DMCA
A Modular Security Analysis of the TLS Handshake Protocol (2008)
| Venue: | Advances in Cryptology — Asiacrypt 2008, Volume 5350 of LNCS |
| Citations: | 26 - 0 self |
BibTeX
@INPROCEEDINGS{Morrissey08amodular,
author = {P. Morrissey and N. P. Smart and B. Warinschi},
title = {A Modular Security Analysis of the TLS Handshake Protocol},
booktitle = {Advances in Cryptology — Asiacrypt 2008, Volume 5350 of LNCS},
year = {2008},
pages = {55--73},
publisher = {Springer}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
We study the security of the widely deployed Secure Session Layer/Transport Layer Security (TLS) key agreement protocol. Our analysis identifies, justifies, and exploits the modularity present in the design of the protocol: the application keys offered to higher level applications are obtained from a master key, which in turn is derived, through interaction, from a pre-master key. Our first contribution consists of formal models that clarify the security level enjoyed by each of these types of keys. The models that we provide fall under well established paradigms in defining execution, and security notions. We capture the realistic setting where only one of the two parties involved in the execution of the protocol (namely the server) has a certified public key, and where the same master key is used to generate multiple application keys. The main contribution of the paper is a modular and generic proof of security for the application keys established through the TLS protocol. We show that the transformation used by TLS to derive master keys essentially transforms an arbitrary secure pre-master key agreement protocol into a secure master-key agreement protocol. Similarly, the transformation used to derive application keys works when applied to an arbitrary secure master-key agreement protocol. These results are in the random oracle model. The security of the overall protocol then follows from proofs of security for the basic pre-master key generation protocols employed by TLS. 1
Keyphrases
master key modular security analysis tl handshake protocol application key arbitrary secure master-key agreement protocol tl protocol overall protocol multiple application key generic proof realistic setting secure master-key agreement protocol pre-master key modularity present derive application key random oracle model main contribution analysis identifies basic pre-master key generation protocol security notion first contribution level application public key formal model key agreement protocol security level
