Pattern-Matching Spi-Calculus A Type System for Cryptographic Protocols Christian Haack and Alan Jeffrey DePaul University, Chicago Pattern-Matching Spi-Calculus – p.1/11
Types for Cryptographic Protocols Pattern-Matching Spi-Calculus – p.2/11
Types for Cryptographic Protocols Spi-calculus: A small and abstract domain-specific language for cryptographic protocols: Abadi and Gordon [1997] Pattern-Matching Spi-Calculus – p.2/11
Types for Cryptographic Protocols Spi-calculus: A small and abstract domain-specific language for cryptographic protocols: Abadi and Gordon [1997] Type systems for verifying secrecy or authenticity within the spi-calculus. Abadi [1999] Abadi and Blanchet [2001] Gordon and Jeffrey [2001, 2002] Pattern-Matching Spi-Calculus – p.2/11
Types for Cryptographic Protocols Spi-calculus: A small and abstract domain-specific language for cryptographic protocols: Abadi and Gordon [1997] Type systems for verifying secrecy or authenticity within the spi-calculus. Abadi [1999] Abadi and Blanchet [2001] Gordon and Jeffrey [2001, 2002] Advantages of verification by type-checking: Type-checking is easier than proofs from first principles. Type-checking is automatable. Pattern-Matching Spi-Calculus – p.2/11
Pattern-Matching Spi: Messages n | x | () | ( M, N ) | { | M | } N | { | M | } N − 1 ::= L, M, N | Enc ( M ) | Dec ( M ) Other constructors by translation to this core language: Pattern-Matching Spi-Calculus – p.3/11
Pattern-Matching Spi: Messages n | x | () | ( M, N ) | { | M | } N | { | M | } N − 1 ::= L, M, N | Enc ( M ) | Dec ( M ) Other constructors by translation to this core language: Symmetric crypto: ∆ { M } k = { | M | } Enc ( k ) where k is a secret key pair Pattern-Matching Spi-Calculus – p.3/11
Pattern-Matching Spi: Messages n | x | () | ( M, N ) | { | M | } N | { | M | } N − 1 ::= L, M, N | Enc ( M ) | Dec ( M ) Other constructors by translation to this core language: Symmetric crypto: ∆ { M } k = { | M | } Enc ( k ) where k is a secret key pair Message tagging: ∆ l ( M ) = { | M | } Enc ( l ) where l is a public “key” pair Pattern-Matching Spi-Calculus – p.3/11
Pattern-Matching Spi: Messages n | x | () | ( M, N ) | { | M | } N | { | M | } N − 1 ::= L, M, N | Enc ( M ) | Dec ( M ) Other constructors by translation to this core language: Symmetric crypto: ∆ { M } k = { | M | } Enc ( k ) where k is a secret key pair Message tagging: ∆ l ( M ) = { | M | } Enc ( l ) where l is a public “key” pair Hashing: ∆ = hashtag ( { | M | } hashkey ) where hashkey is a public #( M ) encryption key with decryption part unknown to everybody Pattern-Matching Spi-Calculus – p.3/11
Pattern-Matching Spi: Processes P, Q ::= out N M | inp N X ; P | new n : T ; P | ! P | P | Q | 0 Pattern-matching input; X is a pattern. Pattern-Matching Spi-Calculus – p.4/11
Pattern-Matching Spi: Processes P, Q ::= out N M | inp N X ; P | new n : T ; P | ! P | P | Q | 0 Pattern-matching input; X is a pattern. x . M | ¯ where ¯ ::= { � A } A is a set of assertions X Pattern-Matching Spi-Calculus – p.4/11
Pattern-Matching Spi: Processes P, Q ::= out N M | inp N X ; P | new n : T ; P | ! P | P | Q | 0 Pattern-matching input; X is a pattern. x . M | ¯ where ¯ ::= { � A } A is a set of assertions X Surface syntax has syntax sugar. For instance: ∆ } k − 1 | x : T } ; P inp N { | x : T | } k − 1 ; P = inp N { x . { | x | Pattern-Matching Spi-Calculus – p.4/11
Pattern-Matching Spi: Processes P, Q ::= out N M | inp N X ; P | new n : T ; P | ! P | P | Q | 0 Pattern-matching input; X is a pattern. x . M | ¯ where ¯ ::= { � A } A is a set of assertions X Surface syntax has syntax sugar. For instance: ∆ } k − 1 | x : T } ; P inp N { | x : T | } k − 1 ; P = inp N { x . { | x | Syntactic restricitions: Members of binder � x must have a witness in M . Pattern-Matching Spi-Calculus – p.4/11
Pattern-Matching Spi: Processes P, Q ::= out N M | inp N X ; P | new n : T ; P | ! P | P | Q | 0 Pattern-matching input; X is a pattern. x . M | ¯ where ¯ ::= { � A } A is a set of assertions X Surface syntax has syntax sugar. For instance: ∆ } k − 1 | x : T } ; P inp N { | x : T | } k − 1 ; P = inp N { x . { | x | Syntactic restricitions: Members of binder � x must have a witness in M . Input patterns must be Dolev-Yao-implementable. For } k − 1 | ¯ instance, { x, k . { | x | A } is not D-Y-implementable. Pattern-Matching Spi-Calculus – p.4/11
Semantics of Pattern-Matching Dynamic semantics. x ← � x . M | ¯ x ← � out L M { � N } | inp L { � A } ; P → P { � N } Pattern-Matching Spi-Calculus – p.5/11
Semantics of Pattern-Matching Dynamic semantics. x ← � x . M | ¯ x ← � out L M { � N } | inp L { � A } ; P → P { � N } Dynamic check that input message matches input message pattern M . Pattern-Matching Spi-Calculus – p.5/11
Semantics of Pattern-Matching Dynamic semantics. x ← � x . M | ¯ x ← � out L M { � N } | inp L { � A } ; P → P { � N } Dynamic check that input message matches input message pattern M . Dynamic semantics ignores the assertion set ¯ A . Pattern-Matching Spi-Calculus – p.5/11
Semantics of Pattern-Matching Dynamic semantics. x ← � x . M | ¯ x ← � out L M { � N } | inp L { � A } ; P → P { � N } Dynamic check that input message matches input message pattern M . Dynamic semantics ignores the assertion set ¯ A . Static semantics. E ⊢ ¯ x ← � A { � N } x . M | ¯ x ← � E ⊢ M { � N } ∈ { � A } Pattern-Matching Spi-Calculus – p.5/11
Semantics of Pattern-Matching Dynamic semantics. x ← � x . M | ¯ x ← � out L M { � N } | inp L { � A } ; P → P { � N } Dynamic check that input message matches input message pattern M . Dynamic semantics ignores the assertion set ¯ A . Static semantics. E ⊢ ¯ x ← � A { � N } x . M | ¯ x ← � E ⊢ M { � N } ∈ { � A } Static check that assertion set ¯ A holds after input. Pattern-Matching Spi-Calculus – p.5/11
Semantics of Pattern-Matching Dynamic semantics. x ← � x . M | ¯ x ← � out L M { � N } | inp L { � A } ; P → P { � N } Dynamic check that input message matches input message pattern M . Dynamic semantics ignores the assertion set ¯ A . Static semantics. E ⊢ ¯ x ← � A { � N } x . M | ¯ x ← � E ⊢ M { � N } ∈ { � A } Static check that assertion set ¯ A holds after input. ¯ A may be viewed as checked input post-condition. Pattern-Matching Spi-Calculus – p.5/11
Correspondence Assertions A → B ( m, A, B ) ∆ = new m : T ; out net ( m, A, B ) P A inp net { x, p . ( x, p, B ) | ¯ ∆ = A ( x, p ) } ; P B Pattern-Matching Spi-Calculus – p.6/11
Correspondence Assertions A !begins “ A sends m to B ” A → B ( m, A, B ) B ends “ A sends m to B ” ∆ = new m : T ; begin !( m, A, B ); out net ( m, A, B ) P A inp net { x, p . ( x, p, B ) | ¯ ∆ = A ( x, p ) } ; end ( x, p, B ) P B Pattern-Matching Spi-Calculus – p.6/11
Correspondence Assertions A !begins “ A sends m to B ” A → B ( m, A, B ) B ends “ A sends m to B ” ∆ = new m : T ; begin !( m, A, B ); out net ( m, A, B ) P A inp net { x, p . ( x, p, B ) | ¯ ∆ = A ( x, p ) } ; end ( x, p, B ) P B A process is safe iff in every run every end-assertion is preceeded by a matching begin-assertion. Pattern-Matching Spi-Calculus – p.6/11
Correspondence Assertions A !begins “ A sends m to B ” A → B ( m, A, B ) B ends “ A sends m to B ” ∆ = new m : T ; begin !( m, A, B ); out net ( m, A, B ) P A inp net { x, p . ( x, p, B ) | ¯ ∆ = A ( x, p ) } ; end ( x, p, B ) P B A process is safe iff in every run every end-assertion is preceeded by a matching begin-assertion. P A | P B is safe. Pattern-Matching Spi-Calculus – p.6/11
Correspondence Assertions A !begins “ A sends m to B ” A → B ( m, A, B ) B ends “ A sends m to B ” ∆ = new m : T ; begin !( m, A, B ); out net ( m, A, B ) P A inp net { x, p . ( x, p, B ) | ¯ ∆ = A ( x, p ) } ; end ( x, p, B ) P B A process is safe iff in every run every end-assertion is preceeded by a matching begin-assertion. P A | P B is safe. A process P is robustly safe iff P | O is safe for all opponents O . Pattern-Matching Spi-Calculus – p.6/11
Correspondence Assertions A !begins “ A sends m to B ” A → B ( m, A, B ) B ends “ A sends m to B ” ∆ = new m : T ; begin !( m, A, B ); out net ( m, A, B ) P A inp net { x, p . ( x, p, B ) | ¯ ∆ = A ( x, p ) } ; end ( x, p, B ) P B A process is safe iff in every run every end-assertion is preceeded by a matching begin-assertion. P A | P B is safe. A process P is robustly safe iff P | O is safe for all opponents O . P A | P B is not robustly safe. Pattern-Matching Spi-Calculus – p.6/11
Correspondence Assertions A !begins “ A sends m to B ” A → B ( m, A, B ) B ends “ A sends m to B ” ∆ = new m : T ; begin !( m, A, B ); out net ( m, A, B ) P A inp net { x, p . ( x, p, B ) | ¯ ∆ = A ( x, p ) } ; end ( x, p, B ) P B A process is safe iff in every run every end-assertion is preceeded by a matching begin-assertion. P A | P B is safe. A process P is robustly safe iff P | O is safe for all opponents O . P A | P B is not robustly safe. Theorem: Every well-typed process is robustly safe. Pattern-Matching Spi-Calculus – p.6/11
Recommend
More recommend
