Linköping University | Department of Electrical Engineering Master’s thesis, 30 ECTS | Computer Science 2019 | LITH-ISY-EX--19/5211--SE A Performance Evaluation of Post-Quantum Cryptography in the Signal Protocol En prestandautvärdering av kvantsäkert krypto i Signal- protokollet. Markus Alvila Supervisor : Guilherme B. Xavier Examiner : Jan-Åke Larsson External supervisor : Marcus Kardell Linköpings universitet SE–581 83 Linköping +46 13 28 10 00 , www.liu.se Upphovsrätt Detta dokument hålls tillgängligt på Internet - eller dess framtida ersättare - under 25 år från publicer- ingsdatum under förutsättning att inga extraordinära omständigheter uppstår. Tillgång till dokumentet innebär tillstånd för var och en att läsa, ladda ner, skriva ut enstaka ko- pior för enskilt bruk och att använda det oförändrat för ickekommersiell forskning och för undervis- ning. Överföring av upphovsrätten vid en senare tidpunkt kan inte upphäva detta tillstånd. All annan användning av dokumentet kräver upphovsmannens medgivande. För att garantera äktheten, säker- heten och tillgängligheten finns lösningar av teknisk och administrativ art. Upphovsmannens ideella rätt innefattar rätt att bli nämnd som upphovsman i den omfattning som god sed kräver vid användning av dokumentet på ovan beskrivna sätt samt skydd mot att dokumentet ändras eller presenteras i sådan form eller i sådant sammanhang som är kränkande för upphovsman- nens litterära eller konstnärliga anseende eller egenart. För ytterligare information om Linköping University Electronic Press se förlagets hemsida http://www.ep.liu.se/. Copyright The publishers will keep this document online on the Internet - or its possible replacement - for a period of 25 years starting from the date of publication barring exceptional circumstances. The online availability of the document implies permanent permission for anyone to read, to down- load, or to print out single copies for his/hers own use and to use it unchanged for non-commercial research and educational purpose. Subsequent transfers of copyright cannot revoke this permission. All other uses of the document are conditional upon the consent of the copyright owner. The publisher has taken technical and administrative measures to assure authenticity, security and accessibility. According to intellectual property law the author has the right to be mentioned when his/her work is accessed as described above and to be protected against infringement. For additional information about the Linköping University Electronic Press and its procedures for publication and for assurance of document integrity, please refer to its www home page: http://www.ep.liu.se/. © Markus Alvila Abstract The Signal protocol can be considered state-of-the-art when it comes to secure messag- ing, but advances in quantum computing stress the importance of finding post-quantum resistant alternatives to its asymmetric cryptographic primitives. The aim is to determine whether existing post-quantum cryptography can be used as a drop-in replacement for the public-key cryptography currently used in the Signal protocol and what the performance trade-offs may be. An implementation of the Signal protocol using commutative supersingular isogeny Diffie-Hellman (CSIDH) key exchange operations in place of elliptic-curve Diffie-Hellman (ECDH) is proposed. The benchmark results on a Samsung Galaxy Note 8 mobile device equipped with a 64-bit Samsung Exynos 9 (8895) octa-core CPU shows that it takes roughly 8 seconds to initialize a session using CSIDH-512 and over 40 seconds using CSIDH-1024, without platform specific optimization. To the best of our knowledge, the proposed implementation is the first post-quantum resistant Signal protocol implementation and the first evaluation of using CSIDH as a drop- in replacement for ECDH in a communication protocol. Acknowledgments Foremost, I would like to thank my mother and father, for their unfaltering support and teaching me the true meaning of Finnish sisu. I would also like to thank my brothers, for standing by my side through thick and thin. My thanks and appreciations also go to my supervisors Marcus Kardell and Guilherme B. Xavier for their mentorship and encouragement, as well as to Peter Schwabe, Jonathan Jogenfors and Christan Vestlund for their invaluable advice. iv Contents Abstract iii Acknowledgments iv Contents v List of Figures vii List of Tables viii Abbreviations ix 1 Introduction 1 1.1 Motivation . 1 1.2 Aim............................................ 1 1.3 Research Questions . 2 1.4 Scope . 2 2 Theory 3 2.1 Common Cryptographic Primitives . 3 2.2 Secure Messaging Properties . 4 2.3 The Signal Protocol . 6 2.4 Quantum Computing . 11 2.5 Post-Quantum Cryptography . 13 2.6 Standardization Efforts . 14 3 Method 16 3.1 Affected Components . 16 3.2 Post-Quantum Resistant Drop-In Replacement . 16 3.3 Implementation . 17 3.4 Performance Evaluation . 23 4 Results 27 4.1 Implementation . 27 4.2 Performance . 27 5 Discussion 29 5.1 Results . 29 5.2 Method . 29 5.3 Impact on National Security . 31 6 Conclusion 32 6.1 Future Work . 32 v A Performance Benchmarks 33 A.1 First Message Thread Times . 33 A.2 Consecutive Message Thread Times . 35 A.3 Reply Message Thread Times . 37 Bibliography 39 vi List of Figures 2.1 A KDF chain . 8 2.2 A complete Diffie-Hellman ratchet . 9 2.3 Deriving message keys via the symmetric key ratchet . 10 2.4 Illustration of how the different chains advance . 11 3.1 Original ECC implementation layout. 17 3.2 CSIDH implementation layout. 17 3.3 Benchmarking app user interface. 22 3.4 Android Studio CPU profiler overview. 24 3.5 An example call chart illustrating the involved time concepts. 24 3.6 Android Studio CPU profiler hover panel. 25 3.7 Call chart for a message initializing a session. 25 3.8 Call chart for a consecutive message. 26 3.9 Call chart for a reply. 26 vii List of Tables 2.1 CSIDH attack cost in number of operations for different NIST levels. 14 3.1 Key sizes in bytes. 21 4.1 Mean thread time [ms] for sending/receiving the first message in a session. 28 4.2 Mean thread time [ms] for sending/receiving consecutive messages. 28 4.3 Mean thread time [ms] for sending/receiving replies. 28 A.1 Thread time [ms] for sending the first message in a session. 33 A.2 Thread time [ms] for receiving the first message in a session. 34 A.3 Thread time [ms] for sending consecutive messages. 35 A.4 Thread time [ms] for receiving consecutive messages. 36 A.5 Thread time [ms] for sending a reply. 37 A.6 Thread time [ms] for receiving a reply. 38 viii Abbreviations AEAD Authenticated Encryption with Associated Data AES Advanced Encryption Standard CBC Cipher Block Chaining CPU Central Processing Unit CSIDH Commutative Supersingular Isogeny Diffie-Hellman ECC Elliptic-curve Cryptography ECDH Elliptic-curve Diffie-Hellman EdDSA Edwards-curve Digital Signature Algorithm EU European Union HKDF HMAC-based Extract-and-Expand Key Derivation Function HMAC Hash-based Message Authentication Code IPsec Internet Protocol Security KDF Key Derivation Function MAC Message Authentication Code NATO North Atlantic Treaty Organization NIST National Institute of Standards and Technology PQC Post-Quantum Cryptography RSA Rivest-Shamir-Adleman SD Standard Deviation SHA Secure Hash Algorithm SIDH Supersingular Isogeny Diffie-Hellman SIKE Supersingular Isogeny Key Encapsulation SSH Secure Shell TLS Transport Layer Security X3DH Extended Triple Diffie-Hellman ix Chapter 1 Introduction Over the past decades there has been a stable set of secure cryptographic primitives upon which to rely, but as quantum computing continues to be developed, these primitives come under new threats and the work to find potential replacements is ongoing [3, 11]. These new primitives are however still in their infancy and need further public scrutiny and evaluation in real-world contexts. 1.1 Motivation It has been proved that current public key cryptography based on the difficulty of integer fac- torization or the hardness of the discrete logarithm problem are breakable in sub-exponential time on a theoretical quantum computer using Shor’s factorization algorithm [29]. It has also been proved that Grover’s algorithm provides a quadratic speed-up for quantum search algorithms [18]. Therefore, parties with confidential information and a legal obligation to keep it secure for many decades to come, have already started to look into post-quantum replacements [3, 11]. The currently available post-quantum cryptographic primitives come with performance trade-offs and there is limited research whether these can be practically used in an end-to-end encrypted, mobile messaging context. This thesis project was conducted at Sectra Communications, an international cyberse- curity company providing secure communication solutions to government authorities and defense organizations in the EU and NATO, where the ability to communicate quickly and securely is of critical importance. 1.2 Aim The aim is to determine whether existing post-quantum cryptography can be used as a drop- in replacement for the public-key cryptography currently used in the Signal protocol and what the performance trade-offs may be. Considering the quantum attacks made possible by the algorithms developed by Shor and Grover, the priority is to replace public-key cryptography vulnerable in the post-quantum era with quantum-resistant alternatives. Present symmetric cryptography and cryptographic hash functions are not as critical to replace, due to their higher resilience to known quantum attacks [4]. The Signal protocol was of particular interest as it can be considered state-of-the-art in se- cure messaging. Other messaging apps such as Facebook Messenger, WhatsApp and Skype, among others, have adopted the Signal protocol for their secure messaging functionality [13]. After using existing post-quantum cryptography to replace the currently used public-key cryptography in the Signal protocol and implementing the protocol as part of a simple proof of concept app, CPU performance metrics of the modified protocol are collected and com- pared to the original protocol.