This chapter discusses cryptographic protocols, which provide a means for cryptographic primitives to be combined in ways that allow complex sets of security goals to be tailored to particular application environments. It describes a simple, but artificial, application in order to demonstrate that there are many different ways in which a cryptographic protocol can be designed, and also how sensitive the security of cryptographic protocols can be. It then considers the important family of AKE protocols (authentication and key establishment).
This chapter discusses cryptographic protocols, which provide a means for cryptographic primitives to be combined in ways that allow complex sets of security goals to be tailored to particular application environments. It describes a simple, but artificial, application in order to demonstrate that there are many different ways in which a cryptographic protocol can be designed, and also how sensitive the security of cryptographic protocols can be. It then considers the important family of AKE protocols (authentication and key establishment).
This chapter is concerned with cryptographic protocols. We begin with an explanation of what components a cryptographic protocol consists of. We then illustrate the complexity of designing a secure cryptographic protocol by considering an artificially simple scenario, for which we propose and analyse seven candidate protocols. For each of these protocols, we comment on whether, or under which conditions, they meet the required specification. We go on to look at the important class of authentication and key establishment protocols. We identify typical goals and examine some important protocols in this class, including the Diffie–Hellman protocol.
This chapter considers key establishment protocols and related cryptographic techniques which provide shared secrets between two or more parties, typically for subsequent use as symmetric keys for a variety of cryptographic purposes including encryption, message authentication, and entity authentication. The main focus is two-party key establishment, with the aid of a trusted third party in some cases. While many concepts extend naturally to multi-party key establishment including conference keying protocols, such protocols rapidly become more complex, and are considered here only briefly, as is the related area of secret sharing. Broader aspects of key management, including distribution of public keys, certificates, and key life cycle issues, are deferred to Chapter 13 .
Following its etymology, the term cryptography denotes the techniques used to ensure the confidentiality of information in its storage or transmission. Besides confidentiality, cryptography also encompasses other important functions such as authentication, signature, non-repudiation or secret sharing, to name just a few. The purpose of this section is to give a short introduction to classical cryptography, but only for areas that are relevant to quantum cryptography. For our purposes, we will only deal with confidentiality and authentication. The former is the most important function that quantum key distribution helps to achieve, while the latter is a requirement for quantum key distribution to work. Also, we will cover some topics on the security of classical cryptographic schemes so as to give some insight when comparing classical and quantum cryptography. The study of cryptography ranges from the analysis of cryptographic algorithms (or primitives ) to the design of a solution to a security problem. A cryptographic algorithm is a mathematical tool that provides a solution to a very specific problem and may be based on premises or on other primitives. A solution can be designed by combining primitives, and the requirements and functions of the primitives have to be combined properly. We will first review the confidentiality provided by ciphers that use the same key for both encryption and decryption, hence called secret-key ciphers . Then, we will discuss authentication techniques. Finally, we will show some aspects of public-key cryptography .
Key exchange protocols, first introduced by Diffie and Hellman in 1976, are one of the most widely-deployed cryptographic protocols. They allow two parties, that have never interacted before, to establish shared secrets. These shared cryptographic keys may subsequently be used to establish a secure communication channel. Use cases include the classic client-server setting that is for example at play when browsing the internet, but also chats via end-to-end-encrypted instant messaging applications. Security-wise, we generally demand of key exchange protocols to achieve key secrecy and authentication. While, informally, authentication ensures that the communicating parties have confidence in the identity of their peers, key secrecy ensures that any shared cryptographic key that is established via the key exchange protocol is only known to the participants in the protocol and can be used securely in cryptographic protocols, i.e., is sufficiently random. In 1993, Bellare and Rogaway gave a first formalization of key exchange protocol security that captures these properties with respect to powerful adversaries with full control over the network. Their model constitutes the basis of the many subsequent treatments of authenticated key exchange security, including the models presented in this thesis. The common methodological approach underlying all of these formalizations is the provable security paradigm, which has become a standard tool in assessing the security of cryptographic protocols and primitives. So-called security models specify the expected security guarantees of the scheme in question with regards to a well-defined class of adversaries. Proofs that validate these security claims do so by reducing the security of the overall scheme to the security of the underlying cryptographic primitives and hardness assumptions. However, advances in computational power and more sophisticated cryptanalytic capabilities often render exactly these components insecure. Especially the advent of quantum computers will have a devastating effect on much of today's public key cryptography. This is especially true for key exchange protocols since they rely crucially on public-key algorithms. In this thesis, our focus in future-proofing key exchange protocols is two-fold. First, we focus on extending security models for key exchange protocols to capture the (un)expected break of cryptographic primitives and hardness assumptions. The aim is to gain assurances with respect to future adversaries and to investigate the effects of primitive failures on key exchange protocols. More specifically, we explore how key exchange protocols can be safely transitioned to new, post-quantum secure algorithms with hybrid techniques. Hybrids combine classical and post-quantum algorithms such that the overall key agreement scheme remains secure as long as one of the two base schemes remains secure. For this, we introduce security notions for key encapsulation mechanisms that account for adversaries with varying levels of quantum capabilities and present three new constructions for hybrid key encapsulation mechanisms. Our hybrid designs are practice-inspired and for example capture draft proposals for hybrid modes in the Transport Layer Security (TLS) protocol, which is one of the most widely-deployed cryptographic protocols that enables key agreement. Furthermore, our notion of breakdown resilience for key exchange protocols allows to gauge the security of past session keys in the event of a failure of a cryptographic component in the key exchange. We exercise our model on variants of the post-quantum secure key exchange protocol NewHope by Alkim et al. Thereby, we confirm the intuition that, in order to guard against adversaries that only have access to quantum computing power in the (more distant) future, it is sufficient to use classically-secure authentication mechanisms alongside post-quantum key agreement to achieve authenticated key exchange. As with any mathematical statement, theorems in the provable security paradigm are only as valid as the underlying assumptions. A careful consideration of any newly made assumption is thus essential to ensure the meaningfulness of the statement itself and make the assumption a viable tool for future analyses. Thus, secondly, we systematically classify the PRF-ODH assumption, a complexity-theoretic hardness assumption that has been used in key exchange security analyses of such prominent protocols as TLS, Signal, and Wireguard. In particular, we give a unified, parametrized definition of the assumption encompassing different variants that are present in the literature. We relate the resulting parametrized notions in terms of their strength and show where these assumptions fit in the collection of well-understood related hardness assumptions. We finally sketch our result on the impossibility of instantiating this assumption in the standard model, thereby disposing of the uncertainty in the community whether PRF-ODH is in fact a standard model assumption, i.e., removes the usage of some idealized assumptions in key exchange protocol proofs.
We prcscnt a general framework for constructing and analyzing authentication protocols in realistic models of communication networks.This framework provides a sound formalization for the authentication problem and suggests simple and attractive design principles for general authentication and key exchange protocols.The key element in our appronch io a modular treatment of the authentication problem in cryptographic protocols; thii applies to the definition of accurity, to the design of the protocols, and to their analysis.In particulnr, following this modular approach, we show how to systematically transform solutions that work in a model of idaalizcd authenticated communications into solutions that are secure in the realistic setting of communication channels controlled by an active adversary.Using these principles we construct and prove the security of simple and practical authentication and key-exchange protocols.In particular, we provide a security analysis of aomo well-known key exchange protocols (e.g.authenticated Dlfllc-Hcllman key exchange), and of some of the techniques underlying the design of several authentication protocols that are currently being deployed on a large scale for the Intornot Protocol and other applications.
The methods of cryptography can be successful only if they are properly incorporated into an application. A cryptographic technique can be unbreakable as such, and yet could still be insecure if it is used unwisely. This observation motivates the subject of security protocols. A security protocol consists of a formal method of using a cryptographic technique in a practical application. Without a well-defined security protocol, a perfectly secure cryptographic technique could be compromised by its use. We do not draw a sharp distinction between the topic of secrecy and the topic of security. The two are closely related, and it is not helpful to attempt to draw a sharp line between them. In this context, a primitive is a basic method of obtaining secrecy and a protocol is a body of rules for using that primitive. In this chapter we will also study other forms of information protection such as identification and secret sharing that can be regarded as topics closely related to security protocols. The topic of identification deals with methods for establishing the identity of the source of a transmission. This is a subtle and difficult topic because the very concept of identity is vague and subjective. The identity of an isolated individual or device may be self-defined and subject to no outside verification. That identity is useful only to establish that all messages in a sequence of messages are from the same entity.