DMCA
Proving the TLS handshake secure (as it is (2013)
| Venue: | BFS + 13] Christina Brzuska, Marc Fischlin, Nigel |
| Citations: | 5 - 3 self |
BibTeX
@TECHREPORT{Bhargavan13provingthe,
author = {Karthikeyan Bhargavan and Markulf Kohlweiss and Alfredo Pironti and Pierre-yves Strub},
title = {Proving the TLS handshake secure (as it is},
institution = {BFS + 13] Christina Brzuska, Marc Fischlin, Nigel},
year = {2013}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
The TLS Internet Standard features a mixed bag of cryptographic algorithms and constructions, let-ting clients and servers negotiate their use for each run of the handshake. Although many ciphersuites are now well-understood in isolation, their composition remains problematic, and yet it is critical to obtain practical security guarantees for TLS. We experimentally confirm that all mainstream implemen-tations of TLS share key materials between different algorithms, some of them of dubious strength. We outline attacks in their handling of resumption and renegotiation, stressing the need to model multiple related instances of the handshake. We study the provable security of the TLS handshake, as it is implemented and deployed. To capture the details of the standard and its main extensions, we rely on miTLS, a verified reference implementation of the protocol. miTLS inter-operates with mainstream browsers and servers for many protocol versions, configurations, and ciphersuites; and it provides application-level, provable security for some. We propose new agile security definitions and assumptions for the signatures, key encapsulation mechanisms (KEM), and key derivation algorithms used by the TLS handshake. By necessity, our
Keyphrases
tl handshake secure tl handshake provable security new agile security definition many ciphersuites key encapsulation mechanism tl internet standard practical security guarantee many protocol version cryptographic algorithm verified reference implementation key derivation algorithm dubious strength mainstream browser mixed bag different algorithm let-ting client tl share key material multiple related instance main extension mainstream implemen-tations
