A Key-Update Mechanism for the Space Data Link Security Protocol

• Ability to establish keys between unknown parties.
  • There are plans to use SDLS for satellite swarms.
• Forward Secrecy
• Algorithms:
  • US, EU, PRC, … might end up with different requirements, standard has to be agnostic.
  • Base a recommendation on established algorithms:
    • Primarily NIST winners
    • Solutions otherwise approved in Europe.
• Hybrid Security
  • Ongoing Debate in the Community.
  • ESA insisted on the possibility, we agree.

• Reliability:
  • Always a factor, but to a much greater extend in space!
• Satellites are somewhat authenticated by their position in the sky.
  • ⇒ If ground stations are trustworthy, they potentially don’t require authentication on the protocol level!
• Key establishment not a phase of a data transmission protocol, but run independently of those.

We analyzed two classes of handshakes, both with support for an optional pre-shared key:

Sign + KEM

KEMs for key establishment and signatures for authenticity.

Dual/Triple KEM

KEM-only approach. (2 - 3 KEMs)

• Focus on sizes. (Compute not as much of a bottleneck with most modern algorithms.)
• Don’t make the protocol hybrid, use hybrid primitives instead.
• Prove security in version of BR-model. eCK-PFS-PSK very likely possible, but only real difference is dealing with corrupted randomness. (Not a relevant attack vector here.)
  • Simplifies the security notion quite a bit at little real cost. (Corrupted randomness is generally considered an implementation vulnerability and not something that protocols should necessarily deal with.)
• Separate KEMs in analysis:
  • Allows different KEM primitives within the same protocol. (e.g. Kyber for ephemeral Confidentiality and Classic McEliece for long-term authenticity.)
• Recommended protocol heavily based on Post Quantum Noise
  • Use handshake phase as full protocol
  • Add explicit key confirmation message instead of relying in implicit authentication by first message
• Add mechanism to update long-term keys.

• Kyber + Falcon runner up, but:
  • Notorious difficulty to implement securely.
  • Can in theory safe one roundtrip, but too fragile.
• Stateful signatures and chains of one-time signatures are not competitive.
• Skipping responder authentication is possible and saves some bandwidth, but usually not worth the risks.

• Protocol currently in standardization by CCSDS
• No updates for long term keys.
• Additional confirmation from satellite.
• Otherwise only minor changes.