Beyond Security and Efficiency: On-Demand Ratcheting with Security Awareness

Abstract

Secure asynchronous two-party communication applies ratcheting to strengthen privacy, in the presence of internal state exposures. Security with ratcheting is provided in two forms: forward security and post-compromise security. There have been several such secure protocols proposed in the last few years. However, they come with a high cost. In this paper, we propose two generic constructions with favorable properties. Concretely, our first construction achieves security awareness. It allows users to detect non-persistent active attacks, to determine which messages are not safe given a potential leakage pattern, and to acknowledge for deliveries. In our second construction, we define a hybrid system formed by combining two protocols: typically, a weakly secure "light" protocol and a strongly secure "heavy" protocol. The design goals of our hybrid construction are, first, to let the sender decide which one to use in order to obtain an efficient protocol with ratchet on demand ; and second, to restore the communication between honest participants in the case of a message loss or an active attack. We can apply our generic constructions to any existing protocol.

Symmetric Asynchronous Ratcheted Communication with Associated Data

“…We prove that EtH enforces confidentiality and authentication. We deduce that we can use EtH in the generic constructions by Caforio et al [6].…”

“…Organization. In Section 2, we revisit the preliminary notions from Caforio-Durak-Vaudenay [6], all of which are very relevant to our work. In Section 3, we construct a correct and secure symmetric-cryptography-based ARCAD protocol.…”

“…The first formal definitions of ratcheting security is given by Bellare et al [3] at CRYPTO 2017. Following their work, a line of studies about ratcheting protocols have been made with different security levels and primitives [1,6,[8][9][10]13]. Some of these results study secure messaging while others are about key-exchange.…”

“…In the same conference, Alwen et al [1] proposed two other ratcheting protocols with security against adversarially chosen random coins and immediate decryption. Caforio et al [6] proposed a generic construction of a messaging protocol offering on-demand ratcheting, by composing a strongly secure protocol (to be used infrequently) and a weakly secure one. Their construction further generically strengthen protocols by adding the notion of security awareness.…”

“…In this paper, we are mostly interested in the work by Caforio et al [6]. They considered message encryption and adapted Durak-Vaudenay protocol to define asynchronous ratcheted communication with associated data (ARCAD).…”