On the Insider Security of MLS

Alwen, Joël; Jost, Daniel; Mularczyk, Marta

doi:10.1007/978-3-031-15979-4_2

Cited by 10 publications

(1 citation statement)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A growing line of work considers the performance and security of messaging in both the two-party [6,7,11,21,26,34] and more general group settings [2][3][4] settings. Some of these works provide similar [26] and sometimes weaker [27] guarantees for in-band active attack detection assuming in-order communication.…”

Section: Additional Related Workmentioning

confidence: 99%

On Active Attack Detection in Messaging with Immediate Decryption

Barooti

Collins

Colombo

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

The widely used Signal protocol provides protection against state exposure attacks through forward security (protecting past messages) and post-compromise security (for restoring security). It supports immediate decryption, allowing messages to be re-ordered or dropped at the protocol level without affecting correctness. In this work, we consider strong active attack detection for secure messaging with immediate decryption, where parties are able to immediately detect active attacks under certain conditions. We first consider in-band active attack detection, where participants who have been actively compromised but are still able to send a single message to their partner can detect the compromise. We propose two complementary notions to capture security, and present a compiler that provides security with respect to both notions. Our notions generalise existing work (RECOVER security) which only supported in-order messaging. We also study the related out-of-band attack detection problem by considering communication over out-of-band, authenticated channels and propose analogous security notions. We prove that one of our two notions in each setting imposes a linear communication overhead in the number of sent messages and security parameter using an information-theoretic argument. This implies that each message must information-theoretically contain all previous messages and that our construction, that essentially attaches the entire message history to every new message, is asymptotically optimal. We then explore ways to bypass this lower bound and highlight the feasibility of practical active attack detection compatible with immediate decryption.

show abstract