Foundations of Low-Latency Key Exchange

认证密钥交换（AKE）协议在个人计算机、智能电话和平板计算机的所有现代Web浏览器中实现。我们每天都在使用它们，当我们阅读电子邮件、网上银行、网上购物或在互联网上传输密码时。像TLS这样的经典AKE协议会导致巨大的延迟开销，这是由于在可以发送第一个密码保护的有效载荷消息之前必须交换相对大量的协议消息的事实。最近的突破是基于以下观察：巧妙设计的AKE协议，其使得任何一方都能够与第一个AKE协议消息一起发送密码保护的消息，允许在没有不必要的延迟的情况下建立密钥。有趣的是，LLKE的概念并非来自学术界，而是来自工业界，其动机是分布式应用的具体实际需求。LLKE的想法源于Google最近提出的快速UDP Internet连接（QUIC）协议。QUIC旨在将密钥建立的延迟降至最低，同时仍然提供互联网上密钥交换协议所期望的所有安全保证。QUIC在最新版本的Google Chrome Web浏览器、Opera Web浏览器中实现，并在Google的Web服务器上使用。从某种意义上说，LLKE协议的实践目前领先于学术研究。这种情况时有出现，尤其是在互联网技术的发展中。然而，这显然是不可取的。特别是在密码安全协议领域中，密码安全协议通常在很长一段时间内广泛使用，重要的是，我们要很好地理解这些协议提供的安全保证及其局限性。LLKE协议提出了许多有趣的研究问题，对于密码学的理论基础和加密协议。尽管LLKE是一个具有高度实用性的有趣原语，但该领域以前的所有工作都提供了QUIC的后验安全分析[FG 14，LJBN 15]。最重要的是，我们还没有任何基础的结构，例如从一般的复杂性假设，具有严格的安全性，或具有“完全”的前向安全性。后者被认为是现代密钥交换协议的重要安全目标。在本提案中描述的项目中，将提供低延迟协议和密钥更新密钥交换协议的基本结构，这些协议概括了LLKE的概念。

Authenticated key exchange (AKE) protocols are implemented in all modern Web browsers of personal computers, smartphones, and tablet computers. We use them every day, when reading e-mails, doing online-banking, going online-shopping, or transmitting passwords over the Internet. Classical AKE protocols like TLS incur a huge latency overhead, which stems from the fact that a relatively large number of protocol messages must be exchanged before the first cryptographically protected payload message can be transmitted.A recent breakthrough is based on the observation that a cleverly designed AKE protocol, which enables either party to transmit cryptographically protected messages already with the first AKE protocol message, allows to establish a key without unnecessary latency. Such protocols are called low-latency key exchange (LLKE) protocols.Interestingly, the concept of LLKE originates not from academia, but from industry, motivated by concrete practical demands of distributed applications. The idea of LLKE stems from the Quick UDP Internet Connections (QUIC) protocol recently proposed by Google. QUIC aims at reducing the latency for key establishment to a minimum, while still providing all security guarantees expected from a key-exchange protocol on the Internet. QUIC is implemented in recent versions of the Google Chrome web browser, the Opera web browser, and it is in use on Google's web servers. In a sense, practice is currently ahead of academic research on LLKE protocols. Such a situation appears from time to time, in particular in the development of Internet technologies. However, it is clearly not desirable. In particular in the area of cryptographic security protocols, which are often in wide-spread use over a very long time, it is important that we have a very good understanding of the security guarantees provided by these protocols and their limitations.The current state-of-the-art of LLKE protocols raises a number of intriguing research questions with great importance for both the theoretical foundations of cryptology and practical applications of cryptographic protocols. Even though LLKE is an interesting primitive of high practical relevance, all previous works in this area provide an a posteriori security analysis of QUIC [FG14, LJBN15]. Most importantly, we do not yet have any foundational constructions, for example from generic complexity assumptions, with tight security, or with "full" forward security. The latter is considered an important security goal of modern key exchange protocols. In the project described in this proposal will provide such foundational constructions of low-latency protocols, and of key-refreshing key exchange protocols, which generalize the concept of LLKE.