Year: 2014
Type: article
Abstract: Securing today's Internet communication is one of the most fundamental application of cryptographic techniques, and one of the prevailing protocol suite used for this purpose is IPsec.It consists, among others, of a sub-protocol for key establishment, the second version of the Internet Key Exchange (IKEv2) protocol, and a sub-protocol for securing the traffic, the Encapsulated Security Payload (ESP) protocol.Whereas the ESP protocol is based on the well established encrypt-then-MAC approach, the design of the IKEv2 protocol is more peculiar: while based on the Diffie-Hellman key exchange, that exchange is initially not authenticated.The authentication is postponed to a second round, which at the same time already makes use of that previously negotiated key.Somewhat surprisingly, and despite its practical importance, no comprehensive analysis of the IKEv2 protocol in a coherent framework has been conducted so far.Even though certain aspects of the IKEv2 protocol have been studied in depth in the literature, all analyses either consider significantly simplified protocol variants or neglect important aspects such as the initial lack of authentication.This might partially be explained by the numerous options and the thereby implied complexity of the protocol.In this thesis, we follow the constructive cryptography paradigm of Maurer and Renner (ICS 2011) to model and analyze both the ESP and the IKEv2 protocol.One main advantage of this approach is that it comes with strong composition guarantees: the protocols can be decomposed into a sequence of individually provable steps; the composition theorem then immediately guarantees the security of the overall protocol.Thus, this approach is well suited for analyzing complex protocols such as IKEv2.We formalize the security guarantees achieved by IKEv2 and ESP, as well as their assumptions, explicitly.In particular, we prove that the IKEv2 protocol constructs a shared secret key assuming a random oracle and a pre-established authentication mechanism, and that the ESP protocol constructs a replay-free secure channel, relying on pre-shared keys.The paradigm of constructive cryptography enables us to both clearly identify superfluous security mechanisms applied in the protocols, as well as pinpoint the specific shortcomings hindering provable security.As a consequence, we are able to propose improvements to the IKEv2 protocol to make it simpler and more secure.i Acknowledgments I would like to express my thankfulness to various people who contributed with their valuable input towards the successful completion of this thesis and who motivated my throughout those six months.First and foremost, I would like to express my gratitude to Professor Ueli Maurer for giving me the opportunity to gain valuable insight into a fascinating research area by writing my thesis in his group.I would also like to show my greatest appreciation to my adviser Björn Tackmann for his support, the valuable feedback on draft versions, and especially for the countless illuminating discussions we had about the topics related to this thesis.Special thanks also to my family and friends for their enduring support and encouragement throughout my life.iii 1.2 Related WorkModes of Operations Both the ESP and the AH protocols can be deployed in two basic modes: tunnel mode and transport mode.In the tunnel mode, cryptographic protection is provided for entire IP packets; the whole packet plus security fields is treated as the new payload of an outer IP packet, which has its own header.The original IP packet is said to be encapsulated within the outer packet.The processing usually happens at security gateways on behalf of the endpoint; thus, the inner IP header containing the address of the endpoint has to be protected, since one gateway can be responsible for many endpoints.In transport mode, the header of the original packet itself is preserved, some security fields are inserted, and that newly formed payload, and in AH parts of the packet header, undergoes cryptographic processing.Transport mode is typically used for end-to-end security.In this thesis we mostly consider a setting with a fixed sender and receiver, and an abstracted underlying communication network.Hence, the differences between tunnel and transport mode are not of relevance for the further discussion. Related WorkSomewhat surprisingly, the sub-protocols of IPsec were not designed with the goal of provable security in mind, and in fact the desired security goals are often not even completely stated.In recent years, several parts and individual aspects of the protocols have been analyzed and some of them proven to be secure.In the literature, there exists both positive and negative results on the IPsec sub-protocols.Regarding the IKEv2 protocol, on the positive side, Canetti and Krawczyk [9] analyzed an early version of IKE.They provide a cryptographic analysis of IKE, and the underlying sign-and-mac (SIGMA) protocols.However, they neglect many practical details such as the key derivation from the Diffie-Hellman group element.Then, in [25], the authors provide a first systematic description of the development and rationale of the SIGMA protocols.Various work has been performed in order to validate the key derivation mechanism used in IKE in the standard model; however, most of these papers do not precisely consider the protocol but either discuss a simplified description, or consider some isolated primitives being part of the IKE protocol.Dodis et al. [13] showed that idealized versions of the various PRFs used in IKE-namely CBC, Cascade and HMAC modes-serve as strong randomness extractors.Thus, they validate the approach of IKE to use a PRF for key derivation.Those results are later on revisited by [17], which remark that most of the previous work considered simplified protocols and, thus, the results do not necessarily directly translate to the full IKE protocol.Indeed, they show some gaps between the existing security results and the first version of IKE, due to the nonces not being properly authenticated.However, the authors do not discuss IKEv2 in detail.Moreover, the security of hashed Diffie-Hellman exchanges over non-DDH groups has been studied by Gennaro et al. [17].Notably, they motivate their work on the fact that IPsec standardizes a couple of groups to be used in IKE, with non of them satisfying the DDH-assumption.Related to the paradigm of constructive cryptography, 3.2 Unauthenticated Key (IKE_SA_INIT)
Author: Jost, Daniel
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W578000702