[PPT] - The Coinductive Approach to Verifying Cryptographic Protocols Jesse PowerPoint Presentation

SLIDE 1

The Coinductive Approach to Verifying Cryptographic Protocols

Jesse Hughes joint work with Martijn Warnier

jesseh@cs.kun.nl

University of Nijmegen

The Coinductive Approach to Verifying Cryptographic Protocols – p.1/27

SLIDE 2

Outline

I. Cryptographic protocols in general

The Coinductive Approach to Verifying Cryptographic Protocols – p.2/27

SLIDE 3

Outline

I. Cryptographic protocols in general
II. An example protocol

The Coinductive Approach to Verifying Cryptographic Protocols – p.2/27

SLIDE 4

Outline

I. Cryptographic protocols in general
II. An example protocol
III. Coalgebra primer

The Coinductive Approach to Verifying Cryptographic Protocols – p.2/27

SLIDE 5

Outline

I. Cryptographic protocols in general
II. An example protocol
III. Coalgebra primer
IV. Temporal operators/Galois algebras

The Coinductive Approach to Verifying Cryptographic Protocols – p.2/27

SLIDE 6

Outline

I. Cryptographic protocols in general
II. An example protocol
III. Coalgebra primer
IV. Temporal operators/Galois algebras
V. The specification language CCSL

The Coinductive Approach to Verifying Cryptographic Protocols – p.2/27

SLIDE 7

Outline

I. Cryptographic protocols in general
II. An example protocol
III. Coalgebra primer
IV. Temporal operators/Galois algebras
V. The specification language CCSL
VI. The CCSL compiler

The Coinductive Approach to Verifying Cryptographic Protocols – p.2/27

SLIDE 8

Outline

I. Cryptographic protocols in general
II. An example protocol
III. Coalgebra primer
IV. Temporal operators/Galois algebras
V. The specification language CCSL
VI. The CCSL compiler
VII. Security protocols revisited

The Coinductive Approach to Verifying Cryptographic Protocols – p.2/27

SLIDE 9

Outline

I. Cryptographic protocols in general
II. An example protocol
III. Coalgebra primer
IV. Temporal operators/Galois algebras
V. The specification language CCSL
VI. The CCSL compiler
VII. Security protocols revisited
VIII. Paulson’s inductive method

The Coinductive Approach to Verifying Cryptographic Protocols – p.2/27

SLIDE 10

Outline

I. Cryptographic protocols in general
II. An example protocol
III. Coalgebra primer
IV. Temporal operators/Galois algebras
V. The specification language CCSL
VI. The CCSL compiler
VII. Security protocols revisited
VIII. Paulson’s inductive method

The Coinductive Approach to Verifying Cryptographic Protocols – p.2/27

SLIDE 11

Outline

I. Cryptographic protocols in general
II. An example protocol
III. Coalgebra primer
IV. Temporal operators/Galois algebras
V. The specification language CCSL
VI. The CCSL compiler
VII. Security protocols revisited
VIII. Paulson’s inductive method

The Coinductive Approach to Verifying Cryptographic Protocols – p.2/27

SLIDE 12

Outline

I. Cryptographic protocols in general
II. An example protocol
III. Coalgebra primer
IV. Temporal operators/Galois algebras
V. The specification language CCSL
VI. The CCSL compiler
VII. Security protocols revisited
VIII. Paulson’s inductive method

The Coinductive Approach to Verifying Cryptographic Protocols – p.2/27

SLIDE 13

Outline

I. Cryptographic protocols in general
II. An example protocol
III. Coalgebra primer
IV. Temporal operators/Galois algebras
V. The specification language CCSL
VI. The CCSL compiler
VII. Security protocols revisited
VIII. Paulson’s inductive method

The Coinductive Approach to Verifying Cryptographic Protocols – p.2/27

SLIDE 14

Part One: The Background

The Coinductive Approach to Verifying Cryptographic Protocols – p.3/27

SLIDE 15

Cryptographic Protocols

Cryptographic Protocols, Abstract representation for:

The Coinductive Approach to Verifying Cryptographic Protocols – p.4/27

SLIDE 16

Cryptographic Protocols

Cryptographic Protocols, Abstract representation for:

Distributing secret keys over an open (insecure)

network.

The Coinductive Approach to Verifying Cryptographic Protocols – p.4/27

SLIDE 17

Cryptographic Protocols

Cryptographic Protocols, Abstract representation for:

Distributing secret keys over an open (insecure)

network.

Authenticating principals to each other.

The Coinductive Approach to Verifying Cryptographic Protocols – p.4/27

SLIDE 18

Cryptographic Protocols

Cryptographic Protocols, Abstract representation for:

Distributing secret keys over an open (insecure)

network.

Authenticating principals to each other.
Assuring secrecy of message content.

The Coinductive Approach to Verifying Cryptographic Protocols – p.4/27

SLIDE 19

Cryptographic Protocols

Cryptographic Protocols, Abstract representation for:

Distributing secret keys over an open (insecure)

network.

Authenticating principals to each other.
Assuring secrecy of message content.
Assuring integrity of messages.

The Coinductive Approach to Verifying Cryptographic Protocols – p.4/27

SLIDE 20

Cryptographic Protocols

Cryptographic Protocols, Abstract representation for:

Distributing secret keys over an open (insecure)

network.

Authenticating principals to each other.
Assuring secrecy of message content.
Assuring integrity of messages.
A combination of all of the above.

The Coinductive Approach to Verifying Cryptographic Protocols – p.4/27

SLIDE 21

An example Protocol

Bilateral Key Exchange with Public Key Protocol: a simple protocol for distributing a symmetric key.

The Coinductive Approach to Verifying Cryptographic Protocols – p.5/27

SLIDE 22

An example Protocol

Bilateral Key Exchange with Public Key Protocol: a simple protocol for distributing a symmetric key.

1. B → A : B, {NB, B}pkA

Principal B sends to Principal A a message containing

his name, B,

The Coinductive Approach to Verifying Cryptographic Protocols – p.5/27

SLIDE 23

An example Protocol

Bilateral Key Exchange with Public Key Protocol: a simple protocol for distributing a symmetric key.

1. B → A : B, {NB, B}pkA

Principal B sends to Principal A a message containing

his name, B,
and a nonce, NB.

The Coinductive Approach to Verifying Cryptographic Protocols – p.5/27

SLIDE 24

An example Protocol

Bilateral Key Exchange with Public Key Protocol: a simple protocol for distributing a symmetric key.

1. B → A : B, {NB, B}pkA

Principal B sends to Principal A a message containing

his name, B,
and a nonce, NB.

This is (mostly) encrypted with A’s public key, pkA.

The Coinductive Approach to Verifying Cryptographic Protocols – p.5/27

SLIDE 25

An example Protocol

Bilateral Key Exchange with Public Key Protocol: a simple protocol for distributing a symmetric key.

1. B → A : B, {NB, B}pkA
2. A → B : {Sha(NB), NA, A, KAB}pkB

A replies with a message containing

a hash of B’s nonce,

The Coinductive Approach to Verifying Cryptographic Protocols – p.5/27

SLIDE 26

An example Protocol

Bilateral Key Exchange with Public Key Protocol: a simple protocol for distributing a symmetric key.

1. B → A : B, {NB, B}pkA
2. A → B : {Sha(NB), NA, A, KAB}pkB

A replies with a message containing

a hash of B’s nonce,
a fresh nonce, NA,

The Coinductive Approach to Verifying Cryptographic Protocols – p.5/27

SLIDE 27

An example Protocol

Bilateral Key Exchange with Public Key Protocol: a simple protocol for distributing a symmetric key.

1. B → A : B, {NB, B}pkA
2. A → B : {Sha(NB), NA, A, KAB}pkB

A replies with a message containing

a hash of B’s nonce,
a fresh nonce, NA,
A’s name, A,

The Coinductive Approach to Verifying Cryptographic Protocols – p.5/27

SLIDE 28

An example Protocol

Bilateral Key Exchange with Public Key Protocol: a simple protocol for distributing a symmetric key.

1. B → A : B, {NB, B}pkA
2. A → B : {Sha(NB), NA, A, KAB}pkB

A replies with a message containing

a hash of B’s nonce,
a fresh nonce, NA,
A’s name, A,
and a key, KAB.

The Coinductive Approach to Verifying Cryptographic Protocols – p.5/27

SLIDE 29

An example Protocol

Bilateral Key Exchange with Public Key Protocol: a simple protocol for distributing a symmetric key.

1. B → A : B, {NB, B}pkA
2. A → B : {Sha(NB), NA, A, KAB}pkB

A replies with a message containing

a hash of B’s nonce,
a fresh nonce, NA,
A’s name, A,
and a key, KAB.

All of this is encrypted with B’s public key, pkB.

The Coinductive Approach to Verifying Cryptographic Protocols – p.5/27

SLIDE 30

An example Protocol

Bilateral Key Exchange with Public Key Protocol: a simple protocol for distributing a symmetric key.

1. B → A : B, {NB, B}pkA
2. A → B : {Sha(NB), NA, A, KAB}pkB
3. B → A : {Sha(NA)}KAB

B replies with a hash of NA

The Coinductive Approach to Verifying Cryptographic Protocols – p.5/27

SLIDE 31

An example Protocol

Bilateral Key Exchange with Public Key Protocol: a simple protocol for distributing a symmetric key.

1. B → A : B, {NB, B}pkA
2. A → B : {Sha(NB), NA, A, KAB}pkB
3. B → A : {Sha(NA)}KAB

B replies with a hash of NA encrypted with the session key KAB.

The Coinductive Approach to Verifying Cryptographic Protocols – p.5/27

SLIDE 32

Analysis

It would be nice to know that, if two participants use a protocol, the outcome is good.

The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27

SLIDE 33

Analysis

It would be nice to know that, if two participants use a protocol, the outcome is good.

No one learns the key they agree to use;

The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27

SLIDE 34

Analysis

It would be nice to know that, if two participants use a protocol, the outcome is good.

No one learns the key they agree to use;
Both of them know the key;

The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27

SLIDE 35

Analysis

It would be nice to know that, if two participants use a protocol, the outcome is good.

No one learns the key they agree to use;
Both of them know the key;
Each is aware the other knows the key.

The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27

SLIDE 36

Analysis

It would be nice to know that, if two participants use a protocol, the outcome is good.

No one learns the key they agree to use;
Both of them know the key;
Each is aware the other knows the key.

For this, we need an appropriate model in which to reason about the protocols.

The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27

SLIDE 37

Analysis

It would be nice to know that, if two participants use a protocol, the outcome is good.

No one learns the key they agree to use;
Both of them know the key;
Each is aware the other knows the key.

For this, we need an appropriate model in which to reason about the protocols. We analyze the protocol using a Dolev-Yao security model. That is, we create a model consisting of

any number of “normal” agents and

The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27

SLIDE 38

Analysis

It would be nice to know that, if two participants use a protocol, the outcome is good.

No one learns the key they agree to use;
Both of them know the key;
Each is aware the other knows the key.

For this, we need an appropriate model in which to reason about the protocols. We analyze the protocol using a Dolev-Yao security model. That is, we create a model consisting of

any number of “normal” agents and
one very powerful spy.

The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27

SLIDE 39

Analysis

It would be nice to know that, if two participants use a protocol, the outcome is good.

No one learns the key they agree to use;
Both of them know the key;
Each is aware the other knows the key.

For this, we need an appropriate model in which to reason about the protocols. We analyze the protocol using a Dolev-Yao security model. That is, we create a model consisting of

any number of “normal” agents and
one very powerful spy.

We then prove that the conditions above hold.

The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27

SLIDE 40

Analysis

Requirements: needed for:

to model abstract data types

messages

The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27

SLIDE 41

Analysis

Requirements: needed for:

to model abstract data types

messages

to model dynamic systems

users’ knowledge

The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27

SLIDE 42

Analysis

Requirements: needed for:

to model abstract data types

messages

to model dynamic systems

users’ knowledge

to use temporal reasoning

correctness conditions

The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27

SLIDE 43

Analysis

Requirements: needed for:

to model abstract data types

messages

to model dynamic systems

users’ knowledge

to use temporal reasoning

correctness conditions The language CCSL allows all of this.

The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27

SLIDE 44

Analysis

Requirements: theory:

to model abstract data types

algebra

to model dynamic systems
to use temporal reasoning

The language CCSL allows all of this. CCSL is built upon an abstract mathematical foundation.

The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27

SLIDE 45

Analysis

Requirements: theory:

to model abstract data types

algebra

to model dynamic systems

coalgebra

to use temporal reasoning

The language CCSL allows all of this. CCSL is built upon an abstract mathematical foundation.

The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27

SLIDE 46

Analysis

Requirements: theory:

to model abstract data types

algebra

to model dynamic systems

coalgebra

to use temporal reasoning

Galois algebra The language CCSL allows all of this. CCSL is built upon an abstract mathematical foundation.

The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27

SLIDE 47

Part Two: The Theory

The Coinductive Approach to Verifying Cryptographic Protocols – p.7/27

SLIDE 48

Algebra primer

Let Σ be a signature, i.e., Σ = {f (ni)

i

| i ∈ I}.

The Coinductive Approach to Verifying Cryptographic Protocols – p.8/27

SLIDE 49

Algebra primer

Let Σ be a signature, i.e., Σ = {f (ni)

i

| i ∈ I}. A Σ-algebra is a set A together with an interpretation for each fi.

The Coinductive Approach to Verifying Cryptographic Protocols – p.8/27

SLIDE 50

Algebra primer

Example: Σ = {e, −−1, ×}. 1 A A × A A

−1

×
e
The Coinductive Approach to Verifying Cryptographic Protocols – p.8/27

SLIDE 51

Algebra primer

Example: Σ = {e, −−1, ×}. 1 + A + A × A A

The Coinductive Approach to Verifying Cryptographic Protocols – p.8/27

SLIDE 52

Algebra primer

Example: Σ = {e, −−1, ×}. 1 + A + A × A FA

A
A

Let F :SET

SET be given. An F-algebra is a set A

with a structure FA

A

The Coinductive Approach to Verifying Cryptographic Protocols – p.8/27

SLIDE 53

Algebra primer

Example: Σ = {e, −−1, ×}. 1 + A + A × A FA

A
A

For polynomial functors, an F-algebra is a universal algebra.

The Coinductive Approach to Verifying Cryptographic Protocols – p.8/27

SLIDE 54

Coalgebra primer

Example: 1 + A + A × A FA

A
A

The Coinductive Approach to Verifying Cryptographic Protocols – p.9/27

SLIDE 55

Coalgebra primer

Example: 1 + A + A × A FA A

A
An F-coalgebra is a set A with a structure

FA A

The Coinductive Approach to Verifying Cryptographic Protocols – p.9/27

SLIDE 56

Coalgebra primer

Example: 1 + A + A × A FA A

A
An F-coalgebra is a set A with a structure

FA A

Think: a coalgebra is a set in which each element can be

decomposed as elements of a structured set.

The Coinductive Approach to Verifying Cryptographic Protocols – p.9/27

SLIDE 57

Coalgebra primer

Example: 1 + A + A × A FA A

A
Coalgebras model non-well-founded structures, including

infinitary trees, streams, etc.

The Coinductive Approach to Verifying Cryptographic Protocols – p.9/27

SLIDE 58

Coalgebra primer

Example: 1 + A + A × A FA A

A
Coalgebras can also represent dynamic systems.

The Coinductive Approach to Verifying Cryptographic Protocols – p.9/27

SLIDE 59

Coalgebra primer

Example: 1 + A + A × A FA A

A
Coalgebras can also represent dynamic systems.

In security protocols, the principals’ knowledge changes

ver time as messages are sent and received.

The Coinductive Approach to Verifying Cryptographic Protocols – p.9/27

SLIDE 60

Coalgebra primer

Example: 1 + A + A × A FA A

A
Coalgebras can also represent dynamic systems.

In security protocols, the principals’ knowledge changes

ver time as messages are sent and received.

Hence, we use a coalgebraic model.

The Coinductive Approach to Verifying Cryptographic Protocols – p.9/27

SLIDE 61

Coalgebraic signatures

An algebraic signature is given by declarations: fi:Xni

X

The Coinductive Approach to Verifying Cryptographic Protocols – p.10/27

SLIDE 62

Coalgebraic signatures

An algebraic signature is given by declarations: fi:FiX

X

The Coinductive Approach to Verifying Cryptographic Protocols – p.10/27

SLIDE 63

Coalgebraic signatures

An algebraic signature is given by declarations: fi:FiX

X

Equivalently, f :

i FiX X

The Coinductive Approach to Verifying Cryptographic Protocols – p.10/27

SLIDE 64

Coalgebraic signatures

An algebraic signature is given by declarations: fi:FiX

X

Equivalently, f :

i FiX X

A coalgebraic signature is given by declarations fi:X

FiX

The Coinductive Approach to Verifying Cryptographic Protocols – p.10/27

SLIDE 65

Coalgebraic signatures

An algebraic signature is given by declarations: fi:FiX

X

Equivalently, f :

i FiX X

A coalgebraic signature is given by declarations fi:X

FiX

Equivalently, f :X

i FiX

The Coinductive Approach to Verifying Cryptographic Protocols – p.10/27

SLIDE 66

Examples

FX Initial algebra Final coalgebra

Z × X ∅ infinite streams

The Coinductive Approach to Verifying Cryptographic Protocols – p.11/27

SLIDE 67

Examples

FX Initial algebra Final coalgebra

Z × X ∅ infinite streams 1 + Z × X finite streams finite and infinite streams

The Coinductive Approach to Verifying Cryptographic Protocols – p.11/27

SLIDE 68

Examples

FX Initial algebra Final coalgebra

Z × X ∅ infinite streams 1 + Z × X finite streams finite and infinite streams 1 + X × X finite trees finite and infinite trees

The Coinductive Approach to Verifying Cryptographic Protocols – p.11/27

SLIDE 69

Examples

FX Initial algebra Final coalgebra

Z × X ∅ infinite streams 1 + Z × X finite streams finite and infinite streams 1 + X × X finite trees finite and infinite trees PωX finite, arb. branching trees Kripke frame

The Coinductive Approach to Verifying Cryptographic Protocols – p.11/27

SLIDE 70

Our coalgebra

A B Spy

Consider a run with three principals: A, B and the Spy.

The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27

SLIDE 71

Our coalgebra

A B Spy

Consider a run with three principals: A, B and the Spy. Suppose that A sends a message to B.

The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27

SLIDE 72

Our coalgebra

!

Then, in the next instant, the Spy learns the message.

The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27

SLIDE 73

Our coalgebra

!

Then, in the next instant, the Spy learns the message. Supposing that the message arrives at that time, then...

The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27

SLIDE 74

Our coalgebra

!
!

...the next instant, B learns the message, too.

The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27

SLIDE 75

Our coalgebra

!
!

So, to describe this system, we use a coalgebra with

a method giving the next state,

The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27

SLIDE 76

Our coalgebra

!
!

So, to describe this system, we use a coalgebra with

a method giving the next state,
attributes describing the action occurring,

The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27

SLIDE 77

Our coalgebra

!
!

So, to describe this system, we use a coalgebra with

a method giving the next state,
attributes describing the action occurring,
attributes describing the participants’ knowledge.

The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27

SLIDE 78

Our coalgebra

!
!

MsgContext : CLASSSPEC METHOD

✁

✂ ✄

: Self → Self

☎✆ ✄ ✝✟✞

: Self → {idle, sent, received}

✠

✞

✡ ☛

: Self × Princ → [Message → Bool]

The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27

SLIDE 79

Our coalgebra

!
!

We would like to prove, e.g., that The Spy never learns the session key.

The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27

SLIDE 80

Our coalgebra

!
!

We would like to prove, e.g., that The Spy never learns the session key. For this, we need to reason temporally.

The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27

SLIDE 81

Our coalgebra

!
!

We would like to prove, e.g., that The Spy never learns the session key. For this, we need to reason temporally. Categories of coalgebras come with temporal operators, which we can understand in terms of Galois algebras.

The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27

SLIDE 82

Galois algebras

A Galois algebra is a complete, Boolean algebra P together with an operation [ ]:P

P

which preserves meets.

The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27

SLIDE 83

Galois algebras

A Galois algebra is a complete, Boolean algebra P together with an operation [ ]:P

P

which preserves meets. Think: [ ]P(x) means P holds for all successor states of x.

The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27

SLIDE 84

Galois algebras

A Galois algebra is a complete, Boolean algebra P together with an operation [ ]:P

P

which preserves meets. Think: [ ]P(x) means P holds for all successor states of x. With just these assumptions, we can develop a remarkable amount of temporal logic.

The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27

SLIDE 85

Galois algebras ← ⊣ [ ]

[ ] is part of a Galois connection, with left adjoint ←.

The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27

SLIDE 86

Galois algebras ← ⊣ [ ] [ ]←

Each operator has a conjugate, [ ]← = ¬ ←¬ = ¬[ ]¬

The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27

SLIDE 87

Galois algebras ← ⊣ [ ] [ ]← ⊢

This yields another Galois connection.

The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27

SLIDE 88

Galois algebras ← ⊣ [ ]

Next time

[ ]← ⊢

In our interpretation, [ ] means “in every next state”. [ ]P = {p | ∀p → r . P(r)}

The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27

SLIDE 89

Galois algebras ← ⊣ [ ]

Next time

[ ]← ⊢

In our interpretation, [ ] means “in every next state”. [ ]P = {p | ∀p → r . P(r)} A proposition P such that P implies [ ]P is called an invariant.

The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27

SLIDE 90

Galois algebras ← ⊣ [ ]

Next time

[ ]← ⊢

In our interpretation, [ ] means “in every next state”. [ ]P = {p | ∀p → r . P(r)} A proposition P such that P implies [ ]P is called an invariant. Invariants are the coalgebraic analogues to inductive predicates.

The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27

SLIDE 91

Galois algebras

Some time preceding ←

⊣ [ ]

Next time Always preceding [ ]←

⊢

Some next time This induces the remaining interpretations.

The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27

SLIDE 92

Galois algebras

Some time preceding ←

⊣ [ ]

Next time Always preceding [ ]←

⊢

Some next time This induces the remaining interpretations.

The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27

SLIDE 93

Galois algebras

Some time preceding ←

⊣ [ ]

Next time Always preceding [ ]←

⊢

Some next time This induces the remaining interpretations.

The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27

SLIDE 94

Galois algebras

Some time preceding ←

⊣ [ ]

Next time Always preceding [ ]←

⊢

Some next time This allows us to represent statements like If B receives a message at time t, then B knows the message at t + 1.

The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27

SLIDE 95

Galois algebras

Some time preceding ←

⊣ [ ]

Next time Always preceding [ ]←

⊢

Some next time Note: from just a complete partial order with a meet-preserving operator, we get the remaining three

perators.

The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27

SLIDE 96

Galois algebras

Some time preceding ←

⊣ [ ]

Next time Always preceding [ ]←

⊢

Some next time Note: from just a complete partial order with a meet-preserving operator, we get the remaining three

perators.

But wait! There’s more...

The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27

SLIDE 97

Fixed point operators

Always We can define an “always” operator via a fixed point construction:

☞

P = νZ . P ∧ [ ]Z

The Coinductive Approach to Verifying Cryptographic Protocols – p.14/27

SLIDE 98

Fixed point operators

Always We can define an “always” operator via a fixed point construction:

☞

P = νZ . P ∧ [ ]Z

☞

P is the greatest invariant contained in P.

The Coinductive Approach to Verifying Cryptographic Protocols – p.14/27

SLIDE 99

Fixed point operators

Always We can define an “always” operator via a fixed point construction:

☞

P = νZ . P ∧ [ ]Z

☞

P is the greatest invariant contained in P. This operator preserves meets, so we have another Galois algebra.

The Coinductive Approach to Verifying Cryptographic Protocols – p.14/27

SLIDE 100

Fixed point operators

Once ✸←

⊣

Always Previously ←

⊢ ✸

Eventually This yields the remaining operators and interpretations.

The Coinductive Approach to Verifying Cryptographic Protocols – p.14/27

SLIDE 101

Fixed point operators

Once ✸←

⊣

Always Previously ←

⊢ ✸

Eventually Now, we can represent statements like The Spy never learns the private keys of the other principals.

The Coinductive Approach to Verifying Cryptographic Protocols – p.14/27

SLIDE 102

Fixed point operators

Once ✸←

⊣

Always Previously ←

⊢ ✸

Eventually All of this structure just comes from the presence of the “next time” operator, [ ].

The Coinductive Approach to Verifying Cryptographic Protocols – p.14/27

SLIDE 103

Part Three: CCSL

The Coinductive Approach to Verifying Cryptographic Protocols – p.15/27

SLIDE 104

Overview

The mathematical theories of algebra, coalgebra and Galois algebras give us a number of tools for reasoning about class specifications.

The Coinductive Approach to Verifying Cryptographic Protocols – p.16/27

SLIDE 105

Overview

The mathematical theories of algebra, coalgebra and Galois algebras give us a number of tools for reasoning about class specifications. CCSL provides a means for expressing a class specification in terms of these theories.

Class Spec

The Coinductive Approach to Verifying Cryptographic Protocols – p.16/27

SLIDE 106

Overview

The compiler translates a specification into a formal, logical theory (in PVS/Isabelle).

CCSL Class PVS Theory Spec

The Coinductive Approach to Verifying Cryptographic Protocols – p.16/27

SLIDE 107

Overview

This theory includes induction (algebra), coinduction (coalgebra), temporal axioms (Galois algebra), etc.

CCSL Class PVS Theory Spec Informal Theory

The Coinductive Approach to Verifying Cryptographic Protocols – p.16/27

SLIDE 108

Overview

The user then proves the correctness of the specification in the theorem prover.

CCSL User Class Theory Spec Proof PVS

The Coinductive Approach to Verifying Cryptographic Protocols – p.16/27

SLIDE 109

The specification language CCSL

The Coalgebraic Class Specification Language is a formal language for writing specifications of:

The Coinductive Approach to Verifying Cryptographic Protocols – p.17/27

SLIDE 110

The specification language CCSL

The Coalgebraic Class Specification Language is a formal language for writing specifications of:

Object oriented classes

The Coinductive Approach to Verifying Cryptographic Protocols – p.17/27

SLIDE 111

The specification language CCSL

The Coalgebraic Class Specification Language is a formal language for writing specifications of:

Object oriented classes
Abstract data types

The Coinductive Approach to Verifying Cryptographic Protocols – p.17/27

SLIDE 112

The specification language CCSL

The Coalgebraic Class Specification Language is a formal language for writing specifications of: Models

Object oriented classes

Coalgebras

Abstract data types

Algebras

The Coinductive Approach to Verifying Cryptographic Protocols – p.17/27

SLIDE 113

The specification language CCSL

The Coalgebraic Class Specification Language is a formal language for writing specifications of: Models

Object oriented classes

Greatest fixed point

Abstract data types

Least fixed point

The Coinductive Approach to Verifying Cryptographic Protocols – p.17/27

SLIDE 114

The specification language CCSL

The Coalgebraic Class Specification Language is a formal language for writing specifications of: Reasoning

Object oriented classes

Coinductive

Abstract data types

Inductive

The Coinductive Approach to Verifying Cryptographic Protocols – p.17/27

SLIDE 115

The specification language CCSL

The Coalgebraic Class Specification Language is a formal language for writing specifications of:

Object oriented classes
Abstract data types

In our setting, we represent:

The Coinductive Approach to Verifying Cryptographic Protocols – p.17/27

SLIDE 116

The specification language CCSL

The Coalgebraic Class Specification Language is a formal language for writing specifications of:

Object oriented classes
Abstract data types

In our setting, we represent:

static structure by an abstract data type

(e.g. the set of messages);

The Coinductive Approach to Verifying Cryptographic Protocols – p.17/27

SLIDE 117

The specification language CCSL

The Coalgebraic Class Specification Language is a formal language for writing specifications of:

Object oriented classes
Abstract data types

In our setting, we represent:

static structure by an abstract data type

(e.g. the set of messages);

dynamic structure by a class

(e.g. principal’s current knowledge).

The Coinductive Approach to Verifying Cryptographic Protocols – p.17/27

SLIDE 118

CCSL class specs

A class specification consists of:

The Coinductive Approach to Verifying Cryptographic Protocols – p.18/27

SLIDE 119

CCSL class specs

A class specification consists of:

Coalgebraic method declarations;

The Coinductive Approach to Verifying Cryptographic Protocols – p.18/27

SLIDE 120

CCSL class specs

A class specification consists of:

Coalgebraic method declarations;
Assertions (axioms);

The Coinductive Approach to Verifying Cryptographic Protocols – p.18/27

SLIDE 121

CCSL class specs

A class specification consists of:

Coalgebraic method declarations;
Assertions (axioms);
Theorems (to be proved).

The Coinductive Approach to Verifying Cryptographic Protocols – p.18/27

SLIDE 122

CCSL class specs

A class specification consists of:

Coalgebraic method declarations;
Assertions (axioms);
Theorems (to be proved).

The method declarations define a coalgebraic signature.

The Coinductive Approach to Verifying Cryptographic Protocols – p.18/27

SLIDE 123

CCSL class specs

A class specification consists of:

Coalgebraic method declarations;
Assertions (axioms);
Theorems (to be proved).

The method declarations define a coalgebraic signature. MsgContext : CLASSSPEC METHOD

✁

✂ ✄

: Self → Self

☎✆ ✄ ✝✟✞

: Self → {idle, sent, received}

✠

✞

✡ ☛

: Self × Princ → [Message → Bool]

The Coinductive Approach to Verifying Cryptographic Protocols – p.18/27

SLIDE 124

CCSL class specs

A class specification consists of:

Coalgebraic method declarations;
Assertions (axioms);
Theorems (to be proved).

The assertions restrict the models of the signature.

The Coinductive Approach to Verifying Cryptographic Protocols – p.18/27

SLIDE 125

CCSL class specs

A class specification consists of:

Coalgebraic method declarations;
Assertions (axioms);
Theorems (to be proved).

The assertions restrict the models of the signature. Assertions are axioms for the specification.

The Coinductive Approach to Verifying Cryptographic Protocols – p.18/27

SLIDE 126

CCSL class specs

A class specification consists of:

Coalgebraic method declarations;
Assertions (axioms);
Theorems (to be proved).

The assertions restrict the models of the signature. Assertions are axioms for the specification. Here’s where the assumptions come in!

The Coinductive Approach to Verifying Cryptographic Protocols – p.18/27

SLIDE 127

CCSL class specs

A class specification consists of:

Coalgebraic method declarations;
Assertions (axioms);
Theorems (to be proved).

The theorems are claims to be proved (by the user).

The Coinductive Approach to Verifying Cryptographic Protocols – p.18/27

SLIDE 128

CCSL class specs

A class specification consists of:

Coalgebraic method declarations;
Assertions (axioms);
Theorems (to be proved).

The theorems are claims to be proved (by the user). Correctness conditions for a specification are represented as theorems.

The Coinductive Approach to Verifying Cryptographic Protocols – p.18/27

SLIDE 129

The CCSL compiler

Input: class and abstract data specifications.

The Coinductive Approach to Verifying Cryptographic Protocols – p.19/27

SLIDE 130

The CCSL compiler

Input: class and abstract data specifications. Output: PVS theories including axioms, definitions, etc.

The Coinductive Approach to Verifying Cryptographic Protocols – p.19/27

SLIDE 131

The CCSL compiler

Input: class and abstract data specifications. Output: PVS theories including axioms, definitions, etc. This includes:

definitions of invariant predicate, homomorphism, etc.,

The Coinductive Approach to Verifying Cryptographic Protocols – p.19/27

SLIDE 132

The CCSL compiler

Input: class and abstract data specifications. Output: PVS theories including axioms, definitions, etc. This includes:

definitions of invariant predicate, homomorphism, etc.,
principles of induction, coinduction, etc.,

The Coinductive Approach to Verifying Cryptographic Protocols – p.19/27

SLIDE 133

The CCSL compiler

Input: class and abstract data specifications. Output: PVS theories including axioms, definitions, etc. This includes:

definitions of invariant predicate, homomorphism, etc.,
principles of induction, coinduction, etc.,
basic theory of temporal operators.

The Coinductive Approach to Verifying Cryptographic Protocols – p.19/27

SLIDE 134

Part Four: The Application

The Coinductive Approach to Verifying Cryptographic Protocols – p.20/27

SLIDE 135

Back to security protocols

Considering protocols like:

1. B → A : B, {NB, B}pkA
2. A → B : {Sha(NB), NA, A, KAB}pkB
3. B → A : {Sha(NA)}KAB

The Coinductive Approach to Verifying Cryptographic Protocols – p.21/27

SLIDE 136

Back to security protocols

Considering protocols like:

1. B → A : B, {NB, B}pkA
2. A → B : {Sha(NB), NA, A, KAB}pkB
3. B → A : {Sha(NA)}KAB

We make a number of assumptions:

Perfect cryptography assumption

The Coinductive Approach to Verifying Cryptographic Protocols – p.21/27

SLIDE 137

Back to security protocols

Considering protocols like:

1. B → A : B, {NB, B}pkA
2. A → B : {Sha(NB), NA, A, KAB}pkB
3. B → A : {Sha(NA)}KAB

We make a number of assumptions:

Perfect cryptography assumption
Dolev-Yao model : Spy can read (but not nec. decrypt)

any message in the network

The Coinductive Approach to Verifying Cryptographic Protocols – p.21/27

SLIDE 138

Back to security protocols

Considering protocols like:

1. B → A : B, {NB, B}pkA
2. A → B : {Sha(NB), NA, A, KAB}pkB
3. B → A : {Sha(NA)}KAB

We make a number of assumptions:

Perfect cryptography assumption
Dolev-Yao model : Spy can read (but not nec. decrypt)

any message in the network

Other assumptions: freshness, “perfect” hashes, true

randomness of nonces.

The Coinductive Approach to Verifying Cryptographic Protocols – p.21/27

SLIDE 139

Back to security protocols

Considering protocols like:

1. B → A : B, {NB, B}pkA
2. A → B : {Sha(NB), NA, A, KAB}pkB
3. B → A : {Sha(NA)}KAB

We do not assume:

a fixed number of participants

The Coinductive Approach to Verifying Cryptographic Protocols – p.21/27

SLIDE 140

Back to security protocols

Considering protocols like:

1. B → A : B, {NB, B}pkA
2. A → B : {Sha(NB), NA, A, KAB}pkB
3. B → A : {Sha(NA)}KAB

We do not assume:

a fixed number of participants
a limited number of parallel protocol runs

The Coinductive Approach to Verifying Cryptographic Protocols – p.21/27

SLIDE 141

Back to security protocols

Considering protocols like:

1. B → A : B, {NB, B}pkA
2. A → B : {Sha(NB), NA, A, KAB}pkB
3. B → A : {Sha(NA)}KAB

We do not assume:

a fixed number of participants
a limited number of parallel protocol runs
participants send only protocol messages

The Coinductive Approach to Verifying Cryptographic Protocols – p.21/27

SLIDE 142

The Message Context class

The assumptions common to all security protocols go into the Message Context class, MsgContext. This class:

The Coinductive Approach to Verifying Cryptographic Protocols – p.22/27

SLIDE 143

The Message Context class

The assumptions common to all security protocols go into the Message Context class, MsgContext. This class:

Represents the state of the system at a point in time;

The Coinductive Approach to Verifying Cryptographic Protocols – p.22/27

SLIDE 144

The Message Context class

The assumptions common to all security protocols go into the Message Context class, MsgContext. This class:

Represents the state of the system at a point in time;
Axiomatizes the effects of sending and receiving

messages;

The Coinductive Approach to Verifying Cryptographic Protocols – p.22/27

SLIDE 145

The Message Context class

The assumptions common to all security protocols go into the Message Context class, MsgContext. This class:

Represents the state of the system at a point in time;
Axiomatizes the effects of sending and receiving

messages;

Restricts the possible actions of the participants.

The Coinductive Approach to Verifying Cryptographic Protocols – p.22/27

SLIDE 146

MsgContext: sample methods

MsgContext : CLASSSPEC METHOD

✁

✂ ✄

: Self → Self

☎ ✆ ✄ ✝✟✞

: Self → {idle, sent, received}

✠

✞

✡ ☛

: Self × Princ → [Message → Bool] The basic methods represent

the flow of time (
✁

✂ ✄

),

The Coinductive Approach to Verifying Cryptographic Protocols – p.22/27

SLIDE 147

MsgContext: sample methods

MsgContext : CLASSSPEC METHOD

✁

✂ ✄

: Self → Self

☎ ✆ ✄ ✝✟✞

: Self → {idle, sent, received}

✠

✞

✡ ☛

: Self × Princ → [Message → Bool] The basic methods represent

the flow of time (
✁

✂ ✄

),

the action occurring (

☎ ✆ ✄ ✝ ✞

),

The Coinductive Approach to Verifying Cryptographic Protocols – p.22/27

SLIDE 148

MsgContext: sample methods

MsgContext : CLASSSPEC METHOD

✁

✂ ✄

: Self → Self

☎ ✆ ✄ ✝✟✞

: Self → {idle, sent, received}

✠

✞

✡ ☛

: Self × Princ → [Message → Bool] The basic methods represent

the flow of time (
✁

✂ ✄

),

the action occurring (

☎ ✆ ✄ ✝ ✞

),
the state of the principals’ knowledge (

✠

✞

✡ ☛

).

The Coinductive Approach to Verifying Cryptographic Protocols – p.22/27

SLIDE 149

MsgContext: sample assertion

MsgContext : CLASSSPEC METHOD

✁

✂ ✄

: Self → Self

☎✆ ✄ ✝✟✞

: Self → {idle, sent, received}

✠

✞

✡ ☛

: Self × Princ → [Message → Bool] ASSERTION

☎✆ ✄ ✝✟✞

(x) = idle ⇒

∀(P : Princ) : x.

✠

✞

✡ ☛

(P) = x.

✁

✂ ✄

.

✠

✞

✡ ☛

(P) Knowledge does not change if idle.

The Coinductive Approach to Verifying Cryptographic Protocols – p.22/27

SLIDE 150

MsgContext: sample theorem

MsgContext : CLASSSPEC METHOD

✁

✂ ✄

: Self → Self

☎✆ ✄ ✝✟✞

: Self → {idle, sent, received}

✠

✞

✡ ☛

: Self × Princ → [Message → Bool] ASSERTION

☎✆ ✄ ✝✟✞

(x) = idle ⇒

∀(P : Princ) : x.

✠

✞

✡ ☛

(P) = x.

✁

✂ ✄

.

✠

✞

✡ ☛

(P) THEOREM ∀(P : Princ, m : Message) : x.

✠

✞

✡ ☛

(P)(m) ⇒ x.

✁

✂ ✄

.

✠

✞

✡ ☛

(P)(m).

The Coinductive Approach to Verifying Cryptographic Protocols – p.22/27

SLIDE 151

Inheritance

The CCSL language supports class inheritance.

The Coinductive Approach to Verifying Cryptographic Protocols – p.23/27

SLIDE 152

Inheritance

The CCSL language supports class inheritance. We use: MsgContext

A generic MsgContext class

The Coinductive Approach to Verifying Cryptographic Protocols – p.23/27

SLIDE 153

Inheritance

The CCSL language supports class inheritance. We use: MsgContext

A generic MsgContext class
general model for learning, message passing, etc.

The Coinductive Approach to Verifying Cryptographic Protocols – p.23/27

SLIDE 154

Inheritance

The CCSL language supports class inheritance. We use: MsgContext

A generic MsgContext class
general model for learning, message passing, etc.
our security model assumptions.

The Coinductive Approach to Verifying Cryptographic Protocols – p.23/27

SLIDE 155

Inheritance

The CCSL language supports class inheritance. We use: MsgContext Needham Schroeder

Bilateral Key Exchange
A generic MsgContext class
Specific protocol classes containing:

The Coinductive Approach to Verifying Cryptographic Protocols – p.23/27

SLIDE 156

Inheritance

The CCSL language supports class inheritance. We use: MsgContext Needham Schroeder

Bilateral Key Exchange
A generic MsgContext class
Specific protocol classes containing:
Axioms describing the protocol,

The Coinductive Approach to Verifying Cryptographic Protocols – p.23/27

SLIDE 157

Inheritance

The CCSL language supports class inheritance. We use: MsgContext Needham Schroeder

Bilateral Key Exchange
A generic MsgContext class
Specific protocol classes containing:
Axioms describing the protocol,
Correctness theorems.

The Coinductive Approach to Verifying Cryptographic Protocols – p.23/27

SLIDE 158

Correctness

So, what do we want to prove about a protocol (say, Bilateral Key Exchange)?

The Coinductive Approach to Verifying Cryptographic Protocols – p.24/27

SLIDE 159

Correctness

So, what do we want to prove about a protocol (say, Bilateral Key Exchange)? We want to prove: If A invites B to start the protocol ...

The Coinductive Approach to Verifying Cryptographic Protocols – p.24/27

SLIDE 160

Correctness

So, what do we want to prove about a protocol (say, Bilateral Key Exchange)? We want to prove: If A invites B to start the protocol and A and B respond as the protocol dictates ...

The Coinductive Approach to Verifying Cryptographic Protocols – p.24/27

SLIDE 161

Correctness

So, what do we want to prove about a protocol (say, Bilateral Key Exchange)? We want to prove: If A invites B to start the protocol and A and B respond as the protocol dictates then there is a key K such that

eventually A and B know K;

The Coinductive Approach to Verifying Cryptographic Protocols – p.24/27

SLIDE 162

Correctness

So, what do we want to prove about a protocol (say, Bilateral Key Exchange)? We want to prove: If A invites B to start the protocol and A and B respond as the protocol dictates then there is a key K such that

eventually A and B know K;
eventually A and B believe they each know K;

The Coinductive Approach to Verifying Cryptographic Protocols – p.24/27

SLIDE 163

Correctness

So, what do we want to prove about a protocol (say, Bilateral Key Exchange)? We want to prove: If A invites B to start the protocol and A and B respond as the protocol dictates then there is a key K such that

eventually A and B know K;
eventually A and B believe they each know K;
no one else knows K.

The Coinductive Approach to Verifying Cryptographic Protocols – p.24/27

SLIDE 164

Correctness

So, what do we want to prove about a protocol (say, Bilateral Key Exchange)? We want to prove: If A invites B to start the protocol and A and B respond as the protocol dictates then there is a key K such that

eventually A and B know K;
eventually A and B believe they each know K;
no one else knows K.

All of this is easily expressible in CCSL, using our MsgContext protocol.

The Coinductive Approach to Verifying Cryptographic Protocols – p.24/27

SLIDE 165

Correctness

So, what do we want to prove about a protocol (say, Bilateral Key Exchange)? We want to prove: If A invites B to start the protocol and A and B respond as the protocol dictates then there is a key K such that

eventually A and B know K;
eventually A and B believe they each know K;
no one else knows K.

Admittedly, proving it is not so easy.

The Coinductive Approach to Verifying Cryptographic Protocols – p.24/27

SLIDE 166

Paulson’s Inductive Approach

Lawrence Paulson uses a similar approach to analyzing security protocols.

The Coinductive Approach to Verifying Cryptographic Protocols – p.25/27

SLIDE 167

Paulson’s Inductive Approach

Lawrence Paulson uses a similar approach to analyzing security protocols. However, his models are inherently algebraic, rather than coalgebraic.

The Coinductive Approach to Verifying Cryptographic Protocols – p.25/27

SLIDE 168

Paulson’s Inductive Approach

Lawrence Paulson uses a similar approach to analyzing security protocols. However, his models are inherently algebraic, rather than coalgebraic. He considers the set of finite traces for a protocol. This set can be given by a least fixed point construction, i.e., by an initial algebra.

The Coinductive Approach to Verifying Cryptographic Protocols – p.25/27

SLIDE 169

Paulson’s Inductive Approach

His basic proof principle is induction. To prove P always holds, he shows

P[] holds and ...

The Coinductive Approach to Verifying Cryptographic Protocols – p.25/27

SLIDE 170

Paulson’s Inductive Approach

His basic proof principle is induction. To prove P always holds, he shows

P[] holds and
if P(evs), then P(ev # evs).

The Coinductive Approach to Verifying Cryptographic Protocols – p.25/27

SLIDE 171

Paulson’s Inductive Approach

His basic proof principle is induction. To prove P always holds, he shows

P[] holds and
if P(evs), then P(ev # evs).

This is analogous to showing that P is an invariant, in the coalgebraic sense.

The Coinductive Approach to Verifying Cryptographic Protocols – p.25/27

SLIDE 172

Paulson’s Inductive Approach

His basic proof principle is induction. To prove P always holds, he shows

P[] holds and
if P(evs), then P(ev # evs).

This is analogous to showing that P is an invariant, in the coalgebraic sense. The main theoretical difference is that we consider infinite traces as models, while Paulson considers finite traces.

The Coinductive Approach to Verifying Cryptographic Protocols – p.25/27

SLIDE 173

Comparison

There are a number of practical differences in Paulson’s work and our own. Our approach Paulson’s

The Coinductive Approach to Verifying Cryptographic Protocols – p.26/27

SLIDE 174

Comparison

There are a number of practical differences in Paulson’s work and our own. Our approach Paulson’s Separate specification language (CCSL) Specified directly in Isabelle

The Coinductive Approach to Verifying Cryptographic Protocols – p.26/27

SLIDE 175

Comparison

There are a number of practical differences in Paulson’s work and our own. Our approach Paulson’s Separate specification language (CCSL) Specified directly in Isabelle Temporal reasoning Inductive reasoning

The Coinductive Approach to Verifying Cryptographic Protocols – p.26/27

SLIDE 176

Comparison

There are a number of practical differences in Paulson’s work and our own. Our approach Paulson’s Separate specification language (CCSL) Specified directly in Isabelle Temporal reasoning Inductive reasoning Inheritance No inheritance

The Coinductive Approach to Verifying Cryptographic Protocols – p.26/27

SLIDE 177

Comparison

There are a number of practical differences in Paulson’s work and our own. Our approach Paulson’s Separate specification language (CCSL) Specified directly in Isabelle Temporal reasoning Inductive reasoning Inheritance No inheritance As well, our specification places fewer restrictions on the behavior of the participants ...

The Coinductive Approach to Verifying Cryptographic Protocols – p.26/27

SLIDE 178

Comparison

There are a number of practical differences in Paulson’s work and our own. Our approach Paulson’s Separate specification language (CCSL) Specified directly in Isabelle Temporal reasoning Inductive reasoning Inheritance No inheritance As well, our specification places fewer restrictions on the behavior of the participants but we pay for this generality!

The Coinductive Approach to Verifying Cryptographic Protocols – p.26/27

SLIDE 179

Summary

Summarizing:

The Coinductive Approach to Verifying Cryptographic Protocols – p.27/27

SLIDE 180

Summary

Summarizing: Specify a protocol in CCSL, using temporal operators.

The Coinductive Approach to Verifying Cryptographic Protocols – p.27/27

SLIDE 181

Summary

Summarizing: Specify a protocol in CCSL, using temporal operators. The protocol inherits from a general MsgContext class.

The Coinductive Approach to Verifying Cryptographic Protocols – p.27/27

SLIDE 182

Summary

Summarizing: Specify a protocol in CCSL, using temporal operators. The protocol inherits from a general MsgContext class. Compile the CCSL specification into a PVS theory.

The Coinductive Approach to Verifying Cryptographic Protocols – p.27/27

SLIDE 183

Summary

Summarizing: Specify a protocol in CCSL, using temporal operators. The protocol inherits from a general MsgContext class. Compile the CCSL specification into a PVS theory. Prove the correctness conditions.

The Coinductive Approach to Verifying Cryptographic Protocols – p.27/27

SLIDE 184

Summary

Summarizing: Specify a protocol in CCSL, using temporal operators. The protocol inherits from a general MsgContext class. Compile the CCSL specification into a PVS theory. Prove the correctness conditions. More on CCSL can be found here: http://wwwtcs.inf.tu-dresden.de/∼tews/ccsl/

The Coinductive Approach to Verifying Cryptographic Protocols – p.27/27