Timed Spi-Calculus with Types for Secrecy and Authenticity - - PowerPoint PPT Presentation

▶

Dec 15, 2023 266 likes •724 views

Timed Spi-Calculus with Types for Secrecy and Authenticity Christian Haack Alan Jeffrey CTI, DePaul University Bell Labs, Lucent Technology fpl.cs.depaul.edu/chaack fpl.cs.depaul.edu/ajeffrey Timed Spi-Calculus with Types for Secrecy and

SLIDE 1

Timed Spi-Calculus with Types for Secrecy and Authenticity

Christian Haack Alan Jeffrey CTI, DePaul University Bell Labs, Lucent Technology

fpl.cs.depaul.edu/chaack fpl.cs.depaul.edu/ajeffrey

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.1/??

SLIDE 2

Type Systems for Protocol Verification

Type systems for verifying secrecy and/or authenticity in the spi-calculus: Abadi, Abadi/Blanchet, Gordon/Jeffrey, and more. Other methods and systems for protocol verification: model checking (e.g. Casper), BAN logic, proof assistants (e.g. Isabelle), automatic theorem provers (e.g. ProVerif), static analysis, and more.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.2/??

SLIDE 3

Type Systems for Protocol Verification

Type systems for verifying secrecy and/or authenticity in the spi-calculus: Abadi, Abadi/Blanchet, Gordon/Jeffrey, and more. Other methods and systems for protocol verification: model checking (e.g. Casper), BAN logic, proof assistants (e.g. Isabelle), automatic theorem provers (e.g. ProVerif), static analysis, and more. Typechecking (our approach): Human help required: type annotations. No finiteness needed. For instance, arbitrary many session runs are allowed. Our type systems are incomplete.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.2/??

SLIDE 4

Why Timed Spi?

Untimed spi-calculus models perfect cryptography.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.3/??

SLIDE 5

Why Timed Spi?

Untimed spi-calculus models perfect cryptography. A more realistic model: Distinguish between long- and short-term keys. Short-term keys can be cracked given enough time. Such a model allows us to express key compromise attacks.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.3/??

SLIDE 6

Why Timed Spi?

Untimed spi-calculus models perfect cryptography. A more realistic model: Distinguish between long- and short-term keys. Short-term keys can be cracked given enough time. Such a model allows us to express key compromise attacks. Prime examples: key distribution protocols (KDPs) The distributed session keys are short-term. KDPs must make sure that received session keys have been recently generated. Previous type systems for untimed spi did not verify recency, our new type system for timed spi does.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.3/??

SLIDE 7

Example: NSSK

A S A S A B A B A B

A,B,na {ℓ1na, B, kab, {ℓ2A, kab}kbs}kas {ℓ2A, kab}kbs {ℓ3nb}kab {ℓ4nb}kab

Goal: At the end of a complete run both A and B want to be sure that kab is a fresh, secret short-term key shared with the other principal.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.4/??

SLIDE 8

An Attack on NSSK

A S A S A I B A I B A I B

A,B,na {ℓ1na, B, kab, {ℓ2A, kab}kbs}kas {ℓ2A, oldkab}kbs {ℓ3nb}oldkab {ℓ4nb}oldkab

B falsely believes that oldkab is a fresh, secret

short-term key shared with A. But really oldkab is an expired key that has been cracked by I.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.5/??

SLIDE 9

Expressing NSSK in Typed Spi

· B · B · B

{ℓ2A, kab}kbs {ℓ3nb}kab {ℓ4nb}kab

PB(a:Un, b:Un, s:Un, kbs:lt-Key, net:Un)

∆

= inp net (ctxt : Un); decrypt ctxt is {x : lt-Auth}kbs; match x is ℓ2a, kab : ?; new(nb : Un); (out net ℓ3nb | inp net (ctxt′ : Un); decrypt ctxt′ is {y : ?}kbs; match y is ℓ4nb; st-secret(kab))

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.6/??

SLIDE 10

Expressing NSSK in Typed Spi

· B · B · B

{ℓ2A, kab}kbs {ℓ3nb}kab {ℓ4nb}kab

PB(a:Un, b:Un, s:Un, kbs:lt-Key, net:Un)

∆

= inp net (ctxt : Un); decrypt ctxt is {x : lt-Auth}kbs; match x is ℓ2a, kab : ?; new(nb : Un); (out net ℓ3nb | inp net (ctxt′ : Un); decrypt ctxt′ is {y : ?}kbs; match y is ℓ4nb; st-secret(kab)) System(a:Un, b:Un, s:Un, net:Un)

∆

= new(kas : lt-Key); new(kbs : lt-Key); !PA(a, b, s, kas, net) |!PB(a, b, s, kbs, net) |!PS(a, b, s, kas, kbs, net)

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.6/??

SLIDE 11

Our Model of Time

A clock-tick represents the end of an epoch, which is the time required for cracking short-term keys.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.7/??

SLIDE 12

Our Model of Time

A clock-tick represents the end of an epoch, which is the time required for cracking short-term keys. New primitive: crack M is {x:Un}y:Un; P Cracking uses up all time of the current epoch. All other actions are instantaneous. Cracking allows us to express key-compromising attackers, for instance, the attack on NSSK.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.7/??

SLIDE 13

Our Model of Time

A clock-tick represents the end of an epoch, which is the time required for cracking short-term keys. New primitive: crack M is {x:Un}y:Un; P Cracking uses up all time of the current epoch. All other actions are instantaneous. Cracking allows us to express key-compromising attackers, for instance, the attack on NSSK. Specification primitive for short-term secrecy:

st-secret(M)

A short-term secret is secret within the current epoch.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.7/??

SLIDE 14

Our Model of Time

A clock-tick represents the end of an epoch, which is the time required for cracking short-term keys. New primitive: crack M is {x:Un}y:Un; P Cracking uses up all time of the current epoch. All other actions are instantaneous. Cracking allows us to express key-compromising attackers, for instance, the attack on NSSK. Specification primitive for short-term secrecy:

st-secret(M)

A short-term secret is secret within the current epoch. Specification primitives for short-term authenticity.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.7/??

SLIDE 15

Our Model of Time

A clock-tick represents the end of an epoch, which is the time required for cracking short-term keys. New primitive: crack M is {x:Un}y:Un; P Cracking uses up all time of the current epoch. All other actions are instantaneous. Cracking allows us to express key-compromising attackers, for instance, the attack on NSSK. Specification primitive for short-term secrecy:

st-secret(M)

A short-term secret is secret within the current epoch. Specification primitives for short-term authenticity. Input expires with a clock-tick, modelling timeout.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.7/??

SLIDE 16

Operational Semantics

Instantaneous reductions as usual ...

ut N M | inp N (x:T); P → P{x←M}

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.8/??

SLIDE 17

Operational Semantics

Instantaneous reductions as usual ...

ut N M | inp N (x:T); P → P{x←M}

... plus tick-reductions that use up a clock tick.

P

→ P ′ Q σ → Q′ P | Q σ → Q | Q′ Q = st-secret(K) or Q = public(K) crack {M}K is {x:T}y:U; P | Q

→ P{x, y←M, K} | public(K) st-secret(M) σ → public(M) inp N (x:T); P

→ 0

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.8/??

SLIDE 18

Operational Semantics

Instantaneous reductions as usual ...

ut N M | inp N (x:T); P → P{x←M}

... plus tick-reductions that use up a clock tick.

P

→ P ′ Q σ → Q′ P | Q σ → Q | Q′ Q = st-secret(K) or Q = public(K) crack {M}K is {x:T}y:U; P | Q

→ P{x, y←M, K} | public(K) st-secret(M) σ → public(M) inp N (x:T); P

→ 0 ⇒

∆

= (→ ∪ σ →)∗

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.8/??

SLIDE 19

Robust Safety

An opponent is an Un-typed process, that does not contain secrecy declarations τ-secret(M).

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.9/??

SLIDE 20

Robust Safety

An opponent is an Un-typed process, that does not contain secrecy declarations τ-secret(M). ... but opponents may declare public(M).

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.9/??

SLIDE 21

Robust Safety

An opponent is an Un-typed process, that does not contain secrecy declarations τ-secret(M). ... but opponents may declare public(M).

P is safe iff P ⇒ public(M) | τ-secret(M) | Q.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.9/??

SLIDE 22

Robust Safety

An opponent is an Un-typed process, that does not contain secrecy declarations τ-secret(M). ... but opponents may declare public(M).

P is safe iff P ⇒ public(M) | τ-secret(M) | Q. P is robustly safe if P | O is safe for all opponents O.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.9/??

SLIDE 23

Robust Safety

An opponent is an Un-typed process, that does not contain secrecy declarations τ-secret(M). ... but opponents may declare public(M).

P is safe iff P ⇒ public(M) | τ-secret(M) | Q. P is robustly safe if P | O is safe for all opponents O.

For instance: NSSK is safe. NSSK it is not robustly safe.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.9/??

SLIDE 24

Robust Safety

An opponent is an Un-typed process, that does not contain secrecy declarations τ-secret(M). ... but opponents may declare public(M).

P is safe iff P ⇒ public(M) | τ-secret(M) | Q. P is robustly safe if P | O is safe for all opponents O.

For instance: NSSK is safe. NSSK it is not robustly safe. Theorem (Robust Safety of the Type System): If

n: T ⊢ public( n) and n: T ⊢ P, then P is robustly safe.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.9/??

SLIDE 25

Sample Rules: Encryption/Decryption

Introduction and elimination rules for honest agents ... (Encrypt)

E ⊢ K : τ-Key, M : τ-Auth E ⊢ {M}K : Un

(where τ ∈ {lt, st}) (Decrypt)

E ⊢ M : Un, K : τ-Key E, x : τ-Auth ⊢ P E ⊢ decrypt M is {x : τ-Auth}K; P

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.10/??

SLIDE 26

Sample Rules: Encryption/Decryption

Introduction and elimination rules for honest agents ... (Encrypt)

E ⊢ K : τ-Key, M : τ-Auth E ⊢ {M}K : Un

(where τ ∈ {lt, st}) (Decrypt)

E ⊢ M : Un, K : τ-Key E, x : τ-Auth ⊢ P E ⊢ decrypt M is {x : τ-Auth}K; P

... plus intro- and elim-rules for opponents. (Encrypt Un)

E ⊢ K : Un, M : Un E ⊢ {M}K : Un

(Decrypt Un)

E ⊢ M : Un, K : Un E, x:Un ⊢ P E ⊢ decrypt M is {x:T}K; P

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.10/??

SLIDE 27

Tag Types

ℓ : T → τ-Auth M : τ-Auth

∆

=

“M requires authentication by a τ-key”

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.11/??

SLIDE 28

Tag Types

ℓ : T → τ-Auth M : τ-Auth

∆

=

“M requires authentication by a τ-key” Restrictions on tag types: where step(T) is the type that T turns into in the next epoch:

step(st-Secret)

∆

= Un, step(lt-Secret)

∆

= lt-Secret, step(Un)

∆

= Un, step(Top)

∆

= Top, and more cases.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.11/??

SLIDE 29

Tag Types

ℓ : T → τ-Auth M : τ-Auth

∆

=

“M requires authentication by a τ-key” Restrictions on tag types: If τ = st, then step(T) ≤ Un. where step(T) is the type that T turns into in the next epoch:

step(st-Secret)

∆

= Un, step(lt-Secret)

∆

= lt-Secret, step(Un)

∆

= Un, step(Top)

∆

= Top, and more cases.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.11/??

SLIDE 30

Tag Types

ℓ : T → τ-Auth M : τ-Auth

∆

=

“M requires authentication by a τ-key” Restrictions on tag types: If τ = st, then step(T) ≤ Un. If τ = lt, then step(T) = T. where step(T) is the type that T turns into in the next epoch:

step(st-Secret)

∆

= Un, step(lt-Secret)

∆

= lt-Secret, step(Un)

∆

= Un, step(Top)

∆

= Top, and more cases.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.11/??

SLIDE 31

Tag Types for NSSK

A B

{ℓ2A, kab}kbs

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.12/??

SLIDE 32

Tag Types for NSSK

A B

{ℓ2A, kab}kbs

ℓ2 : Un, st-Secret → lt-Auth

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.12/??

SLIDE 33

Tag Types for NSSK

A B

{ℓ2A, kab}kbs

ℓ2 : Un, st-Secret → lt-Auth

... but this is not a legal tag type, because

step(st-Secret) = st-Secret.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.12/??

SLIDE 34

Tag Types for NSSK

A B

{ℓ2A, kab}kbs

ℓ2 : Un, st-Secret → lt-Auth

... but this is not a legal tag type, because

step(st-Secret) = st-Secret.

So NSSK does not typecheck ...

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.12/??

SLIDE 35

Tag Types for NSSK

A B

{ℓ2A, kab}kbs

ℓ2 : Un, st-Secret → lt-Auth

... but this is not a legal tag type, because

step(st-Secret) = st-Secret.

So NSSK does not typecheck ... ... because B gets no guarantee that kab is fresh.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.12/??

SLIDE 36

Tag Types for NSSK

A S

{ℓ1na, b, kab, {ℓ2a, kab}kbs}kas

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.13/??

SLIDE 37

Tag Types for NSSK

A S

{ℓ1na, b, kab, {ℓ2a, kab}kbs}kas

ℓ1 : na:Un, Un, kab:Top, Un[A(na, kab)] → lt-Auth

where A(na, kab) =

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.13/??

SLIDE 38

Tag Types for NSSK

A S

{ℓ1na, b, kab, {ℓ2a, kab}kbs}kas

ℓ1 : na:Un, Un, kab:Top, Un[A(na, kab)] → lt-Auth

where A(na, kab) = The assertion A(na, kab) is a pre-condition for tagging and a post-condition for untagging.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.13/??

SLIDE 39

Tag Types for NSSK

A S

{ℓ1na, b, kab, {ℓ2a, kab}kbs}kas

ℓ1 : na:Un, Un, kab:Top, Un[A(na, kab)] → lt-Auth

where A(na, kab) = na-stamped(kab : st-Secret) The assertion A(na, kab) is a pre-condition for tagging and a post-condition for untagging.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.13/??

SLIDE 40

Tag Types for NSSK

A S

{ℓ1na, b, kab, {ℓ2a, kab}kbs}kas

ℓ1 : na:Un, Un, kab:Top, Un[A(na, kab)] → lt-Auth

where A(na, kab) = na-stamped(kab : st-Secret) The assertion A(na, kab) is a pre-condition for tagging and a post-condition for untagging. This type is legal: step(M-stamped(A))

∆

= M-stamped(A).

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.13/??

SLIDE 41

Tag Types for NSSK

A S

{ℓ1na, b, kab, {ℓ2a, kab}kbs}kas

ℓ1 : na:Un, Un, kab:Top, Un[A(na, kab)] → lt-Auth

where A(na, kab) = na-stamped(kab : st-Secret) The assertion A(na, kab) is a pre-condition for tagging and a post-condition for untagging. This type is legal: step(M-stamped(A))

∆

= M-stamped(A).

Typechecker may unstamp only if stamp is fresh.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.13/??

SLIDE 42

Nonce- and Time-Stamps

A ::= M:T | M-stamped(A) | fresh(M)

(assertions) Short-term can be turned into long-term assertions by stamping them with a nonce: (Nonce Stamp)

E ⊢ M : Top, A E ⊢ M-stamped(A)

Stamped assertions can be unstamped provided the stamp is fresh: (Nonce Unstamp)

E ⊢ M-stamped(A), fresh(M) E, A ⊢ P E ⊢ P

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.14/??

SLIDE 43

Summary

We have extended the spi-calculus by an abstract notion of discrete time. This allows us to: distinguish between long- and short-term secrets, model key compromise attacks, express protocols with timestamps. We have proposed a type system for verifying short-term secrecy and short-term authenticity.

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.15/??

SLIDE 44

Related Work

Timeliness without explicit model of time: BAN logic [89], Guttman [MFPS 01] (strand space model), Paulson [98] (Isabelle proof assistant, inductive method) With explicit models of time: Evans and Schneider [ESORICS 00] (tock-CSP , PVS, rank functions) Lowe (timed CSP , Casper model checker) Gorrieri, Locatelli, Martinelli [ESOP 03] (tCryptoSpa) Bozga, Ene, Lakhnech [CONCUR 04] (real time, symbolic decision procedure, bounded number of sessions required) Delzanno, Ganty [TACAS 04] (real time, symbolic decision procedure, possibly non-terminating)

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.16/??

SLIDE 45

Related Work

Type systems for cryptographic protocol verification: Abadi [JACM 99] (strong secrecy for symmetric crypto) Abadi, Blanchet [FOSSACS 01] (secrecy for asymmetric crypto) Gordon, Jeffrey [JCS 03] (authenticity for symmetric crypto) Gordon, Jeffrey [JCS 03] (authenticity for asymmetric crypto)

Timed Spi-Calculus with Types for Secrecy and Authenticity – p.17/??