53] for conciseness. Syntax A stateful AEAD scheme sAEAD is a 4-tuple (sG, sI, sE, sD) associated with a message space M ⊆ {0, 1} * , an associated data space AD ⊆ {0, 1} * , and a state space ST ⊆ {0, 1} * .…”

Section: Stateful Authenticated Encryption With Associated Datamentioning

confidence: 99%

Secure Communication Channel Establishment: TLS 1.3 (over TCP Fast Open) versus QUIC

et al. 2021

View full text Add to dashboard Cite

Secure channel establishment protocols such as Transport Layer Security (TLS) are some of the most important cryptographic protocols, enabling the encryption of Internet traffic. Reducing latency (the number of interactions between parties before encrypted data can be transmitted) in such protocols has become an important design goal to improve user experience. The most important protocols addressing this goal are TLS 1.3, the latest TLS version standardized in 2018 to replace the widely deployed TLS 1.2, and Quick UDP Internet Connections (QUIC), a secure transport protocol from Google that is implemented in the Chrome browser. There have been a number of formal security analyses for TLS 1.3 and QUIC, but their security, when layered with their underlying transport protocols, cannot be easily compared. Our work is the first to thoroughly compare the security and availability properties of these protocols. Toward this goal, we develop novel security models that permit “layered” security analysis. In addition to the standard goals of server authentication and data confidentiality and integrity, we consider the goals of IP spoofing prevention, key exchange packet integrity, secure channel header integrity, and reset authentication, which capture a range of practical threats not usually taken into account by existing security models that focus mainly on the cryptographic cores of the protocols. Equipped with our new models we provide a detailed comparison of three low-latency layered protocols: TLS 1.3 over TCP Fast Open (TFO), QUIC over UDP, and QUIC[TLS] (a new design for QUIC that uses TLS 1.3 key exchange) over UDP. In particular, we show that TFO’s cookie mechanism does provably achieve the security goal of IP spoofing prevention. Additionally, we find several new availability attacks that manipulate the early key exchange packets without being detected by the communicating parties. By including packet-level attacks in our analysis, our results shed light on how the reliability, flow control, and congestion control of the above layered protocols compare, in adversarial settings. We hope that our models will help protocol designers in their future protocol analyses and that our results will help practitioners better understand the advantages and limitations of secure channel establishment protocols.

show abstract

“…A stateful MAC is similar to a classical MAC combined with an additional state at sender or receiver side. In this context, various security definitions and stream properties have been defined, e.g., [12,13,20,28,32,46].…”

Section: Statefulmentioning

confidence: 99%

ProMACs: Progressive and Resynchronizing MACs for Continuous Efficient Authentication of Message Streams

Armknecht

Walther

Tsudik

et al. 2020

Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

Efficiently integrity verification of received data requires Message Authentication Code (MAC) tags. However, while security calls for rather long tags, in many scenarios this contradicts other requirements. Examples are strict delay requirements (e.g., robot or drone control) or resource-scarce settings (e.g., LoRaWAN networks with limited battery capacity). Prior techniques suggested truncation of MAC tags, thus trading off linear performance gain for exponential security loss. To achieve security of full-length MACs with short(er) tags, we introduce Progressive MACs (ProMACs)-a scheme that uses internal state to gradually increase security upon reception of subsequent messages. We provide a formal framework and propose a provably secure, generic construction called Whips. We evaluate applicability of ProMACs in several realistic scenarios and demonstrate example settings where ProMACs can be used as a drop-in replacement for traditional MACs. CCS CONCEPTS • Security and privacy → Hash functions and message authentication codes; Formal security models; Domain-specific security and privacy architectures; • Theory of computation → Cryptographic primitives.

show abstract

From Stateless to Stateful: Generic Authentication and Authenticated Encryption Constructions with Application to TLS

Cited by 22 publications

References 24 publications

Implementing and Proving the TLS 1.3 Record Layer

Implementing and Proving the TLS 1.3 Record Layer

Secure Communication Channel Establishment: TLS 1.3 (over TCP Fast Open) versus QUIC

ProMACs: Progressive and Resynchronizing MACs for Continuous Efficient Authentication of Message Streams

Contact Info

Product

Resources

About