Authenticated Key Exchange — Foundations

Corresponds to Chapter 21.1–21.10. Plain Diffie-Hellman key exchange has no way to verify who you’re exchanging a key with (additional-public-key-tools covers the resulting man-in-the-middle attack), so authenticated key exchange (AKE) adds authentication — via signatures, encryption, or pre-shared keys — on top of key agreement. Covers encryption-based AKE protocols and a catalogue of insecure variants (illustrating exactly which step each subtle attack exploits), perfect forward secrecy (using fresh, ephemeral key material so a long-term key’s later compromise can’t decrypt past sessions), HSM security (protocols still secure even if the long-term key is held inside hardware that only performs specific operations, never exposing the raw key), identity protection (hiding who is communicating from a network eavesdropper, not just what they say), one-sided authentication (only one party authenticates, as in typical client-server web browsing), deniability (a party can later deny having participated), and channel bindings (cryptographically tying a higher-layer authentication to the specific secure channel it ran over). Formalizes all of this with precise security definitions before the TLS 1.3 session-setup case study — see transport-layer-security-and-tls for the broader TLS context.

Outline (TODO — flesh out each)

• Identification and AKE
• An encryption-based protocol; insecure variations
• Perfect forward secrecy via ephemeral encryption
• HSM security; strongly unpredictable ciphertexts
• Identity protection
• One-sided authenticated key exchange
• Deniability — with and without identity protection
• Channel bindings
• Formal definitions of AKE security
• Case study: TLS 1.3 session setup; AKE with preshared keys