Automatic Security Analyses of Network Protocols with Tamarin-Prover - PowerPoint PPT Presentation

1/18 Automatic Security Analyses of Network Protocols with Tamarin-Prover Introductory Talk Eike Stadtländer May 17, 2018

2/18 Outline Motivation Tamarin-Prover Overview Language and Environment State Demo Goals for the Lab

. ⌢ 3/18 The Thing with Proofs Consider the following “proof”: i i i i i Thus, clearly Lesson: It is easy to make subtle mistakes in proofs which makes them diffjcult to verify.

. ⌢ 3/18 The Thing with Proofs Consider the following “proof”: i i i i i Thus, clearly Lesson: It is easy to make subtle mistakes in proofs which makes them diffjcult to verify.

. ⌢ 3/18 The Thing with Proofs Consider the following “proof”: i i i i i Thus, clearly Lesson: It is easy to make subtle mistakes in proofs which makes them diffjcult to verify. − 1 1 = 1 − 1

. ⌢ 3/18 i It is easy to make subtle mistakes in proofs which makes them Lesson: Thus, clearly i i i i diffjcult to verify. The Thing with Proofs Consider the following “proof”: √ √ − 1 1 = 1 − 1 1 1 = − 1 ⇒ − 1

. ⌢ 3/18 The Thing with Proofs It is easy to make subtle mistakes in proofs which makes them Lesson: Thus, clearly i i i i i diffjcult to verify. Consider the following “proof”: √ √− 1 √ √ − 1 1 = 1 − 1 1 1 1 = 1 = √ √− 1 − 1 ⇒ − 1 ⇒

. ⌢ 3/18 The Thing with Proofs It is easy to make subtle mistakes in proofs which makes them Lesson: Thus, clearly i i i i diffjcult to verify. Consider the following “proof”: √ √− 1 √ √ − 1 1 = 1 − 1 1 1 1 = 1 1 = 1 = √− 1 ⇒ i √ − 1 ⇒ − 1 ⇒

. ⌢ 3/18 The Thing with Proofs It is easy to make subtle mistakes in proofs which makes them Lesson: Thus, clearly i diffjcult to verify. Consider the following “proof”: √ √− 1 √ √ − 1 1 = 1 − 1 1 1 1 = 1 1 = 1 = √− 1 ⇒ i √ − 1 ⇒ − 1 ⇒ ⇒ − 1 = i 2 = i i = 1

3/18 The Thing with Proofs It is easy to make subtle mistakes in proofs which makes them Lesson: ⌢ i diffjcult to verify. Consider the following “proof”: √ √− 1 √ √ − 1 1 = 1 − 1 1 1 1 = 1 1 = 1 = √− 1 ⇒ i √ − 1 ⇒ − 1 ⇒ ⇒ − 1 = i 2 = i i = 1 Thus, clearly − 1 = 1 .

3/18 The Thing with Proofs It is easy to make subtle mistakes in proofs which makes them Lesson: i diffjcult to verify. Consider the following “proof”: √ √− 1 √ √ − 1 1 = 1 − 1 1 1 1 = 1 1 = 1 = √− 1 ⇒ i √ − 1 ⇒ − 1 ⇒ ⇒ − 1 = i 2 = i i = 1 Thus, clearly − 1 = 1 . ⌢

3/18 The Thing with Proofs It is easy to make subtle mistakes in proofs which makes them Lesson: i diffjcult to verify. Consider the following “proof”: √ √− 1 √ √ − 1 1 = 1 − 1 1 1 1 = 1 1 = 1 = √− 1 ⇒ i √ − 1 ⇒ − 1 ⇒ ⇒ − 1 = i 2 = i i = 1 Thus, clearly − 1 = 1 . ⌢

3/18 The Thing with Proofs It is easy to make subtle mistakes in proofs which makes them Lesson: i diffjcult to verify for humans , at least. Consider the following “proof”: √ √− 1 √ √ − 1 1 = 1 − 1 1 1 1 = 1 1 = 1 = √− 1 ⇒ i √ − 1 ⇒ − 1 ⇒ ⇒ − 1 = i 2 = i i = 1 Thus, clearly − 1 = 1 . ⌢

• “In our opinion, many proofs in cryptography have become • “We generate more proofs than we carefully verify (and as a 4/18 Experts on Security Proofs 1 essentially unverifjable. Our fjeld may be approaching a crisis of rigor. [...] game-playing may play a role in the answer.” Bellare and Rogaway 2004 consequence some of our published proofs are incorrect).” Halevi 2005 1 Slide inspired by Barthe (2014)

• “We generate more proofs than we carefully verify (and as a 4/18 Experts on Security Proofs 1 essentially unverifjable. Our fjeld may be approaching a crisis of rigor. [...] game-playing may play a role in the answer.” Bellare and Rogaway 2004 consequence some of our published proofs are incorrect).” Halevi 2005 1 Slide inspired by Barthe (2014) • “In our opinion, many proofs in cryptography have become

4/18 Experts on Security Proofs 1 essentially unverifjable. Our fjeld may be approaching a crisis of rigor. [...] game-playing may play a role in the answer.” Bellare and Rogaway 2004 consequence some of our published proofs are incorrect).” Halevi 2005 1 Slide inspired by Barthe (2014) • “In our opinion, many proofs in cryptography have become • “We generate more proofs than we carefully verify (and as a

• can verify a proof • can complete a partial proof • can fjnd a proof • can fjnd counter examples for disproof 5/18 The Cryptographer’s Wish List Wouldn’t it be great if we had a machine that of statements or security properties for a given protocol. Goal : Extensible framework for plug-and-play security.

• can complete a partial proof • can fjnd a proof • can fjnd counter examples for disproof 5/18 The Cryptographer’s Wish List Wouldn’t it be great if we had a machine that of statements or security properties for a given protocol. Goal : Extensible framework for plug-and-play security. • can verify a proof

• can fjnd a proof • can fjnd counter examples for disproof 5/18 The Cryptographer’s Wish List Wouldn’t it be great if we had a machine that of statements or security properties for a given protocol. Goal : Extensible framework for plug-and-play security. • can verify a proof • can complete a partial proof

• can fjnd counter examples for disproof 5/18 The Cryptographer’s Wish List Wouldn’t it be great if we had a machine that of statements or security properties for a given protocol. Goal : Extensible framework for plug-and-play security. • can verify a proof • can complete a partial proof • can fjnd a proof

5/18 The Cryptographer’s Wish List Wouldn’t it be great if we had a machine that of statements or security properties for a given protocol. Goal : Extensible framework for plug-and-play security. • can verify a proof • can complete a partial proof • can fjnd a proof • can fjnd counter examples for disproof

5/18 The Cryptographer’s Wish List Wouldn’t it be great if we had a machine that of statements or security properties for a given protocol. Goal : Extensible framework for plug-and-play security. • can verify a proof • can complete a partial proof • can fjnd a proof • can fjnd counter examples for disproof

• based on homotopy type theory • Univalent Foundations of Mathematics, Vladimir Voevodsky • e.g. “Proving the TLS Handshake Secure (as it is)” • based on constraint logic • symbolic analysis • e.g. “A Comprehensive Symbolic Analysis of TLS 1.3” • Mathematics: Coq • ProVerif, CryptoVerif, ... • EasyCrypt • Tamarin-Prover 6/18 Automatic Provers - A Status Quo (Bhargavan et al. 2014) (Cremers et al. 2017) Our Goal : Analyse IPSec protocol using automatic provers

• e.g. “Proving the TLS Handshake Secure (as it is)” • based on constraint logic • symbolic analysis • e.g. “A Comprehensive Symbolic Analysis of TLS 1.3” • based on homotopy type theory • Univalent Foundations of Mathematics, Vladimir Voevodsky • ProVerif, CryptoVerif, ... • EasyCrypt • Tamarin-Prover 6/18 Automatic Provers - A Status Quo (Bhargavan et al. 2014) (Cremers et al. 2017) Our Goal : Analyse IPSec protocol using automatic provers • Mathematics: Coq

• e.g. “Proving the TLS Handshake Secure (as it is)” • based on constraint logic • symbolic analysis • e.g. “A Comprehensive Symbolic Analysis of TLS 1.3” • Univalent Foundations of Mathematics, Vladimir Voevodsky • ProVerif, CryptoVerif, ... • EasyCrypt • Tamarin-Prover 6/18 Automatic Provers - A Status Quo (Bhargavan et al. 2014) (Cremers et al. 2017) Our Goal : Analyse IPSec protocol using automatic provers • Mathematics: Coq • based on homotopy type theory

• e.g. “Proving the TLS Handshake Secure (as it is)” • based on constraint logic • symbolic analysis • e.g. “A Comprehensive Symbolic Analysis of TLS 1.3” • ProVerif, CryptoVerif, ... • EasyCrypt • Tamarin-Prover 6/18 Automatic Provers - A Status Quo (Bhargavan et al. 2014) (Cremers et al. 2017) Our Goal : Analyse IPSec protocol using automatic provers • Mathematics: Coq • based on homotopy type theory • Univalent Foundations of Mathematics, Vladimir Voevodsky

• e.g. “Proving the TLS Handshake Secure (as it is)” • based on constraint logic • symbolic analysis • e.g. “A Comprehensive Symbolic Analysis of TLS 1.3” • EasyCrypt • Tamarin-Prover 6/18 Automatic Provers - A Status Quo (Bhargavan et al. 2014) (Cremers et al. 2017) Our Goal : Analyse IPSec protocol using automatic provers • Mathematics: Coq • based on homotopy type theory • Univalent Foundations of Mathematics, Vladimir Voevodsky • ProVerif, CryptoVerif, ...

• based on constraint logic • symbolic analysis • e.g. “A Comprehensive Symbolic Analysis of TLS 1.3” • e.g. “Proving the TLS Handshake Secure (as it is)” • Tamarin-Prover 6/18 Automatic Provers - A Status Quo (Bhargavan et al. 2014) (Cremers et al. 2017) Our Goal : Analyse IPSec protocol using automatic provers • Mathematics: Coq • based on homotopy type theory • Univalent Foundations of Mathematics, Vladimir Voevodsky • ProVerif, CryptoVerif, ... • EasyCrypt