Expressing Type-Flaw Attacks in a Strongly Typed Language Iliano - - PowerPoint PPT Presentation

▶
expressing type flaw attacks in a strongly typed language
SMART_READER_LITE
LIVE PREVIEW

Expressing Type-Flaw Attacks in a Strongly Typed Language Iliano - - PowerPoint PPT Presentation

Nov 07, 2022 428 likes •892 views

Expressing Type-Flaw Attacks in a Strongly Typed Language Iliano Cervesato iliano@itd.nrl.navy.mil ITT Industries, Inc @ NRL Washington DC http://www.cs.stanford.edu/~iliano/ 2 nd International Workshop on Foundations for

slide-1
SLIDE 1

Tokyo, October 27th, 2001 2nd International Workshop on Foundations for Secure/Survivable Systems and Networks

Expressing Type-Flaw Attacks in a Strongly Typed Language

Iliano Cervesato

iliano@itd.nrl.navy.mil

ITT Industries, Inc @ NRL – Washington DC

http://www.cs.stanford.edu/~iliano/

slide-2
SLIDE 2

Expressing Type-Flaw Attacks in a Strongly Typed Language

2

Outline

  • Type-confusion attacks
  • Type-Flaw Attacks in MSR
  • Simulation with Dolev-Yao Intruder

Work in progress Work in progress

MSR 2.0 Type flaws Simulation

Example Positions Contribution Example Typing DAS Execution Intruder Type flaws Big steps Type flaws DY Intruder

slide-3
SLIDE 3

Expressing Type-Flaw Attacks in a Strongly Typed Language

3

Type-Flaw Attacks

  • Functionalities seen as “types”
  • Names
  • Nonces
  • Keys, …
  • Violation
  • Principal misinterprets data
  • Type flaw/confusion attack
  • Intruder manipulates message
  • Principal led to misuse data

MSR 2.0 Type flaws Simulation

Example Positions Contribution

slide-4
SLIDE 4

Expressing Type-Flaw Attacks in a Strongly Typed Language

4

Example: NSL

[Millen]

A → B: {A, nA }kB B → A: {nA , nB , B}kA A → B: {nB }kB

A I B

{I, nB , B}kA {A, I}kB Confusion 1:

name/nonce

{nB ,B, nA , A}kI {I, nB ,B}kA Confusion 2:

pair/nonce

{nB }kB B is fooled!

“Unlikely type violation”

Type flaws

Example Positions Contribution

MSR 2.0 Simulation

slide-5
SLIDE 5

Expressing Type-Flaw Attacks in a Strongly Typed Language

5

Advocates

Type-flaw attacks are serious threats

  • Push type-free specifications
  • Catch all “normal”

attacks

  • …

and type-confusion attacks too

  • Types are not real!

Example Positions

Type flaws

Contribution

MSR 2.0 Simulation

slide-6
SLIDE 6

Expressing Type-Flaw Attacks in a Strongly Typed Language

6

Opponents

Most type-flaw attacks are unrealistic

  • Push typed specification languages
  • Catch “real”

attacks

  • Types guide search 

fast

  • Type-flaw attacks too low-level anyway

Positions

Type flaws

Example Contribution

MSR 2.0 Simulation

slide-7
SLIDE 7

Expressing Type-Flaw Attacks in a Strongly Typed Language

7

Desired World

  • Prog. Languages vs. Security
  • Types in

programming languages

  • Types in

security

Positions

Type flaws

Example Contribution

MSR 2.0 Simulation

Whole Wild World Tolerated World Interesting World Exciting World Symbolic World Ugh!

slide-8
SLIDE 8

Expressing Type-Flaw Attacks in a Strongly Typed Language

8

… in Reality

Type discriminants

  • Data length
  • Redundancy
  • Explicit checks
  • Resolve many situations …
  • … but not all

“I so far found only one realistic type-flaw attack”

[Meadows]

Positions

Type flaws

Example Contribution

MSR 2.0 Simulation

slide-9
SLIDE 9

Expressing Type-Flaw Attacks in a Strongly Typed Language

9

Contribution

  • Reconcile
  • Typed languages
  • Type violations
  • User specifies confusable types
  • Flexible
  • Abstract
  • Support efficient simulation

Positions Contribution

Type flaws

Example

MSR 2.0 Simulation

slide-10
SLIDE 10

Expressing Type-Flaw Attacks in a Strongly Typed Language

10

MSR

  • Follows the Dolev-Yao abstraction
  • Based on
  • Multiset rewriting, linear logic, type theory
  • Used to prove
  • Undecidability of protocol verification
  • Completeness of Dolev-Yao intruder
  • Related to
  • strands
  • CIL
  • spi-calculus, …

MSR 2.0 Type flaws Simulation

Example Typing DAS Execution Intruder Type flaws

slide-11
SLIDE 11

Expressing Type-Flaw Attacks in a Strongly Typed Language

11

What’s in MSR 2.0 ?

  • Multiset rewriting with existentials
  • Dependent types w/ subsorting
  • Memory predicates
  • Constraints

New New New

MSR 2.0 Type flaws Simulation

Example Typing DAS Execution Intruder Type flaws

slide-12
SLIDE 12

Expressing Type-Flaw Attacks in a Strongly Typed Language

12

The Dolev-Yao Model of Security

  • Found in most protocol analysis tools
  • Tractability
  • Black-box cryptography
  • No guessing of keys
  • Partially abstract data access
  • Knowledge soup

a ka kb s

MSR 2.0 Type flaws Simulation

Example Typing DAS Execution Intruder Type flaws

ka

  • No bits

01001011010…

  • Symbolic data
slide-13
SLIDE 13

Expressing Type-Flaw Attacks in a Strongly Typed Language

13

Roles

  • Generic

roles

  • Anchored

roles

∃y:τ’. ∀x:τ. lhs → rhs

… … …

∃y:τ’. ∀x:τ. lhs → rhs

∃L: τ’1

(x1)

x … x τ’n

(xn)

…

Role state pred.

  • var. declarations

∀A

Role

  • wner

∃L: τ’1

(x

1) x … x τ’n

(xn)

…

A

Role

  • wner

∃y:τ’. ∀x:τ. lhs → rhs

… … …

∃y:τ’. ∀x:τ. lhs → rhs

MSR 2.0 Type flaws Simulation

Example Typing DAS Execution Intruder Type flaws

slide-14
SLIDE 14

Expressing Type-Flaw Attacks in a Strongly Typed Language

14

Rules

∃y1 : τ’1 . … ∃yn’ : τ’n’ . ∀x1 : τ1 . … ∀xn : τn . lhs → rhs

  • N(t)

Network

  • L(t, …, t)

Local state

  • MA

(t, …, t) Memory

  • χ

Constraints

  • N(t)

Network

  • L(t, …, t)

Local state

  • MA

(t, …, t) Memory

MSR 2.0 Type flaws Simulation

Example Typing DAS Execution Intruder Type flaws

slide-15
SLIDE 15

Expressing Type-Flaw Attacks in a Strongly Typed Language

15

NSL Initiator

∀A

∀B: princ ∀kB: pubK B

  • →

∃nA :nonce.

L(A,B,kB ,nA )

N({A, nA

}kB )

∀ … ∀kA: pubK A ∀

k’A: privK kA

∀nA,nB: nonce

L(A,B,kB ,nA )

N({nA

,nB ,B}kA ) →

N({nB

}kB )

∃L: princ x princ(B) x pubK B x nonce. A → B: {A, nA }kB B → A: {nA , nB, B}kA A → B: {nB }kB

MSR 2.0 Type flaws Simulation

Example Typing DAS Execution Intruder Type flaws

slide-16
SLIDE 16

Expressing Type-Flaw Attacks in a Strongly Typed Language

16

NSL Responder

∀B

∀kB: pubK B ∀k’B: privK

kB

∀A: princ ∀nA: nonce ∀kA: pubK A

N({A,nA

}kB ) → ∃nB

:nonce. L(B,kB

,k’B ,nB )

N({nA

,nB ,B}kA )

∀ … ∀nB: nonce

L(B,kB ,k’B ,nB )

N({nB

}kB ) →

  • ∃L:

princ(B) x pubK B(kB) x privK kB x nonce. A → B: {A, nA }kB B → A: {nA , nB, B}kA A → B: {nB }kB

MSR 2.0 Type flaws Simulation

Example Typing DAS Execution Intruder Type flaws

slide-17
SLIDE 17

Expressing Type-Flaw Attacks in a Strongly Typed Language

17

Types of Terms

  • A:

princ

  • n: nonce
  • k:

shK A B

  • k:

pubK A

  • k’: privK k
  • …

(definable)

  • A:

princ

  • n: nonce
  • A:

princ

  • n: nonce
  • k:

shK A B

  • k:

pubK A

  • k’: privK k

Types can depend

  • n term
  • Captures relations

between objects

MSR 2.0 Type flaws Simulation

Example Typing DAS Execution Intruder Type flaws

slide-18
SLIDE 18

Expressing Type-Flaw Attacks in a Strongly Typed Language

18

Subtyping

  • Allows atomic terms in messages
  • Definable
  • Non-transmittable terms
  • Sub-hierarchies

princ :: msg nonce :: msg pubK A :: msg

MSR 2.0 Type flaws Simulation

Example Typing DAS Execution Intruder Type flaws

slide-19
SLIDE 19

Expressing Type-Flaw Attacks in a Strongly Typed Language

20

  • Transmission of a long term key
  • Catches:
  • Encryption with a nonce

Type Checking

Σ |— P Γ |— t : τ

P is well- typed in Σ t has type τ in Γ

  • Decidable
  • Circular key hierarchies, …
  • Static

and dynamic uses

New

MSR 2.0 Type flaws Simulation

Example Typing DAS Execution Intruder Type flaws

slide-20
SLIDE 20

Expressing Type-Flaw Attacks in a Strongly Typed Language

21

Data Access Specification

  • Catches
  • A

signing/encrypting with B’s key

Σ ‖— P Γ ‖—A r

P is DAS- valid in Σ r is DAS-valid for A in Γ

  • A

accessing B’s private data, …

  • Static &

Decidable

New

  • Gives meaning to Dolev-Yao intruder
  • Completeness
  • Reconstructibility

MSR 2.0 Type flaws Simulation

Example Typing DAS Execution Intruder Type flaws

slide-21
SLIDE 21

Expressing Type-Flaw Attacks in a Strongly Typed Language

22

Configurations

C = [S]R

Σ

Active role set Signature

  • a : τ
  • Ll : τ
  • M_: τ

State

  • N(t)
  • Ll

(t, …, t)

  • MA

(t, …, t)

MSR 2.0 Type flaws Simulation

Example Typing DAS Execution Intruder Type flaws

slide-22
SLIDE 22

Expressing Type-Flaw Attacks in a Strongly Typed Language

23

Execution Model

  • Activate roles
  • Generates new role state pred. names
  • Instantiate variables
  • Apply rules
  • Skips rules

P  C → C’

1-step firing

MSR 2.0 Type flaws Simulation

Example Typing DAS Execution Intruder Type flaws

slide-23
SLIDE 23

Expressing Type-Flaw Attacks in a Strongly Typed Language

24

Variable Instantiation

Type checking guarantees proper usage

Σ |— t : τ [S]R (∀x:τ.r,ρ) A

Σ →

[S]R ([t/x]r,ρ)

A

Σ

MSR 2.0 Type flaws Simulation

Example Typing DAS Execution Intruder Type flaws

slide-24
SLIDE 24

Expressing Type-Flaw Attacks in a Strongly Typed Language

25

Rule Application

S, F

→ [S2 ]RρA

Σ, c:τ c not in S1

S, G(c)

[S1 ]R(r,ρ)A

Σ

  • Firing

r = F, χ → ∃n:τ. G(n)

  • Constraint check

Σ

|=

χ

(constraint handler)

MSR 2.0 Type flaws Simulation

Example Typing DAS Execution Intruder Type flaws

slide-25
SLIDE 25

Expressing Type-Flaw Attacks in a Strongly Typed Language

26

Execution with an Attacker

P, PI  C → C’

  • Selected principal(s):

I

  • Generic capabilities:

PI

  • Well-typed
  • DAS-valid
  • Modeled completely within MSR

MSR 2.0 Type flaws Simulation

Example Typing DAS Execution Intruder Type flaws

slide-26
SLIDE 26

Expressing Type-Flaw Attacks in a Strongly Typed Language

27

Expressing Type Violations ?

  • Impossible !

Σ |— t : τ [S]R (∀x:τ.r,ρ) A

Σ →

[S]R ([t/x]r,ρ)

A

Σ

Typing forces principal to play by the rules

MSR 2.0 Type flaws Simulation

Example Typing DAS Execution Intruder Type flaws

slide-27
SLIDE 27

Expressing Type-Flaw Attacks in a Strongly Typed Language

28

Expressing Type Violations !

Σ |—D t : τ [S]R (∀x:τ.r,ρ) A

Σ →

[S]R ([t/x]r,ρ)

A

Σ

How things should be

  • n paper

How things are in realty

Distinguish

  • Static

type-checking

  • Dynamic

type-checking

|—D

MSR 2.0 Type flaws Simulation

Example Typing DAS Execution Intruder Type flaws

slide-28
SLIDE 28

Expressing Type-Flaw Attacks in a Strongly Typed Language

29

Subtyping Revisited

  • Most rules have

a rigid format

Γ, a:τ, Γ’ |— a : τ

τ’

::

τ

Γ |— t :

τ’

Γ |— t :

τ

  • Subtyping

provides hook Extend subtyping with confusable types

MSR 2.0 Type flaws Simulation

Example Typing DAS Execution Intruder Type flaws

slide-29
SLIDE 29

Expressing Type-Flaw Attacks in a Strongly Typed Language

30

A First Solution

princ :: msg nonce :: msg pubK A :: msg

static

princ :: nonce msg :: nonce

dynamic extension

  • …

but very raw

  • not every msg

mistaken as a nonce

  • unwanted recursion
  • Works …

{I, nB , B}kA {nB ,B, nA , A}kI {A, I}kB {I, nB ,B}kA

MSR 2.0 Type flaws Simulation

Example Typing DAS Execution Intruder Type flaws

slide-30
SLIDE 30

Expressing Type-Flaw Attacks in a Strongly Typed Language

31

Towards a Polymorphic MSR

  • Fine grained
  • Captures what we want
  • Recursion is up to us

princ :: msg nonce :: msg pubK A :: msg pair α β :: msg nonce+ :: msg princ :: nonce+ nonce :: nonce+ pair princ nonce :: nonce+

Confusable nonces

pair : type -> type -> type. _,_ : α

  • > β
  • > pair α β.

MSR 2.0 Type flaws Simulation

Example Typing DAS Execution Intruder Type flaws

slide-31
SLIDE 31

Expressing Type-Flaw Attacks in a Strongly Typed Language

32

Summary

  • Type violation (attacks) expressible in MSR
  • Simple
  • Flexible
  • You decide confusable types
  • Shades of gray in black/white positions

Types are good

MSR 2.0 Type flaws Simulation

Example Typing DAS Execution Intruder Type flaws

slide-32
SLIDE 32

Expressing Type-Flaw Attacks in a Strongly Typed Language

33

Simulation

MSR 2.0 Type flaws Simulation

Big steps Type flaws DY Intruder

  • No attacker
  • Prototype
  • With attacker
  • Verification
  • Model checking
  • Theorem proving
  • Process equivalence
slide-33
SLIDE 33

Expressing Type-Flaw Attacks in a Strongly Typed Language

34

The Dolev-Yao Intruder

  • Intercept / emit messages
  • Decrypt / encrypt with known key
  • Split / form pairs
  • Look up public information
  • Generate fresh data

MSR 2.0 Type flaws Simulation

Big steps Type flaws DY Intruder

  • Found in most protocol analysis tools
  • Modeled completely within MSR
  • Generated automatically (mostly)
slide-34
SLIDE 34

Expressing Type-Flaw Attacks in a Strongly Typed Language

35

Intruder Simulation Approaches

  • Take protocol text into account?
  • Blind / Focused
  • Size of intruder steps
  • Small / Big
  • Intruder representation
  • Explicit / Implicit

MSR 2.0 Type flaws Simulation

Big steps Type flaws DY Intruder

slide-35
SLIDE 35

Expressing Type-Flaw Attacks in a Strongly Typed Language

36

Graphically…

small big blind focused

Strands MSR, … NPA Paulson spi CAPSL ? Casper ? Good for proving theorems

MSR

MSR 2.0 Type flaws Simulation

Big steps Type flaws DY Intruder

slide-36
SLIDE 36

Expressing Type-Flaw Attacks in a Strongly Typed Language

37

Intruder Activity

No need to remember No need to construct

MSR 2.0 Type flaws Simulation

Big steps Type flaws DY Intruder

slide-37
SLIDE 37

Expressing Type-Flaw Attacks in a Strongly Typed Language

38

Intruder Activity Comparison

Disassembly

  • Blind
  • Take pieces apart

until

  • Atomic
  • Key unavailable
  • Focused
  • Anticipate message

contents

  • Memorize only what

is needed

Assembly

  • Blind
  • Put pieces together

until meaningful message is built

  • Focused
  • Build only usable

messages

MSR 2.0 Type flaws Simulation

Big steps Type flaws DY Intruder

slide-38
SLIDE 38

Expressing Type-Flaw Attacks in a Strongly Typed Language

39

Big-Step Message Disassembly

  • Take typing derivation of

(incoming) messages

  • Encryption defines

regions

  • 1 role for each message
  • 1 rule for each region
  • Interface rule

Γ |— t :

τ

MSR 2.0 Type flaws Simulation

Big steps Type flaws DY Intruder

slide-39
SLIDE 39

Expressing Type-Flaw Attacks in a Strongly Typed Language

40

NSL – 1st Message

  • MI

(m) “forgotten” as soon as k’B is known

A → B: {A, nA }kB B → A: {nA , nB, B}kA A → B: {nB }kB

I

∀m: msg

→ L(I,m) MI (m)

∀

A: princ

∀kB: pubK B ∀k’B: privK kB ∀nA: nonce

L(I, {A, nA }kB ) MI ({A, nA }kB ) MI (k’B ) → MI (A) MI (nA ) MI (k’B )

∃L: princ x msg.

N(m)

  • Special case if k’B

known right away

MSR 2.0 Type flaws Simulation

Big steps Type flaws DY Intruder

slide-40
SLIDE 40

Expressing Type-Flaw Attacks in a Strongly Typed Language

41

Big-Step Message Assembly

  • Take typing derivation of

(outgoing) messages

  • Encryption defines regions
  • 1 role for each region
  • Extras for generated data

Γ |— t :

τ

MSR 2.0 Type flaws Simulation

Big steps Type flaws DY Intruder

slide-41
SLIDE 41

Expressing Type-Flaw Attacks in a Strongly Typed Language

42

NSL – 1st Message

A → B: {A, nA }kB B → A: {nA , nB, B}kA A → B: {nB }kB

What about confusable types ?

∀m: msg

→ N(m) MI (m)

I I

∀A,B: princ ∀kB: pubK B ∀nA: nonce

N({A, nA }kB ) MI (A),MI (nA ),MI (kB ) → MI (A) MI (nA ) MI (kB )

I

∀A,B: princ ∀kB: pubK B

∃nA :nonce. N({A, nA }kB ) MI (A),MI (nA ),MI (kB ) → MI (A) MI (kB )

MSR 2.0 Type flaws Simulation

Big steps Type flaws DY Intruder

slide-42
SLIDE 42

Expressing Type-Flaw Attacks in a Strongly Typed Language

43

Creating Confusion

  • Mark confusable objects
  • Add rules for each option

I

∀A,B: princ ∀kB : pubK B ∀n: nonce+

N({A, n}kB ) MI (A),MI (kB ) → L(I,n) MI (A) MI (kB )

∀C: princ ∀n: nonce

L(I, (C,n)) MI (C),MI (n) → MI (C) MI (n)

∀n: nonce

L(I, n), MI (n) → MI (n)

∀C: princ

L(I, C), MI (C) → MI (C)

∃L: princ x nonce+. + similar rule with ∃n:nonce

MSR 2.0 Type flaws Simulation

Big steps Type flaws DY Intruder

slide-43
SLIDE 43

Expressing Type-Flaw Attacks in a Strongly Typed Language

44

Making Sense of Confusion

I

∀

A: princ

∀kB : pubK B ∀k’B : privK kB ∀nA : nonce+

L(I, {A, nA }kB ) MI ({A, nA }kB ) MI (k’B ) → MI (A) L'(I,nA ) MI (k’B )

∃L: princ x msg. ∀m: msg

→ L(I,m) MI (m) N(m)

∀n: nonce

L'(I,n) → MI (n)

∀A: princ

L'(I,A) → MI (A)

∀A: princ ∀n: nonce

L'(I,(A,n)) → MI (A) MI (n)

∃L’: princ x nonce+.

MSR 2.0 Type flaws Simulation

Big steps Type flaws DY Intruder

slide-44
SLIDE 44

Expressing Type-Flaw Attacks in a Strongly Typed Language

45

Further Optimizations

  • Fold added rules in

(unless confusion type is recursive)

  • Type-check in static type system
  • Bigger steps
  • Simplify result using DAS rules
  • More compact
  • Formalizes “regions”
  • Automation

MSR 2.0 Type flaws Simulation

Big steps Type flaws DY Intruder

slide-45
SLIDE 45

Expressing Type-Flaw Attacks in a Strongly Typed Language

46

Future Work

  • Polymorphic MSR
  • Strategies

MSR 2.0 Type flaws Simulation