On the End-to-End Security of Group Chats Real World Crypto 2018 2018-01-10 Horst Görtz Institute for IT Security Chair for Network and Data Security Paul Rösler , Christian Mainka, Jörg Schwenk
On the End-to-End Security of Group Chats Real World Crypto 2018 2018-01-10 Horst Görtz Institute for IT Security Chair for Network and Data Security Paul Rösler , Christian Mainka, Jörg Schwenk Or: Why what is doing is
On the End-to-End Security of Group Chats Real World Crypto 2018 2018-01-10 Horst Görtz Institute for IT Security Chair for Network and Data Security Paul Rösler , Christian Mainka, Jörg Schwenk Or: Why what is doing is (in )
Secure Group Instant Messaging: End-to-End • Dynamic group of users On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018 4
Secure Group Instant Messaging: End-to-End • Dynamic group of users • One central server On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018 5
Secure Group Instant Messaging: End-to-End • Dynamic group of users • One central server • End-to-end protection within protected transport layer • Server potentially malicious On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018 6
Agenda Chair for Network and Data Security Prof. Dr. Jörg Schwenk ▪ Security Model ▪ Protocol Overview and Weaknesses ▪ Signal ▪ WhatsApp ▪ (Threema) ▪ Problems and Solutions ▪ Traceable Delivery ▪ Closeness On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018
Secure Group Instant Security Model Messaging: Two Parties Protocols & Weaknesses Problems & Solutions Confidentiality Integrity Two • • Message Confidentiality Message Authentication Groups Parties On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018 8
Secure Group Instant Security Model Messaging: Two Parties Protocols & Weaknesses Problems & Solutions Confidentiality Integrity • • Message Confidentiality Message Authentication • Two No Duplication Groups Parties • Traceable Delivery “Only successful delivery is acknowledged” Hey! Hi! On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018 9
Secure Group Instant Security Model Messaging: Groups Protocols & Weaknesses Problems & Solutions Confidentiality Integrity • • Message Confidentiality Message Authentication • Two No Duplication Parties Groups • Traceable Delivery • • Closeness No Creation “Only group (admin) decides on “Only successful delivery is membership” acknowledged” Hey! Hi! On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018 10
Security Model: Malicious Security Model Server Protocols & Weaknesses Problems & Solutions • Malicious Server • Can decrypt transport layer protection • E.g. IM provider, TLS certificate forger on network, ... On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018 11
Security Model: Malicious Security Model Server Protocols & Weaknesses Problems & Solutions • Malicious Server • Can decrypt transport layer protection • E.g. IM provider, TLS certificate forger on network, ... Traceable Closeness Delivery ? On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018 12
Security Model: Security Model Compromising Attacker Protocols & Weaknesses Problems & Solutions • Compromising Attacker • Access to members’ secrets • E.g. access to device, cryptanalysis, … Traceable Closeness Delivery ? On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018 13
Security Model: Security Model Compromising Attacker Protocols & Weaknesses Problems & Solutions • Compromising Attacker • Access to members’ secrets • E.g. access to device, cryptanalysis, … • Advanced Goals: • Forward Secrecy Secure Traceable Closeness • Future Secrecy Delivery (aka Post Compromise Security aka Backward Secrecy) ? Secure On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018 14
Security Model: Security Model Compromising Attacker Protocols & Weaknesses Problems & Solutions • Compromising Attacker • Access to members’ secrets • E.g. access to device, cryptanalysis, … • Advanced Goals: • Forward Secrecy Secure Traceable Closeness • Future Secrecy Delivery (aka Post Compromise Security aka Backward Secrecy) (Fut. Sec.) Secure On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018 15
Protocol Overview: Signal Security Model Protocols & Weaknesses Problems & Solutions • Ciphertexts (ID static) On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018 16
Protocol Overview: Signal Security Model Protocols & Weaknesses Problems & Solutions • Ciphertexts (ID static) • Forward and future secure key streams of direct communication • Group ID as proof of membership On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018 17
Protocol Overview: Signal Security Model Protocols & Weaknesses Problems & Solutions • Ciphertexts (ID static) • Acks (plain) • Forward and future secure key streams of direct communication • Group ID as proof of membership On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018 18
Protocol Overview: Signal Security Model Protocols & Weaknesses Problems & Solutions • Ciphertexts (ID static) • Acks (plain) • Forward and future secure key streams of direct communication • Group ID as proof of membership On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018 19
Protocol Overview: Signal Security Model Protocols & Weaknesses Problems & Solutions • Ciphertexts (ID static) • Acks (plain) • Group update as message • Forward and future secure key streams of direct communication • Group ID as proof of membership On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018 20
Weaknesses: Signal Security Model Protocols & Weaknesses Problems & Solutions • Ciphertexts (ID static) • Acks (plain) • Group update as message • Forward and future secure key streams of direct communication • Group ID as proof of membership On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018 21
Weaknesses: Signal Security Model Protocols & Weaknesses Problems & Solutions • Ciphertexts (ID static) • Acks (plain) • Group update as message • Forward and future secure key streams of direct communication • Group ID as proof of membership On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018 22
Weaknesses: Signal Security Model Protocols & Weaknesses Problems & Solutions • Ciphertexts (ID static) • Acks (plain) • Group update as message • Forward and future secure key streams of direct communication • Group ID as proof of membership On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018 23
Weaknesses: Signal Security Model Protocols & Weaknesses Problems & Solutions • Ciphertexts (ID static) • Acks (plain) • Group update as message • Forward and future secure key streams of direct communication • Group ID as proof of membership • Traceable delivery by ack forgery * On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018 24
Weaknesses: Signal Security Model Protocols & Weaknesses Problems & Solutions • Ciphertexts (ID static) • Acks (plain) • Group update as message • Forward and future secure key streams of direct communication • Group ID as proof of membership • Traceable delivery by ack forgery * On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018 25
Weaknesses: Signal Security Model Protocols & Weaknesses Problems & Solutions • Ciphertexts (ID static) • Acks (plain) • Group update as message • Forward and future secure key streams of direct communication • Group ID as proof of membership • Traceable delivery by ack forgery * On the End-to-End Security of Group Chats Real World Crypto 2018 | Paul Rösler | Zürich | 05.01.2018 26
Recommend
More recommend
