Abstract:<h3 class="a-plus-plus">Abstract</h3> <p class="a-plus-plus">Transport Layer Security (TLS) is the most important cryptographic protocol in use today. However, finding a cryptographic security proof for the complete, unaltered protocol has proven to be a challenging task. We give the first such proof in the standard model for the core cryptographic protocol underlying TLS cipher suites based on ephemeral Diffie–Hellman key exchange (TLS-DHE). This includes the cipher suite <span class="a-plus-plus emphasis fontcategory-non-proportional">TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA</span>, which is mandatory in TLS 1.0 and TLS 1.1. It is impossible to prove the TLS Handshake secure in the classical security models of Bellare–Rogaway and Canetti–Krawczyk. The reason for this is that the final <span class="a-plus-plus emphasis fontcategory-non-proportional">Finished</span> messages of the TLS Handshake are encrypted with the session key, which provides an opportunity to distinguish real keys from random values. Therefore we start with proving the security of a truncated version of the TLS Handshake protocol, which has also been considered in previous work on TLS, and give the first proof of this variant in the standard model. Then we define the new notion of authenticated and confidential channel establishment (ACCE), which allows the monolithic analysis of protocols for which a modular security proof is not possible. We show that the combination of the TLS-DHE Handshake protocol and the TLS Record Layer encryption is secure in this model. Since the conference publication of this paper, the notion of ACCE has found many further applications, for example to the analysis of further TLS cipher suites (Krawczyk et al., Crypto 2013; Li et al., PKC 2014), advanced mechanisms like secure renegotiation of TLS session keys (Giesen et al., CCS 2013), and other practical protocols like EMV channel establishment (Brzuska et al., CCS 2013), SSH (Bergsma et al., CCS 2014), and QUIC (Lychev et al., S&P 2015).</p>

Provably Secure Commitment-based Protocols over Unauthenticated Channels

Automated Cryptographic Analysis of the Pedersen Commitment Scheme

Authenticated Key Exchange and Signatures with Tight Security in the Standard Model.

Provable Password-Authenticated Key Exchange Protocol Against Imposter Attack on Ad Hoc Networks.

Degrees of Security: Protocol Guarantees in the Face of Compromising Adversaries

A New Framework for Deniable Secure Key Exchange

Building Secure and Anonymous Communication Channel: Formal Model and its Prototype Implementation

On constant-round concurrent non-malleable proof systems

Authenticated Key Exchange Protocol with Enhanced Freshness Properties.

Formal security analysis of registration protocols for interactive systems: a methodology and a case of study

Provably Secure Three-Party Password-Authenticated Key Exchange

Authenticated Confidential Channel Establishment and the Security of TLS-DHE

Multiuser Commitment over Noisy Channels

Provably Secure Identity-Based Authenticated Key Agreement Protocols in the Standard Model

Unconditionally Secure Commitments with Quantum Auxiliary Inputs

Reliable Communication in Hybrid Authentication and Trust Models

On the Security of Public Key Protocols

Provably secure certificateless one-way and two-party authenticated key agreement protocol

Reexamination of Quantum Bit Commitment: the Possible and the Impossible

A Novel Single Agent Quantum Bit Commitment Scheme

Provably Secure Three-Party Authenticated Key Exchange Based on Certificateless Key Encapsulation Sensor Mechanism