Towards a Logic for Verification of Security Protocols Work in - - PowerPoint PPT Presentation

towards a logic for verification of security protocols
SMART_READER_LITE
LIVE PREVIEW

Towards a Logic for Verification of Security Protocols Work in - - PowerPoint PPT Presentation

Towards a Logic for Verification of Security Protocols Work in progress Comments welcome Vincent Bernat Laboratoire Spcification et Vrification CNRS & ENS Cachan SPV03 - Marseille p.1/17 Plan 1. Intro Existing models,


slide-1
SLIDE 1

Towards a Logic for Verification of Security Protocols

Work in progress Comments welcome

Vincent Bernat Laboratoire Spécification et Vérification CNRS & ENS Cachan

SPV’03 - Marseille – p.1/17

slide-2
SLIDE 2

Plan

  • 1. Intro

Existing models, caveats, reactive systems, properties

  • 2. Transition system

States, constraints, inference rules

  • 3. Logics

Temporal logics, expressiveness, decidability

  • 4. Applications

SPV’03 - Marseille – p.2/17

slide-3
SLIDE 3

Existing models

Verification of cryptographic protocols is a model checking problem: does a protocol P satisfies a property φ?

SPV’03 - Marseille – p.3/17

slide-4
SLIDE 4

Existing models

Verification of cryptographic protocols is a model checking problem: does a protocol P satisfies a property φ? To prove protocols, you may use: Process algebra

SPV’03 - Marseille – p.3/17

slide-5
SLIDE 5

Existing models

Verification of cryptographic protocols is a model checking problem: does a protocol P satisfies a property φ? To prove protocols, you may use: Process algebra Trace models

SPV’03 - Marseille – p.3/17

slide-6
SLIDE 6

Existing models

Verification of cryptographic protocols is a model checking problem: does a protocol P satisfies a property φ? To prove protocols, you may use: Process algebra CSP [Schneider 96] Trace models

SPV’03 - Marseille – p.3/17

slide-7
SLIDE 7

Existing models

Verification of cryptographic protocols is a model checking problem: does a protocol P satisfies a property φ? To prove protocols, you may use: Process algebra CSP [Schneider 96] Spi-calculus [Abadi Gordon 97] Trace models

SPV’03 - Marseille – p.3/17

slide-8
SLIDE 8

Existing models

Verification of cryptographic protocols is a model checking problem: does a protocol P satisfies a property φ? To prove protocols, you may use: Process algebra CSP [Schneider 96] Spi-calculus [Abadi Gordon 97] Trace models [Paulson 98] [Millen Rueß 2000]

SPV’03 - Marseille – p.3/17

slide-9
SLIDE 9

Existing models

Verification of cryptographic protocols is a model checking problem: does a protocol P satisfies a property φ? To prove protocols, you may use: Process algebra CSP [Schneider 96] Spi-calculus [Abadi Gordon 97] Trace models [Paulson 98] [Millen Rueß 2000] Rewriting rules [Rusinowitch Turuani 2001]

SPV’03 - Marseille – p.3/17

slide-10
SLIDE 10

Existing models

Verification of cryptographic protocols is a model checking problem: does a protocol P satisfies a property φ? To prove protocols, you may use: Process algebra CSP [Schneider 96] Spi-calculus [Abadi Gordon 97] Trace models [Paulson 98] [Millen Rueß 2000] Rewriting rules [Rusinowitch Turuani 2001] Horn clauses [Comon-Lundh Cortier 2003] [Blanchet 2002]

SPV’03 - Marseille – p.3/17

slide-11
SLIDE 11

Existing models

Verification of cryptographic protocols is a model checking problem: does a protocol P satisfies a property φ? To prove protocols, you may use: Process algebra CSP [Schneider 96] Spi-calculus [Abadi Gordon 97] Trace models [Paulson 98] [Millen Rueß 2000] Rewriting rules [Rusinowitch Turuani 2001] Horn clauses [Comon-Lundh Cortier 2003] [Blanchet 2002] Others...

SPV’03 - Marseille – p.3/17

slide-12
SLIDE 12

Caveats of spi-calculus

Introduced in [Abadi Gordon 97]. Properties are based on

  • bservational equivalence.

SPV’03 - Marseille – p.4/17

slide-13
SLIDE 13

Caveats of spi-calculus

Introduced in [Abadi Gordon 97]. Properties are based on

  • bservational equivalence.

Secrecy Inst(M) ≃ Inst(M ′) if M ≃ M ′, for all M, M ′.

SPV’03 - Marseille – p.4/17

slide-14
SLIDE 14

Caveats of spi-calculus

Introduced in [Abadi Gordon 97]. Properties are based on

  • bservational equivalence.

Secrecy Inst(M) ≃ Inst(M ′) if M ≃ M ′, for all M, M ′. Authentication Inst(M) ≃ Instspec(M) for all M.

SPV’03 - Marseille – p.4/17

slide-15
SLIDE 15

Caveats of spi-calculus

Introduced in [Abadi Gordon 97]. Properties are based on

  • bservational equivalence.

Secrecy Inst(M) ≃ Inst(M ′) if M ≃ M ′, for all M, M ′. Authentication Inst(M) ≃ Instspec(M) for all M. Many problems:

SPV’03 - Marseille – p.4/17

slide-16
SLIDE 16

Caveats of spi-calculus

Introduced in [Abadi Gordon 97]. Properties are based on

  • bservational equivalence.

Secrecy Inst(M) ≃ Inst(M ′) if M ≃ M ′, for all M, M ′. Authentication Inst(M) ≃ Instspec(M) for all M. Many problems: Secrecy is tightly linked to observational equivalence: how to express another kind of secrecy property ?

SPV’03 - Marseille – p.4/17

slide-17
SLIDE 17

Caveats of spi-calculus

Introduced in [Abadi Gordon 97]. Properties are based on

  • bservational equivalence.

Secrecy Inst(M) ≃ Inst(M ′) if M ≃ M ′, for all M, M ′. Authentication Inst(M) ≃ Instspec(M) for all M. Many problems: Secrecy is tightly linked to observational equivalence: how to express another kind of secrecy property ? To express an authentication property, one has to build an ad hoc process: difficulty to compare authentication properties between two different protocols.

SPV’03 - Marseille – p.4/17

slide-18
SLIDE 18

Caveats for other models

Most of these models are primary targeted to express protocols.

SPV’03 - Marseille – p.5/17

slide-19
SLIDE 19

Caveats for other models

Most of these models are primary targeted to express protocols. Questions you may ask:

SPV’03 - Marseille – p.5/17

slide-20
SLIDE 20

Caveats for other models

Most of these models are primary targeted to express protocols. Questions you may ask: Given two properties, one expressed with [Comon-Lundh Cortier 2003] and one with [Paulson 98], how could you compare them, since they do not work on the same abstraction?

SPV’03 - Marseille – p.5/17

slide-21
SLIDE 21

Caveats for other models

Most of these models are primary targeted to express protocols. Questions you may ask: Given two properties, one expressed with [Comon-Lundh Cortier 2003] and one with [Paulson 98], how could you compare them, since they do not work on the same abstraction? Given one protocol P in [Schneider 96] and one property φ expressed with [Comon-Lundh Cortier 2003], how can you check if φ satisfies P?

SPV’03 - Marseille – p.5/17

slide-22
SLIDE 22

Caveats for other models

Most of these models are primary targeted to express protocols. Questions you may ask: Given two properties, one expressed with [Comon-Lundh Cortier 2003] and one with [Paulson 98], how could you compare them, since they do not work on the same abstraction? Given one protocol P in [Schneider 96] and one property φ expressed with [Comon-Lundh Cortier 2003], how can you check if φ satisfies P? Given a set of properties and a protocol P expressed with [Blanchet 2002], how could you check them without altering P?

SPV’03 - Marseille – p.5/17

slide-23
SLIDE 23

Reactive systems

Abstraction petri nets automata networks process algebra ...

SPV’03 - Marseille – p.6/17

slide-24
SLIDE 24

Reactive systems

Abstraction petri nets automata networks process algebra ... Temporal logic LTL CTL PLTL ...

SPV’03 - Marseille – p.6/17

slide-25
SLIDE 25

Reactive systems

Abstraction petri nets automata networks process algebra ... Transition system Temporal logic LTL CTL PLTL ...

SPV’03 - Marseille – p.6/17

slide-26
SLIDE 26

Reactive systems

Abstraction petri nets automata networks process algebra ... Transition system Temporal logic LTL CTL PLTL ... The transition system is the semantic glue between the abstraction and the temporal logic.

SPV’03 - Marseille – p.6/17

slide-27
SLIDE 27

Reactive systems (2)

Transposing the approach of reactive systems to cryptographic protocols has the following advantages:

SPV’03 - Marseille – p.7/17

slide-28
SLIDE 28

Reactive systems (2)

Transposing the approach of reactive systems to cryptographic protocols has the following advantages: Changing the abstraction layer while keeping the logic is allowed, and vice versa;

SPV’03 - Marseille – p.7/17

slide-29
SLIDE 29

Reactive systems (2)

Transposing the approach of reactive systems to cryptographic protocols has the following advantages: Changing the abstraction layer while keeping the logic is allowed, and vice versa; Easy comparison of different protocols for a given property;

SPV’03 - Marseille – p.7/17

slide-30
SLIDE 30

Reactive systems (2)

Transposing the approach of reactive systems to cryptographic protocols has the following advantages: Changing the abstraction layer while keeping the logic is allowed, and vice versa; Easy comparison of different protocols for a given property; Easy comparison of different properties for a given protocol;

SPV’03 - Marseille – p.7/17

slide-31
SLIDE 31

Reactive systems (2)

Transposing the approach of reactive systems to cryptographic protocols has the following advantages: Changing the abstraction layer while keeping the logic is allowed, and vice versa; Easy comparison of different protocols for a given property; Easy comparison of different properties for a given protocol; No new model needed, current models are fine if the transition system is general enough.

SPV’03 - Marseille – p.7/17

slide-32
SLIDE 32

Goals

Conception of a logic for security properties covering at least: secrecy from the intruder point of view temporary secrecy partial secrecy

SPV’03 - Marseille – p.8/17

slide-33
SLIDE 33

Goals

Conception of a logic for security properties covering at least: secrecy authentication vivacity weak agreement non-injective agreement agreement

SPV’03 - Marseille – p.8/17

slide-34
SLIDE 34

Goals

Conception of a logic for security properties covering at least: secrecy authentication Conception of a transition system expressive enough to catch both the semantics of the protocols and the semantics of the logics, retaining cryptographic protocol specificities to be able to handle it.

SPV’03 - Marseille – p.8/17

slide-35
SLIDE 35

Plan

  • 1. Intro

Existing models, caveats, reactive systems, properties

  • 2. Transition system

States, constraints, inference rules

  • 3. Logics

Temporal logics, expressiveness, decidability

  • 4. Applications

SPV’03 - Marseille – p.9/17

slide-36
SLIDE 36

Choosing a transition system

Powerful enough

SPV’03 - Marseille – p.10/17

slide-37
SLIDE 37

Choosing a transition system

Powerful enough the intruder knowledge

SPV’03 - Marseille – p.10/17

slide-38
SLIDE 38

Choosing a transition system

Powerful enough the intruder knowledge for each triple (actor, session, role): the step number, the actor’s memory the last message received

SPV’03 - Marseille – p.10/17

slide-39
SLIDE 39

Choosing a transition system

Powerful enough the intruder knowledge for each triple (actor, session, role): the step number, the actor’s memory the last message received the last message sent on the network

SPV’03 - Marseille – p.10/17

slide-40
SLIDE 40

Choosing a transition system

Powerful enough the intruder knowledge for each triple (actor, session, role): the step number, the actor’s memory the last message received the last message sent on the network Specific enough: multiple sources of infinity, we have to work with it

SPV’03 - Marseille – p.10/17

slide-41
SLIDE 41

Inference rules

Two built-in rules

SPV’03 - Marseille – p.11/17

slide-42
SLIDE 42

Inference rules

Two built-in rules

Honest replay If some transition is possible in some state, it

should be possible to have a similar transition in some similar state; e.g, replaying a session between two actors.

SPV’03 - Marseille – p.11/17

slide-43
SLIDE 43

Inference rules

Two built-in rules

Honest replay If some transition is possible in some state, it

should be possible to have a similar transition in some similar state; e.g, replaying a session between two actors. A state s similar to a state s′ is roughly the same state to which we apply a substitution σ on the session

  • numbers. Nonces are parameterized by session

numbers.

SPV’03 - Marseille – p.11/17

slide-44
SLIDE 44

Inference rules

Two built-in rules

Honest replay If some transition is possible in some state, it

should be possible to have a similar transition in some similar state; e.g, replaying a session between two actors. A state s similar to a state s′ is roughly the same state to which we apply a substitution σ on the session

  • numbers. Nonces are parameterized by session

numbers.

Intruder attack If some transition is done by an agent

expecting a term t, the intruder can force it to do the transition by providing himself t.

SPV’03 - Marseille – p.11/17

slide-45
SLIDE 45

Honest replay

q − → q′ q′′ ⊕ qσ − → q′′ ⊕ q′σ

SPV’03 - Marseille – p.12/17

slide-46
SLIDE 46

Honest replay

q − → q′ q′′ ⊕ qσ − → q′′ ⊕ q′σ Partial example : A s1 n − 1 A, B NA,s1 B s2 m − 1 B, A NB,s2 A s1 n A, B NA,s1 B s2 m − 1 B, A NB,s2

SPV’03 - Marseille – p.12/17

slide-47
SLIDE 47

Honest replay

q − → q′ q′′ ⊕ qσ − → q′′ ⊕ q′σ Partial example : A s1 n − 1 A, B NA,s1 A s′

1

n − 1 A, B NA,s′

1

B s2 m − 1 B, A NB,s2 B s′

2

m − 1 B, A NB,s′

2

A s1 n A, B NA,s1 B s2 m − 1 B, A NB,s2

SPV’03 - Marseille – p.12/17

slide-48
SLIDE 48

Honest replay

q − → q′ q′′ ⊕ qσ − → q′′ ⊕ q′σ Partial example : A s1 n − 1 A, B NA,s1 A s′

1

n − 1 A, B NA,s′

1

B s2 m − 1 B, A NB,s2 B s′

2

m − 1 B, A NB,s′

2

A s1 n A, B NA,s1 A B s2 m − 1 B, A NB,s2 B σ = s1 − → s′

1

s2 − → s′

2

SPV’03 - Marseille – p.12/17

slide-49
SLIDE 49

Honest replay

q − → q′ q′′ ⊕ qσ − → q′′ ⊕ q′σ Partial example : A s1 n − 1 A, B NA,s1 A s′

1

n − 1 A, B NA,s′

1

B s2 m − 1 B, A NB,s2 B s′

2

m − 1 B, A NB,s′

2

A s1 n A, B NA,s1 A s′

1

n A, B NA,s′

1

B s2 m − 1 B, A NB,s2 B s′

2

m − 1 B, A NB,s′

2

σ = s1 − → s′

1

s2 − → s′

2

SPV’03 - Marseille – p.12/17

slide-50
SLIDE 50

Intruder attack

q ⊕ q1

A ⊕ q1 B ⊕ e1

− → q ⊕ q2

A ⊕ q1 B ⊕ e2 ⊕ I1

− → q ⊕ q2

A ⊕ q2 B ⊕ e3 ⊕ I2

q ⊕ q1

A ⊕ q1 B ⊕ e1

SPV’03 - Marseille – p.13/17

slide-51
SLIDE 51

Intruder attack

q ⊕ q1

A ⊕ q1 B ⊕ e1

− → q ⊕ q2

A ⊕ q1 B ⊕ e2 ⊕ I1

− → q ⊕ q2

A ⊕ q2 B ⊕ e3 ⊕ I2

q ⊕ q1

A ⊕ q1 B ⊕ e1

− → q ⊕ q1

A ⊕ q2 B ⊕ e3 ⊕ I2

SPV’03 - Marseille – p.13/17

slide-52
SLIDE 52

Intruder attack

q ⊕ q1

A ⊕ q1 B ⊕ e1

− → q ⊕ q2

A ⊕ q1 B ⊕ e2 ⊕ I1

− → q ⊕ q2

A ⊕ q2 B ⊕ e3 ⊕ I2

q ⊕ q1

A ⊕ q1 B ⊕ e1

− → q ⊕ q1

A ⊕ q2 B ⊕ e3 ⊕ I2

− → q ⊕ q2

A ⊕ q2 B ⊕ e2 ⊕ I2

e2 ∈ q|I

SPV’03 - Marseille – p.13/17

slide-53
SLIDE 53

Intruder attack

q ⊕ q1

A ⊕ q1 B ⊕ e1

− → q ⊕ q2

A ⊕ q1 B ⊕ e2 ⊕ I1

− → q ⊕ q2

A ⊕ q2 B ⊕ e3 ⊕ I2

q ⊕ q1

A ⊕ q1 B ⊕ e1

− → q ⊕ q1

A ⊕ q2 B ⊕ e3 ⊕ I2

− → q ⊕ q2

A ⊕ q2 B ⊕ e2 ⊕ I2

Partial example : A s1 n − 1 A s1 n − 1 B s2 m − 1 B s2 m − 1 A s1 n B s2 m − 1 A s1 n B s2 m

SPV’03 - Marseille – p.13/17

slide-54
SLIDE 54

Intruder attack

q ⊕ q1

A ⊕ q1 B ⊕ e1

− → q ⊕ q2

A ⊕ q1 B ⊕ e2 ⊕ I1

− → q ⊕ q2

A ⊕ q2 B ⊕ e3 ⊕ I2

q ⊕ q1

A ⊕ q1 B ⊕ e1

− → q ⊕ q1

A ⊕ q2 B ⊕ e3 ⊕ I2

− → q ⊕ q2

A ⊕ q2 B ⊕ e2 ⊕ I2

Partial example : A s1 n − 1 A s1 n − 1 B s2 m − 1 B s2 m − 1 A s1 n A s1 n − 1 B s2 m − 1 B s2 m A s1 n B s2 m

SPV’03 - Marseille – p.13/17

slide-55
SLIDE 55

Intruder attack

q ⊕ q1

A ⊕ q1 B ⊕ e1

− → q ⊕ q2

A ⊕ q1 B ⊕ e2 ⊕ I1

− → q ⊕ q2

A ⊕ q2 B ⊕ e3 ⊕ I2

q ⊕ q1

A ⊕ q1 B ⊕ e1

− → q ⊕ q1

A ⊕ q2 B ⊕ e3 ⊕ I2

− → q ⊕ q2

A ⊕ q2 B ⊕ e2 ⊕ I2

Partial example : A s1 n − 1 A s1 n − 1 B s2 m − 1 B s2 m − 1 A s1 n A s1 n − 1 B s2 m − 1 B s2 m A s1 n A s1 n B s2 m B s2 m

SPV’03 - Marseille – p.13/17

slide-56
SLIDE 56

Plan

  • 1. Intro

Existing models, caveats, reactive systems, properties

  • 2. Transition system

States, constraints, inference rules

  • 3. Logics

Temporal logics, expressiveness, decidability

  • 4. Applications

SPV’03 - Marseille – p.14/17

slide-57
SLIDE 57

Choosing a logic

Powerful enough

SPV’03 - Marseille – p.15/17

slide-58
SLIDE 58

Choosing a logic

Powerful enough able to express properties on states

SPV’03 - Marseille – p.15/17

slide-59
SLIDE 59

Choosing a logic

Powerful enough able to express properties on states temporal dimension for secrecy

SPV’03 - Marseille – p.15/17

slide-60
SLIDE 60

Choosing a logic

Powerful enough able to express properties on states temporal dimension for secrecy possibility to count to express strong authentication properties

SPV’03 - Marseille – p.15/17

slide-61
SLIDE 61

Choosing a logic

Powerful enough able to express properties on states temporal dimension for secrecy possibility to count to express strong authentication properties Specific enough decidability results with bounded number of sessions ?

SPV’03 - Marseille – p.15/17

slide-62
SLIDE 62

Plan

  • 1. Intro

Existing models, caveats, reactive systems, properties

  • 2. Transition system

States, constraints, inference rules

  • 3. Logics

Temporal logics, expressiveness, decidability

  • 4. Applications

SPV’03 - Marseille – p.16/17

slide-63
SLIDE 63

Applications

Better understanding of authentication properties expression and proof of properties independently of the protocol and of the model, e.g nonces are needed for injective agreement decidability of a class of properties for a bounded number of sessions

SPV’03 - Marseille – p.17/17