Relating Strands and Multiset Rewriting For Security Protocol - - PowerPoint PPT Presentation

▶
relating strands and multiset rewriting for security
SMART_READER_LITE
LIVE PREVIEW

Relating Strands and Multiset Rewriting For Security Protocol - - PowerPoint PPT Presentation

Sep 20, 2022 234 likes •632 views

Relating Strands and Multiset Rewriting For Security Protocol Analysis Iliano Cervesato Nancy Durgin, Patrick Lincoln John Mitchell, Andre Scedrov July 3 rd , 2000 CSFW-13 Cambridge, UK Representing Security Protocols Several recent

slide-1
SLIDE 1

Cambridge, UK July 3rd, 2000 CSFW-13

Relating Strands and Multiset Rewriting For Security Protocol Analysis

Iliano Cervesato Nancy Durgin, Patrick Lincoln John Mitchell, Andre Scedrov

slide-2
SLIDE 2

Relating Strands and Multiset Rewriting for Security Protocols

Representing Security Protocols

Several recent proposal based on the Dolev-Yao model:

  • Strand spaces
  • Multiset rewriting
  • Spi-calculus, …

How are they related?

slide-3
SLIDE 3

Relating Strands and Multiset Rewriting for Security Protocols

Roadmap

MSR Restricted MSR Canonical MSR Strands Dynamic Strands Decorated Strands

slide-4
SLIDE 4

Relating Strands and Multiset Rewriting for Security Protocols

Running Example

Needham-Schroeder Protocol A → B: {NA , A}KB B → A: {NA , NB }KA A → B: {NB }KB

slide-5
SLIDE 5

Relating Strands and Multiset Rewriting for Security Protocols

MSR

  • Executable

specification language

  • Adapts multiset rewriting with ∃
  • Solid logical foundation
  • Ties with linear logic and process algebra
  • Flexible and fully precise
  • Follows the Dolev-Yao model
slide-6
SLIDE 6

Relating Strands and Multiset Rewriting for Security Protocols

Multiset rewriting …

  • Multiset: set with repetitions allowed
  • Rewrite rule:

r: N1 → N2

  • Application
  • Multi-step transition, reachability

r

M’, N1 → M’, N2

r

M1 → M2

slide-7
SLIDE 7

Relating Strands and Multiset Rewriting for Security Protocols

… with existentials

  • msets of 1st-order atomic formulas
  • Rules:

r: F(x) → ∃n. G(x,n)

  • Application

r

M’, F(t) → M’, G(t,c)

r

M1 → M2

c not in M1

slide-8
SLIDE 8

Relating Strands and Multiset Rewriting for Security Protocols

MSR predicates

  • N(m)

Network messages

  • I(m)

Intruder info.

  • Ai

(t1 ,…,tni ) Role states

  • Pr, PrvK, PubK, …

Persistent info.

slide-9
SLIDE 9

Relating Strands and Multiset Rewriting for Security Protocols

Protocol Theories

  • Initialization rules
  • For each role
  • 1 role generation rule
  • n execution rules
slide-10
SLIDE 10

Relating Strands and Multiset Rewriting for Security Protocols

MSR Restricted MSR

  • Assume initialization has already

happened

  • Initial info:

Π

? No initialization in strands

slide-11
SLIDE 11

Relating Strands and Multiset Rewriting for Security Protocols

NS: MSR rules for Alice

πA0 (A) → A0 (A), πA0 (A)

A0

(A), πA1 (B) → ∃NA .

A1

(A,B,NA ),

N({NA

,A}KB ), πA1 (B)

A1

(A,B, NA ),

N({NA

,NB }KA ) → A2 (A,B,NA ,NB )

A2

(A,B,NA ,NB ) → A3 (A,B,NA ,NB ),

N({NB

}KB )

where πA0(A) = Pr(A), PrvK(A,KA

  • 1)

πA1(B) = Pr(B), PubK(B,KB )

slide-12
SLIDE 12

Relating Strands and Multiset Rewriting for Security Protocols

NS: MSR rules for Bob

πB0 (B) → B0 (B), πB0 (B)

B0

(A), πB1 (A),

N({NA

,A}KB ) → B1 (A,B,NA ), πB1 (A)

B1

(A,B, NA ) → ∃NB .

B2

(A,B,NA ,NB ),

N({NA

,NB }KA )

B2

(A,B,NA ,NB ),

N({NB

}KB ) → B3 (A,B,NA ,NB )

where πB0(B) = Pr(B), PrvK(B,KB

  • 1)

πB1(A) = Pr(A), PubK(A,KA )

slide-13
SLIDE 13

Relating Strands and Multiset Rewriting for Security Protocols

MSR Intruder

  • Implement the Dolev-Yao model
  • Decryption/Encryption
  • Decomposition/composition
  • Nonce generation
  • …
  • Expressed within the language
slide-14
SLIDE 14

Relating Strands and Multiset Rewriting for Security Protocols

Strands

  • Graphical representation of execution
  • Designed for after-the-fact analysis
  • Very simple
  • Follow the Dolev-Yao model
  • Related to
  • Lamport’s causality
  • Mazurkiewicz’s traces
slide-15
SLIDE 15

Relating Strands and Multiset Rewriting for Security Protocols

NS: A Bundle

{NA , A}KB {NA , NB }KA {NA , A}KB {NA , NB }KA {NB }KB

slide-16
SLIDE 16

Relating Strands and Multiset Rewriting for Security Protocols

Penetrator Strands

  • Implement the Dolev-Yao model
  • Decryption/Encryption
  • Decomposition/composition
  • Nonce generation
  • …
  • Expressed within the language
slide-17
SLIDE 17

Relating Strands and Multiset Rewriting for Security Protocols

Strands Dyn. Strands

? Support executable specifications

  • Specification language
  • Parametric strands
  • Execution capabilities
  • Configurations
  • Transitions
slide-18
SLIDE 18

Relating Strands and Multiset Rewriting for Security Protocols

Parametric strands

  • Strands are instances
  • f roles
  • Parameters: instantiable information
  • Constraints:
  • Nonces
  • Persistent info.
slide-19
SLIDE 19

Relating Strands and Multiset Rewriting for Security Protocols

NS: Parametric Strand for Alice

Alice (A,B,NA ,NB ) : NA Fresh, πA (A,B)

where π(A,B) = Pr(A), PrvK(A,KA

  • 1),

Pr(B), PubK(B,KB )

{NA , A}KB {NA , NB }KA {NB }KB

slide-20
SLIDE 20

Relating Strands and Multiset Rewriting for Security Protocols

NS: Parametric Strand for Bob

Bob (A,B,NA ,NB ) : NB Fresh, πB (A,B)

where π(A,B) = Pr(B), PrvK(B,KB

  • 1),

Pr(A), PubK(A,KA )

{NA , A}KB {NA , NB }KA {NB }KB

slide-21
SLIDE 21

Relating Strands and Multiset Rewriting for Security Protocols

Configurations

= + +

Configuration = bundle + extension + fringe

? Capture possible next actions

  • Extension

: bundle + remaining actions

  • Configuration

: bundle + extension

  • Fringe

: crossing arrows

slide-22
SLIDE 22

Relating Strands and Multiset Rewriting for Security Protocols

NS: Configuration

{NA , A}KB {NA , NB }KA {NB }KB {NA , A}KB {NA , NB }KA {NB }KB {NC , C}KD {NC , ND }KC {ND }KD

slide-23
SLIDE 23

Relating Strands and Multiset Rewriting for Security Protocols

Strand Transitions

  •  …  •

ξ ξθ

  •  …  •
  •  …  •

ξ

  • Fresh

Instantiate Send Receive

+ + + +

slide-24
SLIDE 24

Relating Strands and Multiset Rewriting for Security Protocols

Bundles vs. Transition Sequences

  • 1 bundle  O(n!) transition sequences
  • 1 transition sequence  1 bundle
  • Bundles

represent execution more compactly

slide-25
SLIDE 25

Relating Strands and Multiset Rewriting for Security Protocols

  • Restr. MSR
  • Can. MSR
  • Merge role gen. with 1st
  • exec. rule
  • Choose nonces upfront
  • Guess persistent info. upfront

Conversion to canonical form preserves reachability

slide-26
SLIDE 26

Relating Strands and Multiset Rewriting for Security Protocols

NS: Canonical MSR rules for Alice

πA (A,B) → ∃NA .

A1

(A,B,NA ),

N({NA

,A}KB ), πA (A,B)

A1

(A,B, NA ),

N({NA

,NB }KA ) → A2 (A,B,NA ,NB )

A2

(A,B,NA ,NB ) → A3 (A,B,NA ,NB ),

N({NB

}KB )

where πA(A,B) = Pr(A), PrvK(A,KA

  • 1)

Pr(B), PubK(B,KB )

slide-27
SLIDE 27

Relating Strands and Multiset Rewriting for Security Protocols

  • Can. MSR
  • Dyn. Strands
  • Rules 

nodes

  • Role state predicates 

arrows

  • Nonces, persistent info.

 constraints

  • Configuration ⇐ state

Reachable states  Reachable configurations

slide-28
SLIDE 28

Relating Strands and Multiset Rewriting for Security Protocols

NS: MSR Strands

πA (A,B) → ∃NA .

A1

(A,B,NA ),

N({NA

,A}KB ), πA (A,B)

(1)

Alice (A,B,NA ,NB ) : NA Fresh, πA (A,B)

where π(A,B) = Pr(A), PrvK(A,KA

  • 1), Pr(B), PubK(B,KB

)

{NA , A}KB

…

slide-29
SLIDE 29

Relating Strands and Multiset Rewriting for Security Protocols

NS: MSR Strands

A1

(A,B, NA ),

N({NA

,NB }KA ) →

A2

(A,B,NA ,NB )

(2)

…

{NA , A}KB {NA , NB }KA

slide-30
SLIDE 30

Relating Strands and Multiset Rewriting for Security Protocols

NS: MSR Strands

A2

(A,B,NA ,NB ) →

A3

(A,B,NA ,NB ),

N({NB

}KB )

(3)

{NA , A}KB {NA , NB }KA {NB }KB

slide-31
SLIDE 31

Relating Strands and Multiset Rewriting for Security Protocols

  • Dyn. Strands
  • Dec. Strands
  • Add initial (

) and final node (⊥)

  • Add labels Ai

(t1 ,…,tni ) to arrows t1 ,…,tni from

  • Constraints
  • Arguments of Ai-1

⊥

(1)

slide-32
SLIDE 32

Relating Strands and Multiset Rewriting for Security Protocols

  • Dyn. Strands
  • Dec. Strands
  • Transitions

Decoration preserves reachability

⊥  • … • ⊥  • … •

ξθ

⊥  • … •

ξ Fresh Instantiate

(2)

slide-33
SLIDE 33

Relating Strands and Multiset Rewriting for Security Protocols

NS: Decorated Strand for Alice

Alice (A,B,NA ,NB ) : NA Fresh, πA (A,B)

where π(A,B) = Pr(A), PrvK(A,KA

  • 1),

Pr(B), PubK(B,KB ) ⊥

{NA , A}KB {NA , NB }KA {NB }KB

⊥

A0

(A)

A1

(A,B,NA )

A2

(A,B,NA ,NB )

A3

(A,B,NA ,NB )

slide-34
SLIDE 34

Relating Strands and Multiset Rewriting for Security Protocols

  • Dec. Strands
  • Restr. MSR
  • Labels 

role state predicates

  • Events 

network messages

  • Constraints

 nonces, persistent info.

  • State ⇐

fringe Reachable configurations  Reachable states

slide-35
SLIDE 35

Relating Strands and Multiset Rewriting for Security Protocols

NS: Strands MSR

Alice (A,B,NA ,NB )

NA Fresh, πA (A,B)

where π(A,B) = Pr(A), PrvK(A,KA

  • 1),

Pr(B), PubK(B,KB )

⊥

A0

(A)

πA0 (A) → A0 (A), πA0 (A)

where πA0(A) = Pr(A), PrvK(A,KA

  • 1)

…

(1)

slide-36
SLIDE 36

Relating Strands and Multiset Rewriting for Security Protocols

NS: Strands MSR

Alice (A,B,NA ,NB )

NA Fresh, πA (A,B)

where π(A,B) = Pr(A), PrvK(A,KA

  • 1),

Pr(B), PubK(B,KB )

A0

(A), πA1 (B) → ∃NA .

A1

(A,B,NA ),

N({NA

,A}KB ), πA1 (B)

where πA1(B) = Pr(B), PubK(B,KB)

…

{NA , A}KB

A0

(A)

A1

(A,B,NA )

…

(2)

slide-37
SLIDE 37

Relating Strands and Multiset Rewriting for Security Protocols

NS: Strands MSR

Alice (A,B,NA ,NB )

NA Fresh, πA (A,B)

where π(A,B) = Pr(A), PrvK(A,KA

  • 1),

Pr(B), PubK(B,KB )

A1

(A,B, NA ),

N({NA

,NB }KA ) →

A2

(A,B,NA ,NB )

…

{NA , NB }KA

A1

(A,B,NA )

A2

(A,B,NA ,NB )

…

(3)

slide-38
SLIDE 38

Relating Strands and Multiset Rewriting for Security Protocols

What did we learn?

  • Substantial equivalence of
  • MSR
  • Strands
  • Strands as executable spec. language
  • Parametric strands
  • Configurations, transitions
  • Computational traces
  • Bundles
  • Transition sequences