Cryptography · Cluster
Protocol Construction
Composition, transcripts, and proofs.
- 01 Transcript Hashing and Handshake Binding in TLS 1.3 How a running hash over handshake messages commits each flight to the ones before it, which secrets consume the digest, and what breaks when a message is left out of it.
- 02 Domain Separation and Labelled Key Derivation Why one master secret must never produce two interchangeable keys, how labels are encoded into a KDF, and which label collisions still cause cross-protocol failures.
- 03 Unambiguous Message Framing in Cryptographic Protocols Why a byte string must decode to exactly one message structure, how length prefixes and canonical encodings achieve it, and where parsing ambiguities become key-recovery attacks.
- 04 Key Confirmation Ordering and What It Prevents Why a Finished message must come after the peer can no longer change the transcript, what an explicit key-confirmation exchange adds, and which attacks a misordered exchange leaves open.
- 05 Pre-Shared Key Binders and the Cost of Early Data How a binder commits a client to a session ticket before the server has contributed anything, why 0-RTT cannot be replay-protected by the protocol, and what the truncation rules prevent.
- 06 Nonce Construction and the Reuse Limits of AEAD Why an AEAD nonce must be unique per key, how counter, random, and XOR-based constructions differ in what they assume, and what a repeated nonce reveals.
- 07 Channel Binding: Tying an Authenticated Session to Its Transport How a protocol proves that the credential exchange it just performed happened inside this specific TLS connection, and why an unbound exchange is open to a relay in the middle.
- 08 Concurrent Composition and the Isolation Assumption Why a protocol proved secure alone can fail when run beside another, how session identifiers and key separation restore isolation, and where composition theorems stop applying.
- 09 Random Oracle Model Arguments and Their Limits What a proof in the random oracle model actually establishes, why a hash can be instantiated by a construction with an obvious weakness, and how to read a ROM proof without overclaiming.
- 10 Symbolic Protocol Verification and the Perfect Encryption Assumption How Dolev-Yao models reduce cryptography to term algebra, what tools such as ProVerif and Tamarin can and cannot find, and why a symbolic attack is always worth taking seriously.