TLS 1.3 allows two parties to establish a shared session key from an out-of-band agreed pre-shared key (PSK). The PSK is used to mutually authenticate the parties, under the assumption that it is not shared with others. This allows the parties to skip the certificate verification steps, saving bandwidth, communication rounds, and latency. In this paper, we identify a vulnerability in this specific TLS 1.3 option by showing a new “reflection attack” that we call “Selfie.” This attack uses the fact that TLS does not mandate explicit authentication of the server and the client, and leverages it to break the protocol’s mutual authentication property. We explain the root cause of this TLS 1.3 vulnerability, provide a fully detailed demonstration of a Selfie attack using the TLS implementation of OpenSSL, and propose mitigation. The Selfie attack is the first attack on TLS 1.3 after its official release in 2018. It is surprising because it uncovers an interesting gap in the existing TLS 1.3 models that the security proofs rely on. We explain the gap in these model assumptions and show how it affects the proofs in this case.

/pdf/selfie-reflections-on-tls-1-3-with-psk-2hqg1y8f8n.pdf

Selfie: reflections on TLS 1.3 with PSK.

Intelligent Transportation Systems (ITS) is a combination
of information and communication technologies used in
transportation systems to improve efficiency and safety
for transport users. It also encompasses the growing
field of connected and autonomous vehicles that is
expected to have significant benefits for the economy
and overall safety of travel. Two of the main challenges
within ITS are managing the scalability of large
networks, and securing communication between ITS
entities, especially given that entities may be malicious
and need to be revoked. To address security and privacy concerns within ITS,
public key infrastructure (PKI) has been deployed in
vehicular communication architectures. Such architectures
detail how entities (vehicles, road-side units, etc.)
communicate with each other and how their credentials
need to be revoked when they become malicious so that
they cannot continue to communicate with other entities.
This thesis covers both analysis of protocols within
existing architectures and also proposes new
architectures. Our work contributes to the analysis of existing
architectures for revocation. We present a symbolic
analysis of existing REWIRE protocols using the
Tamarin Prover, and show that not all their desired
security goals are met. We propose a new variant of
REWIRE called O-Token which addresses the required
properties based on vehicular public key infrastructure. Vehicular communication architectures are becoming more
heterogeneous and therefore there is active research in
identifying how vehicles can themselves become a root of
trust for supporting secure communications in ITS. We
present a new vehicular communication architecture, based
on trusted computing, which removes the need for
additional PKI infrastructure within an ITS. It enables
secure operations to be performed within vehicles without
relying on constant message exchange with infrastructure.
The novelty of our architecture is the use of Direct
Anonymous Attestation to manage the security and privacy
of entities, to improve the scalability and revocation in
large networks. Furthermore, the architecture is
resilient to colluding trusted third party
infrastructure. Our final contribution is an analysis of one variant of
Direct Anonymous Attestation, ECC-DAA, based on the
ISO/IEC 20008-2:2013 standard. We evaluate whether it
provides the security and privacy guarantees needed in
order for it to be a central technique within our
scalable vehicular communication architecture. Our
symbolic analysis of an ECC-DAA specification using the
Tamarin Prover identifies an attack which exploits a
single compromised trusted platform module to undermine
other uncompromised ones. We propose a solution and
demonstrate the revised specification ensures the
protocol's robustness.

Formal analysis and applications of direct anonymous attestation.

In this master thesis we have presented a security analysis of the TLS protocol with particular emphasis on the recently discovered renegotiation attack. From our security proof we get that the Handshake protocol with renegotiation, including the fix from IETF, is secure, and hence not vulnerable to the renegotiation attack anymore. We have also analysed the Handshake protocol with session resumption, and the Application data protocol together with the Record protocol. Both of these protocols were deemed secure as well. All the security proofs are based on the UC (Universal Composability) security framework.

Tia Helene Firing

Papers

Analysis of the Transport Layer Security protocol