Key Confirmation in Key Exchange - A Formal Treatment and Implications for TLS 1.3

Explore key confirmation in key exchange protocols through this IEEE Symposium on Security & Privacy conference talk. Delve into the first rigorous formalization of key confirmation, examining two flavors: full and almost-full. Discover how these concepts apply to the Transport Layer Security (TLS) protocol version 1.3. Analyze the benefits of precise security definitions and their implications for both the TLS 1.3 full handshake and a generic protocol transformation. Gain insights into the security properties of different handshake messages and the folklore approach to establishing key confirmation.

Intro
Key Confirmation
Why Care
What We Do
Full Key Confirmation
Almost Full Key Confirmation
Transform Protocol
Key Confirmation Protocol
Summary