Håkon Jacobsen

• Gellert, Kai; Gjøsteen, Kristian; Jacobsen, Håkon & Jager, Tibor (2023). On Optimal Tightness for Key Exchange with Full Forward Secrecy via Key Confirmation. Lecture Notes in Computer Science (LNCS). ISSN 0302-9743. 14084, s. 297–329. doi: 10.1007/978-3-031-38551-3_10. Fulltekst i vitenarkiv Vis sammendrag

  A standard paradigm for building key exchange protocols with full forward secrecy (and explicit authentication) is to add key confirmation messages to an underlying protocol having only weak forward secrecy (and implicit authentication). Somewhat surprisingly, we show through an impossibility result that this simple trick must nevertheless incur a linear tightness loss in the number of parties for many natural protocols. This includes Krawczyk’s HMQV protocol (CRYPTO 2005) and the protocol of Cohn-Gordon et al. (CRYPTO 2019). Cohn-Gordon et al. gave a very efficient underlying protocol with weak forward secrecy having a linear security loss, and showed that this is optimal for certain reductions. However, they also claimed that full forward secrecy could be achieved by adding key confirmation messages, and without any additional loss. Our impossibility result disproves this claim, showing that their approach, in fact, has an overall quadratic loss. Motivated by this predicament we seek to restore the original linear loss claim of Cohn-Gordon et al. by using a different proof strategy. Specifically, we start by lowering the goal for the underlying protocol with weak forward secrecy, to a selective security notion where the adversary must commit to a long-term key it cannot reveal. This allows a tight reduction rather than a linear loss reduction. Next, we show that the protocol can be upgraded to full forward secrecy using key confirmation messages with a linear tightness loss, even when starting from the weaker selective security notion. Thus, our approach yields an overall tightness loss for the fully forward-secret protocol that is only linear, as originally claimed. Finally, we confirm that the underlying protocol of Cohn-Gordon et al. can indeed be proven selectively secure, tightly.

• Brzuska, Chris & Jacobsen, Håkon (2017). A modular security analysis of EAP and IEEE 802.11. Lecture Notes in Computer Science (LNCS). ISSN 0302-9743. 10175 LNCS, s. 335–365. doi: 10.1007/978-3-662-54388-7_12. Fulltekst i vitenarkiv
• Brzuska, Christina; Jacobsen, Håkon & Stebila, Douglas (2016). Safely exporting keys from secure channels on the security of EAP-TLS and TLS key exporters. Lecture Notes in Computer Science (LNCS). ISSN 0302-9743. 9665, s. 670–698. doi: 10.1007/978-3-662-49890-3_26. Fulltekst i vitenarkiv
• Gligoroski, Danilo; Mihajloska, Hristina; Samardjiska, Simona; Jacobsen, Håkon; Jensen, Rune Erlend & Aly, Mohamed Ezzat El Hadedy (2014). Pi-Cipher: Authenticated Encryption for Big Data. I Bernsmed, Karin & Fischer-Hübner, Simone (Red.), Secure IT Systems; 19th Nordic Conference, NordSec 2014, Tromsø, Norway, October 15-17, 2014, Proceedings. Springer. ISSN 9783319115993. s. 110–128. doi: 10.1007/978-3-319-11599-3_7. Fulltekst i vitenarkiv Vis sammendrag

  In today’s world of big data and rapidly increasing telecommunications, using secure cryptographic primitives that are parallelizable and incremental is becoming ever more important design goal. π-Cipher is parallel, incremental, nonce based authenticated encryption cipher with associated data. It is designed with the special purpose of providing confidentiality and integrity for big data in transit or at rest. It has, as an option, a secret part of the nonce which provides noncemisuse resistance. The design involves operations of several solid cryptographic concepts such as the Encrypt-then-MAC principle, the XOR MAC scheme and the two-pass sponge construction. It contains parameters that can provide the functionality of tweakable block ciphers for authenticated encryption of data at rest. The security of the cipher relies on the core permutation function based on ARX (Addition, Rotation and XOR) operations. π-Cipher offers several security levels ranging from 96 to 256 bits.

• Jacobsen, Håkon; Samardjiska, Simona & Gligoroski, Danilo (2013). On the strong and weak keys in MQQ-SIG, ICT Innovations 2012. Springer. ISSN 9783642371684. doi: 10.1007/978-3-642-37169-1_18. Fulltekst i vitenarkiv

Se alle arbeider i NVA

• Gligoroski, Danilo; Mihajloska, Hristina; Samardjiska, Simona; Jacobsen, Håkon; Jensen, Rune Erlend & El-Hadedy, Mohamed (2014). CAESAR candidate PiCipher. Fulltekst i vitenarkiv
• Gligoroski, Danilo; Samardjiska, Simona; Jacobsen, Håkon & Bezzateev, Sergey (2013). McEliece in the world of Escher. Fulltekst i vitenarkiv
• Gligoroski, Danilo; Samardjiska, Simona; Jacobsen, Håkon & Bezzateev, Sergey (2013). McEliece in the world of Escher. Fulltekst i vitenarkiv
• Jacobsen, Håkon; Samardjiska, Simona & Gligoroski, Danilo (2012). On the strong and weak keys in MQQ-SIG. Fulltekst i vitenarkiv
• Jacobsen, Håkon & Gligoroski, Danilo (2017). A Modular Security Analysis of EAP and IEEE 802.11. Norges teknisk-naturvitenskapelige universitet. ISSN 9788232626496. Fulltekst i vitenarkiv Vis sammendrag

  This thesis presents a computational reduction-based security analysis of the Extensible Authentication Protocol (EAP) and the IEEE 802.11 protocol. EAP is a widely used authentication framework while IEEE 802.11 is the most commonly used standard for creating wireless local area networks (WLANs), better known as Wi-Fi. The typical use case of EAP is to allow a client on a WLAN to connect to an access point through the use of mutually trusted server. EAP is a general framework that specifies how different sub-protocols can be combined to securely achieve this goal. IEEE 802.11 is usually one of the sub-protocols used within the EAP framework. There are three main contributions of this thesis. The first is a modular security analysis of the general EAP framework. This includes two generic composition theorems that reflect the modular nature of EAP, and which establish sufficient criteria on its sub-protocols in order for the whole framework to be instantiated securely. Having proven the soundness of the general EAP framework, it remains to find suitable sub-protocols that satisfy the security criteria of the composition results. Our second main contribution is a security analysis of one such concrete subprotocol, namely the EAP-TLS protocol which is used to establish a shared key between the wireless client and the trusted server. We prove that EAP-TLS is a secure two-party authenticated key exchange protocol by presenting a generic compiler that transforms secure channel protocols into secure key exchange protocols. Our third main contribution is a thorough security analysis of the IEEE 802.11 protocol. We study both the handshake protocol as well as the encryption algorithm used to protect the application data. On their own, our results on IEEE 802.11 apply to the usage found in wireless home networks where a key is shared between the client and access point a priori, e.g. using a password. However, by combining this with our composition theorems for the EAP framework, we also obtain a result for IEEE 802.11 in its “enterprise” variant, where the common key is instead established using a mutually trusted server.

Se alle arbeider i NVA