Abstract:<h3 class="a-plus-plus">Abstract</h3> <p class="a-plus-plus">Transport Layer Security (TLS) is the most important cryptographic protocol in use today. However, finding a cryptographic security proof for the complete, unaltered protocol has proven to be a challenging task. We give the first such proof in the standard model for the core cryptographic protocol underlying TLS cipher suites based on ephemeral Diffie–Hellman key exchange (TLS-DHE). This includes the cipher suite <span class="a-plus-plus emphasis fontcategory-non-proportional">TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA</span>, which is mandatory in TLS 1.0 and TLS 1.1. It is impossible to prove the TLS Handshake secure in the classical security models of Bellare–Rogaway and Canetti–Krawczyk. The reason for this is that the final <span class="a-plus-plus emphasis fontcategory-non-proportional">Finished</span> messages of the TLS Handshake are encrypted with the session key, which provides an opportunity to distinguish real keys from random values. Therefore we start with proving the security of a truncated version of the TLS Handshake protocol, which has also been considered in previous work on TLS, and give the first proof of this variant in the standard model. Then we define the new notion of authenticated and confidential channel establishment (ACCE), which allows the monolithic analysis of protocols for which a modular security proof is not possible. We show that the combination of the TLS-DHE Handshake protocol and the TLS Record Layer encryption is secure in this model. Since the conference publication of this paper, the notion of ACCE has found many further applications, for example to the analysis of further TLS cipher suites (Krawczyk et al., Crypto 2013; Li et al., PKC 2014), advanced mechanisms like secure renegotiation of TLS session keys (Giesen et al., CCS 2013), and other practical protocols like EMV channel establishment (Brzuska et al., CCS 2013), SSH (Bergsma et al., CCS 2014), and QUIC (Lychev et al., S&P 2015).</p>

Efficient and Practical DHEKE Protocols.

Privacy-Preserving Authenticated Key-Exchange over Internet

Deniable Internet Key Exchange

An Efficient Delegation-Based Anonymous Authentication Protocol

An Improved Kerberos Protocol Based on Diffie-Hellman-DSA Key Exchange.

Cryptanalysis and Improvement of Park Et Al.'s Remote User Authentication Protocol

Three-party Encrypted Key Exchange

OAKE: a New Family of Implicitly Authenticated Diffie-Hellman Protocols.

Efficient Three-Party Authentication and Key Agreement Protocols Resistant to Password Guessing Attacks

Enhanced Three-Party Encrypted Key Exchange Without Server Public Keys

A New Family of Practical Non-Malleable Diffie-Hellman Protocols

Strong password-only authenticated key exchange

Light the Signal: Optimization of Signal Leakage Attacks Against LWE-Based Key Exchange

Composable Security of Distributed Symmetric Key Establishment Protocol

Password-based Authentication and Key Distribution Protocols with Perfect Forward Secrecy

Provably Secure Password-Authenticated Key Exchange Using Diffie-Hellman

An Improved Authenticated Key Agreement Protocol

Deniable Authentication Protocols

Authenticated Confidential Channel Establishment and the Security of TLS-DHE

Efficient public-key authenticated deniable encryption schemes

Efficient Generalized Selective Private Function Evaluation With Applications In Biometric Authentication