用于TLS的短期前向安全委托
Short-Lived Forward-Secure Delegation for TLS
摘要：
在当今的互联网上，将TLS的端到端安全性与内容分发网络（CDN）相结合，同时确保连接的真实性，这导致了具有挑战性的委托问题。当CDN服务器提供内容时，它们必须将自己认证为源服务器，以与客户端建立有效的端到端TLS连接。在标准TLS中，后者需要访问服务器的秘密密钥。为了解决这个问题，存在多种解决方法来实现身份验证的委托。在本文中，我们提出了一个解决方案，使密钥共享不必要，并减少了对变通方法的需要。通过使基于身份的签名适应这种设置，我们的解决方案提供了短暂的委托。此外，通过启用前向安全性，即使服务器的秘密密钥泄漏，现有委托也仍然有效。我们提供了一个实现方案，并讨论集成到TLS堆栈。在我们的评估中，我们表明，一个有效的实现所产生的开销比一个典型的网络往返。因此，我们提出了一种替代方法，目前在网络上的代表团的做法。
英文摘要：
On today's Internet, combining the end-to-end security of TLS with Content Delivery Networks (CDNs) while ensuring the authenticity of connections results in a challenging delegation problem. When CDN servers provide content, they have to authenticate themselves as the origin server to establish a valid end-to-end TLS connection with the client. In standard TLS, the latter requires access to the secret key of the server. To curb this problem, multiple workarounds exist to realize a delegation of the authentication. In this paper, we present a solution that renders key sharing unnecessary and reduces the need for workarounds. By adapting identity-based signatures to this setting, our solution offers short-lived delegations. Additionally, by enabling forward-security, existing delegations remain valid even if the server's secret key leaks. We provide an implementation of the scheme and discuss integration into a TLS stack. In our evaluation, we show that an efficient implementation incurs less overhead than a typical network round trip. Thereby, we propose an alternative approach to current delegation practices on the web.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
