Session Resumption Protocols and Efficient Forward Security for TLS 1.3 0-RTT

Abstract

The TLS 1.3 0-RTT mode enables a client reconnecting to a server to send encrypted application-layer data in “0-RTT” (“zero round-trip time”), without the need for a prior interactive handshake. This fundamentally requires the server to reconstruct the previous session’s encryption secrets upon receipt of the client’s first message. The standard techniques to achieve this are session caches or, alternatively, session tickets. The former provides forward security and resistance against replay attacks, but requires a large amount of server-side storage. The latter requires negligible storage, but provides no forward security and is known to be vulnerable to replay attacks. In this paper, we first formally define session resumption protocols as an abstract perspective on mechanisms like session caches and session tickets. We give a new generic construction that provably provides forward security and replay resilience, based on puncturable pseudorandom functions (PPRFs). We show that our construction can immediately be used in TLS 1.3 0-RTT and deployed unilaterally by servers, without requiring any changes to clients or the protocol. To this end, we present a generic composition of our new construction with TLS 1.3 and prove its security. This yields the first construction that achieves forward security for all messages, including the 0-RTT data. We then describe two new constructions of PPRFs, which are particularly suitable for use for forward-secure and replay-resilient session resumption in TLS 1.3. The first construction is based on the strong RSA assumption. Compared to standard session caches, for “128-bit security” it reduces the required server storage by a factor of almost 20, when instantiated in a way such that key derivation and puncturing together are cheaper on average than one full exponentiation in an RSA group. Hence, a 1 GB session cache can be replaced with only about 51 MBs of storage, which significantly reduces the amount of secure memory required. For larger security parameters or in exchange for more expensive computations, even larger storage reductions are achieved. The second construction combines a standard binary tree PPRF with a new “domain extension” technique. For a reasonable choice of parameters, this reduces the required storage by a factor of up to 5 compared to a standard session cache. It employs only symmetric cryptography, is suitable for high-traffic scenarios, and can serve thousands of tickets per second.

Authenticated Secret Key Generation in Delay Constrained Wireless Systems

“…The use of 0-RTT obviates the need of performing a challenge for every re-authentication through the use of a resumption secret r s , thus reducing latency. Another strong motivation for using this mechanism is that it is forward secure in the scenario we are using here [24]. We first briefly describe the TLS 0-RTT mechanism before describing a similarly inspired 0-RTT mechanism applied to the information reconciliation phase of our SKG mechanism.…”

“…When a client tries to reconnect to that server it includes its look-up identifier k l in the 0-RTT message, which allows the server to retrieve the resumption secret r s . Storing a unique resumption secret r s for each client requires server storage for each client but it provides forward security and resilience against replay attacks, when combined with a key generation mechanisms such as Diffie Hellman (or the SKG used in this paper) which are important goals for security protocols [24]. In our physical layer 0-RTT, given that a node identifier state would be required for linklayer purposes, the session cache places little comparative load and thus is the mechanism proposed here for (re-)authentication.…”

“…Note that the key k ′ can only be obtained if both the physical layer generated key and the resumption key are valid and this method can be shown to be forward secure [24].…”

“…In this study we introduce the joint use of PUF authentication and SKG in a zero-round-trip-time (0-RTT) [23,24] approach, allowing to build quick authentication mechanisms with forward security. Further, we develop an AE primitive [25][26][27] based on standard SKG schemes.…”

Efficiency Improvements for Encrypt-to-Self

“…Such compression operations are at the heart of common hash functions like SHA256 and SHA512 [9], and are routinely assumed to behave pseudo-randomly. 2 The EtS construction of [10] starts with splitting the message input and optional associated-data input into sequences of blocks (m i ) and (ad i ). It then iteratively computes the MD hash value of these blocks, 3 where all message carrying parts are additionally protected by XORing the EtS key into the corresponding compression function input.…”