Hybrid- Exchanges as an Interim-to-Permanent Solution to Cryptographic Agility Matthew Campagna Amazon Web Services Agenda

Classical cryptographic reasoning

Post-quantum

Hybrid

Post-Quantum-s2n Here is what keeps me up at night

Record

AWS Cloud

Client Internet Here is what keeps me up at night

Record

New capabilities AWS Cloud

Client Internet Here is what keeps me up at night

Record plaintext data and harvest New capabilities AWS Cloud

Client Internet Confidentiality requirement Security of an algorithm

The computation complexity of the best known attacks. ! • Defines the bit strength of an algorithm. • Bounds the algorithm security lifetime.

O(2n) How assured am I better attacks are not coming? L [a, c] n • How long has this problem been studied? • Who has studied it and what is the published record of that analysis. • No compression of the iterative analyze/discover/disseminate process Best known attacks

Best known attack Invented Standardized Widely used Year Attack ECC 1985 1999 2000s 1978 Pollard rho 2"

1/3 FF 1976 1991 1990s 1990 NFS Ln[1/3, (64/9) ] 1/3 RSA 1978 1998 1990s 1990 NFS Ln[1/3, (64/9) ] AES 1998 2001 2005 - Exhaust 2n DES 1975 1977 1980s 1991 Differential SHA1 - 1995 1990s 2005 Collision < 2" SHA2 2001 2002 2005 - Birthday attack 2" SHA3 2008 2015 ? - Birthday attack 2" ChaCha20 2008 2015 2018 - Exhaust 2n Impact of on cryptography

Shor’s algorithm (1994): Can solve the discrete log problem (breaking Diffie-Hellman and Elliptic Curve Cryptography), and factor composite numbers (breaking RSA)

Grover’s algorithm (1996): Can search an unsorted database of N items in Ο( # ) time (reducing the security of symmetric ciphers and preimage search for hash functions) Timeline for quantum computing What has ETSI been doing

2013 – Initial ETSI IQC Quantum Safe Cryptography Workshop

2014 – Started ETSI QSC Industry Specification Group

2015 – Published the ETSI Quantum Safe Cryptography and Security

2016 – ETSI CYBER QSC Technical Committee (Chair: Mark Pecen) CYBER-QSC-008 (TR 103 616): Quantum Safe Signatures CYBER-QSC-0012 (TR 103 618): Quantum Safe Identity Based CYBER-QSC-0015 (TS): Quantum-Safe Hybrid Key Exchanges NIST Standardization Process

2015 - NSA changes Suite B algorithms to prepare for post-quantum 2016 – NIST issues a call for proposals for post-quantum proposals 2017 – Round 1: 69 initial complete packages 2019 – Round 2: 17 key encapsulation mechanisms, 9 signature schemes

round candidates More analysis … conference nd Conference rd round candidates st round candidatesst Analysis and evaluationAnalysisnd and evaluation Draft standards Call for proposal1 1 2 2 3 ………

Jan, Nov, April, Jan, Aug, 2022- 2017 2017 2018 2019 2019 2023 NIST PQ KEM Round 2 Submissions 300000 bytes

20000 bytes 10000 bytes

5000 bytes

2500 bytes

1000 bytes

100K 1M 10M 100M 1B Quantum-safe cryptography - recap

We can’t solely rely on new algorithms until we have more assurance

We want to test them to understand impact to applications and protocols we use today

We do both - perform hybrid key exchanges

One classical, like Elliptic Curve Diffie Hellman

One quantum-safe, like BIKE or SIKE

Combine them in a cryptographically non-lossy way Hybrid key agreements

Alice Bob

Generate (a, A) A Generate (b, B)

B

K = KDF(aB) K = KDF(bA) Hybrid key agreements

Alice Bob

Generate (a, A) , pk ( sk, pk ) = Gen( ) A Generate (b, B)

B Hybrid key agreements

Alice Bob

Generate (a, A) , pk ( sk, pk ) = Gen( ) A Generate (b, B) (ss, ct) = Encaps(pk) B , ct Hybrid key agreements

Alice Bob

Generate (a, A) , pk ( sk, pk ) = Gen( ) A Generate (b, B) (ss, ct) = Encaps(pk) ss = Decaps(sk, ct) B , ct

K = KDF(aB || ss) K = KDF(bA || ss) PQ-TLS 1.2 – hybrid key exchange

Client Server (Cert(d, N), e) ClientHello

Generate ECDHE (a, A) Certificate (Cert(d, N)) (sk, pk) = KeyGen( ) ServerKeyExchange (A, pk, sig)) sig = Sign(A, pk…, e) Verify(sig, A, pk…, (d, N)) Generate ECDHE (b, B) (ss, ct) = Encaps(pk) ClientKeyExchange (B, ct) keys = derive keys (bA, ss …) ss = Decaps(sk, ct ) keys = derive keys (aB, ss…) ApplicationData

This is a sketch of a TLS_ECDHE_SIKE_RSA_* negotiated cipher suite connection PQ-TLS 1.2 – hybrid key exchange

Draft experimental RFC within IETF for hybrid key exchange in TLS 1.2

Added SIKE and BIKE reference code into AWS’s s2n (libssl) code base

Add in a hybrid key exchange cipher suites into s2n TLS_ECDHE_BIKE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_SIKE_RSA_WITH_AES_256_GCM_SHA384

Apply the same rigor to this new code as we do to s2n PQ-TLS 1.2 – Bandwidth usage (bytes)

ClientHello ServerKeyExchange ClientKeyExchange

ECDHE-RSA-AES256-GCM-SHA384 139 329 66 ECDHE-BIKE-RSA-AES256-GCM-SHA384 147 2875 2610

ECDHE-SIKE-RSA-AES256-GCM-SHA384 147 711 470 PQ s2n Performance numbers - P50 (ms)

Local host us-west2 us-west1 eu-west2 ap-south1

Ping 0.08 0.69 21 133 22

ECDHE 1.2 2.6 43 278 434 ECDHE-BIKE Hybrid 25 27 67 302 458

ECDHE-SIKE Hybrid 155 156 197 431 588 What comes next

Integrate PQ s2n into AWS SDKs and deploy pq-hybrid into AWS KMS

Move from the Round 1 candidates to Round 2

Add a lattice-based scheme into PQ s2n

Use an ETSI standardized hybrid-key agreement scheme

Increase performance (10x): move from reference code to optimized code

Move from TLS 1.2 to TLS 1.3, consider alternatives to pq-hybrid Double-hulled TLS

AWS Cloud

FIPS-Certified

ECDHE & TLS-AES256-GCM-SHA384 Client Double-hulled TLS

AWS Cloud

FIPS-Certified PQ-KEM & TLS-CHACHA20-POLY1305-SHA3-384 ECDHE & TLS-AES256-GCM-SHA384 Client 7th ETSI/IQC Quantum Safe Cryptography Workshop

When: 5 – 7 November 2019 Where: Amazon Headquarters in Seattle, US Who: Admission is open to all Executive Track: CTO/CISO/Executives and government decision makers looking to understand current trends in quantum-safe or post-. Technical Track: Technologists and standards participants looking to increase their knowledge in the state of the art in quantum-safe cryptography.

Additional Dates: Submission deadline is 22 June 2019 Thank you! Additional details

AWSLabs: https://github.com/awslabs/s2n

IETF: https://tools.ietf.org/html/draft-campagna-tls-bike-sike-hybrid-01 https://tools.ietf.org/html/draft-stebila-tls-hybrid-design-00

ETSI: https://www.etsi.org/events/1607-etsi-iqc-quantum-safe- cryptography-workshop-2019 https://portal.etsi.org/tb.aspx?tbid=856&SubTB=856#/

NIST: https://csrc.nist.gov/Projects/Post-Quantum-Cryptography