Flexible Authenticated and Confidential Channel Establishment (fACCE): Analyzing the Noise Protocol Framework

Abstract

The Noise protocol framework is a suite of channel establishment protocols, of which each individual protocol ensures various security properties of the transmitted messages, but keeps specification, implementation, and configuration relatively simple. Implementations of the Noise protocols are themselves, due to the employed primitives, very performant. Thus, despite its relative youth, Noise is already used by large-scale deployed applications such as WhatsApp and Slack. Though the Noise specification describes and claims the security properties of the protocol patterns very precisely, there has been no computational proof yet. We close this gap. Noise uses only a limited number of cryptographic primitives which makes it an ideal candidate for reduction-based security proofs. Due to its patterns' characteristics as channel establishment protocols, and the usage of established keys within the handshake, the authenticated and confidential channel establishment (ACCE) model (Jager et al. CRYPTO 2012) seems to perfectly fit for an analysis of Noise. However, the ACCE model strictly divides protocols into two non-overlapping phases: the preaccept phase (i.e., the channel establishment) and post-accept phase (i.e., the channel). In contrast, Noise allows the transmission of encrypted messages as soon as any key is established (for instance, before authentication between parties has taken place), and then incrementally increases the channel's security guarantees. By proposing a generalization of the original ACCE model, we capture security properties of such staged channel establishment protocols flexibly-comparably to the multi-stage key exchange model (Fischlin and Günther CCS 2014). We give security proofs for eight of the 15 basic Noise patterns in the full version (EPRINT 2019/436) and exemplify them by the proof of the XK pattern in this article.

Noise: A Library of Verified High-Performance Secure Channel Protocol Implementations

“…These three features are in contrast with prior formal models of Noise protocols that were written for various security analyses [21], [22], [23], [9]. These models ignore many lowlevel protocol details, are not precise at the byte level, and are not testable.…”

“…We observe that our Noise* implementations beat all other general Noise libraries for handshakes per second. Of these, Noise-C is the closest in speed to Noise* and the performance difference is ProVerif 57 Y ˜650 0.5-24h fACCE [23] C Manual 8 N --Dowling et al [37] C Manual 1 N --WireGuard-CV [9] C CryptoVerif 1 N ˜5000 1.5h dominated by DH computations. The IKpsk2 implementation from WireGuard, which also uses HACL* for DH, incorporates careful kernel-level optimizations and is consequently 20% faster than the user-space Noise* code.…”

“…Figure 8 also notes other work on the computational analysis of Noise protocols: [23] defines a new security model for cryptographically analyzing multiple Noise protocols using penand-paper proofs; [37] describes a manual proof of WireGuard, including an analysis of IKpsk2; [9] presents a mechanized cryptographic proof of WireGuard using CryptoVerif. These works use a more precise cryptographic model than the symbolic models in our work or in Vacarme.…”

“…Several prior works present formal analyses for various Noise protocols [21], [22], [23], [9] and multiple open source libraries implement various subsets of Noise. However, until this work, there has been no verified implementation of Noise.…”

“…Project M o d e l T o o l # P a t t e r n s C o d e G e n M o d e l S i z e V e r i f . T i m e Noise* S F* 59 Y ˜680 10s Vacarme [21] S Tamarin 53 N ˜270 1.4 days Noise Explorer [22] SProVerif 57 Y ˜650 0.5-24h fACCE[23] C Manual 8 N --Dowling et al[37] C Manual 1 N --WireGuard-CV[9] C CryptoVerif 1 N ˜5000 1.5h…”