Messaging layer security (MLS) protocol-based secure channels
Presented herein is a Message Layer Security (MLS)-based secure channel communication arrangement that involves a minimal set of changes to the MLS standard to reduce the redundant overhead in case of two-party (one-to-one or 1:1) communication. These techniques reduce the communication and computation complexity of both devices involved in establishing and supporting the one-to-one secure channel communication. Methods are provided to establish a one-to-one secure channel between a first endpoint and a second endpoint by performing a one-to-one secure channel handshake.
1 . A method to establish a one-to-one secure channel between a first endpoint and a second endpoint by performing a one-to-one secure channel handshake, the method performed by the first endpoint and comprising:
receiving from the second endpoint, a welcome message comprising:
welcome content including a joiner secret, a session identifier, a second endpoint ephemeral public encryption key and a second endpoint signature verification key;
a welcome tag that is a message authentication code computed over a welcome transcript using a welcome key derived from the joiner secret, wherein the welcome transcript comprises a first endpoint key package and the welcome content; and
a signature computed over the welcome content and the welcome tag using a second endpoint signature key;
verifying the welcome message by:
decrypting the welcome message using a first endpoint private decryption key that corresponds to a first endpoint ephemeral public encryption key;
verifying the signature of the welcome message using the second endpoint signature verification key; and
verifying the welcome tag in the welcome message; and
upon verifying the welcome message, sending to the second endpoint a confirmation message that confirms the one-to-one secure channel.
2 . The method of claim 1 , further comprising engaging in secure messaging between the first endpoint and the second endpoint using transport encryption keys derived from a key schedule.
3 . The method of claim 1 , wherein verifying the welcome tag comprises:
recomputing a welcome transcript to produce a recomputed welcome transcript and generating a derived welcome key from the recomputed welcome transcript;
recomputing a message authentication code using the recomputed welcome transcript and the derived welcome key to produce a recomputed message authentication code; and
comparing the recomputed message authentication code with the message authentication code of the welcome message.
4 . The method of claim 1 , wherein the joiner secret is derived from a key schedule and key derivation operations performed by the second endpoint.
5 . The method of claim 1 , further comprising:
generating a confirmation tag based on a message authentication code operation performed over a confirmation key and a hash of the welcome transcript, wherein the confirmation key is derived from an exporter secret; and
including the confirmation tag in the confirmation message.
6 . The method of claim 5 , further comprising:
deriving, from the exporter secret, new transport keys for secure messages to be sent to the second endpoint in a next epoch.
7 . The method of claim 5 , further comprising the first endpoint or the second endpoint initiating a key update by sending to the other endpoint an update message that contains a fresh commit secret for a next epoch and a new key package that includes a fresh encryption key that is signed with a signature key of the first endpoint or the second endpoint that sent the update message, and encrypted with an encryption key of the other endpoint.
8 . The method of claim 7 , further comprising the other endpoint that receives the update message:
generating a confirmation key from an exporter secret over the hash of the welcome transcript;
generating a confirmation tag based on a message authentication code operation performed over the confirmation key; and
sending a confirmation message containing the confirmation tag,
wherein the first endpoint and the second endpoint derive, from the exporter secret and the transcript hash, new transport keys for secure messages to be sent to the other endpoint in a next epoch.
9 . The method of claim 1 , further comprising:
the first endpoint or the second endpoint sending an upgrade request message to the other endpoint to convert the one-to-one secure messaging session to a group messaging session; and
upon the other endpoint agreeing to upgrade to a group messaging session, receiving from the other endpoint a welcome message that contains at least one pre-shared key derived from keying material generated by the other endpoint during the one-to-one secure messaging session.
10 . The method of claim 9 , wherein the upgrade request message further indicates to add that at least a third endpoint to the group messaging session.
11 . The method of claim 1 , wherein the first endpoint is a Hypertext Transfer Protocol (HTTP) client and the second endpoint is an HTTP server, further comprising:
the first endpoint sending to the second endpoint a transport initiation message to initiate a transport connection to the second endpoint, the transport initiation message indicating an identity of the HTTP server that the first endpoint seeks to connect to,
wherein the welcome message sent by the second endpoint includes a credential that matches the identity indicated in the transport initiation message.
12 . The method of claim 11 , wherein the identity of the HTTP server and an indication of application-layer protocols supported by the first endpoint are included the first endpoint key package.
13 . The method of claim 12 , wherein the welcome message sent by the second endpoint further includes an indication of which particular application-layer protocol is to be used over the one-to-one secure channel, and thereafter the first endpoint initiates an HTTP request to the second endpoint using the particular application-layer protocol.
14 . The method of claim 1 , wherein the second endpoint is a Hypertext Transfer Protocol (HTTP) client and the first endpoint is an HTTP server, wherein the first endpoint pre-publishes an initial message that includes a credential authenticating one or more domains that the first endpoint is to represent as an HTTP server.
15 . The method of claim 14 , wherein the initial message further includes an indication of a set of application-layer protocols supported by the first endpoint, and wherein the welcome message sent by the second endpoint includes an indication of a particular application-layer protocol is to be used over the one-to-one secure channel, and thereafter the second endpoint initiates an HTTP request to the first endpoint using the particular application-layer protocol.
16 . The method of claim 1 , further comprising:
the first endpoint or the second endpoint initiating a Transmission Control Protocol (TCP) handshake with the other endpoint;
upon completion of the TCP handshake and establishing of a TCP connection between the first endpoint and the second endpoint, the first endpoint receiving the welcome message from the second endpoint over the TCP connection, and the first endpoint sending the confirmation message over the TCP connection; and
upon completion of the one-to-one secure channel handshake, either of the first endpoint or the second endpoint transmitting messages, with application data encrypted with encryption keys derived from the one-to-one secure channel handshake, over the TCP connection.
17 . The method of claim 1 , wherein the welcome message and the confirmation message are carried in respective handshake messages of an encrypted connection-oriented protocol, wherein upon completion of the one-to-one secure channel handshake over the encrypted connection-oriented protocol, keys derived from one-to-one secure channel handshake are used to encrypt packets transmitted via the encrypted connection-oriented protocol.
18 . The method of claim 17 , wherein the encrypted connection-oriented protocol is the QUIC protocol of RFC 9000 of the Internet Engineering Task Force (IETF).
19 . The method of claim 1 , wherein the welcome message and the confirmation message are fragmented according to a framing protocol.
20 . The method of claim 19 , wherein the framing protocol is the User Datagram Protocol (UDP), and the welcome message and the confirmation message are fragmented across a sequence of UDP datagrams.
21 . A method to establish a one-to-one secure channel between a first endpoint and a second endpoint by performing a one-to-one secure channel handshake, the method performed by the second endpoint and comprising:
obtaining a first endpoint key package, the first endpoint key package including a first endpoint ephemeral public encryption key and a first endpoint signature verification key corresponding to a first endpoint signature key, wherein the first endpoint key package is signed with the first endpoint signature key;
generating a welcome message to be sent to the first endpoint, the welcome message comprising:
welcome content including a joiner secret, a session identifier, a second endpoint ephemeral public encryption key and a second endpoint signature verification key;
a welcome tag that is a message authentication code computed over a welcome transcript using a welcome key derived from the joiner secret, wherein the welcome transcript comprises the first endpoint key package and the welcome content; and
a signature computed over the welcome content and welcome tag using a second endpoint signature key;
encrypting the welcome message using the first endpoint ephemeral public encryption key to produce an encrypted welcome message and transmitting the encrypted welcome message to the first endpoint; and
upon the first endpoint decrypting the welcome message, verifying the signature of the welcome message using the second endpoint signature verification key, and verifying the welcome tag by recomputing a message authentication code using the welcome transcript and the welcome key, receiving from the first endpoint a confirmation message.
22 . The method of claim 21 , wherein obtaining comprises obtaining the first endpoint key package in a message received from the first endpoint or by downloading the first endpoint key package from a server.
23 . The method of claim 21 , further comprising engaging in secure messaging between the first endpoint and the second endpoint using transport encryption keys derived from a key schedule.
24 . One or more non-transitory computer readable storage media encoded with instructions that, when executed by a processor, cause the processor to perform operations for a method to establish a one-to-one secure channel between a first endpoint and a second endpoint by performing a one-to-one secure channel handshake, the method performed by the first endpoint and comprising:
receiving from the second endpoint, a welcome message comprising:
welcome content including a joiner secret, a session identifier, a second endpoint ephemeral public encryption key and a second endpoint signature verification key;
a welcome tag that is a message authentication code computed over a welcome transcript using a welcome key derived from the joiner secret, wherein the welcome transcript comprises a first endpoint key package and the welcome content; and
a signature computed over the welcome content and welcome tag using a second endpoint signature key,
verifying the welcome message by:
decrypting the welcome message using a first endpoint private decryption key that corresponds to a first endpoint ephemeral public encryption key;
verifying the signature of the welcome message using the second endpoint signature verification key; and
verifying the welcome tag in the welcome message; and
upon verifying the welcome message, sending a confirmation message that confirms the one-to-one secure channel.
25 . The one or more non-transitory computer readable storage media of claim 24 , wherein the instructions for verifying the welcome tag comprises instructions that cause the processor to perform operations including:
recomputing a welcome transcript to produce a recomputed welcome transcript and generating a derived welcome key from the recomputed welcome transcript;
recomputing a message authentication code using the recomputed welcome transcript and the derived welcome key to produce a recomputed message authentication code; and
comparing the recomputed message authentication code with the message authentication code of the welcome message.
26 . The one or more non-transitory computer readable storage media of claim 24 , further comprising instructions that, when executed by the processor, cause the processor to perform operations including:
generating a confirmation tag based on a message authentication code operation performed over a confirmation key and a hash of the welcome transcript, wherein the confirmation key is derived from an exporter secret; and
including the confirmation tag in the confirmation message.