1. Secure password-based cipher suite for TLS: The importance of end-to-end security Marie L.S. Dumont CS 265

2. Why integration of DH-EKE in TLS?  Case Study: Web Banking –Authentication, Confidentiality and Integrity  Sending passwords on one-way authenticated SSL Channels Heavy burden on the user  SSL with Client Certification Requires proper protection of client’s keys  SSL Channels with DH-EKE passwords Resistant to (offline) dictionary attack Eliminates the requirement of a PKI

3. Diffie-Hellman Encrypted Key Exchange (DH-EKE) Client Server (password pwd) x  Z p-1 Ê pwd (h x ) y  Z p-1, K mstr  (h x ) y, C 1  domain(E) Ê pwd (h y ), E Kmstr (C 1 ) K mstr  (h y ) x, C 2  domain(E) E Kmstr (C 1, C 2 ) verify response E Kmstr (C 2 ) verify response

4. Refined DH-EKE Client Server (password pwd) (password pwd) x  Z p-1 K auth = H 1 (pwd, ID C, ID S ) Ê Kauth (h x ) y  Z q, K auth = H 1 (pwd, ID C, ID S ) K mstr  (h x ) (y((p-1)/q)) K conf  G 1 (K mstr ), K sess  G 2 (K mstr ) g y, MAC Kconf (“1”, Ê Kauth (h x ), g y ) K mstr  (g y ) (x (mod q)) K conf  G 1 (K mstr ), K sess  G 2 (K mstr ) abort if MAC not ok MAC Kconf (“2”, Ê Kauth (h x ), g y ) abort if MAC not OK

5. Overview of TLS Client Server ClientHello ServerHello, Certificate *, ServerKeyExchange *, CertificateRequest *, ServerHelloDone Certificate *, ClientKeyExchange, CertificateVerify *, [ChangeCipherSpec], Finished [ChangeCipherSpec] Finished Application Data  --------------------------------------------------------------------------------- 

6. Integration of DH-EKE in TLS Client Server (password pwd) (v = g * Kvrfy, K auth ) ClientHello choose y, y ’ ε R Z q ServerHello, ServerKeyExchange (g y, g * y’ ), ServerHelloDone derive K auth and K vrfy from pwd and choose, x ε R Z p-1 ClientKeyExchange (Ê Kauth ( h x )) calculate premaster secret pms = H 3 ((h x ) (y(p-1/q)),v y’ ) [ChangeCipherSpec], Finished (MAC G3(pms) (Ê Kauth ( h x ), g y, …)) calculate premaster secret pms = H 3 ((g y ) (x (mod q)), (g * y’ ) Kvrfy ) accept if Finished OK [ChangeCipherSpec], Finished (MAC G4(pms) (Ê Kauth (h x ), g y, …)) accept if Finished OK Application Data  --------------------------------------------------------- 

7. Notations p, qPrimes gGenerator in Z p hGenerator in subgroup G of Z p with order q x, y Secret exponent  R Z q pwdPassword / weak secret K auth Key derived from password (= H 1 (pwd, ID C, ID S )) vVerifier derived from password via one-way function E pwd Symmetric encryption with password as shared key MAC k (…)Message Authentication Code on … with key k HiHi Pseudo-randon functions GiGi Key derivation functions K mstr Master key for a session K conf Handshake confirmation key K sess Session key

8. Conclusion  Password-based protocols can be made secure no (trusted) storage minimal in Infrastructure requirements  Integration of DH-EKE in TLS is as non-intrusive as possible requires minimal number of flows has competitive performance