[TLS] A Cryptographic Analysis of the TLS 1.3 Handshake Protocol Candidates

[Felix Günther <[e-mail]>]

Dear all,

In a recent work, we analyzed the ephemeral Diffie--Hellman-based
handshake protocol in two drafts of TLS 1.3 which were available at the
time of our research project in May: draft-ietf-tls-tls13-05 as well as
the variant proposal draft-ietf-tls-tls13-dh-based
(https://github.com/ekr/tls13-spec/blob/ietf92_materials/draft-ietf-tls-tls13-dh-based.txt).
 At this point in time, these have been integrated into the latest draft
08.

Our research paper will be published at the ACM Conference on Computer
and Communications Security (CCS 2015) in October; a full version is now
available in the IACR Cryptology ePrint Archive
(https://eprint.iacr.org/2015/914). We show that, for both drafts, the
full and resumption handshakes achieve the main goal of providing secure
authenticated key exchange in a "multi-stage" setting using a game-based
approach toward provable security (in the style of Bellare and Rogaway).

On a high level, this means that the handshakes establish record layer
keys, resumption keys, and exporter keys that look random to an
adversary. This holds with sessions that run concurrently and if the
adversary controls the whole network, is able to corrupt the long-term
secret keys of other parties, and allowed to reveal keys established in
other sessions, thus providing quite strong security guarantees for
practice. Moreover, we show that even leakage of record layer or
exporter keys in the same handshake session do not compromise each
other's security.
Our results hold based on standard cryptographic assumptions, namely
collision resistance of hash functions, unforgeability of signatures,
pseudorandomness of the key derivation function, and the Decisional
Diffie--Hellman assumption, and without resorting to an idealized model
such as the random oracle model.

Before sharing some technical insights and comments arising from our
work, let us shortly state precisely the scope of our work:
 * TLS 1.3 of course is still a work in progress, hence our analysis is
inevitably limited to the draft specifications at the time of writing
and should hence be considered as a contribution to the ongoing
discussion rather than a definitive analysis of TLS 1.3.
 * Our work focuses on the full and resumption handshakes, but does not
capture 0-RTT handshakes which were still un(der)specified at the time
of writing.
 * We do not analyze the record layer protocol (which is outside of the
scope of this work, and has been worked on by others), but rather follow
a compositional approach by showing that the full handshake securely
composes with any symmetric-key protocol. Extending this result to
encompass also the (non-forward-secret) resumption handshake is left for
future work due to a technicality in the compositional framework that
depends on forward secrecy.

Our main comments can be summarized as follows (see Section 3 of our
paper for a more detailed version):

 1. Soundness of key separation
    Using separate keys for the encryption of handshake messages and
application data (compared with previous versions of TLS that encrypted
the Finished messages using the session key) allows the protocol to
achieve standard key secrecy/indistinguishability notions using standard
cryptographic assumptions (i.e., DDH rather than PRF-ODH).

 2. Key independence
    The key schedule which derives each output key (in particular the
two traffic keys) through an application of the key derivation function
with a unique label/info input allows us to prove that these keys are
computationally independent: neither is affected by the other's
compromise. This in particular contributes to the compositional approach
of treating the (security of the) handshake and record layer separately.

 3. Session hash in online signatures
    Including the full transcript/session hash in the CertificateVerify
signature makes the security proof easier and contributes to
establishing security based on standard assumptions.

 4. Encryption of handshake messages
    The handshake traffic key is secure against passive adversaries and
hence encryption within the handshake can indeed increase privacy. We
confirm that this approach does not have negative effects on the main
key secrecy/indistinguishability goal of the key exchange.


While our paper addresses older drafts (draft-05 and draft-dh), we
expect that our analysis of the full handshake in draft-dh can be
adapted to cover the full handshake in the latest draft-08 version. As
the handshake stabilizes, we hope to update our work. At this point in
time, we hope that our analysis can provide some cryptographic insights
for the so-far achieved and further development of TLS 1.3.

We welcome your comments and suggestions.

Benjamin Dowling, Marc Fischlin, Felix Günther, and Douglas Stebila
(Queensland University of Technology and Technische Universität Darmstadt)