A Cryptographic Analysis of the TLS 1.3 draft-10 Full and Pre-shared Key Handshake Protocol

Benjamin Dowling; Marc Fischlin; Felix Günther; Douglas Stebila

Paper 2016/081

A Cryptographic Analysis of the TLS 1.3 draft-10 Full and Pre-shared Key Handshake Protocol

Benjamin Dowling, Marc Fischlin, Felix Günther, and Douglas Stebila

Abstract

We analyze the handshake protocol of TLS 1.3 draft-ietf-tls-tls13-10 (published October 2015). This continues and extends our previous analysis (CCS 2015, Cryptology ePrint Archive 2015) of former TLS 1.3 drafts (draft-ietf-tls-tls13-05 and draft-ietf-tls-tls13-dh-based). Here we show that the full (EC)DHE Diffie-Hellman-based handshake of draft-10 is also secure in the multi-stage key exchange framework of Fischlin and Günther which captures classical Bellare-Rogaway key secrecy for key exchange protocols that derive multiple keys. We also note that a recent protocol change---the introduction of a NewSessionTicket message for resumption, encrypted under the application traffic key---impairs the protocol modularity and hence our compositional guarantees that ideally would allow an independent analysis of the record protocol. We additionally analyze the pre-shared key modes (with and without ephemeral Diffie-Hellman key), and fit them into the composability framework, addressing composability with the input resumption secret from a previous handshake and of the output session keys.

Note: Corrected proofs using PRF-ODH assumption

Metadata

Available format(s): PDF
Category: Cryptographic protocols
Publication info: Preprint. MINOR revision.
Keywords: Transport Layer Security (TLS)key exchange protocol analysis composition
Contact author(s): guenther @ cs tu-darmstadt de
History: 2017-01-31: revised; 2016-01-29: received; See all versions
Short URL: https://ia.cr/2016/081
License: CC BY

BibTeX

@misc{cryptoeprint:2016/081,
      author = {Benjamin Dowling and Marc Fischlin and Felix Günther and Douglas Stebila},
      title = {A Cryptographic Analysis of the {TLS} 1.3 draft-10 Full and Pre-shared Key Handshake Protocol},
      howpublished = {Cryptology {ePrint} Archive, Paper 2016/081},
      year = {2016},
      url = {https://eprint.iacr.org/2016/081}
}