CCNx Key Exchange Protocol Version 1.0
draft-wood-icnrg-ccnxkeyexchange-00

Abstract

This document specifies Version 1.0 of the CCNx Key Exchange (CCNxKE) protocol. The CCNxKE protocol allows two peers to establish a shared, forward-secure key for secure and confidential communication. The protocol is designed to prevent eavesdropping, tampering, and message forgery between two peers. It is also designed to minimize the number of rounds required to establish a shared key. In the worst case, it requires two RTTs between a consumer and producer to establish a shared key. In the best case, one RTT is required before sending any application data. This document outlines how to derive the keys used to encrypt traffic for a session and shows how session information is exchanged between a consumer and producer using message encapsulation.

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on January 9, 2017.

Copyright Notice

Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

Table of Contents

• 1. Introduction
• 1.1. Conventions and Terminology
• 2. Goals
• 3. Scope
• 4. Presentation Language
• 5. CCNxKE Overview
• 5.1. Connection Establishment Latency
• 5.2. Connection Migration and Resumption
• 5.3. Re-Transmissions, Timeouts, and Replay Prevention
• 5.4. Loss Sensitivity
• 6. The CCNxKE Protocol
• 6.1. Round Overview
• 6.2. Round 1
• 6.3. Round 2
• 6.4. Round 3
• 7. Alternative Exchanges
• 7.1. One-RTT Exchange
• 8. PSK Mode and Session Resumption
• 9. Secret Derivation
• 9.1. SourceCookie Derivation
• 9.2. MoveToken Derivation
• 9.3. SessionID and PreSharedKey Properties, Derivation, and Usage
• 9.4. Key Derivation
• 9.5. Secret Generation and Lifecycle
• 10. Re-Key Message
• 11. Application Data Protocol
• 12. Security Considerations
• 13. References
• 13.1. Normative References
• 13.2. Informative References
• Authors' Addresses

1. Introduction

DISCLAIMER: This is a WIP draft of CCNxKE and has not yet seen rigorous security analysis.

Ephemeral sessions similar to those enabled by TLS 1.3 [TLS13], QUIC [QUIC], and DTLS 1.2 [DTLS12] are needed for some CCN exchanges between consumers and producers. Currently, there does not exist a standard way to establish these sessions. Thus, the primary goal of the CCNxKE protocol is to provide privacy and data integrity between two CCN-enabled peers (e.g., a consumer and producer engaged in session-based communication). It is built on the CCNx 1.0 protocol and only relies upon standard Interest and Content Objects as a vehicle for communication. The CCNxKE protocol is used to bootstrap session-based communication, wherein traffic is encapsulated and encrypted using symmetric-key cryptography for transmission between two endpoints (i.e., a consumer and producer). The CCNxKE protocol enables this form of communication by establishing shared state, i.e., shared, ephemeral, and forward-secure symmetric keys. This protocol has the following four main properties:

• Each peer’s identity can be authenticated using asymmetric, or public key, cryptography (e.g., RSA [RSA], ECDSA [ECDSA], etc.). Server authentication is mandatory whereas mutual authentication is optional.
• The negotiation of a forward-secure shared secret is protected from eavesdroppers and man-in-the-middle (MITM) attacks.
• The negotiation is reliable: no attacker can modify the negotiation communication without being detected by the parties to the communication.
• The state of a CCNxKE session can be securely migrated between an endpoint performing authentication and that which provides content using a “move token.” This allows authentication and authorization to be separated from encryption for a session, enabling different systems to complete these steps.

Usage of CCNxKE is entirely independent of upper-layer application protocols. Session-based communication via encapsulation and encryption enables secure, confidential, and authenticated communication between two peers. One advantage of this protocol is that it facilitates the creation and use of ephemeral CCN Interest and Content Objects.

CCNxKE also introduces a new type of cookie based on reverse hash chains [HASHCHAIN] to help limit the amount of significant server work done in response to a client or consumer Interest. TCP-based protocols, such as TLS [TLS13], use the TCP 3-way handshake for such proof. UDP-based protocols, such as QUIC [QUIC] and DTLS 1.2 [DTLS12], use an optional session address token or cookie that must be presented by the client (consumer) to prove ownership of an address during a key exchange procedure. Without source addresses, our cookie technique ensures that the same entity which requested server information, e.g., the public configuration data, is the same entity that wishes to complete a key exchange.

The main contribution of this work is adapting key exchange principles to the pull-based CCNx communication model. CCNxKE only assumes that a consumer knows a first name prefix to initiate the key exchange. The first Interest does not need to be a CCNxKE packet — the producer can signal back to the consumer that it requires CCNxKE before progressing.

This specification does not subsume other ICN-compliant key exchange protocols. Nor does its existence imply that all encryption in an ICN must be based on sessions. It was designed specifically to solve the problem of session-based encryption in ICN.

1.1. Conventions and Terminology

The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “NOT RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in RFC 2119 [RFC2119].

The following terms are used:

Consumer/Client: The CCN consumer initiating the CCNxKE key exchange via a first Interest.

Producer/Server: The CCN producer receiving or accepting the CCNxKE key exchange request request Interest.

Sender: An endpoint that originates a message.

Receiver: An endpoint that is receiving messages.

Peer: An endpoint. When discussing a particular endpoint, “peer” refers to the endpoint that is remote to the primary subject of discussion.

Connection: A network path of n >= 1 hops between the consumer and producer.

Endpoint: Either the consumer or producer of the connection.

Handshake: A series of message exchanges between two peers that is used to perform a task (e.g., perform key exchange and derivation).

Session: An association between a consumer and a producer resulting from a CCNxKE handshake.

DH: A Diffie Hellman key exchange procedure [RFC2631] [DH].

Key Share: One half of the shared-secret provided by one peer performing a DH key exchange.

Forward-secure: The property that compromising any long-term secrets (e.g., cryptographic keys) does not compromise any session keys derived from those long-term secrets.

CONFIG information: A data structure created by a producer which contains long-term cryptographic material and associated information needed by a client to initiate a key-exchange with the producer.

HELLO exchange: An exchange between a consumer and producer wherein the consumer retrieves the CONFIG information from the producer.

Payload: The payload section of a CCNxMessage as defined in [CCNxMessages].

KEPayload: A payload for information used in the CCNxKE protocol which is a generic key-value store. The KEPayload is not the CCNxMessage payload.

CCNxName: A CCNxName as defined in [CCNxMessages].

Semi-static: Short-term.

Short-term Secret (SS): A secret which is derived from the server’s semi-static DH share and the client’s fresh DH share.

Forward-secure Secret (FSK): A secret which is derived from fresh (i.e., generated on demand at random) DH shares from both the consumer and producer for the given connection.

HKDF: Hash-based key-derivation function [RFC5869].

2. Goals

The goals of the CCNxKE protocol, in order of priority, are as follows:

1. Cryptographic security: CCNxKE should be used to securely establish a session and all related shared secrets between two peers. Cryptographic properties of interest include: (a) forward-secure session key derivation and (b) (state and computational) denial-of-service prevention at the producer (see [RFC4987]) that is no worse than DTLS 1.2 [DTLS12]}. For property (a), different keys (and relevant algorithm parameters such as IVs) are established for each communication direction, i.e., from consumer to producer and producer to consumer. For property (b), we use a new type of stateless cookie inspired by that of DTLS 1.2.
2. Interoperability: Independent programmers should be able to develop applications utilizing CCNxKE that can successfully exchange cryptographic parameters without knowledge of one another’s code.
3. Extensibility: CCNxKE seeks to provide a framework into which new public key and symmetric key methods and algorithms can be incorporated without breaking backwards compatibility or requiring all clients to implement new functionality. Moreover, the protocol should be able to support a variety of peer authentication protocols, e.g., EAP-TLS, EAP-PWD, or a simple challenge-response protocol.
4. Relative efficiency: CCNxKE tries to create sessions with minimal computation, bandwidth, and message complexity. In particular, it seeks to create sessions with as few end-to-end round trips as possible, and also provide support for accelerated session establishment and resumption when appropriate. At most 2 round-trip-times (RTTs) should be used to establish a session key, with the possibility of 1-RTT accelerated starts and resumption.

3. Scope

This document and the CCNxKE protocol are influenced by the TLS 1.3 [TLS13], QUIC [QUIC], and DTLS 1.2 [DTLS12] protocols. The reader, however, does not need a detailed understanding of those protocols to understand this document. Moreover, where appropriate, references to related protocols are made for brevity and technical clarity. This document is intended primarily for readers who will be implementing the protocol and for those doing cryptographic analysis of it. The specification has been written with this in mind and it is intended to reflect the needs of those two groups.

This document is not intended to supply any details of service definition or of interface definition, although it does cover select areas of policy as they are required for the maintenance of solid security.

4. Presentation Language

This document uses a presentation language of remote calls (i.e. packet messages) similar to the format used by TLS [TLS13].

5. CCNxKE Overview

5.1. Connection Establishment Latency

CCNxKE operates in three rounds, where each round requires a single RTT to complete. The full execution of the protocol therefore requires 2 RTTs before a session is fully established. The full version is used when consumers have no a priori information about the producer. An accelerated one round version is used when the consumer has valid configuration information and a source cookie from the producer; this variant requires 1 RTT before a session is established.

5.2. Connection Migration and Resumption

CCN end hosts lack the notion of addresses. Thus, the producer endpoint for a given execution of the CCNxKE protocol is one which can authoritatively serve as the owner of a particular namespace. For example, a consumer may wish to establish a session with a producer who owns the /company/foo namespace. The specific end host which partakes in the protocol instance is not specified, by virtue of the fact that all CCNxKE messages are based on well-defined names. This enables the producer end-host which partakes in the protocol to change based on the name of the CCNxKE messages. Consequently, to maintain correctness, it is important that a single execution of the protocol operates within the same trusted context; this does not mean that the same producer end-host is required to participate in all three steps of the protocol. Rather, it means that the end-host responding to a CCNxKE message must be trusted by the consumer to complete the exchange. CCNxKE is designed to enable this sort of producer migration.

For example, a consumer may use an initial name like ‘/parc/index.html’ that works like an IP any cast address and could got to one of several systems. CCNxKE allows the responding endpoint to include a localized name to ensure that subsequent messages from the consumer come back to the same producer. CCNxKE also allows the key exchange peer to securely hand-off the session to a content producer peer via another name and session token once the client is authenticated and keying material is exchanged.

5.3. Re-Transmissions, Timeouts, and Replay Prevention

CCNxKE timeouts and retransmissions are handled using the approach in [RFC6347]. One primary difference is that timer values may need to be adjusted (elongated) due to prefix shifts and the need for a producer to transfer security information between different machines.

Replay attack prevention is also an optional feature, and if used, MAY be done using one of the following two approaches at the receiver (producer):

• IPSec AH [RFC4302] and ESP [RFC4303] style replay detection based on sliding windows and monotonically increasing sequence numbers for windows. Note that the sliding window inherently limits the performance of the protocol to the window size, since only a finite number of messages may be received within a given window (based on the window size).
• The optimized anti-replay algorithm of [RFC6479].

5.4. Loss Sensitivity

CCNxKE messages are transferred using standard CCN Interest and Content Objects and are therefore subject to loss as any datagram. This means that traffic encrypted with keys derived from CCNxKE must be stateless. They cannot depend on in-order arrival. This problem is solved by two mechanisms: (1) by prohibiting stream ciphers of any kind and (2) adding sequence numbers to each message that allow the receiver to identify and use the correct cryptographic state to decrypt the message. Moreover, sequence numbers permit anti-replay mechanisms similar to those used in DTLS [DTLS12] as mentioned above.

6. The CCNxKE Protocol

This section describes the CCNxKE protocol in detail at the message level. The specific encoding of those messages is given later. CCNxKE could be adapted to different wire format encodings, such as those used by the NDN protocol.

The following assumptions are made about peers participating in the CCNxKE protocol:

• Consumers know the namespace prefix of the producer for which they wish to execute the CCNxKE protocol.
• CCNxKE protocol information is carried in a distinguished field outside of the payload of CCN messages. This is done to distinguish key exchange material with application data in a message. This is necessary for 0 RTT packets that carry both keying material and application payload.
• CCNxKE does not require any special behavior of intermediate systems to forward packets.
• CCNxKE packets generally should not be cached for significant periods of time, as use normal protocol methods to limit caching. Part of this is achieved through the use of consumer-specific nonces in names.

6.1. Round Overview

CCNxKE is composed of three rounds. The purpose of each round is described below.

• Round 1: Perform a bare HELLO exchange to obtain the extensions (parameters) for the key exchange provided by the producer and a source cookie to prove ownership of the “source” of the request.
• Round 2: Perform the initial FULL-HELLO exchange to establish a forward-secure key used for future communication, i.e., Interest and Content Object exchanges in the context of the newly established session.
• Round 3: Send the first bit of application data and (optionally) transfer resumption cookie(s) from the producer to the consumer.

Conceptually, there are two secrets established during a single execution of CCNxKE:

• Static Secret (SS): A secret which is derived in one of two ways: (a) from the client and server ephemeral key shares and (b) from the server’s semi-static share and the client’s ephemeral key share. Keying material derived from SS in option (a) is not forward secure.
• Ephemeral Secret (ES): A secret which is derived from both the client and server ephemeral key shares.

Depending on the mode in which CCNxKE is used, these secrets can be established in a variety of ways. Key derivation details are outlined in Section Section 9.

All secrets are derived with the appropriate amount of randomness [RFC4086]. An overview of the messages sent in each of the three rounds to establish and use these secrets is shown in Figure Figure 1 below. This diagram omits some parts of each message for brevity.

    Consumer                                           Producer

    HELLO:
    + SourceChallenge
                       I[/prefix/random-1]
                            -------->
                                                    HELLO-REJECT:
                                                      + Timestamp
                                                   + SourceCookie
                                                 + pinned-prefix*
                                               + ServerChallenge*
                                           + ServerConfiguration*

                      CO[/prefix/random-1]
                            <---------
    FULL-HELLO:
    + ClientKeyShare
    + SourceCookie
    + SourceProof
    + MoveChallenge
    + Timestamp
                    I[/pinned-prefix/random-2]
                             -------->
                                                    HELLO-ACCEPT:
                                                 + ServerKeyShare
                                                      + SessionID
                                          + [CertificateRequest*]
                                           + [CertificateVerify*]
                                      + [MovePrefix*, MoveToken*]
                                                     + [Finished]
                    CO[/pinned-prefix/random-2]
                            <--------
                    **key exchange complete**
    Payload:
    + MoveToken*
    + MoveProof*
    + [ConsumerData]

                      I[/prefix/SessionID/[...]]
                            -------->
                                                 + NewSessionID*
                                              + NewSessionIDTag*
                                                        Payload:
                                                  [ProducerData]
                     CO[/prefix/SessionID/[...]]
                            <--------

    Repeat with data        <-------->        Repeat with data

            *  Indicates optional or situation-dependent
               messages that are not always sent.

            {} Indicates messages protected using keys
               derived from the short-term secret (SS).

            () Indicates messages protected using keys
               derived from the ephemeral secret (ES).

            [] Indicates messages protected using keys
               derived from the traffic secret (TS).

    /prefix/random-1

    /prefix/random-2

Consumer                                           Producer

HELLO:
+ SourceChallenge
                   I[/prefix/random-1]
                        -------->
                                                HELLO-REJECT:
                                                  + Timestamp
                                               + SourceCookie
                                             ServerChallenge*
                                         ServerConfiguration*

                   CO[/prefix/random-1]
                        <---------

    Consumer                                           Producer
                            -------->
                       ExchangeSourceCookie
                            <---------
    FULL-HELLO:
    + ClientKeyShare
    + SourceCookie
    + SourceProof
    + Timestamp
    + Certificate*
    + {ConsumerData*}
                       I[/prefix/random-2]
                             -------->
                                                    HELLO-ACCEPT:
                                                 + ServerKeyShare
                                                      + SessionID
                                              + [ServerExtensions]
                                                  + [PreSharedKey]
                                           + [CertificateRequest*]
                                       + [MovePrefix*, MoveToken*]
                                                      + [Finished]
                       CO[/prefix/random-2]
                            <--------
                    **key exchange complete**
    Send encrypted data   <-------->   Send encrypted data

            *  Indicates optional or situation-dependent
               messages that are not always sent.

            {} Indicates messages protected using keys
               derived from the short-term secret (SS).

            () Indicates messages protected using keys
               derived from the ephemeral secret (ES).

            [] Indicates messages protected using keys
               derived from the traffic secret (TS).

    Consumer                                           Producer
                            -------->
                       ExchangeSourceCookie
                            <---------
    FULL-HELLO:
    + ClientKeyShare
    + SourceCookie
    + SourceProof
    + Timestamp
    + PreSharedKey
                       I[/prefix/random-2]
                             -------->
                                                    HELLO-ACCEPT:
                                                   + PreSharedKey
                                                 + ServerKeyShare
                                                      + SessionID
                                              + [ServerExtensions]
                                       + [MovePrefix*, MoveToken*]
                                                      + [Finished]
                       CO[/prefix/random-2]
                            <--------
                    **key exchange complete**
    Send encrypted data   <-------->   Send encrypted data

            *  Indicates optional or situation-dependent
               messages that are not always sent.

            {} Indicates messages protected using keys
               derived from the short-term secret (SS).

            () Indicates messages protected using keys
               derived from the ephemeral secret (ES).

            [] Indicates messages protected using keys
               derived from the traffic secret (TS).

SourceCookie = HMAC(k, SourceChallenge || timestamp)

SourceCookie = HMAC(k, SHA256(SourceProof) || timestamp)

SessionID = Enc(k1, H(TS || (Prefix3))),

PreSharedKey = Enc(k2, TS || ( (Prefix3 || MoveToken) )),

(TS || ( (Prefix3 || MoveToken) )) = Dec(k2, PreSharedKey)

SessionID = Enc(k1, H(TS || (Prefix3)))

+------+           +------+
| KE-1 |           | KE-2 |
+------+           +----+-+
    |                   |
+---v--+           +----v-+
|  SS  +---+    +--+  ES  |
+------+   |    |  +------+
         +-v----v-|
         |   MK   |
         +---+----+
             |
           +-v--+
           | TS |
           +----+