Cryptographic Reverse Firewalls

Abstract

Abstract. Recent revelations by Edward Snowden [PLS13,BBG13,Gre14] show that a user's own hardware and software can be used against her in various ways (e.g., to leak her private information). And, a series of recent announcements has shown that widespread implementations of cryptographic software often contain serious bugs that cripple security (e.g., [LHA + 12,CVE14b, CVE14a,CVE14c]). This motivates us to consider the following (seemingly absurd) question: How can we guarantee a user's security when she may be using a malfunctioning or arbitrarily compromised machine? To that end, we introduce the notion of a cryptographic reverse firewall (RF). Such a machine sits between the user's computer and the outside world, potentially modifying the messages that she sends and receives as she engages in a cryptographic protocol.A good reverse firewall accomplishes three things: (1) it maintains functionality, so that if the user's computer is working correctly, the RF will not break the functionality of the underlying protocol; (2) it preserves security, so that regardless of how the user's machine behaves, the presence of the RF will provide the same security guarantees as the properly implemented protocol; and (3) it resists exfiltration, so that regardless of how the user's machine behaves, the presence of the RF will prevent the machine from leaking any information to the outside world. Importantly, we do not model the firewall as a trusted party. It does not share any secrets with the user, and the protocol should be both secure and functional without the firewall (when it is implemented correctly).Our security definition for reverse firewalls depends on the security notion(s) of the underlying protocol. As such, our model generalizes much prior work (e.g., [OO90, YY96, BBS98, BPR14a]) and provides a general framework for building cryptographic schemes that remain secure when run on compromised machine. It is also a modern take on a line of work that received considerable attention in the 80s and 90s (e.g., [Sim84, Sim85, BD91, Des90, Des94, BDI + 96, BBS98]).We show that our definition is achievable by constructing a private function evaluation protocol with a secure reverse firewall for each party. Along the way, we design an oblivious transfer protocol that also has a secure RF for each party, and a rerandomizable garbled circuit that is both more efficient and more secure than previous constructions. Finally, we show how to convert any protocol into a protocol with an exfiltrationresistant reverse firewall for all parties. (In other words, we provide a generic way to prevent a tampered machine from leaking information to an eavesdropper via any protocol.)

Security of Symmetric Encryption against Mass Surveillance

“…Russell, Tang, Yung and Zhou [43] consider ASAs on one-way and trapdoor one-way functions. Cryptographic reverse firewalls [33,17] represent an architecture to counter ASAs via trusted code in network perimeter filters. Dodis, Ganesh, Golovnev, Juels and Ristenpart [16] provide a formal treatment of backdooring of PRGs, another form of subversion.…”

Subversion-resilient signatures: Definitions, constructions and applications

“…Using a reverse firewall. In Section 6, we show that security against arbitrary tampering with the computation can be achieved, by making the additional assumption of an un-tamperable cryptographic reverse firewall (RF) [MS15,DMS16]. Roughly, a RF takes as input a message/signature pair, and is allowed to "sanitize" the input signature using only public information.…”

“…As our third positive result, we provide a way to achieve the ambitious goal of protecting signature schemes against arbitrary SAs, relying on a cryptographic reverse firewall. The latter primitive was introduced in [MS15] (see also [DMS16]) to model security of arbitrary two-party protocols run on machines possibly corrupted by a virus. On a high level, a RF for a signature scheme is an algorithm taking as input a message/signature pair (m, σ), some public state, and outputting a "patched" signature (m, σ ); the initial state of the firewall is typically a function of the verification key vk .…”

True2F: Backdoor-Resistant Authentication Tokens

“…Cryptographic reverse firewalls [87] are a general technique for defending against backdoored implementations of interactive cryptographic protocols. A reverse firewall sits between a potentially backdoored implementation and the outside world, modifying messages in such a way that (a) preserves the security of the original protocol and (b) prevents the malicious implementation from leaking information to the outside world.…”