A Formal Treatment of Accountable Proxying over TLS - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2018

A Formal Treatment of Accountable Proxying over TLS

Abstract

Much of Internet traffic nowadays passes through active proxies, whose role is to inspect, filter, cache, or transform data exchanged between two endpoints. To perform their tasks, such proxies modify channel-securing protocols, like TLS, resulting in serious vulnerabilities. Such problems are exacerbated by the fact that middleboxes are often invisible to one or both endpoints, leading to a lack of accountability. A recent protocol, called mcTLS, pioneered accountability for proxies, which are authorized by the endpoints and given limited read/write permissions to application traffic. Unfortunately, we show that mcTLS is insecure: the protocol modifies the TLS protocol, exposing it to a new class of middlebox-confusion attacks. Such attacks went unnoticed mainly because mcTLS lacked a formal analysis and security proofs. Hence, our second contribution is to formalize the goal of accountable proxying over secure channels. Third, we propose a provably-secure alternative to soon-to-be-standardized mcTLS: a generic and modular protocol-design that carefully composes generic secure channel-establishment protocols, which we prove secure. Finally, we present a proof-of-concept implementation of our design, instantiated with unmodified TLS 1.3 draft 23, and evaluate its overheads.
Fichier principal
Vignette du fichier
main.pdf (580.44 Ko) Télécharger le fichier
Origin : Files produced by the author(s)
Loading...

Dates and versions

hal-01948722 , version 1 (08-12-2018)

Identifiers

  • HAL Id : hal-01948722 , version 1

Cite

Karthikeyan Bhargavan, Ioana Boureanu, Antoine Delignat-Lavaud, Pierre-Alain Fouque, Cristina Onete. A Formal Treatment of Accountable Proxying over TLS. SP 2018 - IEEE Symposium on Security and Privacy, May 2018, San Francisco, United States. ⟨hal-01948722⟩
107 View
286 Download

Share

Gmail Facebook X LinkedIn More