The original cryptographic problem is for Alice and Bob to have a conversation using some insecure communications channel, but preventing Eve both from eavesdropping and in and improper manner tampering with their conversation. This chapter develops the theory of messaging protocols, which is the answer to the original cryptographic problem. The chapter develops a framework for messaging protocols and related security notions. The framework also captures symmetric key channels as a special case. The chapter in particular analyses compositional constructions based on key exchange protocols and channels. The results provides solid solutions for the original cryptographic problem. The chapter also investigates stronger notions of security for messaging protocols, including a design based on role-symmetric key exchange. One important societal goal is to defend against mass surveillance. While cryptography cannot solve this problem on its own, this chapter discusses techniques for preventing messaging protocols from making mass surveillance trivial.
The original cryptographic problem is for Alice and Bob to have a conversation using some insecure communications channel, but preventing Eve both from eavesdropping and in and improper manner tampering with their conversation. This chapter develops the theory of messaging protocols, which is the answer to the original cryptographic problem. The chapter develops a framework for messaging protocols and related security notions. The framework also captures symmetric key channels as a special case. The chapter in particular analyses compositional constructions based on key exchange protocols and channels. The results provides solid solutions for the original cryptographic problem. The chapter also investigates stronger notions of security for messaging protocols, including a design based on role-symmetric key exchange. One important societal goal is to defend against mass surveillance. While cryptography cannot solve this problem on its own, this chapter discusses techniques for preventing messaging protocols from making mass surveillance trivial.
Cryptographic protocols are an integral part of today’s communication infrastructure, where information has to be secured on various levels. The security of cryptographic protocols has been studied for decades with numerous methods, focuses, and levels of abstraction. However, no model has been developed so far that captures the specifics of message exchange protocols that only consist of two rounds, a single client request and a subsequent server response. In this thesis, we define and analyze three protocols that offer security guarantees for two-round message exchange protocols, including authenticated message exchange (using digital signatures or passwords) as well as confidentiality (using hybrid encryption). Our protocols are generic in the sense that they can be used to securely implement any service based on two-round message exchange, because request and response can carry arbitrary payloads. Our modelings and analyses include realistic aspects characteristic to secure two-round protocols like timestamps and long-lived, but bounded server memory. All three protocols are uniformly modeled and analyzed in a simulation-based security framework, allowing us to modularize the security analyses and allowing others to build upon our protocols while utilizing the strong composability results offered by the simulation-based security notion. In addition, one of the protocols is analyzed in a concrete computational model; for this we extend the Bellare–Rogaway framework by, e. g., timestamps and payloads with signed parts. Analyzing one of the protocols in both a simulation-based and a concrete computational framework gives insights into the relation between both frameworks; we show a connection for mutual authentication protocols and point out differences for the case of secure two-round message exchange. In addition, we discuss how our goal of authenticated message exchange is related to the common security notions of message and entity authentication.
We present a general framework for constructing and analyzing authentication protocols in realistic models of communication networks. This framework provides a sound formalization for the authentication problem and suggests simple and attractive design principles for general authentication and key exchange protocols. The key element in our approach is a modular treatment of the authentication problem in cryptographic protocols; this applies to the definition of security, to the design of the protocols, and to their analysis. In particular, following this modular approach, we show how to systematically transform solutions that work in a model of idealized authenticated communications into solutions that are secure in the realistic setting of communication channels controlled by an active adversary. Using these principles we construct and prove the security of simple and practical authentication and key-exchange protocols. In particular, we provide a security analysis of some well-known key exchange protocols (e.g. authenticated Diffie-Hellman key exchange), and of some of the techniques underlying the design of several authentication protocols that are currently being
The design of secure protocols that implement arbitrarily desired functionalities is a major part of modern cryptography. Taking the opposite perspective, the design of any cryptographic scheme may be viewed as the design of a secure protocol for implementing a suitable functionality. Still, we believe that it makes sense to differentiate between basic cryptographic primitives (which involve little interaction) like encryption and signature schemes, on the one hand, and general cryptographic protocols, on the other hand. In this chapter we consider general results concerning secure multi –party computations, where the two –party case is an important special case. In a nutshell, these results assert that one can construct protocols for securely computing any desirable multi–party functionality (see the following terminology). Indeed, what is striking about these results is their generality, and we believe that the wonder is not diminished by the (various alternative) conditions under which these results hold. Our focus on the general study of secure multi–party computation (rather than on protocols for solving specific problems) is natural in the context of the theoretical treatment of the subject matter. We wish to highlight the importance of this general study to practice. Firstly, this study clarifies fundamental issues regarding security in a multi–party environment. Secondly, it draws the lines between what is possible in principle and what is not. Thirdly, it develops general techniques for designing secure protocols. And last, sometimes it may even yield schemes (or modules) that may be incorporated in practical systems.
The basic problems We saw in Chapter 5 that the one-time pad is a cryptosystem that provides perfect secrecy, so why not use it? The obvious reason is that the key needs to be as long as the message and the users need to decide on this secret key in advance using a secure channel. Having introduced public key cryptography in Chapter 7 one might wonder why anyone would want to use a symmetric cryptosystem. Why not simply use RSA or some other public key cryptosystem and dispense with the need to exchange secret keys once and for all? The problem with this approach is that symmetric cryptosystems are generally much faster. For example in 1996, DES was around 1000 times faster than RSA. In situations where a large amount of data needs to be encrypted quickly or the users are computationally limited, symmetric cryptosystems still play an important role. A major problem they face is how to agree a common secret key to enable communications to begin. This basic ‘key exchange problem’ becomes ever more severe as communication networks grow in size and more and more users wish to communicate securely. Indeed while one could imagine. Alice and Bob finding a way to exchange a secret key securely the same may not be true if you have a network with 1000 users.
This chapter formally defines key exchange and related security notions. The theory is developed in some generality, and a rich body of theory is developed to support two major design strategies, one based on just key encapsulation mechanisms, and the other also using digital signatures. Diffie-Hellman-based protocols are used as examples, while the major design theorems are based on key encapsulation mechanisms. The chapter also discusses variants of key exchange, such as single-message key exchange, single-sided authentication and continuous key exchange.
In the analysis of many cryptographie protocole, it is useful to distinguish two classes of attacks: passive attacks in which an adversary eavesdrops on messages sent between honest users and active attacks (i.e, “man-in-the-middle” attacks) in which—in addition to eavesdropping—the adversary inserts, deletes, or arbitrarily modifies messages sent from one user to another. Passive attacks are well characterized (the adversary's choices are inherently limited) and techniques for achieving security against passive attacks are relatively well understood. Indeed, cryptographers have long focused on methods for countering passive eavesdropping attacks, and much work in the 1970's and 1980's has dealt with formalizing notions of security and providing provably-secure solutions for this setting. On the other hand, active attacks are not well characterized and precise modeling has been difficult. Few techniques exist for dealing with active attacks, and designing practical protocols secure against such attacks remains a challenge.
This dissertation considers active attacks in a variety of settings and provides new, provably-secure protocols preventing such attacks. Proofs of security are in the standard cryptographie model and rely on well-known cryptographie assumptions. The protocols presented here are efficient and practical, and may find application in real-world systems.