Cas Cremers

Research topics / Post-compromise security

If an adversary learns a party’s secrets, can that party subsequently communicate securely again? We call such guarantees post-compromise security (PCS). Our work formalizes this question and studies the conditions under which these guarantees can be achieved.

The answer depends on the threat model and on the system in which the protocol is used. We study recovery in key exchange and messaging, including the effects of cloned devices, membership in multiple groups, and session handling. We also prove impossibility results for communication systems that must tolerate certain forms of state loss. These results distinguish the guarantees of a protocol component from those available to the users of a complete system.

Suggested reading

These papers develop the notion and foundations of post-compromise security and examine its guarantees and limitations in communication systems.

  1. On Post-Compromise SecurityOn Post-Compromise Security

    In this work we study communication with a party whose secrets have already been compromised. At first sight, it may seem impossible to provide any type of security in this scenario. However, under some conditions, practically relevant guarantees can still be achieved. We call such guarantees ``post-compromise security''.

    We provide the first informal and formal definitions for post-compromise security, and show that it can be achieved in several scenarios. At a technical level, we instantiate our informal definitions in the setting of authenticated key exchange (AKE) protocols, and develop two new strong security models for two different threat models. We show that both of these security models can be satisfied, by proposing two concrete protocol constructions and proving they are secure in the models.

    Our work leads to crucial insights on how post-compromise security can (and cannot) be achieved, paving the way for applications in other domains.

     Details
    Katriel Cohn-Gordon, Cas Cremers, and Luke Garratt.
    IEEE CSF 2016, Proc. of the 29th IEEE Computer Security Foundations Symposium, 2016.
    [Long version] [bibtex]

    We introduce the notion of post-compromise security and give informal and formal definitions. We instantiate them for authenticated key exchange, and give constructions for two different threat models.

    Research: Post-compromise security; Applied cryptography; Key exchange and group key establishment
  2. Clone Detection in Secure Messaging: Improving Post-Compromise Security in Practice Details
    Cas Cremers, Jaiden Fairoze, Benjamin Kiesl, and Aurora Naska.
    ACM CCS 2020, Virtual, November 2020.
    [pdf] [bibtex] [Tamarin models]

    This paper studies clone detection as a means of improving post-compromise security in messaging. The accompanying Tamarin models are linked below.

    Research: Secure messaging; Post-compromise security; Formal verification of security protocols
  3. The Complexities of Healing in Secure Group Messaging: Why Cross-Group Effects Matter Details
    Cas Cremers, Britta Hale, and Konrad Kohbrok.
    USENIX 2021, Virtual, August 2021.
    [pdf] [bibtex]

    We examine healing in group messaging, where a party can participate in several groups. The work studies why interactions between groups matter for recovery after compromise.

    Research: Secure messaging; Post-compromise security; Key exchange and group key establishment
  4. Formal Analysis of Session-Handling in Secure Messaging: Lifting Security from Sessions to Conversations Details
    Cas Cremers, Charlie Jacomme, and Aurora Naska.
    USENIX 2023, August 2023.
    [eprint] [pdf] [bibtex]

    We show how session handling can prevent a conversation from recovering even when its individual ratcheting chains provide post-compromise security, and analyze mechanisms for stronger guarantees.

    Research: Secure messaging; Post-compromise security; Formal verification of security protocols; Key exchange and group key establishment
  5. Impossibility Results for Post-Compromise Security in Real-World Communication Systems Details
    Cas Cremers, Niklas Medinger, and Aurora Naska.
    IEEE Symposium on Security & Privacy, San Francisco, May 2025.
    [eprint] [bibtex]

    We prove limits on post-compromise security for systems that must tolerate certain forms of state loss. The results expose a trade-off between failure resilience and security.

    Research: Secure messaging; Post-compromise security

Further reading

Tools and resources

Complete chronological publication list