Secure Public Instant Messaging

Financial Cryptography - Feb 27, 2006

A Protocol for Secure Public Instant Messaging
Mohammad Mannan and Paul C. van Oorschot
Digital Security Group
Carleton University, Canada

Mohammad Mannan

Feb 27, 2006

1

Secure Public Instant Messaging

Outline➠ IM overview and motivation➠ Instant Messaging Key Exchange (IMKE) – the protocol➠ Security comments

Mohammad Mannan

Feb 27, 20062

Secure Public Instant Messaging

Figure 1: IM in action
Mohammad Mannan

Feb 27, 20063

Secure Public Instant Messaging

IM communication modelServer

Client A
A’s contact list

Client B
B’s contact list

BADCEHH

Client−Server Communications (e.g. login, profile)
Client−Client Direct Communications (e.g. file data transfer)
Client−Client Server−mediated Communications (e.g. text message)

Mohammad Mannan

Feb 27, 2006

4

Secure Public Instant Messaging

Do we need secure IM?

➠ IM is a popular application• instant communication (home users)• instant collaboration (enterprise users)➠ Number of users : MSN 185m, Yahoo! 82m, AOL 61ma
➠ 13 of Fortune 50 companies were affected by IM-related security
incidents in the last 6 monthsb➠ IMlogic was bought by Symantec (Jan. 2006)ab

Source: ComScore Media Metrix, Aug. 2005
Source: IMlogic, Nov. 2005

Mohammad Mannan

Feb 27, 2006

5

Secure Public Instant Messaging

IMKE - motivation
1. Existing solutions have drawbacks• SSL: relayed user messages are visible to IM server• client plug-ins: client-server messages are plaintext• secure protocols: not designed for integration
2. Strong password protocols do not fit• efficiency• simplicity

Mohammad Mannan

Feb 27, 2006

6

Secure Public Instant Messaging

IMKE - goals
1. Mutual assurance of identity
2. Secure communications (“C.I.A.”)3. Forward secrecy
4. Repudiation (!)
5. Replay detection• authentication phase: X• text message / file transfers: standard techniques

Mohammad MannanFeb 27, 2006

7

Secure Public Instant Messaging

IMKE - notation
A, B, S

IM users Alice and Bob, and IM server

IDA

User ID of A

PA

Password shared by A and S

RA

Random number generated by A

{data}K

Secret-key encryption of data using key K{data}EA

Public-key encryption of data using A’s public key KUAsKAS

Symmetric (s) session encryption key shared by A and S[X]ASMAC output of X under the symmetric MAC key shared by A and S

Mohammad Mannan

Feb 27, 2006

8

Secure Public Instant Messaging

IMKE - features➠ Comparing IMKE re: offline dictionary attack avoidance
1. password-only (eg. EKE): {KUA }PA
2. known server public key (eg. Halevi-Krawczyk): {PA , R}ES
3. IMKE: {KAS }ES , {PA }KAS

➠ Public key protocol independence➠ IM server works as an online public key distribution center➠ Secure communications between users who share no long-term secret➠ Dynamic client public keys

Mohammad Mannan

Feb 27, 2006

9Secure Public Instant Messaging

IMKE - message summary (1)PhasesMessage

Messages

LabelsA generates a dynamic public/private key pairAuthentication
andKey Exchange

A, S authenticate each other using shared password
A, S establish a session key
A’s public key is sent to and stored by S

Public Key

A communicates to S a desire to talk to B

Distribution

S forwards B ’s public key to A (and A’s to B )A, B authenticate each other using the received

SessionKey Transportpublic keys

A, B establish a session key

Mohammad Mannan

Feb 27, 200610

Secure Public Instant Messaging

IMKE - message summary (2)PhasesMessage

Messages

LabelsAuthenticationa1

A → S : IDA , {KAS }ES , {KUA , f1 (PA )}KASanda2

A ← S : {RS }EA , {f2 (PA )}KASKey Exchangea3

A → S : f3 (RS )Public Key

b1s , [KUB , IDB ]ASA ← S : {KUB , IDB }KASDistribution

b2s , [KUA , IDA ]BSB ← S : {KUA , IDA }KBSc1

A → B : {KAB }EB , {RA }KABc2

A ← B : {RB }EA , {f6 (RA )}KAB

c3

A → B : f7 (RA , RB )SessionKey Transportss
KAS= f (KAS , RS ), KAB= f (KAB , RB )Mohammad Mannan

Feb 27, 2006

11

Secure Public Instant Messaging

IMKE - security➠ Formal proofs: ✗➠ BAN-like analysis (outline): X➠ AVISPA protocol analysis tool: X
http://www.scs.carleton.ca/~mmannan/avispa-imke/

Mohammad Mannan

Feb 27, 2006

12

Secure Public Instant Messaging

IMKE - attacks not addressed
1. Keyloggers can collect passwords
2. A false public key of S on client allows offline dictionary attacks
3. Malicious IM server may forward false client public keys (MIM)
4. IM worms

Mohammad Mannan

Feb 27, 200613

Secure Public Instant Messaging

IMKE - implementation
1. Integrated with Jabber
2. Usable performance➠ authentication time doubles, but still less than 0.5 second➠ little effect on text messaging and bulk data transfer
3. Incrementally deployable

Mohammad Mannan

Feb 27, 2006

14

Secure Public Instant Messaging

Concluding remarks
1. Secure IM: becoming increasingly important
2. IMKE: simple, integratable
3. Main lesson from IMKE implementation: practical today

Mohammad Mannan

Feb 27, 200615