Cryptology ePrint Archive: Report 2017/082

Replay Attacks on Zero Round-Trip Time: The Case of the TLS 1.3 Handshake Candidates

Marc Fischlin and Felix Günther

Abstract: We investigate security of key exchange protocols supporting so-called zero round-trip time (0-RTT), enabling a client to establish a fresh provisional key without interaction, based only on cryptographic material obtained in previous connections. This key can then be already used to protect early application data, transmitted to the server before both parties interact further to switch to fully secure keys. Two recent prominent examples supporting such 0-RTT modes are Google's QUIC protocol and the latest drafts for the upcoming TLS version 1.3.

We are especially interested in the question how replay attacks, enabled through the lack of contribution from the server, affect security in the 0-RTT case. Whereas the first proposal of QUIC uses state on the server side to thwart such attacks, the latest version of QUIC and TLS 1.3 rather accept them as inevitable. We analyze what this means for the key secrecy of both the preshared-key-based 0-RTT handshake in draft-14 of TLS 1.3 as well as the Diffie-Hellman-based 0-RTT handshake in TLS 1.3 draft-12. As part of this we extend previous security models to capture such cases, also shedding light on the limitations and options for 0-RTT security under replay attacks.

Category / Keywords: cryptographic protocols / Transport Layer Security (TLS), key exchange, protocol analysis, zero round-trip time, composition

Original Publication (with major differences): 2nd IEEE European Symposium on Security and Privacy (EuroS&P 2017)

Date: received 2 Feb 2017

Contact author: guenther at cs tu-darmstadt de

Available format(s): PDF | BibTeX Citation

Version: 20170206:190224 (All versions of this report)

Short URL: ia.cr/2017/082