Minimalt: Minimal-Latency Networking Through Better Security W

MinimaLT: Minimal-latency Networking Through Better Security W. Michael Petullo Xu Zhang Jon A. Solworth Daniel J. Bernstein Tanja Lange mike@flyn.org [email protected] [email protected] [email protected] [email protected] University of Illinois at Chicago TU Eindhoven USA Netherlands ABSTRACT all long-term private keys cannot decrypt past packets or identify the parties involved in communication. Tradition- Minimal Latency Tunneling (MinimaLT) is a new net- ally, using Diffie-Hellman key exchange (DH) to achieve work protocol that provides ubiquitous encryption for max- PFS requires a round trip before sending any sensitive imal confidentiality, including protecting packet headers. data. MinimaLT eliminates this roundtrip, instead re- MinimaLT provides server and user authentication, exten- ceiving the server's ephemeral key during a directory ser- sive Denial-of-Service protections, and IP mobility while ap- vice lookup (x4.3.1). To establish connection liveness| proaching perfect forward secrecy. We describe the proto- necessary only if the connection is inactive and the server col, demonstrate its performance relative to TLS and unen- is running out of memory|we invert the normal mandatory crypted TCP/IP, and analyze its protections, including its start-of-connection handshake and replace it with an only- resilience against DoS attacks [56]. By exploiting the prop- when-needed server-originated handshake (x4.3.4). Elimi- erties of its cryptographic protections, MinimaLT is able to nating roundtrips makes MinimaLT faster than unencrypted eliminate three-way handshakes and thus create connections TCP/IP at establishing connections. faster than unencrypted TCP/IP. A second challenge is to make connections portable 1 Introduction across IP addresses to better support mobile computing. allows you to start a connection from home, Our goal is to protect all networking against eavesdropping, MinimaLT travel to work, and continue to use that connection. This modification, and, to the extent possible, Denial of Ser- avoids application recovery overhead and lost work for op- vice (DoS). To achieve this goal, networking must protect erations which would otherwise be interrupted by a move. privacy, perform well, provide strong (i.e., cryptographic) IP mobility does not require intermediary hosts authentication, and be easy to configure. These needs are MinimaLT or redirects, allowing it to integrate cleanly into protocol not met by existing protocols. processing (x4.3.3). To provide better privacy, Hardware and software improvements have eliminated his- MinimaLT blinds third parties to IP-address portability to prevent link- torical cryptographic performance bottlenecks. Now, strong ing a connection across different IP addresses. symmetric encryption can be performed on a single CPU core at Gb/s rates [45], even on resource-constrained mobile A third challenge is DoS. A single host cannot thwart an devices [13]. Public-key cryptography, once so agonizingly attacker with overwhelming resources [36], but MinimaLT slow that systems would try to simulate it with symmetric protects against attackers with fewer resources. In particu- key cryptography [43], is now performed at tens of thousands lar, MinimaLT dynamically increases the ratio of client (i.e., of operations per second on commodity CPUs. But one per- attacker) to server resources needed for a successful attack. formance parameter is a fundamental limitation|network MinimaLT deploys a variety of defenses to maintain propor- latency [33]. Latency is critical for users [58]. For example, tional resource usage between a client and server (x5.3). Google found that a 500ms latency increase resulted in a A fourth challenge is authentication and authorization. 25% dropoff in page searches, and studies have shown that Experience indicates that network-based password authen- user experience degrades when interfaces incur latencies as tication is fraught with security problems [34, 57, 47, 16], small as 100ms [17]. This has prompted several efforts to and that cryptographic authentication is needed. Our reduce TCP and TLS latency [18, 46, 44, 53, 59]. authentication framework supports both identified and We describe here MinimaLT, a secure network protocol non-identified (pseudonym) users (x4.1.1). We designed which delivers protected data on the first packet of a typ- MinimaLT to integrate into systems with strong authoriza- ical client-server connection. MinimaLT provides substan- tion controls. tial protections and is extraordinarily simple to configure To meet these challenges, we have done a clean-slate de- and use. In particular, it provides cryptographic authenti- sign, starting from User Datagram Protocol (UDP), and cation of servers and users; encryption of communication; concurrently considering multiple network layers. We found simplicity of protocol, implementation, and configuration; an unexpected synergy between speed and security. The rea- clean IP-address mobility; and DoS protections. son that the Internet uses higher-latency protocols is that, MinimaLT's design intentionally crosses network layers. historically, low-latency protocols such as T/TCP have al- It does so for two reasons: First, security problems often lowed such severe attacks [18] as to make them undeployable. occur in the seams between layers. For example, Transport It turns out that providing strong authentication elsewhere Layer Security (TLS) is unable to protect against attacks on in the protocol stops all such attacks without adding latency. TCP/IP headers due to its layering; RST and sequence num- In short, MinimaLT provides the features of TCP/IP (re- ber attacks interrupt TLS connections in such a way that is liability, flow control, and congestion control), and adds difficult to correct or even detect [23, 4, 62]. Second, multi- in encryption, authentication, clean IP mobility, and DoS layer design enables MinimaLT to improve performance. protections, all while preserving PFS and reducing latency Particularly challenging has been to provide Perfect For- costs. We describe MinimaLT and its implementation here. ward Secrecy (PFS) at low latency. PFS means that even In x2 we describe related work, x3 describes our threat an attacker who captures network traffic and later obtains model, x4 describes the design, and x5 provides an evalu- ation of the security and performance of MinimaLT. Linux kernel, SELinux, and IPsec, each of which are very complex. Furthermore, IPsec security association granular- 2 Related work ity limits the granularity of controls in labeled IPsec. In TLS provides cryptographic network protections above the contrast, MinimaLT is designed from scratch, significantly transport layer and is normally implemented as a user-space simplifying policy specification, implementation, and use. library [19]. TLS is widely deployed as the primary network Stream Control Transport Protocol (SCTP) is a security layer in web browsers, yet many Internet applica- transport-layer protocol that provides reliable delivery and tions avoid the use of TLS or use weak TLS options [61]. congestion control [60]. SCTP differs from TCP in that Even well-meaning developers routinely misuse complex it can bundle messages from multiple applications (i.e., TLS Application Programming Interfaces (APIs), resulting chunks) into a single packet. MinimaLT borrows this tech- in security holes [31, 26]. Optionally, TLS can provide user- nique. Structured Stream Transport (SST) [29] allows ap- level authentication using client-side certificates but autho- plications to associate lightweight network streams with an rization is left to application logic. ForceHTTPS [38] and existing stream, reducing the number of three-way hand- HTTPS Everywhere [25] attempt to make TLS/HTTP more shakes incurred by applications and providing semantics use- robust; MinimaLT forgoes backwards compatibility to pro- ful for applications that use both data and control connec- vide a simpler, less mistake-prone platform. tions. MinimaLT eliminates the handshake on even the first There have been many attempts to reduce the latency in- connection, and MinimaLT's tunnels do not require a pro- curred by TLS and TCP. Recently, False Start (no longer grammer's explicit use of a lightweight stream API. used), Snap Start, and certificate pre-fetching have accel- Table 1 compares several network protocols with erated establishing a TLS session [46, 44, 59]. TCP Fast MinimaLT. MinimaLT is unique in that it provides encryp- Open (TFO) [53] clients may request a TFO cookie that al- tion and authentication with PFS while allowing a client to lows them to forgo the three-way handshake on future con- include data in the first packet sent to a server (often for- nections. Since any client may request a TFO cookie, a going pre-transmission round trips entirely). MinimaLT is client may spoof its sending Internet Protocol (IP) address also notable in that it includes robust DoS protections di- to mount a DoS attack against a server; under this condi- rectly in the protocol. tion, the server must again require a three-way handshake. To benefit from TFO, a server application must be idempo- 3 Threat model tent, a requirement that MinimaLT does not impose. Data- We are concerned with the confidentiality and integrity gram Transport Layer Security (DTLS) [54] provides TLS of network traffic in the presence of an attacker that can protections on top of UDP, which is useful when reliability is observe or modify arbitrary packets|including a Man-in- not needed. However, DTLS shares TLS' initial

Load more