Cryptology ePrint Archive: Report 2020/534

Post-quantum TLS without handshake signatures

Peter Schwabe and Douglas Stebila and Thom Wiggers

Abstract: We present KEMTLS, an alternative to the TLS 1.3 handshake that uses key-encapsulation mechanisms (KEMs) instead of signatures for server authentication. Among existing post-quantum candidates, signature schemes generally have larger public key/signature sizes compared to the public key/ciphertext sizes of KEMs: by using an IND-CCA-secure KEM for server authentication in post-quantum TLS, we obtain multiple benefits. A size-optimized post-quantum instantiation of KEMTLS requires less than half the bandwidth of a size-optimized post-quantum instantiation of TLS 1.3. In a speed-optimized instantiation, KEMTLS reduces the amount of server CPU cycles by almost 90% compared to TLS 1.3, while at the same time reducing communication size, reducing the time until the client can start sending encrypted application data, and eliminating code for signatures from the server's trusted code base.

Category / Keywords: cryptographic protocols / TLS, Transport Layer Security, authentication protocols, public-key cryptography, key-encapsulation mechanisms, post-quantum, NIST PQC

Original Publication (with major differences): ACM CCS 2020

Date: received 7 May 2020, last revised 21 Apr 2021

Contact author: peter at cryptojedi org,dstebila@uwaterloo ca,thom@thomwiggers nl

Available format(s): PDF | BibTeX Citation

Note: Small updates to the security model and proof

Version: 20210421:135303 (All versions of this report)

Short URL:

[ Cryptology ePrint archive ]