NDLI: How Secure and Quick is QUIC? Provable Security and Performance Analyses

Content Provider	IEEE Xplore Digital Library
Author	Lychev, R. Jero, S. Boldyreva, A. Nita-Rotaru, C.
Copyright Year	2015
Abstract	QUIC is a secure transport protocol developed by Google and implemented in Chrome in 2013, currently representing one of the most promising solutions to decreasing latency while intending to provide security properties similar with TLS. In this work we shed some light on QUIC's strengths and weaknesses in terms of its provable security and performance guarantees in the presence of attackers. We first introduce a security model for analyzing performance-driven protocols like QUIC and prove that QUIC satisfies our definition under reasonable assumptions on the protocol's building blocks. However, we find that QUIC does not satisfy the traditional notion of forward secrecy that is provided by some modes of TLS, e.g., TLS-DHE. Our analyses also reveal that with simple bit-flipping and replay attacks on some public parameters exchanged during the handshake, an adversary could easily prevent QUIC from achieving minimal latency advantages either by having it fall back to TCP or by causing the client and server to have an inconsistent view of their handshake leading to a failure to complete the connection. We have implemented these attacks and demonstrated that they are practical. Our results suggest that QUIC's security weaknesses are introduced by the very mechanisms used to reduce latency, which highlights the seemingly inherent trade off between minimizing latency and providing "good" security guarantees.
Starting Page	214
Ending Page	231
File Size	415263
Page Count	18
File Format	PDF
ISBN	9781467369497
ISSN	10816011
DOI	10.1109/SP.2015.21
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2015-05-17
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Protocols Servers Encryption IP networks Public key
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

How secure and quick is QUIC? provable security and performance analyses (2015)

Efficient Chosen Ciphertext Secure Threshold Public-Key Encryption with Forward Security

Provable Security in the Real World

Practical Identity-Based Key Agreement For Secure Communication in Sensor Networks

Performance-Directed iSCSI Security with Parallel Encryption

Certificateless public key encryption with keyword search

An Efficient and Provable Secure Security-Mediated Identity-Based Identification Scheme

Key management for secure multicast communication: A survey

An Identity-Based Fault-Tolerant Conference Key Distribution Scheme

How Secure and Quick is QUIC? Provable Security and Performance Analyses

Similar Documents

How secure and quick is QUIC? provable security and performance analyses (2015)

Efficient Chosen Ciphertext Secure Threshold Public-Key Encryption with Forward Security

Provable Security in the Real World

Practical Identity-Based Key Agreement For Secure Communication in Sensor Networks

Performance-Directed iSCSI Security with Parallel Encryption

Certificateless public key encryption with keyword search

An Efficient and Provable Secure Security-Mediated Identity-Based Identification Scheme

Key management for secure multicast communication: A survey

An Identity-Based Fault-Tolerant Conference Key Distribution Scheme

How Secure and Quick is QUIC? Provable Security and Performance Analyses