보안 메시징 프로토콜 MLS에서 관리자에 메시지 노출에 관한 연구
Study on message exposure to administratorin Secure Messaging Protocol MLS
2
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
메신저 애플리케이션은 서버로 메시지 노출을 방지하고자 종단간 암호화를 자체적으로 적용하였다. 안전하고 효율적인 메시지 통신을 위해 종단간 암호화가 적용된 그룹 메시징 프로토콜인 MLS (Message Layer Security)의 표준화가 진행 중이다. 본 논문은 MLS의 동작 과정과 보안 요구사항을 기반으로 안전성 점검을 수행한다. 메신저 통신에서 필수 보안 요구사항인 중앙 서버에 대한 기밀성은 서버 관리자에 의해 쉽게 위반될 수 있다. 그룹의 통신 내용이 궁금한 서버 관리자를 curious admin으로 정의하고 관리자가 MLS에서 그룹키를 획득하는 공격을 제시한다. 메신저 애플리케이션 사용자에게 서버가 언제든 통신 내용을 열람할 수 있다는 점을 상기시킨다. Curious admin 공격을 방지하기 위해 서버를 거치지 않고 사용자 간 인증하는 방안에 대해 논의한다.
Abstract
Messenger applications applied end-to-end encryption on their own to prevent message exposure to servers. Standardization of a group messaging protocol called Message Layer Security (MLS) with end-to-end encryption is being discussed for secure and efficient message communication. This paper performs safety checks based on the operation process and security requirements of MLS. Confidentiality to a middleman server, which is an essential security requirement in messenger communication, can be easily violated by a server administrator. We define a server administrator who is curious about the group's communication content as a curious admin and present an attack in which the admin obtains a group key from MLS. Reminds messenger application users that the server can view your communication content at any time. We discuss ways to authenticate between users without going through the server to prevent curious admin attacks.
참고문헌 (9)
- "Global number of mobile me ssaging users 2018-2025" (2021)[URL]
- M. R. Albrecht, "Collective Information Security in Large-Scale Urban Protests: the Case of Hong Kong", Proceedings of 30th USENIX Security Symposium, pp.3363~3380 (2021)
- M. Weidner, "Key Agreement for Decentralized Secure Group Messaging with Strong Security Guarantees", Proceedings of 2021ACM SIGSAC Conference on Computer and Communications Security, pp.2024~2045 (2021)
- R. Barnes, "The Messaging Layer Security (MLS) Protocol draft-ietfmls-protocol-12", Internet Engineering Task Force, ~ (2021)
- K. Cohn-Gordon, "On Ends-to-Ends Encryption Asynchronous Group Messaging with Strong Security Guarantees", Proceedings of 2018 ACM SIGSAC Conference on Computer and Communications Security, pp.1802~1819 (2018)
- P. Rösler, "More is less: On the end-to-end security of group chats in Signal, WhatsApp, and Threema", Proceedings of 2018 IEEE European Symposium on Security and Privacy, pp.415~429 (2018)
- K. Elmaghraby, "Blockchain-Based Fair and Secure Certified Electronic Mail Without a TTP", IEEE Access, 9, pp.100708~100724 (2021)
- M. Chase, "SEEMless: Secure End-to-End Encrypted Messaging with less Trust", Proceedings of 2019ACM SIGSAC Conference on Computer and Communications Security, pp.1639~1656 (2019)
- V. Goyal, "Reducing Trust in the PKG in Identity Based Cryptosystems", Proceedings of Annual International Cryptology Conference, pp.430~447 (2007)