Comparing State Spaces in Automatic Security Protocol Verification - - PowerPoint PPT Presentation

▶
comparing state spaces in automatic security protocol
SMART_READER_LITE
LIVE PREVIEW

Comparing State Spaces in Automatic Security Protocol Verification - - PowerPoint PPT Presentation

Jul 22, 2023 376 likes •833 views

Comparing State Spaces in Automatic Security Protocol Verification Comparing State Spaces in Automatic Security Protocol Verification Pascal Lafourcade & Cas Cremers Comparing State Spaces in Automatic Security Protocol Verification

slide-1
SLIDE 1

Comparing State Spaces in Automatic Security Protocol Verification

Comparing State Spaces in Automatic Security Protocol Verification

Pascal Lafourcade & Cas Cremers

slide-2
SLIDE 2

Comparing State Spaces in Automatic Security Protocol Verification Motivations

Cryptographic Protocols

slide-3
SLIDE 3

Comparing State Spaces in Automatic Security Protocol Verification Motivations

Cryptographic Protocols

slide-4
SLIDE 4

Comparing State Spaces in Automatic Security Protocol Verification Motivations

Cryptographic Protocols

slide-5
SLIDE 5

Comparing State Spaces in Automatic Security Protocol Verification Motivations

Information Security Everywhere

  • The world is distributed and based
  • n networked information systems.
  • Protocols essential to developing

networked services and new applications. Security errors in protocol design are costly

slide-6
SLIDE 6

Comparing State Spaces in Automatic Security Protocol Verification Motivations

Example: Needham-Schroeder Protocol 1978

slide-7
SLIDE 7

Comparing State Spaces in Automatic Security Protocol Verification Motivations

Example: Needham-Schroeder Protocol 1978

slide-8
SLIDE 8

Comparing State Spaces in Automatic Security Protocol Verification Motivations

Example: Needham-Schroeder Protocol 1978

slide-9
SLIDE 9

Comparing State Spaces in Automatic Security Protocol Verification Motivations

Example: Needham-Schroeder Protocol 1978

{NA, A}KB {NA, NB}KA {NB}KB

slide-10
SLIDE 10

Comparing State Spaces in Automatic Security Protocol Verification Motivations

Example: Needham-Schroeder Protocol 1978

{NA, A}KB {NA, NB}KA {NB}KB

slide-11
SLIDE 11

Comparing State Spaces in Automatic Security Protocol Verification Motivations

Lowe Attack on the Needham-Schroeder

so-called “Man in the middle attack”

slide-12
SLIDE 12

Comparing State Spaces in Automatic Security Protocol Verification Motivations

Lowe Attack on the Needham-Schroeder

so-called “Man in the middle attack”

slide-13
SLIDE 13

Comparing State Spaces in Automatic Security Protocol Verification Motivations

Lowe Attack on the Needham-Schroeder

so-called “Man in the middle attack”

slide-14
SLIDE 14

Comparing State Spaces in Automatic Security Protocol Verification Motivations

Lowe Attack on the Needham-Schroeder

so-called “Man in the middle attack”

slide-15
SLIDE 15

Comparing State Spaces in Automatic Security Protocol Verification Motivations

Lowe Attack on the Needham-Schroeder

so-called “Man in the middle attack”

slide-16
SLIDE 16

Comparing State Spaces in Automatic Security Protocol Verification Motivations

Lowe Attack on the Needham-Schroeder

so-called “Man in the middle attack”

slide-17
SLIDE 17

Comparing State Spaces in Automatic Security Protocol Verification Motivations

Lowe Attack on the Needham-Schroeder

so-called “Man in the middle attack”

slide-18
SLIDE 18

Comparing State Spaces in Automatic Security Protocol Verification Motivations

Necessity of Tools

  • Protocols are small recipes.
  • Non trivial to design and understand.
  • The number and size of new protocols.
  • Out-pacing human ability to rigourously

analyze them. GOAL : A tool is finding flaws or establishing their correctness.

  • completely automated,
slide-19
SLIDE 19

Comparing State Spaces in Automatic Security Protocol Verification Motivations

How can we compare all these tools “fairly”?

State of the art

  • Time performence comparison of

AVISPA Tools

  • L. Vigano “Automated Security Protocol

Analysis With the AVISPA Tool” ENTCS 2006.

  • Usability comparison between AVISPA
slide-20
SLIDE 20

Comparing State Spaces in Automatic Security Protocol Verification Motivations

Outline

1 Motivations 2 State Spaces

Notations Results

3 Settings

Tools Protocols and PC

slide-21
SLIDE 21

Comparing State Spaces in Automatic Security Protocol Verification State Spaces

Outline

1 Motivations 2 State Spaces

Notations Results

3 Settings

Tools Protocols and PC

slide-22
SLIDE 22

Comparing State Spaces in Automatic Security Protocol Verification State Spaces Notations

Terminology

  • A run is a single (possibly partial) instance
  • f a role, performed by an agent.
  • A run description of a protocol with |R|

roles is a set of roles. An element of a run description is of the form r(a1, a2, . . . , a|R|), where r denotes the role that the run is performing.

  • A Scenario is a multiset of run
slide-23
SLIDE 23

Comparing State Spaces in Automatic Security Protocol Verification State Spaces Notations

Definitions and Properties (I)

Let n be an integer, and let s be a scenario.

  • Traces is the set of all traces (possible

executions of the protocol) of any length, and any combination of agents.

  • MaxRuns(n) is the set of traces with at

most n runs. ∀n ∈ N : MaxRuns(n) ⊂ Traces (1)

slide-24
SLIDE 24

Comparing State Spaces in Automatic Security Protocol Verification State Spaces Results

Definitions and Properties (II)

  • RepScen(s) is the set of traces built only

with runs that are present in s. The runs defined by the scenario s can be executed any number of times. In other words, each run in each trace corresponds to an element of s.

slide-25
SLIDE 25

Comparing State Spaces in Automatic Security Protocol Verification State Spaces Results

Number of Agents

According to [Comon & Cortier 2004]

  • Only a single dishonest (compromised)

agent e, is enough.

  • For the verification of secrecy, only a single

honest agent a is sufficient.

  • For the verification of authentication, we
slide-26
SLIDE 26

Comparing State Spaces in Automatic Security Protocol Verification State Spaces Results

Minimal Number of Scenarios

With 2 agents and 1 intruder for X(a1, . . . , a|R|), we get |R| ∗ 2 ∗ 3(|R|−1) different possible run descriptions. Now we choose a multiset of n run descriptions: |R| ∗ 2 ∗ 3(|R|−1) + n − 1 n

slide-27
SLIDE 27

Comparing State Spaces in Automatic Security Protocol Verification State Spaces Results

Using Burnside Lemma

  • {a → a, b → b} (the trivial renaming)
  • {a → b, b → a}

We get k(n, |R|) = 2∗|R|∗3(|R|−1)+n−1

n

  • + ǫn

|R|∗3(|R|−1)+ n

2 −1 n 2

  • 2
slide-28
SLIDE 28

Comparing State Spaces in Automatic Security Protocol Verification Settings

Outline

1 Motivations 2 State Spaces

Notations Results

3 Settings

Tools Protocols and PC

slide-29
SLIDE 29

Comparing State Spaces in Automatic Security Protocol Verification Settings Tools

6 Tools Compared

  • Avispa :

OFMC: On-the-fly Model-Checker employs several symbolic techniques to explore the state space in a demand-driven way. CL-AtSe: Constraint-Logic-based Attack Searcher applies constraint solving with simplification heuristics and redundancy elimination techniques. SATMC: SAT-based Model-Checker builds a propositional formula encoding all the

slide-30
SLIDE 30

Comparing State Spaces in Automatic Security Protocol Verification Settings Protocols and PC

4 Protocols analyzed

  • Needham-Schroeder
  • Needham-Schroeder Lowe
  • EKE: Encrypted Key Exchange (using

symetric and asymetric encryption)

  • TLS: Transport Layer Security (larger

protocol)

slide-31
SLIDE 31

Comparing State Spaces in Automatic Security Protocol Verification Settings Protocols and PC

EKE

  • 0. A->B: {Ea}_Kab

| Key exchange part

  • 1. B->A: {{K}_Ea}_Kab

|

  • 2. A->B: {Ca}_K

|

  • 3. B->A: {Ca,Cb}_K

| Challenge/Response

  • 4. A->B: {Cb}_K

| Authentication part TLS

  • 0. A->B: A, Na, Sid, Pa

| Pa is a cryptosuite offer

  • 1. B->A: Nb, Sid, Pb

| Pb is B’s counteroffer

slide-32
SLIDE 32

Comparing State Spaces in Automatic Security Protocol Verification Results

Outline

1 Motivations 2 State Spaces

Notations Results

3 Settings

Tools Protocols and PC

slide-33
SLIDE 33

Comparing State Spaces in Automatic Security Protocol Verification Results Secrecy

slide-34
SLIDE 34

Comparing State Spaces in Automatic Security Protocol Verification Results Secrecy 10 100 1000 Needham-Schroeder-Lowe : secrecy of na and nb for A,B time (s) Casper/FDR CL-Atse OFMC ProVerif Sat-MC Scyther TA4SP

slide-35
SLIDE 35

Comparing State Spaces in Automatic Security Protocol Verification Results Secrecy 10 100 1000 timeout EKE : secrecy of k for A,B time (s) Casper/FDR CL-Atse OFMC ProVerif Sat-MC Scyther TA4SP

slide-36
SLIDE 36

Comparing State Spaces in Automatic Security Protocol Verification Results Secrecy 10 100 1000 timeout TLS : secrecy of ck and sk for A,B time (s) CL-Atse OFMC ProVerif Sat-MC Scyther TA4SP

slide-37
SLIDE 37

Comparing State Spaces in Automatic Security Protocol Verification Results Authentication 10 100 1000 timeout Needham-Schroeder : authentication of A,B time (s) Casper/FDR CL-Atse OFMC ProVerif Sat-MC Scyther

slide-38
SLIDE 38

Comparing State Spaces in Automatic Security Protocol Verification Results Authentication 10 100 1000 timeout Needham-Schroeder-Lowe : authentication of A,B time (s) Casper/FDR CL-Atse OFMC ProVerif Sat-MC Scyther

slide-39
SLIDE 39

Comparing State Spaces in Automatic Security Protocol Verification Results Authentication 10 100 1000 timeout EKE : authentication of A,B time (s) Casper/FDR CL-Atse OFMC ProVerif Sat-MC Scyther

slide-40
SLIDE 40

Comparing State Spaces in Automatic Security Protocol Verification Results Authentication 10 100 1000 timeout TLS : authentication of A,B time (s) CL-Atse OFMC Sat-MC Scyther

slide-41
SLIDE 41

Comparing State Spaces in Automatic Security Protocol Verification Conclusion & Perspective

Outline

1 Motivations 2 State Spaces

Notations Results

3 Settings

Tools Protocols and PC

slide-42
SLIDE 42

Comparing State Spaces in Automatic Security Protocol Verification Conclusion & Perspective

Conclusion

  • Automatic verification is necessary.
  • Tool are very helpful for design and

verification.

  • Use your favorite tool.
  • Modeling of a protocol is quite tricky.
  • Know the limitations of the tool and what

you are checking.

slide-43
SLIDE 43

Comparing State Spaces in Automatic Security Protocol Verification Conclusion & Perspective

slide-44
SLIDE 44

Comparing State Spaces in Automatic Security Protocol Verification Conclusion & Perspective

slide-45
SLIDE 45

Comparing State Spaces in Automatic Security Protocol Verification Conclusion & Perspective

Thank you for your attention. Questions ?