Protocols, TLS, and the Key Exchange¶
Job: develop the TLS 1.3 / KEM, the authenticated key exchange (SIGMA), the commitment schemes, and the QKD (BB84) — with the TLS 1.3 / KEM / AKE as the worked example.
Core¶
The TLS and the KEM¶
| TLS / KEM / key exchange | Description |
|---|---|
| TLS 1.3 | 1-RTT, KEM-based (the information theory) |
| KEM / DEM | encapsulate symmetric key, encrypt bulk (the foundations) |
The AKE and the SIGMA¶
| AKE / SIGMA / signatures | Description |
|---|---|
| AKE | authenticated key exchange (the foundations) |
| SIGMA | the SIGn-and-MAc (the foundations) |
The commitment and the OTP¶
| Commitment / hiding / binding | Description |
|---|---|
| Commitment | hiding (information-theoretic) + binding (computational) (the information theory) |
The QKD and the BB84¶
| QKD / BB84 / quantum | Description |
|---|---|
| QKD | quantum key distribution (the information theory) |
| BB84 | the Bennett–Brassard 1984 (the information theory) |
See it¶
TLS 1.3 and the KEM / AKE. The TLS 1.3: the 1-RTT, the KEM (the Kyber the post-quantum, the information theory). The AKE: the SIGMA (the signatures the authentication, the foundations). The key point: the TLS 1.3 the KEM, the AKE the SIGMA.
Check¶
Explain the TLS 1.3 handshake and the KEM/DEM.
The TLS 1.3: the 1-RTT (the ClientHello the key share, the ServerHello the key share, the Finished, the information theory). The KEM: the \(\mathrm{Encaps}(pk)\to(K,c)\) the encapsulate, the \(\mathrm{Decaps}(sk,c)\to K\) the decapsulate (the foundations). The DEM: the AEAD the bulk (the foundations). The composition: the IND-CCA KEM + the IND-CCA DEM \(\to\) the IND-CCA PKE (the foundations). So the TLS 1.3 the 1-RTT, the KEM/DEM the hybrid.
Explain the SIGMA AKE and the QKD BB84.
The SIGMA: the SIGn-and-MAc (the DH the key, the signatures the identity, the MAC the confirmation, the foundations). The AKE: the authenticated (the signatures the authentication, the foundations). The QKD: the BB84 (the \(|\leftrightarrow\rangle,|\rightarrow\rangle\) the bases, the \(|\updownarrow\rangle,|\otimes\rangle\) the diagonal, the measurement the sifting, the information theory). The BB84: the quantum the no-cloning (the information theory). So the SIGMA the AKE, the BB84 the QKD.
Pitfalls¶
- The TLS 1.3 the 1-RTT (the information theory) — the TLS 1.3 the KEM, the 0-RTT the replay.
- The KEM/DEM the hybrid (the foundations) — the KEM the public, the DEM the symmetric.
- The SIGMA the AKE (the foundations) — the SIGMA the sign-and-MAC, the AKE the authenticated.
- The QKD the BB84 (the information theory) — the QKD the quantum, the no-cloning.
Refs¶
- Rescorla, TLS 1.3 (RFC 8446, 2018); the TLS
- Krawczyk, "SIGMA" (2003); the AKE
- Bennett–Brassard, "Quantum cryptography" (1984); the BB84
- Cramer–Shoup, "A practical public key cryptosystem" (1998); the CCA KEM
Next¶
Crypto index · Foundations · Lattice & Post-Quantum · ZK & MPC · Hash & Signatures · Information theory · Probability