Section: New Results

Symbolic and Computational Verification of TLS 1.3

Participants : Karthikeyan Bhargavan, Bruno Blanchet, Nadim Kobeissi.

We also applied our verification methodology to TLS 1.3, the next version of the Transport Layer Security (TLS) protocol. Its clean-slate design is a reaction both to the increasing demand for low-latency HTTPS connections and to a series of recent high-profile attacks on TLS. The hope is that a fresh protocol with modern cryptography will prevent legacy problems; the danger is that it will expose new kinds of attacks, or reintroduce old flaws that were fixed in previous versions of TLS. The protocol is nearing completion, and the working group has appealed to researchers to analyze the protocol before publication. We responded by presenting a comprehensive analysis of the TLS 1.3 Draft-18 protocol.

We seeked to answer three questions that had not been fully addressed in previous work on TLS 1.3: (1) Does TLS 1.3 prevent well-known attacks on TLS 1.2, such as Logjam or the Triple Handshake, even if it is run in parallel with TLS 1.2? (2) Can we mechanically verify the computational security of TLS 1.3 under standard (strong) assumptions on its cryptographic primitives? (3) How can we extend the guarantees of the TLS 1.3 protocol to the details of its implementations?

To answer these questions, we used our methodology for developing verified symbolic and computational models of TLS 1.3 hand-in-hand with a high-assurance reference implementation of the protocol. We presented symbolic ProVerif models for various intermediate versions of TLS 1.3 and evaluated them against a rich class of attacks to reconstruct both known and previously unpublished vulnerabilities that influenced the current design of the protocol. We presented a computational CryptoVerif model for TLS 1.3 Draft-18 and proved its security. We presented RefTLS, an interoperable implementation of TLS 1.0-1.3 in ProScript and automatically analyzed its protocol core by extracting a ProVerif model from its typed JavaScript code [24], [37]. This work was awarded the Distinguished Paper award at IEEE S&P 2017.