Security Analysis of Olvid's SAS-based Trust Establishment Protocol

Michel Abdalla (1, 2, 3, 4)

1 LIENS - Laboratoire d'informatique de l'école normale supérieure
2 PSL - Université Paris sciences et lettres
3 ENS-PSL - École normale supérieure - Paris
4 CASCADE - Construction and Analysis of Systems for Confidentiality and Authenticity of Data and Entities

In this report, we analyze the security of the trust establishment protocol used in the Olvid messaging protocol. The latter relies on the PV-SAS-MCA message cross-authentication protocol by Pasini an Vaudenay based on short authenticated strings (SAS). In order to make the implementation portable across different platforms, Olvid proposed particular instantiations of the underlying primitives used in PV-SAS-MCA in addition to some other minor modifications. Here, we show that these changes have no impact on the security of the scheme. More precisely, we formally prove that the trust establishment protocol used in Olvid is a secure message cross-authentication protocol. The proof of security is in the random-oracle model and relies on the security of the underlying pseudorandom generator. It also assumes users know each other and have an authentic channel between them.

Domaines: Cryptographie et sécurité [cs.CR]

Michel Abdalla. Security Analysis of Olvid's SAS-based Trust Establishment Protocol. [Research Report] Report 2020/808, IACR Cryptology ePrint Archive. 2020. ⟨hal-03003687⟩