A Formal Analysis for Capturing Replay Attacks in Cryptographic - - PowerPoint PPT Presentation

▶
a formal analysis for capturing replay attacks in
SMART_READER_LITE
LIVE PREVIEW

A Formal Analysis for Capturing Replay Attacks in Cryptographic - - PowerPoint PPT Presentation

Aug 29, 2023 216 likes •438 views

ASIAN07 A Formal Analysis for Capturing Replay Attacks in Cryptographic Protocols Han Gao 1 , Chiara Bodei 2 , Pierpaolo Degano 2 , Hanne Riis Nielson 1 Informatics and Mathematics Modelling, Technical University of Denmark 1 Dipartimento di

slide-1
SLIDE 1

A Formal Analysis for Capturing Replay Attacks in Cryptographic Protocols

Han Gao1, Chiara Bodei2 , Pierpaolo Degano2, Hanne Riis Nielson1 Informatics and Mathematics Modelling, Technical University of Denmark1 Dipartimento di Informatica, Università di Pisa2

ASIAN’07

ASIAN’07 Doha, December 2007

slide-2
SLIDE 2

Replay Attacks in Protocols

(Bob, Alice, Msg)

… …

(Carol, Alice, Msg)

Attacker CFA Result Extended LySa Standard LySa Protocol Narration

Dipartimento di Informatica - Università di Pisa

slide-3
SLIDE 3

Needham-Schroeder

  • Invented in 1978

1. A → S : A, B, Na 2. S → A : {Na, B, K, {K, A}Kb}Ka 3. A → B : {A, K}Kb 4. B → A : {Nb}K 5. A → B : {Nb − 1}K 6. A → B : {Msg}K

Authentication steps: A and B make sure that they both know the key Key distribution steps: The key should be known to both A and B Message exchange step Flaw discovered in 1981

Attacker CFA Result Extended LySa Standard LySa Protocol Narration

Dipartimento di Informatica - Università di Pisa

slide-4
SLIDE 4

Needham-Schroeder

  • The Denning-Sacco Attack

1. A → S : A, B, Na 2. S → A : { Na , B, K, {K, A}Kb}Ka 3. A → B : {A, K}Kb 4. B → A : { Nb }K 5. A → B : { Nb − 1}K 6. A → B : {Msg}K

1. . . . 2. . . . 3. M(A) → B : {A, K0}Kb 4. B → M(A) : {Nb}K0 5. M(A) → B : {Nb − 1}K0 6. M(A) → B : {Msg}K0

An old session key K’ is leaked B believes he is talking to A! A is convinced that K is fresh

No such guarantee for B

Attacker CFA Result Extended LySa Standard LySa Protocol Narration

Dipartimento di Informatica - Università di Pisa

slide-5
SLIDE 5

Whole Picture

protocol narrations

Control Flow Analysis

Dolev-Yao Attacker Standard Lysa Extended Lysa

Find the Denning-Sacco attack in less than 3 sec

Attacker CFA Result Extended LySa Standard LySa Protocol Narration

Dipartimento di Informatica - Università di Pisa

slide-6
SLIDE 6

LySa Calculus

1. A → S : A, B, Na 2. S → A : {Na, B, K, {K, A}Kb}Ka 3. A → B : {A, K}Kb 4. B → A : {Nb}K 5. A → B : {Nb − 1}K 6. A → B : {Msg}K

hA, S, A, B, Nai. hA, B, {A, K}Kbi. (A, B; y). decrypt y as {A; k}Kb in . . .

P = PA | PB | PS

sender payload receiver pattern matching variable binding

Attacker CFA Result Extended LySa Standard LySa Protocol Narration

One global channel

Dipartimento di Informatica - Università di Pisa

slide-7
SLIDE 7

Session Identifiers

Attacker CFA Result Extended LySa Standard LySa Protocol Narration

protocol run 1 protocol run 2 hA, S, Nai. hA, S, Nai. (A, S; x). (A, S; x).

Dipartimento di Informatica - Università di Pisa

slide-8
SLIDE 8

[hA, S, Nai.]2 [(A, S; x).]2 [(A, S; x).]1 [hA, S, Nai.]1

Session Identifiers

Attacker CFA Result Extended LySa Standard LySa Protocol Narration

protocol run 1 protocol run 2

Dipartimento di Informatica - Università di Pisa

slide-9
SLIDE 9

T ([hA, S, Nai.]2) T ([(A, S; x).]2) T ([(A, S; x).]1) T ([hA, S, Nai.]1)

Session Identifiers

Attacker CFA Result Extended LySa Standard LySa Protocol Narration

protocol run 1 protocol run 2

Dipartimento di Informatica - Università di Pisa

slide-10
SLIDE 10

Extended LySa Calculus

1. A → S : A, B, Na 2. S → A : {Na, B, K, {K, A}Kb}Ka 3. A → B : {A, K}Kb 4. B → A : {Nb}K 5. A → B : {Nb − 1}K 6. A → B : {Msg}K

hA, S, A, B, Nai. hA, B, {A, K}Kbi. (A, B; y). decrypt y as {A; k}Kb in . . .

P = PA | PB | PS

P = [!P]0

Standard Extended Terms E E Processes P P

F T

Stops when reaching n or x Stops when reaching 0 or !

F

T

F([{N}K]s) = {[N]s}[K]s

T ([hNi.0 | !((; x).0)]s) = T ([hNi.0]s) | T ([!((; x).0)]s) = h[Ns]i.0 | [!((; x).0)]s

Attacker CFA Result Extended LySa Standard LySa Protocol Narration

Unfold once in each semantics step

Dipartimento di Informatica - Università di Pisa

slide-11
SLIDE 11

Freshness Property

decrypt {[Na]2, [Nb]2}[K]2 as {[Na]1; x}[K]1 in 0 decrypt {[Na]1, [Nb]1}[K]1 as {[Na]1; x}[K]1 in 0

Extract the session ID

Attacker CFA Result Extended LySa Standard LySa Protocol Narration

Equality with sessin IDs ingnored

Dipartimento di Informatica - Università di Pisa

E0 ≈ E0

0 ∧ E1 ≈ E0 1 ∧ R(I(E0), I(E0 0)) ∧ R(I(E1), I(E0 1))

decrypt [{E1, E2}E0]s as {E0

1; x2}E0

0 in P →R P[E2/x2]

slide-12
SLIDE 12

Static Analysis

  • Approximation

– Over-Approximation

  • Algorithms

– Control Flow Analysis

Over-approximation All possible solutions Under-approxmation Actual Solution

Attacker CFA Result Extended LySa Standard LySa Protocol Narration

Dipartimento di Informatica - Università di Pisa

slide-13
SLIDE 13

Static Analysis

  • Analysis of Terms

– Determine the possible values that each term may evaluate to

  • Analysis of Processes

– Collect the values that may flow on the network – Error component

ρ | = E : ϑ

ρ, κ | =RM P : ψ

Attacker CFA Result Extended LySa Standard LySa Protocol Narration

a n a l y s i s ( T ( [ P ]0 ) ) | a n a l y s i s ( T ( [ P ]1 ) ) a n a l y s i s ( P )

Dipartimento di Informatica - Università di Pisa

slide-14
SLIDE 14

The Error Component

  • The error component

collects labels of decryption where freshness violations may

  • happen. For example:
  • The empty error component implies free of

replay attacks at run time

Dipartimento di Informatica - Università di Pisa

Attacker CFA Result Extended LySa Standard LySa Protocol Narration

l ∈ ψ

slide-15
SLIDE 15

The Attacker

  • Capabilities

– Eavesdrop – Alter – Insider or outsider or both – Obtain old session keys

Attacker CFA Result Extended LySa Standard LySa Protocol Narration

Dipartimento di Informatica - Università di Pisa

slide-16
SLIDE 16

1. A → S : A, B, Na 2. S → A : {Na, B, K, {K, A}Kb}Ka 3. A → B : {A, K}Kb 4. B → A : {Nb}K 5. A → B : {Nb − 1}K 6. A → B : {Msg}K

hA, B, {A, K}Kbi.

(A, B; y). decrypt y as {A; k}Kb in . . .

Analysis of Needham-Schroeder

T ([hA, B, {A, K}Kbi]0) T ([(A, B, y). decrypt y as {A; k}Kb in]0) T ([hA, B, {A, K}Kbi]1) P = PA | PB | PS

P = [!P]0

a n a l y s i s ( T ( [ P ] ) ) | a n a l y s i s ( T ( [ P ]

1

) ) a n a l y s i s ( P )

T ([(A, B, y). decrypt y as {A; k}Kb in]1)

Session 1

Attacker CFA Result Extended LySa Standard LySa Protocol Narration

Dipartimento di Informatica - Università di Pisa

slide-17
SLIDE 17

Conclusion

  • Simply process calculus with

cryptographic primitives for modelling security protocols

  • Automatic algorithm for providing security

assurances for protocols

– Semantics correct and sound

  • Implementation has been used to validate

a number of protocols

Dipartimento di Informatica - Università di Pisa

slide-18
SLIDE 18

Thank You!

Dipartimento di Informatica - Università di Pisa

slide-19
SLIDE 19

The Control Flow Analysis

Dipartimento di Informatica - Università di Pisa

  • Over-approximate the protocol behaviour
  • The values of the variables
  • The messages flowing on the network
  • For example:

κ ⊆ P(V al∗) ρ : X → P(V al)

[N]1 ∈ ρ(x)

h[A]1, [B]1, [N]1i ∈ κ

slide-20
SLIDE 20

Judgement for Decryption

Attacker CFA Result Extended LySa Standard LySa Protocol Narration

evaluate terms evaluate key for all encrypted values pattern matching variable binding freshness checking analyse the rest

  • At each decryption point, check whether freshness may be violated

Dipartimento di Informatica - Università di Pisa

ρ | = E : ϑ ∧ E1 : ϑ1 ∧ ρ | = E0 : ϑ0 ∧ ∀[{v1, v2}v0]s ∈ ϑ : v0 ∝ ϑ0∧ v1 ∝ ϑ1 ⇒ v2 ∈ ρ(x2)∧ (I(v1) 6= I(E1) ⇒ l ∈ ψ) ∧ ρ, κ | = P : ψ ρ, κ | = decrypt E as {E1; x1}l

E0 in P : ψ

∝ : membership relation with session IDs ignored