mirror of
https://github.com/zerotier/zssp.git
synced 2026-05-22 16:28:40 -07:00
Whitepaper with LaTeX source.
This commit is contained in:
Adam Ierymenko
@@ -0,0 +1,175 @@
|
||||
|
||||
@inproceedings{post_compromise_security,
|
||||
title = {On post-compromise security},
|
||||
author = {Cohn-Gordon, Katriel and Cremers, Cas and Garratt, Luke},
|
||||
booktitle = {2016 IEEE 29th Computer Security Foundations Symposium (CSF)},
|
||||
pages = {164--178},
|
||||
year = {2016},
|
||||
organization = {IEEE},
|
||||
url = {https://eprint.iacr.org/2016/221.pdf}
|
||||
}
|
||||
|
||||
@inproceedings{wireguard_analysis,
|
||||
title = {A cryptographic analysis of the WireGuard protocol},
|
||||
author = {Dowling, Benjamin and Paterson, Kenneth G},
|
||||
booktitle = {Applied Cryptography and Network Security: 16th International Conference, ACNS 2018, Leuven, Belgium, July 2-4, 2018, Proceedings 16},
|
||||
pages = {3--21},
|
||||
year = {2018},
|
||||
organization = {Springer},
|
||||
url = {https://eprint.iacr.org/2018/080.pdf}
|
||||
}
|
||||
|
||||
@inproceedings{ake_security,
|
||||
title = {Authentication in key-exchange: Definitions, relations and composition},
|
||||
author = {de Saint Guilhem, Cyprien Delpech and Fischlin, Marc and Warinschi, Bogdan},
|
||||
booktitle = {2020 IEEE 33rd Computer Security Foundations Symposium (CSF)},
|
||||
pages = {288--303},
|
||||
year = {2020},
|
||||
organization = {IEEE},
|
||||
url = {https://eprint.iacr.org/2019/1203.pdf}
|
||||
}
|
||||
|
||||
@inproceedings{hkdf,
|
||||
title = {Cryptographic extraction and key derivation: The HKDF scheme},
|
||||
author = {Krawczyk, Hugo},
|
||||
booktitle = {Annual Cryptology Conference},
|
||||
pages = {631--648},
|
||||
year = {2010},
|
||||
organization = {Springer},
|
||||
url = {https://eprint.iacr.org/2010/264.pdf}
|
||||
}
|
||||
|
||||
@online{noise_protocol,
|
||||
title = {The noise protocol framework},
|
||||
author = {Trevor Perrin},
|
||||
year = {2018},
|
||||
addendum = {(accessed: 07.03.2023)},
|
||||
url = {https://noiseprotocol.org/noise.html}
|
||||
}
|
||||
|
||||
@book{fips_kbkdf,
|
||||
title = {Recommendation for key derivation using pseudorandom functions},
|
||||
publisher = {National Institute of Standards and Technology},
|
||||
author = {Chen, Lily and others},
|
||||
journal = {NIST Special Publication},
|
||||
number = {800-108 Rev. 1},
|
||||
year = {2008},
|
||||
url = {https://csrc.nist.gov/publications/detail/sp/800-108/rev-1/final}
|
||||
}
|
||||
|
||||
@online{noise_ask,
|
||||
title = {Additional Symmetric Keys},
|
||||
author = {Mathias Hall-Andersen},
|
||||
year = {2018},
|
||||
addendum = {(accessed: 07.03.2023)},
|
||||
url = {https://github.com/noiseprotocol/noise_wiki/wiki/Additional-Symmetric-Keys}
|
||||
}
|
||||
|
||||
@online{noise_hfs,
|
||||
title = {KEM-based Hybrid Forward Secrecy for Noise},
|
||||
author = {Trevor Perrin},
|
||||
year = {2018},
|
||||
addendum = {(accessed: 07.03.2023)},
|
||||
url = {https://github.com/noiseprotocol/noise_wiki/wiki/Hybrid-Forward-Secrecy}
|
||||
}
|
||||
|
||||
@online{noise_psk_resumption,
|
||||
title = {PSK Resumption},
|
||||
author = {Trevor Perrin},
|
||||
year = {2018},
|
||||
addendum = {(accessed: 07.03.2023)},
|
||||
url = {https://github.com/noiseprotocol/noise_wiki/wiki/PSK-Resumption}
|
||||
}
|
||||
|
||||
@online{signal,
|
||||
title = {The Double Ratchet Algorithm},
|
||||
author = {Moxie Marlinspike and Trevor Perrin},
|
||||
year = {2016},
|
||||
addendum = {(accessed: 07.03.2023)},
|
||||
url = {https://signal.org/docs/specifications/doubleratchet/}
|
||||
}
|
||||
|
||||
@inproceedings{wireguard,
|
||||
title = {Wireguard: next generation kernel network tunnel.},
|
||||
author = {Donenfeld, Jason A},
|
||||
booktitle = {NDSS},
|
||||
pages = {1--12},
|
||||
year = {2017},
|
||||
url = {https://www.wireguard.com/papers/wireguard.pdf}
|
||||
}
|
||||
|
||||
@article{fips_sha2,
|
||||
title = {Secure hash standard (shs)},
|
||||
publisher={National Institute of Standards and Technology},
|
||||
journal = {FIPS Publication},
|
||||
volume = {180},
|
||||
number = {4},
|
||||
year = {2015},
|
||||
url = {https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf}
|
||||
}
|
||||
|
||||
@article{fips_aesgcm,
|
||||
title = {Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC},
|
||||
publisher = {National Institute of Standards and Technology},
|
||||
author = {Morris Dworkin},
|
||||
journal = {NIST Special Publication},
|
||||
number = {800-38D},
|
||||
year = {2007},
|
||||
url = {https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf}
|
||||
}
|
||||
|
||||
@article{fips_aes,
|
||||
title = {Advanced Encryption Standard (AES)},
|
||||
publisher={National Institute of Standards and Technology},
|
||||
journal = {FIPS Publication},
|
||||
volume = {197},
|
||||
year = {2023},
|
||||
url = {https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197-upd1.pdf}
|
||||
}
|
||||
|
||||
@article{fips_p384,
|
||||
title = {Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography},
|
||||
author={Barker, Elaine and Chen, Lily and Keller, Sharon and Roginsky, Allen and Vassilev, Apostol and Davis, Richard},
|
||||
publisher={National Institute of Standards and Technology},
|
||||
journal = {NIST Special Publication},
|
||||
number = {800-56A},
|
||||
year = {2018},
|
||||
url = {https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Ar3.pdf}
|
||||
}
|
||||
|
||||
@inproceedings{kyber,
|
||||
title = {CRYSTALS-Kyber: a CCA-secure module-lattice-based KEM},
|
||||
author = {Bos, Joppe and Ducas, L{\'e}o and Kiltz, Eike and Lepoint, Tancr{\`e}de and Lyubashevsky, Vadim and Schanck, John M and Schwabe, Peter and Seiler, Gregor and Stehl{\'e}, Damien},
|
||||
booktitle = {2018 IEEE European Symposium on Security and Privacy (EuroS\&P)},
|
||||
pages = {353--367},
|
||||
year = {2018},
|
||||
organization = {IEEE}
|
||||
}
|
||||
|
||||
@book{modern_crypto,
|
||||
title = {Introduction to modern cryptography},
|
||||
author = {Katz, Jonathan and Lindell, Yehuda},
|
||||
year = {2020},
|
||||
publisher = {CRC press}
|
||||
}
|
||||
|
||||
@online{fips_blog,
|
||||
title = {OpenSSL and NSS are FIPS 140 certified. Is the Internet safe now?},
|
||||
author = {Matthew Green},
|
||||
year = {2012},
|
||||
addendum = {(accessed: 07.06.2023)},
|
||||
url = {https://blog.cryptographyengineering.com/category/fips/}
|
||||
}
|
||||
|
||||
@inproceedings{219400,
|
||||
author = {Julie M. Haney and Mary Theofanos and Yasemin Acar and Sandra Spickard Prettyman},
|
||||
title = {"We make it a big deal in the company": Security Mindsets in Organizations that Develop Cryptographic Products},
|
||||
booktitle = {Fourteenth Symposium on Usable Privacy and Security (SOUPS 2018)},
|
||||
year = {2018},
|
||||
isbn = {978-1-939133-10-6},
|
||||
address = {Baltimore, MD},
|
||||
pages = {357--373},
|
||||
url = {https://www.usenix.org/conference/soups2018/presentation/haney-mindsets},
|
||||
publisher = {USENIX Association},
|
||||
month = aug
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
|
||||
\theoremstyle{definition}
|
||||
\usepackage{amsthm}
|
||||
\newtheorem{theorem}{Theorem}
|
||||
\theoremstyle{definition}
|
||||
\newtheorem{claim}[theorem]{Claim}
|
||||
\newtheorem{lemma}[theorem]{Lemma}
|
||||
\newtheorem{proposition}[theorem]{Proposition}
|
||||
\newtheorem{corol}{Corollary}
|
||||
\newtheorem{definition}{Definition}
|
||||
\newtheorem{assumption}{Assumption}
|
||||
\newtheorem{obs}[theorem]{Observation}
|
||||
\newtheorem{conj}[theorem]{Conjecture}
|
||||
|
||||
\newenvironment{proofof}[1]{\begin{proof}[Proof of #1.]}{\end{proof}}
|
||||
\newenvironment{proofsketch}{\begin{proof}[Proof Sketch]}{\end{proof}}
|
||||
|
||||
\newcommand{\namedref}[2]{\hyperref[#2]{#1~\ref*{#2}}}
|
||||
%\newcommand{\namedref}[2]{\hyperref[#2]{#1}}
|
||||
%% if you don't like it, use this instead:
|
||||
%\newcommand{\namedref}[2]{#1~\ref{#2}}
|
||||
\newcommand{\chapterref}[1]{\namedref{Chapter}{#1}}
|
||||
\newcommand{\sectionref}[1]{\namedref{Section}{#1}}
|
||||
\newcommand{\theoremref}[1]{\namedref{Theorem}{#1}}
|
||||
\newcommand{\algorithmref}[1]{\namedref{Algorithm}{#1}}
|
||||
\newcommand{\propositionref}[1]{\namedref{Proposition}{#1}}
|
||||
\newcommand{\definitionref}[1]{\namedref{Definition}{#1}}
|
||||
\newcommand{\corollaryref}[1]{\namedref{Corollary}{#1}}
|
||||
\newcommand{\obsref}[1]{\namedref{Observation}{#1}}
|
||||
\newcommand{\lemmaref}[1]{\namedref{Lemma}{#1}}
|
||||
\newcommand{\claimref}[1]{\namedref{Claim}{#1}}
|
||||
\newcommand{\figureref}[1]{\namedref{Figure}{#1}}
|
||||
\newcommand{\subfigureref}[2]{\hyperref[#1]{Figure~\ref*{#1}#2}}
|
||||
\newcommand{\equationref}[1]{\namedref{Equation}{#1}}
|
||||
\newcommand{\appendixref}[1]{\namedref{Appendix}{#1}}
|
||||
\newcommand{\tabref}[1]{\namedref{Table}{#1}}
|
||||
|
||||
\definecolor{darkred}{rgb}{0.5, 0, 0}
|
||||
\definecolor{darkgreen}{rgb}{0, 0.5, 0}
|
||||
\definecolor{darkblue}{rgb}{0,0,0.5}
|
||||
|
||||
\hypersetup{
|
||||
colorlinks=true,
|
||||
linkcolor=darkred,
|
||||
citecolor=darkgreen,
|
||||
urlcolor=darkblue
|
||||
}
|
||||
|
||||
\newcommand{\algn}[1]{\ensuremath{\text{\sf #1}}\xspace}
|
||||
|
||||
\renewcommand{\algorithmicrequire}{\textbf{Input:}}
|
||||
\renewcommand{\algorithmicensure}{\textbf{Output:}}
|
||||
\renewcommand{\algorithmicfor}{\textbf{For}}
|
||||
|
||||
\newcommand{\N}{\ensuremath{\mathbb{N}}\xspace}
|
||||
\newcommand{\Z}{\ensuremath{\mathbb{Z}}\xspace}
|
||||
\newcommand{\R}{\ensuremath{\mathbb{R}}\xspace}
|
||||
\newcommand{\sucht}{\text{ s.t.~}}
|
||||
\newcommand{\andb}{\text{ and }}
|
||||
\newcommand{\orb}{\text{ or }}
|
||||
\newcommand{\prob}{\text{Pr}}
|
||||
Binary file not shown.
+1249
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,38 @@
|
||||
| | Persistent ZSSP | Opportunistic ZSSP | Non-persistent ZSSP | WireGuard | ZeroTier V1 Transport |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
|**Construction**|Noise XKhfs+psk2|Noise XKhfs+psk2|Noise XKhfs|Noise IKpsk2|Static Diffie-Helman|
|
||||
|**Perfect Forward Secrecy**|Yes|Yes|Yes|Yes|No|
|
||||
|**Forward Secret Identity Hiding**|Yes|Yes|Yes|No|No|
|
||||
|**Identity Testing**|Resistant|Resistant|Resistant|Vulnerable|Vulnerable|
|
||||
|**Forward Secrecy Automatically Heals**|Yes|Yes|Yes|Yes|No|
|
||||
|**Ratcheted Forward Secrecy**|Yes|Yes|No|No|No|
|
||||
|**Quantum Forward Secret**|Yes|Yes|Yes|No|No|
|
||||
|**Key-Compromise Impersonation**|Resistant|Resistant|Resistant|Resistant|Vulnerable|
|
||||
|**Compromise-and-Impersonate**|Resistant after ratchet|Detectable after ratchet|Vulnerable|Vulnerable|Vulnerable|
|
||||
|**Single Key-Compromise MitM**|Resistant|Resistant|Resistant|Resistant|Vulnerable|
|
||||
|**Double Key-Compromise MitM**|Resistant after ratchet|Detectable after ratchet|Vulnerable|Vulnerable|Vulnerable|
|
||||
|**Silence is Golden**|Yes|No|No|Yes|No|
|
||||
|**DOS Mitigation**|Yes|Yes|Yes|Yes|No|
|
||||
|**Supports Fragmentation**|Yes|Yes|Yes|No|Yes|
|
||||
|**FIPS Compliant**|Yes|Yes|Yes|No|No|
|
||||
|**Small Code Footprint**|Yes|Yes|Yes|Yes|No|
|
||||
|**RTT**|2|2|2|1|1|
|
||||
|**Kernel Implementation**|No|No|No|Yes|No|
|
||||
|
||||
|
||||
* **Construction**: The mathematical construction the protocol is based upon.
|
||||
* **Perfect Forward Secrecy**: An attacker with the static private keys of both party cannot decrypt recordings of messages sent between those parties.
|
||||
* **Forward Secret Identity Hiding**: An attacker with the static private key of one or more parties cannot determine the identity of everyone they have previously communicated with.
|
||||
* **Identity Testing**: The attacker has the static public key of a single party, and attempts to test whether they participated in a given session.
|
||||
* **Forward Secrecy Automatically Heals**: Forward secrecy will be automatically re-established between communicating parties in the event a session key is compromised.
|
||||
* **Ratcheted Forward Secrecy**: In order to break forward secrecy an attacker must record and break every single key exchange two parties perform, in order, starting from the first time they began communicating. Improves secrecy under weak or compromised RNG.
|
||||
* **Quantum Forward Secret**: A quantum computer powerful enough to break Elliptic-curve cryptography is not sufficient in order to decrypt recordings of messages sent between parties.
|
||||
* **Key-Compromise Impersonation**: The attacker has a memory image of a single party, and attempts to create a brand new session with that party, pretending to be someone else.
|
||||
* **Compromise-and-Impersonate**: The attacker has a memory image of a single party, and attempts to impersonate them on a brand new session with the other party.
|
||||
* **Single Key-Compromise MitM**: The attacker has a memory image of a single party, and attempts to become a Man-in-the-Middle between them and any other party.
|
||||
* **Double Key-Compromise MitM**: The attacker has a memory image of both parties, and attempts to become a Man-in-the-Middle between them.
|
||||
* **Silence is Golden**: A server running the protocol can be configured in such a way that it will not respond to an unauthenticated, anonymous or replayed message.
|
||||
* **Supports Fragmentation**: Transmission data can be fragmented into smaller units to support jumbo-sized data or MTU discovery.
|
||||
* **FIPS Compliant**: The protocol uses FIPS approved cryptographic algorithms.
|
||||
* **Small Code Footprint**: The Codebase implementing the protocol can be easily audited by anyone on the internet.
|
||||
* **RTT**: "Round-Trip-Time" - How many round trips from initiator to responder it takes to establish a session.
|
||||
Reference in New Issue
Block a user