Pervasive Internet-Wide Low-Latency Authentication

Krähenbühl, Cyrill; Legner, Markus; Bitterli, Silvan; Perrig, Adrian

doi:10.1109/icccn52240.2021.9522235

Cited by 1 publication

(2 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this section, we discuss the differences between the RPKIbased PILA [11] and SCION-based PILA including the contributions of this work.…”

Section: Discussionmentioning

confidence: 99%

“…Pervasive Internet-Wide Low-Latency Authentication (PILA) [11] is an authentication system designed to provide ubiquitous end-to-end authentication by issuing such certificates to end-hosts. PILA is not intended to replace existing strong authentication protocols, such as server certificates based on the Web PKI, but to provide an improved minimum level of security if strong authentication protocols are not available.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Ubiquitous Secure Communication in a Future Internet Architecture

Krähenbühl

Perrig

2022

SN COMPUT. SCI.

Self Cite

View full text Add to dashboard Cite

In a world with increasing simplicity to store, transfer, and analyze large volumes of data, preserving data confidentiality and integrity of Internet traffic by default becomes more and more important. Unfortunately, a large gap exists between low-security opportunistic encryption and trust-on-first-use (TOFU) protocols, and high-security communication, such as TLS using server certificates or DNSSEC. Our goal is to reduce this gap and provide a base layer for authentication and secrecy that is strictly better than TOFU security. We achieve this by integrating the authentication method PILA into the future Internet architecture SCION. This combines PILA’s address-based authentication, which leverages irrefutable cryptographic proof of misbehavior, and the flexibility of SCION’s control-plane PKI and its per-AS independent addressing scheme. In this work, two concrete issues of PILA are addressed: (1) the reliance on the hierarchical RPKI which introduces a single global trust root, i.e., a single point of failure regarding the security of PILA, and (2) the necessity of an out-of-band communication to prevent downgrade attacks, which can incur a latency overhead and might be used as a resource exhaustion attack vector. We describe how PILA in combination with SCION mitigates these issues and analyze the security of the system. Finally, we discuss several interesting use cases including the SSH, TLS, and DNS protocols.

show abstract

“…In this section, we discuss the differences between the RPKIbased PILA [11] and SCION-based PILA including the contributions of this work.…”

Section: Discussionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%