Proxying Is Enough
Security of Proxying in TLS Oracles and
AEAD Context Unforgeability
Zhongtang Luo1, Yanxue Jia1, Yaobin Shen2, Aniket Kate13
Purdue University1, Xiamen University2, Supra Research3
Oracle
Oracles pull information from Web2 to Web3
Exchange
Payout
Market
21
700
21.74
How can we verify secret data
while preserving user privacy?
TLS Oracle
Let's verify data through TLS (HTTPS) connections!
But TLS is a symmetric key protocol…
The user can create any transcript after communication
We have to be involved in the connection!
(Root of Trust)
There is a dilemma…
User
doesn't want to reveal
wants to reveal only a decryption
process of
Oracle
worried the user might use some other random
cannot trust the decryption process of
Traditionally…
The oracle joins
[CCS'20] DECO: Liberating Web Data Using Decentralized Oracles for TLS
[IPSEC'23] DIDO: Data Provenance from Restricted TLS 1.3 Websites
[USENIX Sec'24] Lightweight Authentication of Web Data via Garble-Then-Prove
The user proves
[PETS'25] Janus: Fast Privacy-Preserving Data Provenance for TLS
[PETS'25] ORIGO: Proving Provenance of Sensitive Data with Constant Communication
MPC or ZKP in TLS is
expensive…
(90% of the cost in some cases)
Can we do better?
Key Commitment
Problem
The user use different keys to decrypt
Key Commitment
Hard to find different keys that decrypt
Padding
One popular way to achieve key commitment
Padding
Method
Add 128 bytes of 0s to the front of the plaintext
Rationale
Hard to decrypt to the same plaintext (0s) with different keys
Works for
Major cipher suites such as AES-GCM, Chacha20-Poly1305, etc.
AES-GCM: $\underbrace{c_i}_{\text{ciphertext}}=\underbrace{m_i}_{\text{plaintext}}+\underbrace{E_k}_{\text{cipher}}(\underbrace{n}_{\text{nonce}}+\underbrace{i}_{\text{block index}})$
Since for two keys $k$ and $k'$
we
have
$c_i=c'_i$ and $m_i=m'_i$
for $0\le
i<b$
$E_k(n+i)=E_{k'}(n'+i)\ (0\le i< b)$
$E_k(n+i)=E_{k'}(n'+i)\ (0\le i< b)$
| $E_k$: | $\cdots$ | $\cdots$ | $\cdots$ | |||||
|
$0$
|
$n$
|
$n+b$
|
$2^{128}-1$
|
|||||
| $E_{k'}$: | $\cdots$ | $\cdots$ | $\cdots$ | |||||
|
$0$
|
$n'$
|
$n'+b$
|
$2^{128}-1$
|
Pretty hard to get $b$ 128-bit blocks to be the same!
Can we apply padding to our protocol?
HTTPS
HTTP/1.1 200 OK
Date: Wed, 24 Jul 2024 23:41:36 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=UTF-8
...
X (Twitter)
HTTP/1.1 200 OK
date: Wed, 24 Jul 2024 23:47:49 GMT
perf: 7402827104
expiry: Tue, 31 Mar 1981 05:00:00 GMT
pragma: no-cache
...
HTTP/1.1 200 OK
Date: Wed, 24 Jul 2024 23:41:36 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=UTF-8
...
X (Twitter)
HTTP/1.1 200 OK
date: Wed, 24 Jul 2024 23:47:49 GMT
perf: 7402827104
expiry: Tue, 31 Mar 1981 05:00:00 GMT
pragma: no-cache
...
HTTP/1.1 200 OK
Date: Wed, 24 Jul 2024 23:41:36 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=UTF-8
...
X (Twitter)
HTTP/1.1 200 OK
date: Wed, 24 Jul 2024 23:47:49 GMT
perf: 7402827104
expiry: Tue, 31 Mar 1981 05:00:00 GMT
pragma: no-cache
...
It turns out that HTTPS is (kind of) padded!
Starting with status code then date is recommended by RFC 7231
If we consider all status codes (63) and the last hour (3600)…
Only 63 * 3600 possibilities for the first 56 bytes!
Only 63 * 3600 possibilities for the first 56 bytes!
We define this as variably padded
and proved that proxy-based TLS is secure for HTTPS!
| Work | Scenario | Record Type |
Resp. | Key-Related | Record | ||
|---|---|---|---|---|---|---|---|
| Size | Off. | On. | Off. | On. | |||
| (B) | (s) | (s) | (s) | (s) | |||
| ORIGO (Groth16) |
Circuit | Open (32 B) |
1429 | 22.47 | 1.08 | 10.55 | 0.61 |
| ORIGO (Plonk) |
Circuit | Open (32 B) |
1429 | 27.51 | 14.84 | 13.99 | 7.67 |
| Janus | LAN | Open (256 B) |
2048 | 3.94 | 4.79 | 1.13 | 2.08 |
| Xie et al. | LAN | — | 1024 | — | 0.61 | — | |
| DECO (512 B Query) |
LAN | — | — | 2.28 | 0.42 | — | |
| DECO (512 B Query) |
WAN (100 Mbps) |
— | — | 22.81 | 5.20 | — | |
| DECO (1 KB Query) |
LAN | — | — | 2.50 | 0.47 | — | |
| DECO (1 KB Query) |
WAN (100 Mbps) |
— | — | 24.59 | 7.42 | — | |
| DECO | Circuit | Binary Options |
— | — | — | — | 12.97 |
| DECO | Circuit | Age Proof |
— | — | — | — | 3.67 |
| DECO | Circuit | Price Dis- crimination |
— | — | — | — | 12.68 |
| Work | Scenario | Record Type |
Resp. | Key-Related | Record | ||
|---|---|---|---|---|---|---|---|
| Size | Off. | On. | Off. | On. | |||
| (B) | (s) | (s) | (s) | (s) | |||
| ORIGO (Groth16) |
Circuit | Open (32 B) |
1429 | 22.47 | 1.08 | 10.55 | 0.61 |
| ORIGO (Plonk) |
Circuit | Open (32 B) |
1429 | 27.51 | 14.84 | 13.99 | 7.67 |
| Janus | LAN | Open (256 B) |
2048 | 3.94 | 4.79 | 1.13 | 2.08 |
| Xie et al. | LAN | — | 1024 | — | 0.61 | — | |
| DECO (512 B Query) |
LAN | — | — | 2.28 | 0.42 | — | |
| DECO (512 B Query) |
WAN (100 Mbps) |
— | — | 22.81 | 5.20 | — | |
| DECO (1 KB Query) |
LAN | — | — | 2.50 | 0.47 | — | |
| DECO (1 KB Query) |
WAN (100 Mbps) |
— | — | 24.59 | 7.42 | — | |
| DECO | Circuit | Binary Options |
— | — | — | — | 12.97 |
| DECO | Circuit | Age Proof |
— | — | — | — | 3.67 |
| DECO | Circuit | Price Dis- crimination |
— | — | — | — | 12.68 |