Paper 2020/1366 Original: eprint.iacr.org/2020/1366 ↗
LURK: Server-Controlled TLS Delegation
Abstract
By design, TLS (Transport Layer Security) is a 2-party, end-to-end protocol. Yet, in practice, TLS delegation is often deployed: that is, middlebox proxies inspect and even modify TLS traffic between the endpoints. Recently, industry-leaders (e.g., Akamai, Cloudflare, Telefonica, Ericcson), standardization bodies (e.g., IETF, ETSI), and academic researchers have proposed numerous ways of achieving safer TLS delegation. We present LURK the LURK (Limited Use of Remote Keys) extension for TLS~1.2, a suite of designs for TLS delegation, where the TLS-server is aware of the middlebox. We implement and test LURK. We also cryptographically prove and formally verify, in Proverif, the security of LURK. Finally, we comprehensively analyze how our designs balance (provable) security and competitive performance.
Metadata
- Available format(s)
PDF- Category
- Cryptographic protocols
- Publication info
- Preprint.
- History
- 2020-11-02: last updated
- 2020-11-02: published
- Short URL
- https://ia.cr/2020/1366
- License
- https://creativecommons.org/licenses/by/4.0/
BibTeX
@misc{cryptoeprint:2020/1366,
author = {Ioana Boureanu and Daniel Migault and Stere Preda and Hyame Assem Alamedine and Sanjay Mishra and Frederic Fieau and Mohammad Mannan},
title = {LURK: Server-Controlled TLS Delegation},
howpublished = {Cryptology {ePrint} Archive, Paper 2020/1366},
year = {2020},
url = {https://eprint.iacr.org/2020/1366}
}