论文标题
通过ECDHE和SRP减轻TLS妥协
Mitigating TLS compromise with ECDHE and SRP
论文作者
论文摘要
本文审查了TLS中附加加密的隧道的实现，以进一步确保ProtonMail的前端和后端之间的个人信息流量，实施其密钥交换，对称数据包加密和验证。诸如安全远程密码（SRP）和椭圆曲线的技术差异Hellman ephemeral（ECDHE）交换用于密钥交换，并通过PGP签名验证公共参数。然后将数据转移到使用AES-128-GCM加密。该项目旨在集成高安全性数据传输的TLS安全性，并通过重复使用PGP库中存在的部分标准的一部分在前端中易于实现的灵活模型。
The paper reviews an implementation of an additional encrypted tunnel within TLS to further secure and authenticate the traffic of personal information between ProtonMail's frontends and the backend, implementing its key exchange, symmetric packet encryption, and validation. Technologies such as Secure Remote Password (SRP) and the Elliptic Curves Diffie Hellman Ephemeral (ECDHE) exchange are used for the key exchange, verifying the public parameters through PGP signatures. The data is then transferred encrypted with AES-128-GCM. This project is meant to integrate TLS security for high security data transfer, offering a flexible model that is easy to implement in the frontends by reusing part of the standard already existing in the PGP libraries.
