Inductive Analysis of the Internet Protocol TLS Lawrence C. Paulson - - PowerPoint PPT Presentation

inductive analysis of the internet protocol tls
SMART_READER_LITE
LIVE PREVIEW

Inductive Analysis of the Internet Protocol TLS Lawrence C. Paulson - - PowerPoint PPT Presentation

Inductive Analysis of TLS 1 L. C. Paulson Inductive Analysis of the Internet Protocol TLS Lawrence C. Paulson Computer Laboratory University of Cambridge Inductive Analysis of TLS 2 L. C. Paulson TLS: An Internet


slide-1
SLIDE 1

Inductive Analysis of TLS 1

  • L. C. Paulson

Inductive Analysis of the Internet Protocol TLS

Lawrence C. Paulson Computer Laboratory University of Cambridge

slide-2
SLIDE 2

Inductive Analysis of TLS 2

  • L. C. Paulson

TLS: An Internet Protocol

  • to protect data between Web browsers and servers
  • RSA and symmetric-key encryption (among others)
  • random-number generator for negotiating secrets
  • resumption of old sessions with new keys
  • also known as “SSL 3.1”
slide-3
SLIDE 3

Inductive Analysis of TLS 3

  • L. C. Paulson

Hello Messages

client hello

✁ ✂ ✄ ☎ ✁ ✆✞✝ ✟ ✆✡✠ ☛ ☞ ✆✞✌ ✟

server hello

✄ ✂ ✁ ☎ ✝ ✍ ✆✡✠ ☛ ☞ ✆ ✌ ✍

resumption? go straight to Finished messages server certificate

✄ ✂ ✁ ☎ ✎✏ ✑ ✒ ✓✔ ✎✕ ✒ ✏ ✖ ✄ ✆✞✗ ✘ ✙ ✠ ☛ ☞✛✚

session Id (for resumption)

✌ ✟ ✆✞✌ ✍ ✚

crypto preferences

slide-4
SLIDE 4

Inductive Analysis of TLS 4

  • L. C. Paulson

Client Key Exchange Messages

client certificate*

✜ ✢ ✣ ✤ ✥✦ ✧ ★ ✩✪ ✥✫ ★ ✦ ✬ ✜ ✭✞✮ ✯ ✰

client key exchange

✜ ✢ ✣ ✤ ✱✲✴✳ ✵ ✲✶ ✷ ✸

certificate verify*

✜ ✢ ✣ ✤ ✱ ✲

Hash

✹ ✹ ✹ ✲ ✶ ✷ ✺✼✻ ✽

* omit for anonymous session

✳ ✵

= pre-master-secret Diffie-Hellman exchange also possible

slide-5
SLIDE 5

Inductive Analysis of TLS 5

  • L. C. Paulson

Finished Messages

=

✾ ✿ ❀ ❁ ✾ ❂ ❃✞❄ ❅ ❃✞❄ ❆ ❇

master-secret

❈ ❉❊ ❉❋● ❍■ ❏

hash of previous messages client finished

❑ ▲ ▼ ◆ ❖P ❈ ❉❊ ❉❋
■ P◗ ❘ ❙❚ ❯ ❱ ❲ ❳ ❨❬❩ ❭ ❪ ❩ ❫ ❪✛❴ ❵

server finished

▼ ▲ ❑ ◆ ❖ P ❈ ❉❊ ❉❋● ❍■ P◗ ❛ ❯ ❜❝ ❯ ❜ ❳ ❨❬❩ ❭ ❪ ❩ ❫ ❪✛❴ ❵ ❞ ❡❢ ❣ ❤ ✐ ❥

,

❦ ❣ ❧♠ ❣ ❧ ❥

make fresh session keys Each party checks the other’s

slide-6
SLIDE 6

Inductive Analysis of TLS 6

  • L. C. Paulson

An Inductive Approach to Proving Protocols

Work in higher-order logic

Inductively model traces of agent actions

Include an active attacker, compromised & careless agents

No finite-state assumptions

Prove results by induction

Mechanized using Isabelle/HOL

slide-7
SLIDE 7

Inductive Analysis of TLS 7

  • L. C. Paulson

Message Types

♦♣ q r s✞t t t ✉

Agent

✈ ✇

Nonce

non-guessable number

Number

guessable number

Key

Hash

r ✇ ② ✇ r ③ s✞t t t s r ④ ✇⑤

concatenation

Crypt

r

strong encryption

slide-8
SLIDE 8

Inductive Analysis of TLS 8

  • L. C. Paulson

Inductively Defining the Protocol: Hello

client hello. If

⑥ ⑦

is fresh in the trace, may add Says

⑧⑨ ⑩❶ ⑧ ❷ ⑥ ⑦ ❷✡❸ ❹ ❺ ❷✞❻ ⑦ ❶❼

server hello. If the trace has Says

⑧❾❽ ⑨ ⑩ ❶ ⑧ ❷ ⑥ ⑦ ❷ ❸ ❹ ❺ ❷✞❻ ⑦ ❶ ❼

and

⑥ ❿

is fresh, may add Says

⑨ ⑧ ⑩❶ ⑥ ❿ ❷✡❸ ❹ ❺ ❷✞❻ ❿ ❶❼
slide-9
SLIDE 9

Inductive Analysis of TLS 9

  • L. C. Paulson

Defining the Protocol: Client Key Exchange

  • certificate. May add Says
➀➁ ➂➄➃➅ ➆ ➇ ➈➉ ➃➊ ➇ ➅ ➂ ➀ ➋

pubK

➀ ➌ ➌

to a trace client key exchange. If the trace contains the events Says

➀➎➍ ➁ ➏➐✴➑ ➒ ➋✡➓ ➔ → ➋✞➣ ➒ ➐↔

Says

➀➎➍ ➍ ➁ ➂➄➃ ➅ ➆ ➇ ➈➉ ➃ ➊ ➇ ➅ ➂ ➀ ➋✞↕ ➙ ➌ ➌

and

➛ ➜

is fresh, may add Says

➁ ➀ ➂

Crypt

↕ ➙ ➛ ➜ ➌
slide-10
SLIDE 10

Inductive Analysis of TLS 10

  • L. C. Paulson

Modelling Attacks and Accidents

  • Fake. If

can be forged in the trace, may add Says Spy

➞ ➝
  • SpyKeys. If the spy has
➟➠✴➡ ➢ ➤ ➡ ➥ ➤ ➠➦

then he has

➧ ➨ ➩ ➫ ➤ ➡ ➢ ➤ ➡ ➥ ➭

and

➯➲ ➯ ➯ ➳ ➵ ➸➺ ➫ ➡ ➢ ➤ ➡ ➥ ➤ ➭
  • Oops. Anybody who uses a session key may give it to the spy.
slide-11
SLIDE 11

Inductive Analysis of TLS 11

  • L. C. Paulson

Security Goals Proved

The pre-master-secret remains secret (assuming honest peers)

The master-secret remains secret

Certificate verify guarantees that the client is present

session keys remain secret (unless given away)

A message encrypted with peer’s session key came from him

slide-12
SLIDE 12

Inductive Analysis of TLS 12

  • L. C. Paulson

Lemmas Proved Along the Way

Protocol steps don’t reveal private keys

All certificates are valid (too perfect?)

A fresh PMS yields fresh session keys

Compromise of a session key doesn’t compromise any PMS (hard to prove)

slide-13
SLIDE 13

Inductive Analysis of TLS 13

  • L. C. Paulson

Related Work

Wagner and Schneier’s analysis of SSL 3.0:

weaknesses in abstract protocol (fixed in TLS)

discussion of cryptanalysis Dietrich’s thesis:

investigated anonymous connections against an eavesdropper using NCP belief logic Mitchell et al.: simple model-checking experiments

slide-14
SLIDE 14

Inductive Analysis of TLS 14

  • L. C. Paulson

Comments on TLS

Strengthen client key exchange to

➚ ➪ ➶ ➹ ➘➴ ➚ ➷✞➬ ➮ ➴➱ ✃ ❐❮❒ ➾

Explicitness: beware of hashing everything but the kitchen sink

Make the abstract message exchange part of every protocol spec

slide-15
SLIDE 15

Inductive Analysis of TLS 15

  • L. C. Paulson

Conclusions

6 weeks effort; 8 minutes cpu time (model-checking: 8 hours)

mundane proofs but interesting model

Can model key negotiation

Non-determinism is no obstacle

Realistic protocols can now be analyzed—abstractly, at least