Cryptology ePrint Archive: Report 2020/824

Forward-Secure 0-RTT Goes Live: Implementation and Performance Analysis in QUIC

Fynn Dallmeier and Jan P. Drees and Kai Gellert and Tobias Handirk and Tibor Jager and Jonas Klauke and Simon Nachtigall and Timo Renzelmann and Rudi Wolf

Abstract: Modern cryptographic protocols, such as TLS 1.3 and QUIC, can send cryptographically protected data in "zero round-trip times (0-RTT)", that is, without the need for a prior interactive handshake. Such protocols meet the demand for communication with minimal latency, but those currently deployed in practice achieve only rather weak security properties, as they may not achieve forward security for the first transmitted payload message and require additional countermeasures against replay attacks.

Recently, 0-RTT protocols with full forward security and replay resilience have been proposed in the academic literature. These are based on puncturable encryption, which uses rather heavy building blocks, such as cryptographic pairings. Some constructions were claimed to have practical efficiency, but it is unclear how they compare concretely to protocols deployed in practice, and we currently do not have any benchmark results that new protocols can be compared with.

We provide the first concrete performance analysis of a modern 0-RTT protocol with full forward security, by integrating the Bloom Filter Encryption scheme of Derler et al. (EUROCRYPT 2018) in the Chromium QUIC implementation and comparing it to Google's original QUIC protocol. We find that for reasonable deployment parameters, the server CPU load increases approximately by a factor of eight and the memory consumption on the server increases significantly, but stays below 400 MB even for medium-scale deployments that handle up to 50K connections per day. The difference of the size of handshake messages is small enough that transmission time on the network is identical, and therefore not significant.

We conclude that while current 0-RTT protocols with full forward security come with significant computational overhead, their use in practice is not infeasible, and may be used in applications where the increased CPU and memory load can be tolerated in exchange for full forward security and replay resilience on the cryptographic protocol level. Our results also serve as a first benchmark that can be used to assess the efficiency of 0-RTT protocols potentially developed in the future.

Category / Keywords: implementation / 0-RTT, key exchange, forward security, QUIC, implementation, experimental analysis, puncturable encryption

Original Publication (with minor differences): CANS 2020 - 19th International Conference on Cryptology and Network Security

Date: received 3 Jul 2020, last revised 6 Oct 2020

Contact author: kai gellert at uni-wuppertal de, tibor jager@uni-wuppertal de, jan drees@uni-wuppertal, tobias handirk@uni-wuppertal de

Available format(s): PDF | BibTeX Citation

Version: 20201006:141145 (All versions of this report)

Short URL:

[ Cryptology ePrint archive ]