How to (Legally) Keep Secrets from Mobile Operators

Abstract

Secure-channel establishment allows two endpoints to communicate confidentially and authentically. Since they hide all data sent across them, good or bad, secure channels are often subject to mass surveillance in the name of (inter)national security. Some protocols are constructed to allow easy data interception . Others are designed to preserve data privacy and are either subverted or prohibited to use without trapdoors. We introduce LIKE, a primitive that provides secure-channel establishment with an exceptional, session-specific opening mechanism. Designed for mobile communications, where an operator forwards messages between the endpoints, it can also be used in other settings. LIKE allows Alice and Bob to establish a secure channel with respect to n authorities. If the authorities all agree on the need for interception, they can ensure that the session key is retrieved. As long as at least one honest authority prohibits interception, the key remains secure; moreover LIKE is versatile with respect to who learns the key. Furthermore, we guarantee non-frameability: nobody can falsely incriminate a user of taking part in a conversation; and honest-operator: if the operator accepts a transcript as valid, then the key retrieved by the authorities is the key that Alice and Bob should compute. Experimental results show that our protocol can be efficiently implemented.

Pairing-free secure-channel establishment in mobile networks with fine-grained lawful interception

“…Although this opens exceptional access from one to two sets of authorities, we note that this is a legal requirement of international communications. Our protocol, which is pairing-free and very fast, maximizes privacy within the bounds of the law, guaranteeing the same, strong properties pioneered by [3], but with respect to two independent set of authorities.…”

“…At ESORICS 2021 Arfaoui et al introduced Lawful Interception Key-Exchange protocols (LIKE) as a way to provide punctual exceptional access to mobile conversations between users, while preserving the privacy of all users and conversations not targeted by a subpoena [3]. This scenario, which naturally obliges Alice and Bob to converse over a specific channel via their serving networks, also comes with enforced security properties (non-frameability and honest operator) and does not require the authorities to be online.…”

“…The LIKE protocol of [3] can work with multiple service providers, but not multiple sets of authorities. In other words, in contrast to LI requirements during roaming, the scheme of [3] cannot guarantee LI access in both Alice's country and Bob's country.…”

“…The LIKE protocol of [3] can work with multiple service providers, but not multiple sets of authorities. In other words, in contrast to LI requirements during roaming, the scheme of [3] cannot guarantee LI access in both Alice's country and Bob's country. This limits the use of that protocol to domestic communications (featuring only one set of authorities) or to roaming scenarios for which one country agrees to forego its right of LI in favour of another country.…”

“…This limits the use of that protocol to domestic communications (featuring only one set of authorities) or to roaming scenarios for which one country agrees to forego its right of LI in favour of another country. As a second disadvantage, the protocol of [3] requires pairings, which require specialized implementation libraries which might not always be readily available.…”