Formal Verification of e-Auction protocols Jannik Dreier, Pascal - - PowerPoint PPT Presentation

▶
formal verification of e auction protocols
SMART_READER_LITE
LIVE PREVIEW

Formal Verification of e-Auction protocols Jannik Dreier, Pascal - - PowerPoint PPT Presentation

Sep 15, 2023 114 likes •808 views

Introduction Formal Definitions Case Studies Conclusion Formal Verification of e-Auction protocols Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Universit Grenoble 1, CNRS, VERIMAG firstname.lastname@imag.fr Principles of Security and

slide-1
SLIDE 1

Introduction Formal Definitions Case Studies Conclusion

Formal Verification of e-Auction protocols

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech

Université Grenoble 1, CNRS, VERIMAG firstname.lastname@imag.fr Principles of Security and Trust (POST) 2013, Rome

March 19, 2013

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-2
SLIDE 2

Introduction Formal Definitions Case Studies Conclusion

Plan

1 Introduction 2 Formal Definitions

Authentication Fairness Privacy

3 Case Studies

Curtis et al. Brandt

4 Conclusion

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-3
SLIDE 3

Introduction Formal Definitions Case Studies Conclusion

Plan

1 Introduction 2 Formal Definitions

Authentication Fairness Privacy

3 Case Studies

Curtis et al. Brandt

4 Conclusion

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-4
SLIDE 4

Introduction Formal Definitions Case Studies Conclusion

e-Auctions

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-5
SLIDE 5

Introduction Formal Definitions Case Studies Conclusion

Challenges in e-Auctions

Competing parties: Bidders/Buyers, Seller, Auctioneer, . . . Many possible (complex) mechanisms:

English Dutch Sealed Bid First Price Second Price Bulk Goods . . .

Here: Sealed Bid First Price auctions

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-6
SLIDE 6

Introduction Formal Definitions Case Studies Conclusion

e-Auctions: Security Requirements

Security Requirements

Non-Repudiation Fairness Non-Cancellation Verifiability Secrecy of Bidding Price Receipt-Freeness Anonymity of Bidders Coercion-Resistance

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-7
SLIDE 7

Introduction Formal Definitions Case Studies Conclusion Authentication Fairness Privacy

Plan

1 Introduction 2 Formal Definitions

Authentication Fairness Privacy

3 Case Studies

Curtis et al. Brandt

4 Conclusion

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-8
SLIDE 8

Introduction Formal Definitions Case Studies Conclusion Authentication Fairness Privacy

The Applied π-Calculus [AF01]

We use the Applied π-Calculus to model protocols: P, Q, R := processes null process P|Q parallel composition !P replication νn.P name restriction (“new”) if M = N then P else Q conditional in(u, x) message input

  • ut(u, x)

message output {M/x} substitution

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-9
SLIDE 9

Introduction Formal Definitions Case Studies Conclusion Authentication Fairness Privacy

Events

To express our properties, we use the following events: bid(p,id): a bidder id bids the price p recBid(p,id): a bid at price p by bidder id is recorded by the auctioneer/bulletin board/etc. won(p,id): a bidder id wins the auction at price p

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-10
SLIDE 10

Introduction Formal Definitions Case Studies Conclusion Authentication Fairness Privacy

Plan

1 Introduction 2 Formal Definitions

Authentication Fairness Privacy

3 Case Studies

Curtis et al. Brandt

4 Conclusion

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-11
SLIDE 11

Introduction Formal Definitions Case Studies Conclusion Authentication Fairness Privacy

Non-Repudiation

On every trace: bid(p,id) won(p,id)

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-12
SLIDE 12

Introduction Formal Definitions Case Studies Conclusion Authentication Fairness Privacy

Non-Cancellation

Alice Bob Bid bA

>

bB recBid(bA, Alice) Alice reveals data to intruder won(bB, Bob)

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-13
SLIDE 13

Introduction Formal Definitions Case Studies Conclusion Authentication Fairness Privacy

Plan

1 Introduction 2 Formal Definitions

Authentication Fairness Privacy

3 Case Studies

Curtis et al. Brandt

4 Conclusion

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-14
SLIDE 14

Introduction Formal Definitions Case Studies Conclusion Authentication Fairness Privacy

Strong Noninterference & Weak Noninterference

Definition (Strong Noninterference (SN)) An auction protocol ensures Strong Noninterference (SN) if for any two auction processes APA and APB that halt at the end of the bidding phase (i.e. where we remove all code after the last recBid event) we have APA ≈l APB. Definition (Weak Noninterference (WN)) Like Strong Noninterference, but we consider only processes with the same bidders.

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-15
SLIDE 15

Introduction Formal Definitions Case Studies Conclusion Authentication Fairness Privacy

Highest Price Wins

Alice Chuck (honest) (corrupted) Bid bA

>

bC bid(bA, Alice) won(bC, Chuck)

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-16
SLIDE 16

Introduction Formal Definitions Case Studies Conclusion Authentication Fairness Privacy

Plan

1 Introduction 2 Formal Definitions

Authentication Fairness Privacy

3 Case Studies

Curtis et al. Brandt

4 Conclusion

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-17
SLIDE 17

Introduction Formal Definitions Case Studies Conclusion Authentication Fairness Privacy

Strong Bidding-Price Secrecy (SBPS) [DJP10]

Main idea: Observational equivalence between two situations. Alice Carol Bid

≈l

Bid

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-18
SLIDE 18

Introduction Formal Definitions Case Studies Conclusion Authentication Fairness Privacy

Bidding-Price Unlinkability (BPU)

The list of bids can be public, but must be unlinkable to the bidders. Alice Bob Carol Bid

≈l

Bid

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-19
SLIDE 19

Introduction Formal Definitions Case Studies Conclusion Authentication Fairness Privacy

Strong Anonymity (SA)

The winner may stay anonymous. Alice Carol Bid

≈l

Bid

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-20
SLIDE 20

Introduction Formal Definitions Case Studies Conclusion Authentication Fairness Privacy

Weak Anonymity (WA)

Unlinkability, but also for the winner. Alice Carol Bid

≈l

Bid

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-21
SLIDE 21

Introduction Formal Definitions Case Studies Conclusion Authentication Fairness Privacy

e-Auctions: Hierarchy of Privacy Notions

BPU WA SA SBPS[DJP10]

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-22
SLIDE 22

Introduction Formal Definitions Case Studies Conclusion Authentication Fairness Privacy

e-Auctions: Hierarchy of Privacy Notions

BPU WA SA SBPS[DJP10] P FPSBA

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-23
SLIDE 23

Introduction Formal Definitions Case Studies Conclusion Authentication Fairness Privacy

e-Auctions: Hierarchy of Privacy Notions

BPU WA SA SBPS[DJP10] P FPSBA SRF[DJP10] RF-U RF-WA RF-SA RF-BPS RF FPSBA CR-U CR-WA CR-SA CR-BPS CR FPSBA

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-24
SLIDE 24

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Plan

1 Introduction 2 Formal Definitions

Authentication Fairness Privacy

3 Case Studies

Curtis et al. Brandt

4 Conclusion

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-25
SLIDE 25

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Plan

1 Introduction 2 Formal Definitions

Authentication Fairness Privacy

3 Case Studies

Curtis et al. Brandt

4 Conclusion

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-26
SLIDE 26

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Protocol by Curtis et al. [CPS07]: Registration

Main idea: a registration authority (RA) distributes pseudonyms, which are then used for bidding. Bidder Registration Authority

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-27
SLIDE 27

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Protocol by Curtis et al. [CPS07]: Registration

Main idea: a registration authority (RA) distributes pseudonyms, which are then used for bidding. Bidder Registration Authority , h( ),

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-28
SLIDE 28

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Protocol by Curtis et al. [CPS07]: Registration

Main idea: a registration authority (RA) distributes pseudonyms, which are then used for bidding. Bidder Registration Authority , h( ), { , h( ), }pk(Bidder)

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-29
SLIDE 29

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Bidding

The bidder uses his pseudonym to submit his bids. Bidder Registration Authority

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-30
SLIDE 30

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Bidding

The bidder uses his pseudonym to submit his bids. Bidder Registration Authority , { }pk(Auctioneer),

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-31
SLIDE 31

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Bidding

The bidder uses his pseudonym to submit his bids. Bidder Registration Authority , { }pk(Auctioneer), { }pk(Auctioneer),

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-32
SLIDE 32

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Bidding Cont’d

The Registration Authority forwards the bids to the auctioneer, encrypted using a symmetric key k, which is revealed at the end. Registration Authority Auctioneer

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-33
SLIDE 33

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Bidding Cont’d

The Registration Authority forwards the bids to the auctioneer, encrypted using a symmetric key k, which is revealed at the end. Registration Authority Auctioneer { , { }pk(Auctioneer), h( )}k

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-34
SLIDE 34

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Bidding Cont’d

The Registration Authority forwards the bids to the auctioneer, encrypted using a symmetric key k, which is revealed at the end. Registration Authority Auctioneer { , { }pk(Auctioneer), h( )}k k, n

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-35
SLIDE 35

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Completion

The auctioneer decrypts the bids using k and his secret key sk(Auctioneer), and announces the winning pseudonym. Registration Authority Auctioneer

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-36
SLIDE 36

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Completion

The auctioneer decrypts the bids using k and his secret key sk(Auctioneer), and announces the winning pseudonym. Registration Authority Auctioneer

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-37
SLIDE 37

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Analysis

Formal analysis using ProVerif [Bla01]: Non-Repudiation: attack, the messages from the RA to the auctioneer are not authenticated - anybody can impersonate the RA Non-Cancellation: same attack Highest Price Wins: same attack Weak Noninterference: ( ) OK if first message (hash of bid) is encrypted. Privacy: ( ) Weak Anonymity if first message is encrypted and synchronization is added

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-38
SLIDE 38

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Plan

1 Introduction 2 Formal Definitions

Authentication Fairness Privacy

3 Case Studies

Curtis et al. Brandt

4 Conclusion

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-39
SLIDE 39

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

“How to obtain full privacy in auctions” by Brandt [Bra06]

Completely distributed protocol (no authorities) Distributed homomorphic ElGamal encryption Function fij = 1 if bidder i won at price j, fij = 1 otherwise.

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-40
SLIDE 40

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Protocol execution

Bulletin Board Seller Bidders

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-41
SLIDE 41

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Protocol execution

Bulletin Board Seller Bidders

  • 1. Distributed key setup

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-42
SLIDE 42

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Protocol execution

Bulletin Board Seller Bidders

  • 1. Distributed key setup
  • 2. Encrypted bids

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-43
SLIDE 43

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Protocol execution

Bulletin Board Seller Bidders

  • 1. Distributed key setup
  • 2. Encrypted bids
  • 3. Hom. Computation of fij

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-44
SLIDE 44

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Protocol execution

Bulletin Board Seller Bidders

  • 1. Distributed key setup
  • 2. Encrypted bids
  • 3. Hom. Computation of fij
  • 4. Partial decryption

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-45
SLIDE 45

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Protocol execution

Bulletin Board Seller Bidders

  • 1. Distributed key setup
  • 2. Encrypted bids
  • 3. Hom. Computation of fij
  • 4. Partial decryption
  • 5. Shares

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-46
SLIDE 46

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Protocol execution

Bulletin Board Seller Bidders

  • 1. Distributed key setup
  • 2. Encrypted bids
  • 3. Hom. Computation of fij
  • 4. Partial decryption
  • 5. Shares
  • 6. Missing shares for fij

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-47
SLIDE 47

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Analysis

Automatic analysis using ProVerif: Non-Repudiation, Non-Cancellation: attack, lack of authentication Weak Noninterference: OK Highest Price Wins: attack, an intruder can impersonate all bidders, hence controlling winner and winning price Privacy: attack

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-48
SLIDE 48

Introduction Formal Definitions Case Studies Conclusion Curtis et al. Brandt

Attack on Privacy

Exploit lack of authentication: Target one bidder Impersonate all other bidders Resubmit the targeted bidder’s bid as their bids Impersonate the seller Obtain winning price=targeted bidder’s bid

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-49
SLIDE 49

Introduction Formal Definitions Case Studies Conclusion

Plan

1 Introduction 2 Formal Definitions

Authentication Fairness Privacy

3 Case Studies

Curtis et al. Brandt

4 Conclusion

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-50
SLIDE 50

Introduction Formal Definitions Case Studies Conclusion

Conclusion

Much work on e-Auction protocols, but not on formal analysis Developed a framework formalizing Non-Repudiation, Non-Cancellation, Fairness (Strong and Weak Noninterference, Highest Price Wins) and different notions of Privacy Suitable for automatic analysis using ProVerif Two case studies:

Protocol by Curtis et al.: attacks on Non-Repudiation, Non-Cancellation, Fairness and Privacy due to lack of authentication and synchronization Protocol by Brandt: attacks on Privacy, Highest Price Wins, Non-Repudiation and Non-Cancellation

Future work: fix problems and prove a protocol secure

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-51
SLIDE 51

Introduction Formal Definitions Case Studies Conclusion

Thank you for your attention!

Questions? jannik.dreier@imag.fr

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-52
SLIDE 52

Introduction Formal Definitions Case Studies Conclusion

  • M. Abadi and C. Fournet.

Mobile values, new names, and secure communication. In Proc. 28th Symposium on Principles of Programming Languages, POPL ’01, pages 104–115, New York, 2001. ACM.

  • M. Abe and K. Suzuki.

Receipt-free sealed-bid auction. In Proc. 5th Conference on Information Security, volume 2433

  • f LNCS, pages 191–199. Springer, 2002.
  • B. Blanchet.

An Efficient Cryptographic Protocol Verifier Based on Prolog Rules. In Proc. 14th Computer Security Foundations Workshop (CSFW-14), pages 82–96, Cape Breton, Nova Scotia, Canada, June 2001. IEEE Computer Society.

  • F. Brandt.

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-53
SLIDE 53

Introduction Formal Definitions Case Studies Conclusion

How to obtain full privacy in auctions. International Journal of Information Security, 5:201–216, 2006.

  • B. Curtis, J. Pieprzyk, and J. Seruga.

An efficient eAuction protocol. In Proc. 7th Conference on Availability, Reliability and Security (ARES’07), pages 417–421. IEEE Computer Society, 2007. Jannik Dreier, Hugo Jonker, and Pascal Lafourcade. Defining verifiability in e-auction protocols. In 8th ACM Symposium on Information, Computer and Communications Security (ASIACCS), 2013. Naipeng Dong, Hugo L. Jonker, and Jun Pang. Analysis of a receipt-free auction protocol in the applied pi calculus.

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-54
SLIDE 54

Introduction Formal Definitions Case Studies Conclusion

In Pierpaolo Degano, Sandro Etalle, and Joshua D. Guttman, editors, Formal Aspects in Security and Trust, volume 6561 of LNCS, pages 223–238. Springer, 2010.

  • N. Dong, H. L. Jonker, and J. Pang.

Analysis of a receipt-free auction protocol in the applied pi calculus. In Proc. 7th Workshop on Formal Aspects in Security and Trust (FAST’10), volume 6561 of LNCS, pages 223–238. Springer-Verlag, 2011. Stéphanie Delaune, Steve Kremer, and Mark Ryan. Verifying privacy-type properties of electronic voting protocols. Journal of Computer Security, 17:435–487, December 2009.

  • J. Dreier, P. Lafourcade, and Y. Lakhnech.

A formal taxonomy of privacy in voting protocols.

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-55
SLIDE 55

Introduction Formal Definitions Case Studies Conclusion

In Proc. 1st IEEE International Workshop on Security and Forensics in Communication Systems (ICC’12 WS - SFCS), 2012. Jannik Dreier, Pascal Lafourcade, and Yassine Lakhnech. Defining privacy for weighted votes, single and multi-voter coercion. In Sara Foresti, Moti Yung, and Fabio Martinelli, editors, Computer Security - ESORICS 2012 - 17th European Symposium on Research in Computer Security, Pisa, Italy, September 10-12, 2012. Proceedings, volume 7459 of LNCS, pages 451–468. Springer, 2012.

  • M. Harkavy, J. D. Tygar, and H. Kikuchi.

Electronic auctions with private bids. In Proc. 3rd USENIX Workshop on Electronic Commerce. Usenix, 1998.

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-56
SLIDE 56

Introduction Formal Definitions Case Studies Conclusion

  • B. Księżopolski and P. Lafourcade.

Attack and revision of electronic auction protocol using ofmc. Annales UMCS Informatica 2007, pages 171–183, 2007.

  • R. Küsters, T. Truderung, and A. Vogt.

Accountability: definition and relationship to verifiability. In Proc. 17th Conference on Computer and Communications Security (CCS’10), CCS ’10, pages 526–535. ACM, 2010.

  • G. Lowe.

A hierarchy of authentication specifications. In Computer Security Foundations Workshop, 1997. Proceedings., 10th, pages 31 –43, jun 1997. Frank Stajano and Ross J. Anderson. The cocaine auction protocol: On the power of anonymous broadcast.

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-57
SLIDE 57

Introduction Formal Definitions Case Studies Conclusion

In Andreas Pfitzmann, editor, Information Hiding, volume 1768

  • f LNCS, pages 434–447. Springer, 1999.
  • K. Sako.

An auction protocol which hides bids of losers. In Hideki Imai and Yuliang Zheng, editors, Proc. 3rd Workshop

  • n Practice and Theory in Public Key Cryptosystems (PKC

2000), volume 1751 of LNCS, pages 422–432. Springer, 2000. Ben Smyth and Veronique Cortier. Attacking and fixing helios: An analysis of ballot secrecy. In Proceedings of the 24th IEEE Computer Security Foundations Symposium (CSF’11), pages 297–311. IEEE, 2011. Srividhya Subramanian. Design and verification of a secure electronic auction protocol.

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-58
SLIDE 58

In Proceedings of the The 17th IEEE Symposium on Reliable Distributed Systems, SRDS ’98, pages 204–, Washington, DC, USA, 1998. IEEE Computer Society.

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-59
SLIDE 59

e-Auctions: Related Work

Plenty of protocols, e.g. [Bra06, CPS07, Sak00, AS02, SA99, HTK98] . . . Some properties known from different contexts, e.g. voting [DKR09, DLL12b, DLL12a, SC11, Low97] . . . Yet not much work on formalizing these properties for auctions:

Subramanian [Sub98]: design and verification using BAN-logic

  • B. Księżopolski and P. Lafourcade [KL07]: Authentication

attack using OFMC Dong, Jonker and Pang [DJP11]: Receipt-Freeness Küsters et al. [KTV10]: Accountability Dreier et al. [DJL13]: Verifiability

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-60
SLIDE 60

Receipt-Freeness (RF)

Again: Observational equivalence between two situations, but Alice tries to create a receipt or a fake. Alice Bob Mallory A B

≈l

B A Secret Data Fake Data

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-61
SLIDE 61

Receipt-Freeness (RF)

Again: Observational equivalence between two situations, but Alice tries to create a receipt or a fake. Alice Bob Mallory A B

≈l

B A Secret Data Fake Data

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-62
SLIDE 62

Coercion-Resistance (CR)

Observational equivalence between two situations, but Alice is under control by Mallory or only pretends to be so. Alice Bob Mallory A B

≈l

B A Secret Data Fake Data

Orders Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-63
SLIDE 63

Coercion-Resistance (CR)

Observational equivalence between two situations, but Alice is under control by Mallory or only pretends to be so. Alice Bob Mallory A B

≈l

B A Secret Data Fake Data

Orders Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-64
SLIDE 64

Definition (Equivalence in a Frame) Two terms M and N are equal in the frame φ, written (M = N)φ, if and only if φ ≡ ν ˜ n.σ, Mσ = Nσ, and {˜ n} ∩ (fn(M) ∪ fn(N)) = ∅ for some names ˜ n and some substitution σ. Definition (Static Equivalence (≈s)) Two closed frames φ and ψ are statically equivalent, written φ ≈s ψ, when dom(φ) =dom(ψ) and when for all terms M and N (M = N)φ if and only if (M = N)ψ. Two extended processes A and B are statically equivalent (A ≈s B) if their frames are statically equivalent.

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-65
SLIDE 65

Definition (Labelled Bisimilarity (≈l)) Labelled bisimilarity is the largest symmetric relation R on closed extended processes, such that A R B implies

1 A ≈s B, 2 if A → A′, then B → B′ and A′ R B′ for some B′, 3 if A α

− → A′ and fv(α) ⊆ dom(A) and bn(α) ∩ fn(B) = ∅, then B →∗ α − →→∗ B′ and A′ R B′ for some B′.

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-66
SLIDE 66

Definition (Process Pch [DKR09]) Let P be a process and ch be a channel. We define Pch as follows: 0ch ˆ = 0, (P|Q)ch ˆ = Pch|Qch, (νn.P)ch ˆ = νn.out(ch, n).Pch when n is a name of base type, (νn.P)ch ˆ = νn.Pch otherwise, (in(u, x).P)ch ˆ = in(u, x).out(ch, x).Pch when x is a variable

  • f base type,

(in(u, x).P)ch ˆ = in(u, x).Pch otherwise, (out(u, M).P)ch ˆ = out(u, M).Pch, (!P)ch ˆ = !Pch, (if M = N then P else Q)ch ˆ = if M = N then Pch else Qch.

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-67
SLIDE 67

Definition (Process Pc1,c2 [DKR09]) Let P be a process, c1, c2 channels. We define Pc1,c2 as follows: 0c1,c2 ˆ = 0, (P|Q)c1,c2 ˆ = Pc1,c2|Qc1,c2, (νn.P)c1,c2 ˆ = νn.out(c1, n).Pc1,c2 if n is a name of base type, (νn.P)c1,c2 ˆ = νn.Pc1,c2 otherwise, (in(u, x).P)c1,c2 ˆ = in(u, x).out(c1, x).Pc1,c2 if x is a variable

  • f base type & x is a fresh variable,

(in(u, x).P)c1,c2 ˆ = in(u, x).Pc1,c2 otherwise, (out(u, M).P)c1,c2 ˆ = in(c2, x).out(u, x).Pc1,c2, (!P)c1,c2 ˆ = !Pc1,c2, (if M = N then P else Q)c1,c2 ˆ = in(c2, x).if x = true then Pc1,c2 else Qc1,c2 where x is a fresh variable and true is a constant.

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols

slide-68
SLIDE 68

Definition (Process A\out(ch,·) [DKR09]) Let A be an extended process. We define the process A\out(ch,·) as νch.(A|!in(ch, x)).

Jannik Dreier, Pascal Lafourcade, Yassine Lakhnech Formal Verification of e-Auction protocols