1. Universally Composable Authentication and Key-exchange with Global PKI Ran Canetti (TAU and BU) Daniel Shahaf (TAU) Margarita Vald(TAU) PKC2016 Taipei, Taiwan

2. Goal: Analyze security of protocols in use. Need: Realistic security model Rigorous security definition Security proofs for systems in use

3. Modular Security Analysis 1.Split the system into smaller components 2.Separately analyze security of each component 3.Need secure composition to argue security of the system Advantages: Essential for analysis due to protocols complexity Security guarantee holds for any environment

4. Focus: security of key-exchange and authentication Our result: Modular analysis of commonly deployed key-exchange and authentication protocols.

5. Authentication Authentication can be based on: Pre-shared key Shared password Biometrics Public-key [Diffie-Hellman76] Authentication binds message to some long-term entity If R receives a message from S then S actually sent the message to R

6. Public-key Authentication Public-key infrastructure Commonly used: Chip-and-pin debit cards, email authentication, TLS…

7. Analysis of Public-key Authentication Game based: [Canetti-Krawczyk01, Brzuska-Fischlin-Smart-Warinschi-Williams13] Limited composition Simulation based: Universal Composability and Abstract Cryptography [Canetti-Krawczyk02, Canetti04, Maurer-Tackmann-Coretti13, Kohlweiss-Maurer-Onete-Tackmann-Venturi14] Win/Lose Easy and natural definition Ideal auth. General composition

8. Model vs. Reality Discrepancy fresh key per session accessible only by the session participants Same key for all sessions globally accessible PKI Is this an issue?Yes! Observation: Analysis treats the PKI as local to the protocol In reality Long-lived PKI Joint State Universal Composability

9. Guarantees: Authentication Example: Transferability IDEAL Authentication Guarantees: Authentication Non-transferable How to overcome this gap? Public-key infrastructure Transferable! Non-transferable

10. Approach #1 Find new protocols : [Dodis-Katz-Smith-Walfish09] Realize non-transferable authentication with globally available setup Additional cost: assumptions, communication, rounds Is it insecure as a plain authentication protocol?

11. Framework for analysis of authentication and KE with globally accessible PKI This Work Avoid extra properties in definition of authentication: Analyze the existing protocols

12. Secure UC Authentication Certificate authority IDEAL Authentication Certificate authority GUC Eliminates non- transferability Still provides authentication

13. Secure GUC Authentication REAL*IDEAL Authentication Certificate authority REAL Public-key infrastructure New composition theorem

14. Conclusion Framework for analysis of authentication and key-exchange Realistic modeling of protocol execution Allows modular analysis Future directions: Analyze other authentication and KE protocols with globally available PKI e.g. PKI modes of TLS Realistic modeling of other tasks e.g. secure channels

16. Model PKI-based Ideal Authentication Authentication functionality coupled with certificate authority Signs authenticated messages allows anyone to see the signature and verify its validity Certificate authority Still provides authentication Eliminates non-transferability

17. Secure UC Authentication Certificate authority REAL IDEAL Certificate authority GUC Env Adv Sim

18. Further Refined Modeling Two layers of global availability: Cross parties globality: The PKI is available to all parties in all sessions Cross sessions globality: The signing module is per party; shared among all of its session Public-key infrastructure

19. Model PKI-based Ideal Authentication Authentication functionality coupled with certificate authority Signs authenticated messages allows anyone to see the signature and verify its validity Certificate authority Still provides authentication Eliminates non-transferability Sim