Post-quantum Asynchronous Deniable Key Exchange and the Signal Handshake

Abstract

The key exchange protocol that establishes initial shared secrets in the handshake of the Signal end-to-end encrypted messaging protocol has several important characteristics: (1) it runs asynchronously (without both parties needing to be simultaneously online), (2) it provides implicit mutual authentication while retaining deniability (transcripts cannot be used to prove either party participated in the protocol), and (3) it retains security even if some keys are compromised (forward secrecy and beyond). All of these properties emerge from clever use of the highly flexible Diffie-Hellman protocol.While quantum-resistant key encapsulation mechanisms (KEMs) can replace Diffie-Hellman key exchange in some settings, there is no KEM-based replacement for the Signal handshake that achieves all three aforementioned properties, in part due to the inherent asymmetry of KEM operations. In this paper, we show how to construct asynchronous deniable key exchange by combining KEMs and designated verifier signature (DVS) schemes. There are several candidates for post-quantum DVS schemes, either direct constructions or via ring signatures. This yields a template for an efficient post-quantum realization of the Signal handshake with the same asynchronicity and security properties as the original Signal protocol.

On IND-qCCA Security in the ROM and Its Applications

“…Finally, following the KEMTLS paper [29], several recent works used the notion of IND-1CCA KEM to build secure protocols (e.g. [19,31,6]), showing the growing importance of such a notion.…”

“…In another recent paper, Brendel et al [6] propose an alternative to the Signal handshake based on KEMs and designated verifier signature schemes. They first define a core protocol that uses two KEMs in the same vein as KEMTLS: one with long-term keys for implicit authentication of one of the parties and another one with ephemeral keys for guaranteeing forward security.…”

Providing Membership Privacy to the Asynchronous Ratcheting Trees Protocol without losing Scalability

“…4 Furthermore, a key-derivation function (KDF), which is used to derive a stage key, is modeled as a random oracle. 5 Basically, the ART protocol described in [7] is a tree Diffie-Hellman (DH) key agreement. Each user is assigned to a leaf node, and a secret key of a parent node is defined as the DH key of the children nodes.…”

“…The Signal protocol consists of two subprotocols, X3DH (Extended Triple Diffie-Hellman) and double ratcheting, and Hashimoto et al [3] and Alwen et al [4] proposed a generic construction, respectively. Analyzing the Signal protocol is still an ongoing research area, e.g., [5,6]. In addition to two-party messaging, secure group messaging (SGM) protocols also have been proposed [7][8][9][10][11][12][13][14].…”

“…In[7], H is defined as a mapping from a group element to a Z p element that uses the corresponding DH key as the secret key of the parent node. For simplicity, we define H as a hash function 5. Cohn-Gordon et al employed HKDF with SHA256 for key derivation.…”