Automatic Proofs for Symmetric Encryption Modes e 2 Pascal - - PowerPoint PPT Presentation

▶

Sep 22, 2022 156 likes •404 views

Automatic Proofs for Symmetric Encryption Modes e 2 Pascal Lafourcade 1 Yassine Lakhnech 1 Martin Gagn Reihaneh Safavi-Naini 2 1 Universit e Grenoble 1, CNRS, Verimag , FRANCE 2 Department of Computer Science, University of Calgary, Canada

SLIDE 1

Automatic Proofs for Symmetric Encryption Modes

Martin Gagn´ e2 Pascal Lafourcade1 Yassine Lakhnech1 Reihaneh Safavi-Naini2

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE

2 Department of Computer Science, University of Calgary, Canada

ASIAN 2009, Seoul

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 1 / 1

SLIDE 2

Indistinguishability and Symmetric Encryption Modes

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 2 / 1

SLIDE 3

Indistinguishability and Symmetric Encryption Modes

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 2 / 1

SLIDE 4

Indistinguishability and Symmetric Encryption Modes

ECB CBC, OFB ...

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 2 / 1

SLIDE 5

Block Cipher Modes

PRP E → Encryption Mode → IND-CPA

NIST standard

Electronic Code Book (ECB) Cipher Block Chaining (CBC) Cipher FeedBack mode (CFB) Output FeedBack (OFB), and Counter mode (CTR).

Others

DMC,CBC-MAC, IACBC, IAPM, XCB ,TMAC, HCTR, HCH, EME, EME*, PEP, OMAC, TET, CMC, GCM, EAX, XEX, TAE, TCH, TBC, CCM, ABL4

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 3 / 1

SLIDE 6

Block Cipher Modes

Example

Cipher Block Chaining (CBC) Ci = E(Pi ⊕ Ci−1), C0 = IV

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 4 / 1

SLIDE 7

CBC and others

CBC CTR OFB CFB IV

$

← − U; IV

$

← − U; IV

$

← − U; IV

$

← − U; z1 := IV ⊕ m1; z1 := E(IV + 1); z1 := E(IV ); z1 := E(IV ); c1 := E(z1); c1 := m1 ⊕ z1; c1 := m1 ⊕ z1; c1 := m1 ⊕ z1; z2 := c1 ⊕ m2; z2 := E(IV + 2); z2 := E(z1); z2 := E(c1); c2 := E(z2); c2 := m2 ⊕ z2; c2 := m2 ⊕ z2; c2 := m2 ⊕ z2; z3 := c2 ⊕ m3; z3 := E(IV + 3); z3 := E(z2); z3 := E(c2); c3 := E(z3); c3 := m3 ⊕ z3; c3 := m3 ⊕ z3; c3 := m3 ⊕ z3;

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 5 / 1

SLIDE 8

Outline

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 6 / 1

SLIDE 9

How to prove an encryption mode is IND-CPA ?

Our Approach

Automated method for proving correctness of encryption mode: Language: Generic Encryption Mode Predicates: F, E, Indis, Rcounter Hoare logic : 20 rules

RESULT:

If a Generic Encryption Mode EM is correct according to our Hoare logic then EM is IND-CPA.

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 7 / 1

SLIDE 10

Grammar

c ::= x

$

← − U | x := E(y) | x := y ⊕ z | x := yz | x := y + 1 | c1; c2

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 8 / 1

SLIDE 11

Generic Encryption Mode

Definition

A generic encryption mode M is represented by EM(m1| . . . |mp, c0| . . . |cp) : var x; c ECBC(m1|m2|m3, IV |c1|c2|c3) : var z1, z2, z3; IV

$

← − U; z1 := IV ⊕ m1; c1 := E(z1); z2 := c1 ⊕ m2; c2 := E(z2); z3 := c2 ⊕ m3; c3 := E(z3);

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 9 / 1

SLIDE 12

Predicates

ψ ::= Indis(νx; V ) | F(e) | E(E, e) | Rcounter(e) ϕ ::= true | ϕ ∧ ϕ | ψ, Indis(νx; V ): The value of x is indistinguishable from a random value given the value of the variables in V . F(e): The value of e is indistinguishable from a random value that has not been used before. E(E, e): The probability that the value of e have been encrypted by E is negligible. RCounter(e): e is the most recent value of a monotone counter that started at a fresh random value.

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 10 / 1

SLIDE 13

How to generate E(E, x)?

Sampling a Random

(R1) {true} x

$

← − U {F(x) ∧ Indis(νx) ∧ E(E, x)}

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 11 / 1

SLIDE 14

How to generate E(E, x)?

Sampling a Random

(R1) {true} x

$

← − U {F(x) ∧ Indis(νx) ∧ E(E, x)}

PRP Encryption

(B1) {E(E, y)} x := E(y) {F(x) ∧ Indis(νx) ∧ E(E, x)}

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 11 / 1

SLIDE 15

How to generate E(E, x)?

Xor

(X4) {F(y)} x := y ⊕ z {E(E, x)} if y = z

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 12 / 1

SLIDE 16

How to generate E(E, x)?

Xor

(X4) {F(y)} x := y ⊕ z {E(E, x)} if y = z

Counter

(I1) {F(y)} x := y + 1 {RCounter(x) ∧ E(E, x)} (I2) {RCounter(y)} x := y + 1 {RCounter(x) ∧ E(E, x)}

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 12 / 1

SLIDE 17

20 Rules

x

$

← − U (R1) (R2) x = y||z (C1) (C2) x := y + 1 (I1) (I2) (I3) (G1) (G2) (G3) (G4) x := y ⊕ z (X1) (X2) (X3) (X4) x := E(y) (B1) (B2) (B3) (B4) (B5)

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 13 / 1

SLIDE 18

How to prove that a Generic Encryption Mode is IND-CPA?

Theorem

Let EM(m1| . . . |mp, c0| . . . |cp) : var x; c be a generic encryption mode, Then EM is IND-CPA secure, if {true}c i=p

i=0{Indis(νci; m1, . . . , mp, c0, . . . , cp)} is valid.

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 14 / 1

SLIDE 19

Example: CBC

ECBC(m1|m2|m3, IV |c1|c2|c3) var IV , z1, z2, z3; IV

← − U; Indis(νIV ; Var) ∧ F(IV ) (R1) z1 := IV ⊕ m1; Indis(νIV ; Var − z1) ∧ E(E, z1, IV ) (X2)(X4) c1 := E(z1); Indis(νIV ; Var − z1) (B2) ∧Indis(νc1; Var) ∧ F(c1) (B1) z2 := c1 ⊕ m2; Indis(νIV ; Var − z1) (G1) ∧Indis(νc1; Var − z2) ∧ E(E, z2) (X2)(X4) c2 := E(z2); Indis(νIV ; Var − z1) ∧ Indis(νc1; Var − z2) (B2) ∧Indis(νc2; Var) ∧ F(c2) (B1) z3 := c2 ⊕ m3; Indis(νIV ; Var − z1) ∧ Indis(νc1; Var − z2) (G1) ∧Indis(νc2; Var − z3) ∧ E(E, z3) (X2)(X4) c3 := E(z3); Indis(νIV ; Var − z1) ∧ Indis(νc1; Var − z2) (B2) ∧Indis(νc3; Var) ∧ Indis(νc2; Var − z3) (B1)

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 15 / 1

SLIDE 20

Prototype

Implementation of a backward analysis in 1000 lines of Ocaml.

Examples

CBC, FBC, OFB CFB are proved IND-CPA ECB and variants our tool fails: precondition is not true All examples are immediate (less than one second)

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 16 / 1

SLIDE 21

Summary

Generic Encryption Mode New predicats Hoare Logic for proving generic encryption mode IND-CPA Ocaml Prototype

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 17 / 1

SLIDE 22

Future Works

Hybrid encryption using LSFR (Dual Encryption Mode) using Hash function using mathematics (GMC) IND-CCA ? Desai 2000: New Paradigms for Constructing Symmetric Encryption Schemes Secure against Chosen-Ciphertext Attack Considering : For loops

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 18 / 1

SLIDE 23

Thank you for your attention Questions ?

Martin Gagn´ e, Pascal Lafourcade, Yassine Lakhnech, Reihaneh Safavi-Naini (

1 Universit´

e Grenoble 1, CNRS,Verimag, FRANCE,

2 Depa

Automatic Proofs for Symmetric Encryption Modes 19 / 1