Alexandre Poirrier

@inproceedings{dowling2022continuous,

title = {Continuous Authentication in Secure Messaging},

author = {Benjamin Dowling and Felix Günther and Alexandre Poirrier},

editor = {Vijayalakshmi Atluri

and Roberto Di Pietro

and Christian D. Jensen

and Weizhi Meng},

url = {https://link.springer.com/chapter/10.1007/978-3-031-17146-8_18},

doi = {10.1007/978-3-031-17146-8_18},

isbn = {978-3-031-17146-8},

year  = {2022},

date = {2022-09-22},

urldate = {2022-09-22},

booktitle = {Lecture Notes in Computer Science},

volume = {13555},

pages = {361--381},

publisher = {Springer Nature Switzerland},

address = {Cham},

series = {Computer Security – ESORICS 2022},

abstract = {Secure messaging schemes such as the Signal protocol rely on out-of-band channels to verify the authenticity of long-running communication. Such out-of-band checks however are only rarely actually performed by users in practice.



In this paper, we propose a new method for performing continuous authentication during a secure messaging session, without the need for an out-of-band channel. Leveraging the users’ long-term secrets, our Authentication Steps extension guarantees authenticity as long as long-term secrets are not compromised, strengthening Signal’s post-compromise security. Our mechanism further allows to detect a potential compromise of long-term secrets after the fact via an out-of-band channel.



Our protocol comes with a novel, formal security definition capturing continuous authentication, a general construction for Signal-like protocols, and a security proof for the proposed instantiation. We further provide a prototype implementation which seamlessly integrates on top of the official Signal Java library, together with bandwidth and storage overhead benchmarks.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}