Abstract:<h3 class="a-plus-plus">Abstract</h3> <p class="a-plus-plus">Transport Layer Security (TLS) is the most important cryptographic protocol in use today. However, finding a cryptographic security proof for the complete, unaltered protocol has proven to be a challenging task. We give the first such proof in the standard model for the core cryptographic protocol underlying TLS cipher suites based on ephemeral Diffie–Hellman key exchange (TLS-DHE). This includes the cipher suite <span class="a-plus-plus emphasis fontcategory-non-proportional">TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA</span>, which is mandatory in TLS 1.0 and TLS 1.1. It is impossible to prove the TLS Handshake secure in the classical security models of Bellare–Rogaway and Canetti–Krawczyk. The reason for this is that the final <span class="a-plus-plus emphasis fontcategory-non-proportional">Finished</span> messages of the TLS Handshake are encrypted with the session key, which provides an opportunity to distinguish real keys from random values. Therefore we start with proving the security of a truncated version of the TLS Handshake protocol, which has also been considered in previous work on TLS, and give the first proof of this variant in the standard model. Then we define the new notion of authenticated and confidential channel establishment (ACCE), which allows the monolithic analysis of protocols for which a modular security proof is not possible. We show that the combination of the TLS-DHE Handshake protocol and the TLS Record Layer encryption is secure in this model. Since the conference publication of this paper, the notion of ACCE has found many further applications, for example to the analysis of further TLS cipher suites (Krawczyk et al., Crypto 2013; Li et al., PKC 2014), advanced mechanisms like secure renegotiation of TLS session keys (Giesen et al., CCS 2013), and other practical protocols like EMV channel establishment (Brzuska et al., CCS 2013), SSH (Bergsma et al., CCS 2014), and QUIC (Lychev et al., S&P 2015).</p>

Mitigating TLS compromise with ECDHE and SRP

Secure Email Transmission Protocols -- A New Architecture Design

Warp2: A Method of Email and Messaging with Encrypted Addressing and Headers

A Comprehensive Review of TLSNotary Protocol

Authenticated Confidential Channel Establishment and the Security of TLS-DHE

Man in The Middle Attacks Against SSL/TLS: Mitigation and Defeat

Blockchain-based TLS Notary Service

TLS Proxies: Friend or Foe?

A survey and analysis of TLS interception mechanisms and motivations

An End-to-end User Two-Way Authenticated Double Encrypted Messaging Scheme Based on Hybrid RSA for the Future Internet Architectures.

PDoT: Private DNS-over-TLS with TEE Support

DSTC: DNS-based Strict TLS Configurations

Towards Forward Secure Internet Traffic

Hybrid RSA-based Highly Efficient, Reliable and Strong Personal Full Mesh Networked Messaging Scheme

Challenges in Adapting ECH in TLS for Privacy Enhancement over the Internet

mdTLS: How to make middlebox-aware TLS more efficient?

Preventing EFail Attacks with Client-Side WebAssembly: The Case of Swiss Post's IncaMail

A Security Analysis and Revised Security Extension for the Precision Time Protocol

A Formal Security Analysis of the pEp Authentication Protocol for Decentralized Key Distribution and End-to-End Encrypted Email

A Lightweight and Efficient Secure Hybrid RSA (SHRSA) Messaging Scheme with Four-Layered Authentication Stack

Exchanging Keys with Authentication and Identity Protection for Secure Voice Communication without Side-channel