V erification de protocoles cryptographiques en pr esence de th - - PowerPoint PPT Presentation

▶
v erification de protocoles cryptographiques en pr esence
SMART_READER_LITE
LIVE PREVIEW

V erification de protocoles cryptographiques en pr esence de th - - PowerPoint PPT Presentation

Aug 16, 2023 365 likes •1.12k views

V erification de protocoles cryptographiques en pr esence de th eories equationnelles V erification de protocoles cryptographiques en pr esence de th eories equationnelles Pascal Lafourcade LSV, UMR 8643, CNRS, ENS de

slide-1
SLIDE 1

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles

Pascal Lafourcade

LSV, UMR 8643, CNRS, ENS de Cachan & INRIA Futurs LIF, UMR 6166, CNRS & Universit´ e Aix-Marseille 1

Cachan : September 25th 2006

1 / 37

slide-2
SLIDE 2

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Cryptographic Protocols

Osiris communicates with Isis via the net.

2 / 37

slide-3
SLIDE 3

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Cryptographic Protocols

Osiris communicates with Isis via the net. Intruder

2 / 37

slide-4
SLIDE 4

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Cryptographic Protocols

Osiris communicates with Isis via the net. Intruder Secrecy Property: Intruder cannot learn a secret data.

2 / 37

slide-5
SLIDE 5

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Applications

3 / 37

slide-6
SLIDE 6

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Cryptography

Symmetric Encryption (DES, AES) encryption decryption symmetric key

4 / 37

slide-7
SLIDE 7

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Cryptography

Symmetric Encryption (DES, AES) encryption decryption symmetric key Asymmetric Encryption (RSA) public key private key decryption encryption

4 / 37

slide-8
SLIDE 8

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Example :

5 / 37

slide-9
SLIDE 9

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Example :

5 / 37

slide-10
SLIDE 10

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Example :

5 / 37

slide-11
SLIDE 11

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Example :

Shamir 3-Pass Protocol 1 O → I : {m}KO

5 / 37

slide-12
SLIDE 12

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Example :

Shamir 3-Pass Protocol 1 O → I : {m}KO 2 I → O : {{m}KO}KI

5 / 37

slide-13
SLIDE 13

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Example :

Shamir 3-Pass Protocol 1 O → I : {m}KO Commutative 2 I → O : {{m}KO}KI = {{m}KI }KO Encryption

5 / 37

slide-14
SLIDE 14

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Example :

Shamir 3-Pass Protocol 1 O → I : {m}KO Commutative 2 I → O : {{m}KO}KI = {{m}KI }KO Encryption 3 O → I : {m}KI

5 / 37

slide-15
SLIDE 15

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Attacks

Cryptanalysis

6 / 37

slide-16
SLIDE 16

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Attacks

Cryptanalysis

6 / 37

slide-17
SLIDE 17

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Attacks

Cryptanalysis Logical Attack Perfect Encryption hypothesis Needham-Schroeder Public Key Protocol (1978) “Man in the middle attack” [Lowe’96]

6 / 37

slide-18
SLIDE 18

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Attacks

Cryptanalysis Logical Attack Perfect Encryption hypothesis Needham-Schroeder Public Key Protocol (1978) “Man in the middle attack” [Lowe’96] + Algebraic properties

6 / 37

slide-19
SLIDE 19

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Formal Approach

Symbolic abstraction Messages represented by terms

  • {m}k
  • m1, m2

Perfect encryption hypothesis

7 / 37

slide-20
SLIDE 20

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Formal Approach

Symbolic abstraction Messages represented by terms

  • {m}k
  • m1, m2

Perfect encryption hypothesis Useful abstraction [Clark & Jacob’97] Automatic verification with Tools: AVISPA, Casper/FDR, Hermes, Murphi, NRL, Proverif, Scyther ...

7 / 37

slide-21
SLIDE 21

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Formal Approach

Symbolic abstraction Messages represented by terms

  • {m}k
  • m1, m2

Perfect encryption hypothesis + algebraic properties Useful abstraction [Clark & Jacob’97] Automatic verification with Tools: AVISPA, Casper/FDR, Hermes, Murphi, NRL, Proverif, Scyther ...

7 / 37

slide-22
SLIDE 22

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

The Intruder is the Network (Worst Case)

8 / 37

slide-23
SLIDE 23

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

The Intruder is the Network (Worst Case)

Passive: Intruder deduction problem Listen

8 / 37

slide-24
SLIDE 24

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

The Intruder is the Network (Worst Case)

Passive: Intruder deduction problem Listen Active: Security problem Intercept message Delete message (Re)play message

8 / 37

slide-25
SLIDE 25

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

The Intruder is the Network (Worst Case)

Passive: Intruder deduction problem Listen Active: Security problem Intercept message Delete message (Re)play message Intruder Capabilities (Dolev-Yao Model 80’s) Encryption, Decryption with a key Pairing, Projection.

8 / 37

slide-26
SLIDE 26

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

The Intruder is the Network (Worst Case)

Passive: Intruder deduction problem Listen Active: Security problem Intercept message Delete message (Re)play message Intruder Capabilities (Dolev-Yao Model 80’s) Encryption, Decryption with a key Pairing, Projection. In general security problem undecidable [DLMS’99, AC’01]

8 / 37

slide-27
SLIDE 27

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

The Intruder is the Network (Worst Case)

Passive: Intruder deduction problem Listen Active: Security problem Intercept message Delete message (Re)play message Intruder Capabilities (Dolev-Yao Model 80’s) Encryption, Decryption with a key Pairing, Projection. In general security problem undecidable [DLMS’99, AC’01] Bounded number of session ⇒ Decidability [AL’00, RT’01]

8 / 37

slide-28
SLIDE 28

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Logical Attack on Shamir 3-Pass Protocol (I)

Perfect encryption one-time pad (Vernam Encryption) {m}k = m ⊕ k XOR Properties (ACUN) (x ⊕ y) ⊕ z = x ⊕ (y ⊕ z) Associativity x ⊕ y = y ⊕ x Commutativity x ⊕ 0 = x Unity x ⊕ x = 0 Nilpotency

9 / 37

slide-29
SLIDE 29

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Logical Attack on Shamir 3-Pass Protocol (I)

Perfect encryption one-time pad (Vernam Encryption) {m}k = m ⊕ k XOR Properties (ACUN) (x ⊕ y) ⊕ z = x ⊕ (y ⊕ z) Associativity x ⊕ y = y ⊕ x Commutativity x ⊕ 0 = x Unity x ⊕ x = 0 Nilpotency Vernam encryption is a commutative encryption : {{m}KO}KI = (m ⊕ KO) ⊕ KI = (m ⊕ KI) ⊕ KO = {{m}KI }KO

9 / 37

slide-30
SLIDE 30

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Logical Attack on Shamir 3-Pass Protocol (II)

Perfect encryption one-time pad (Vernam Encryption) {m}k = m ⊕ k Shamir 3-Pass Protocol 1 O → I : m ⊕ KO 2 I → O : (m ⊕ KO) ⊕ KI 3 O → I : m ⊕ KI Passive attacker : m ⊕ KO m ⊕ KO ⊕ KI m ⊕ KI

10 / 37

slide-31
SLIDE 31

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Logical Attack on Shamir 3-Pass Protocol (II)

Perfect encryption one-time pad (Vernam Encryption) {m}k = m ⊕ k Shamir 3-Pass Protocol 1 O → I : m ⊕ KO 2 I → O : (m ⊕ KO) ⊕ KI 3 O → I : m ⊕ KI Passive attacker : m ⊕ KO ⊕ m ⊕ KO ⊕ KI ⊕ m ⊕ KI = m

10 / 37

slide-32
SLIDE 32

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

TMN Protocol: Distribution of a fresh symmetric key

[Tatebayashi, Matsuzuki, Newmann 89]: O S I → : O, I, {NO}PubS → : S, O ← : I, O, {NI}PubS ← : S, I, NO ⊕ NI Osiris retrieves NI: Using x ⊕ x ⊕ y = y, knowing NO

11 / 37

slide-33
SLIDE 33

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Attack on TMN Protocol [Simmons’94]

With homomorphic encryption {a}k ⊕ {b}k = {a ⊕ b}k

B S C → : B, C, {NI}PubS ⊕ {NB}PubS

  • {NI ⊕NB}PubS

→ : S, B ← : C, B, {NC}PubS ← : S, (NI ⊕ NB) ⊕ NC

Buto Learns: Using x ⊕ x ⊕ y = y, knowing NB and NC, he deduces NI.

12 / 37

slide-34
SLIDE 34

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Relaxing the perfect encryption hypothesis.

[Journal of Computer Security’06]

Examples

  • f

Protocols Intruder Deduction Problem Security Problem Commutative encryption Shamir P-TIME [CKRT’04] NP-Complete [CKRT’04] ACUN Bull, Gong P-TIME [CS’03,CKRT’03] NP-Complete [CS03,CKRT’03] AG + Exp IKA.1 P-TIME [CKRTV’03] Decidable [MS’03] ACUNh WEP ? ? AGh TMN ? ? Combination Result [CR’06]

13 / 37

slide-35
SLIDE 35

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

My contributions : Homomorphism property

Passive Intruder h(x ⊕ y) = h(x) ⊕ h(y) [RTA’05]

ACh ACUNh AGh

{x ⊕ y}k = {x}k ⊕ {y}k

Distributive Encryption [I&C] Submitted (ACUN{.}., AG{.}.) Distributive and Commutative Encryption [Secret’06] {{m}k1}k2 = {{m}k2}k1

Active Intruder [ICALP’05] ACUNh

14 / 37

slide-36
SLIDE 36

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation

Outline

1 Introduction & Motivation 2 Intruder Deduction Problem (Passive Attacker)

Intruder Capabilities Locality Point of View ACh, ACUNh, AGh ACUN{.}., AG{.}.

3 Security Problem (Active Attacker)

New Extended Dolev-Yao Model Modelisation of Protocols with Constraint System Well-defined Constraints System From Well-defined Constraints System to System of Equations

4 Conclusion

15 / 37

slide-37
SLIDE 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Intruder Deduction Problem (Passive Attacker)

Outline

1 Introduction & Motivation 2 Intruder Deduction Problem (Passive Attacker)

Intruder Capabilities Locality Point of View ACh, ACUNh, AGh ACUN{.}., AG{.}.

3 Security Problem (Active Attacker)

New Extended Dolev-Yao Model Modelisation of Protocols with Constraint System Well-defined Constraints System From Well-defined Constraints System to System of Equations

4 Conclusion

16 / 37

slide-38
SLIDE 38

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Intruder Deduction Problem (Passive Attacker) Intruder Capabilities

Extended Dolev-Yao Deduction System

Deduction System : T0 ⊢? s

(A) u ∈ T0 T0 ⊢ u (UL) T0 ⊢ u, v T0 ⊢ u (P) T0 ⊢ u T0 ⊢ v T0 ⊢ u, v (UR) T0 ⊢ u, v T0 ⊢ v (C) T0 ⊢ u T0 ⊢ v T0 ⊢ {u}v (D) T0 ⊢ {u}v T0 ⊢ v T0 ⊢ u (F) T0 ⊢ u1 · · · T0 ⊢ un T0 ⊢ f (u1, . . . , un) (Eq)T0 ⊢ u u =E v T0 ⊢ v

17 / 37

slide-39
SLIDE 39

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Intruder Deduction Problem (Passive Attacker) Intruder Capabilities

Extended Dolev-Yao Deduction System

Deduction System : T0 ⊢? s

(A) u ∈ T0 T0 ⊢ u (UL) T0 ⊢ u, v T0 ⊢ u (P) T0 ⊢ u T0 ⊢ v T0 ⊢ u, v (UR) T0 ⊢ u, v T0 ⊢ v (C) T0 ⊢ u T0 ⊢ v T0 ⊢ {u}v (D) T0 ⊢ {u}v T0 ⊢ v T0 ⊢ u (F) T0 ⊢ u1 · · · T0 ⊢ un T0 ⊢ f (u1, . . . , un) (Eq)T0 ⊢ u u =E v T0 ⊢ v E is represented by a confluent and terminating rewriting system modulo AC ↓

17 / 37

slide-40
SLIDE 40

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Intruder Deduction Problem (Passive Attacker) Intruder Capabilities

Extended Dolev-Yao Deduction System

Deduction System : T0 ⊢? s

(A) u ∈ T0 T0 ⊢ u↓ (UL) T0 ⊢ u, v T0 ⊢ u↓ (P) T0 ⊢ u T0 ⊢ v T0 ⊢ u, v↓ (UR) T0 ⊢ u, v T0 ⊢ v↓ (C) T0 ⊢ u T0 ⊢ v T0 ⊢ {u}v↓ (D) T0 ⊢ {u}v T0 ⊢ v T0 ⊢ u↓ (F) T0 ⊢ u1 · · · T0 ⊢ un T0 ⊢ f (u1, . . . , un)↓ E is represented by a confluent and terminating rewriting system modulo AC ↓

17 / 37

slide-41
SLIDE 41

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Intruder Deduction Problem (Passive Attacker) Locality Point of View

Definition of S-Locality

A proof P of T0 ⊢ s is S-local : n s T0 ∀n ∈ P, n ∈ S(T0 ∪ {s}) Extended McAllester’s Theorem Let P be a proof system, if: P is S-local, the size of S(T) is computable with complexity K2,

  • ne-step deducibility is decidable with complexity K1,

then provability in the proof system P is decidable in max(K1, K2).

18 / 37

slide-42
SLIDE 42

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Intruder Deduction Problem (Passive Attacker) ACh, ACUNh, AGh

Intruder Deduction problem [RTA’05]

Dolev-Yao Model extended by: (GX)T0 ⊢E u1 . . . T0 ⊢E un T0 ⊢E (u1 ⊕ . . . ⊕ un) ↓ (h) T0 ⊢E u T0 ⊢E h(u) ↓ NP-Complete ACh One-step deducibility (N) Syntactic Subterms (P-TIME) and locality: easy EXP-TIME ACUNh, AGh One-step deducibility: easy (Z/2Z, Z) Design S (EXP-TIME) and prove locality: difficult

19 / 37

slide-43
SLIDE 43

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Intruder Deduction Problem (Passive Attacker) ACh, ACUNh, AGh

Intruder Deduction problem [RTA’05]

Dolev-Yao Model extended by: (GX)T0 ⊢E u1 . . . T0 ⊢E un T0 ⊢E (u1 ⊕ . . . ⊕ un) ↓ (h) T0 ⊢E u T0 ⊢E h(u) ↓ NP-Complete ACh One-step deducibility (N) Syntactic Subterms (P-TIME) and locality: easy EXP-TIME ACUNh, AGh One-step deducibility: easy (Z/2Z, Z) Design S (EXP-TIME) and prove locality: difficult P-TIME Complete [Delaune’06] ACUNh, AGh

19 / 37

slide-44
SLIDE 44

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Intruder Deduction Problem (Passive Attacker) ACUN{.}., AG{.}.

Distributive Encryption : ACUN{.}., AG{.}.

{x ⊕ y}k = {x}k ⊕ {y}k Example T0 = {a ⊕ {b}k, {b}k ⊕ c, {c}k ⊕ d, k} and s = {a}k ⊕ d S(T0 ∪ {s}) = T0 ∪ {s, a, b, c, d, k, {a}k, {b}k, {c}k}

20 / 37

slide-45
SLIDE 45

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Intruder Deduction Problem (Passive Attacker) ACUN{.}., AG{.}.

Distributive Encryption : ACUN{.}., AG{.}.

{x ⊕ y}k = {x}k ⊕ {y}k Example T0 = {a ⊕ {b}k, {b}k ⊕ c, {c}k ⊕ d, k} and s = {a}k ⊕ d S(T0 ∪ {s}) = T0 ∪ {s, a, b, c, d, k, {a}k, {b}k, {c}k}

(GX) (C) a ⊕ {b}k k {a}k ⊕ {{b}k}k (C) {b}k ⊕ c k {{b}k}k ⊕ {c}k {c}k ⊕ d {a}k ⊕ d

20 / 37

slide-46
SLIDE 46

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Intruder Deduction Problem (Passive Attacker) ACUN{.}., AG{.}.

Distributive Encryption : ACUN{.}., AG{.}.

{x ⊕ y}k = {x}k ⊕ {y}k Example T0 = {a ⊕ {b}k, {b}k ⊕ c, {c}k ⊕ d, k} and s = {a}k ⊕ d S(T0 ∪ {s}) = T0 ∪ {s, a, b, c, d, k, {a}k, {b}k, {c}k}

(GX) (C) a ⊕ {b}k k {a}k ⊕ {{b}k}k (C) {b}k ⊕ c k {{b}k}k ⊕ {c}k {c}k ⊕ d {a}k ⊕ d

20 / 37

slide-47
SLIDE 47

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Intruder Deduction Problem (Passive Attacker) ACUN{.}., AG{.}.

Distributive Encryption : ACUN{.}., AG{.}.

{x ⊕ y}k = {x}k ⊕ {y}k Example T0 = {a ⊕ {b}k, {b}k ⊕ c, {c}k ⊕ d, k} and s = {a}k ⊕ d S(T0 ∪ {s}) = T0 ∪ {s, a, b, c, d, k, {a}k, {b}k, {c}k}

(GX) (C) a ⊕ {b}k k {a}k ⊕ {{b}k}k (C) {b}k ⊕ c k {{b}k}k ⊕ {c}k {c}k ⊕ d {a}k ⊕ d ⇓ (GX) (C) (GX)a ⊕ {b}k {b}k ⊕ c a ⊕ c k {a}k ⊕ {c}k {c}k ⊕ d {a}k ⊕ d

20 / 37

slide-48
SLIDE 48

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Intruder Deduction Problem (Passive Attacker) ACUN{.}., AG{.}.

Intruder Deduction Problem

ACUN{.}. Atomic Locality Result EXP-TIME decision procedure AG{.}. Atomic Locality Result & Z-module EXP-TIME decision procedure

21 / 37

slide-49
SLIDE 49

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Intruder Deduction Problem (Passive Attacker) ACUN{.}., AG{.}.

Intruder Deduction Problem

ACUN{.}. Atomic Locality Result EXP-TIME decision procedure AG{.}. Atomic Locality Result & Z-module EXP-TIME decision procedure Binary Case ∀n ∈ P, n = . or n = . ⊕ . but n = . ⊕ . ⊕ . . . ⊕ . AG{.}. P-TIME (prefix rewriting)

21 / 37

slide-50
SLIDE 50

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Intruder Deduction Problem (Passive Attacker) ACUN{.}., AG{.}.

Intruder Deduction Problem

ACUN{.}. and Commutative Encryption Atomic Locality Result 2-EXP-TIME decision procedure AG{.}. and Commutative Encryption Atomic Locality Result & Z-module 2-EXP-TIME decision procedure Binary Case ∀n ∈ P, n = . or n = . ⊕ . but n = . ⊕ . ⊕ . . . ⊕ . AG{.}. P-TIME (prefix rewriting) ACUN{.}. and Commutative Encryption EXP-SPACE hard

21 / 37

slide-51
SLIDE 51

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Security Problem (Active Attacker)

Outline

1 Introduction & Motivation 2 Intruder Deduction Problem (Passive Attacker)

Intruder Capabilities Locality Point of View ACh, ACUNh, AGh ACUN{.}., AG{.}.

3 Security Problem (Active Attacker)

New Extended Dolev-Yao Model Modelisation of Protocols with Constraint System Well-defined Constraints System From Well-defined Constraints System to System of Equations

4 Conclusion

22 / 37

slide-52
SLIDE 52

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Security Problem (Active Attacker) New Extended Dolev-Yao Model

New Extended Dolev-Yao Deduction System

Deduction System : T0 ⊢? s

(A) u ∈ T0 T0 ⊢ u (UL) T0 ⊢ u, v T0 ⊢ u (P) T0 ⊢ u T0 ⊢ v T0 ⊢ u, v (UR) T0 ⊢ u, v T0 ⊢ v (C) T0 ⊢ u T0 ⊢ v T0 ⊢ {u}v (D) T0 ⊢ {u}v T0 ⊢ v T0 ⊢ u (ME) T0 ⊢ u1 · · · T0 ⊢ un T0 ⊢ C[u1, . . . , un] C is a context made with {h, ⊕}

23 / 37

slide-53
SLIDE 53

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Security Problem (Active Attacker) New Extended Dolev-Yao Model

New Extended Dolev-Yao Deduction System

Deduction System : T0 ⊢? s

(A) u ∈ T0 T0 ⊢ u (UL) T0 ⊢ u, v T0 ⊢ u (P) T0 ⊢ u T0 ⊢ v T0 ⊢ u, v (UR) T0 ⊢ u, v T0 ⊢ v (C) T0 ⊢ u T0 ⊢ v T0 ⊢ {u}v (D) T0 ⊢ {u}v T0 ⊢ v T0 ⊢ u (ME) T0 ⊢ u1 · · · T0 ⊢ un T0 ⊢ C[u1, . . . , un] C is a context made with {h, ⊕}

Example

T0 ⊢ a ⊕ h(a) T0 ⊢ b T0 ⊢ a ⊕ h2(a) ⊕ h(b) C[u1, u2] = (h ⊕ 1)(u1) ⊕ h(u2) a ⊕ h(a) ⊕ h(a ⊕ h(a)) ⊕ h(b)

23 / 37

slide-54
SLIDE 54

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Security Problem (Active Attacker) Modelisation of Protocols with Constraint System

Modeling a protocol as a system of constraints The Intruder is the network, he can listen, build, send and replay messages. P :=          recv(u1); send(v1) recv(u2); send(v2) . . . recv(un); send(vn) T0 initial Intruder knowledge. C :=              T0

  • u1

T0, v1

  • u2

T0, v1, v2

  • u3

. . . T0, v1, . . . , vn

  • s

If this system has a solution σ then the secret s can be obtained by the Intruder.

24 / 37

slide-55
SLIDE 55

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Security Problem (Active Attacker) Well-defined Constraints System

System of Constraints Well-formed [MS’03] C = {Ti ui}1≤i≤k is well-formed if: monotonicity: The knowledge of the intruder is increasing. T1 ⊆ T2 ⊆ . . . ⊆ Tk

  • rigination: Variables appear first on right side:

x ∈ vars(Ti) ⇒ ∃j < i such that : x ∈ vars(uj) System of Constraints Well-defined [MS’03] C is well-defined if for every substitution θ, Cθ ↓ is well-formed.

25 / 37

slide-56
SLIDE 56

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Security Problem (Active Attacker) Well-defined Constraints System

System of Constraints Well-formed [MS’03] C = {Ti ui}1≤i≤k is well-formed if: monotonicity: The knowledge of the intruder is increasing. T1 ⊆ T2 ⊆ . . . ⊆ Tk

  • rigination: Variables appear first on right side:

x ∈ vars(Ti) ⇒ ∃j < i such that : x ∈ vars(uj) System of Constraints Well-defined [MS’03] C is well-defined if for every substitution θ, Cθ ↓ is well-formed.

25 / 37

slide-57
SLIDE 57

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Security Problem (Active Attacker) Well-defined Constraints System

Well-Definedness: Example

C := T0

  • X ⊕ Y

T0, X

  • c

26 / 37

slide-58
SLIDE 58

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Security Problem (Active Attacker) Well-defined Constraints System

Well-Definedness: Example

C := T0

  • X ⊕ Y

T0, X

  • c

Monotonicity OK !

26 / 37

slide-59
SLIDE 59

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Security Problem (Active Attacker) Well-defined Constraints System

Well-Definedness: Example

C := T0

  • X ⊕ Y

T0, X

  • c

Monotonicity OK ! Origination OK !

26 / 37

slide-60
SLIDE 60

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Security Problem (Active Attacker) Well-defined Constraints System

Well-Definedness: Example

C := T0

  • X ⊕ Y

T0, X

  • c

Monotonicity OK ! Origination OK ! Well-formed OK !

26 / 37

slide-61
SLIDE 61

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Security Problem (Active Attacker) Well-defined Constraints System

Well-Definedness: Example

C := T0

  • X ⊕ Y

T0, X

  • c

Monotonicity OK ! Origination OK ! Well-formed OK ! But NOT well-defined ! θ = {Y → X} and Cθ is not well-formed: Cθ := T0

  • T0, X
  • c

26 / 37

slide-62
SLIDE 62

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Security Problem (Active Attacker) From Well-defined Constraints System to System of Equations

Our Procedure

Theorem [ICALP’06] The security problem modulo ACUNh with a bounded number of sessions is decidable for deterministic protocols. Idea of the proof: Let C be a W-D constraints system

1 From W-D to W-D 1 2 From W-D 1 to W-D ME 3 From W-D ME to W-D equations systems 4 Solve these W-D equations systems

27 / 37

slide-63
SLIDE 63

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Security Problem (Active Attacker) From Well-defined Constraints System to System of Equations

From W-D to W-D 1

Example C := T

  • X, h(Y )

Guess set of subterms of C and an order on these subterms C′ :=    T 1 X T, X 1 h(Y ) T, X, h(Y ) 1 X, h(Y )

28 / 37

slide-64
SLIDE 64

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Security Problem (Active Attacker) From Well-defined Constraints System to System of Equations

From W-D to W-D 1

Example C := T

  • X, h(Y )

Guess set of subterms of C and an order on these subterms C′ :=    T 1 X T, X 1 h(Y ) T, X, h(Y ) 1 X, h(Y )

28 / 37

slide-65
SLIDE 65

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Security Problem (Active Attacker) From Well-defined Constraints System to System of Equations

From W-D 1 to W-D ME

Guess equalities between subterms of C. (consider all the possible applications of rules (C) (P) (D) (UR) (UL)) Example C :=

  • a, b

1 X, b a, b, X ⊕ b 1 Y ⊕ a, b Guess {X, b = a, b}, compute ACUNh m.g.u. θ : {X → a} [UNIF’06] Cθ :=

  • a, b

ME a, b a, b, a ⊕ b ME Y ⊕ a, b

29 / 37

slide-66
SLIDE 66

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Security Problem (Active Attacker) From Well-defined Constraints System to System of Equations

From W-D ME to W-D Equations System (I)

Idea Abstraction ρ to get a constraint system on signature:⊕, h, and constant symbols. Example: C := a, b ME X, b a, b, X ME X ⊕ b C is well-defined, but not Cρ Cρ := a, b ME c1 a, b, X ME X ⊕ b

30 / 37

slide-67
SLIDE 67

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Security Problem (Active Attacker) From Well-defined Constraints System to System of Equations

From W-D ME to W-D Equations System (II)

Lemma Restriction to systems where abstraction preserves Well-Definedness is sufficent for completeness. Example: C := a, b ME X a, b, X, b ME X, b ⊕ Z C and Cρ are well-defined. Cρ := a, b ME X a, b, c1 ME c1 ⊕ Z

31 / 37

slide-68
SLIDE 68

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Security Problem (Active Attacker) From Well-defined Constraints System to System of Equations

Constraint ME to Quadratic Equations System

System C of Constraints ME C :=    t1, t2 ME h(X1) ⊕ X2 t1, t2, X1 ⊕ X2 ME X1 ⊕ a t1, t2, X1 ⊕ X2, X1 ME X2 ⊕ b System of equations E E :=    z[1, 1]t1 ⊕ z[1, 2]t2 = h(X1) ⊕ X2 z[2, 1]t1 ⊕ z[2, 2]t2 ⊕ z[2, 3](X1 ⊕ X2) = X1 ⊕ a z[3, 1]t1 ⊕ z[3, 2]t2 ⊕ z[3, 3](X1 ⊕ X2) ⊕ z[3, 4]X1 = X2 ⊕ b z[i, j] ∈ Z/2Z[h] Solving quadratic systems of equations is in general undecidable.

32 / 37

slide-69
SLIDE 69

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Security Problem (Active Attacker) From Well-defined Constraints System to System of Equations

Constraint ME to Quadratic Equations System

System C of Constraints ME C :=    t1, t2 ME h(X1) ⊕ X2 t1, t2, X1 ⊕ X2 ME X1 ⊕ a t1, t2, X1 ⊕ X2, X1 ME X2 ⊕ b System of equations E E :=    z[1, 1]t1 ⊕ z[1, 2]t2 = h(X1) ⊕ X2 z[2, 1]t1 ⊕ z[2, 2]t2 ⊕ z[2, 3](X1 ⊕ X2) = X1 ⊕ a z[3, 1]t1 ⊕ z[3, 2]t2 ⊕ z[3, 3](X1 ⊕ X2) ⊕ z[3, 4]X1 = X2 ⊕ b z[i, j] ∈ Z/2Z[h] Solving quadratic systems of equations is in general undecidable. We propose a procedure to solve Well-defined Quadratic system of equations.

32 / 37

slide-70
SLIDE 70

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Conclusion

Outline

1 Introduction & Motivation 2 Intruder Deduction Problem (Passive Attacker)

Intruder Capabilities Locality Point of View ACh, ACUNh, AGh ACUN{.}., AG{.}.

3 Security Problem (Active Attacker)

New Extended Dolev-Yao Model Modelisation of Protocols with Constraint System Well-defined Constraints System From Well-defined Constraints System to System of Equations

4 Conclusion

33 / 37

slide-71
SLIDE 71

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Conclusion

Theorem [ICALP’06] The security problem modulo ACUNh with a bounded number of sessions is decidable for deterministic protocols. Given: Well-defined protocol.

1 Guess partition of subterms ⇒ WD one-step Constraints 2 Guess equality on subterms ⇒ WD ME Constraints 3 Abstraction ⇒ System of equations WD 4 Solve system of equations ⇒ Attack on Protocol.

34 / 37

slide-72
SLIDE 72

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Conclusion

Conclusions & Future Works

Complexity Intruder Deduction Problem Security Problem ACUNh EXP-TIME [RTA’05] Decidable [ICALP’06] AGh EXP-TIME [RTA’05] Undecidable ACUN{.}. & AG{.}. EXP-TIME Submitted ? ACUN{.}. & AG{.}. Commutative 2EXP-TIME [Secret’06] ?

35 / 37

slide-73
SLIDE 73

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Conclusion

Future Works

Extensions Active case for distributive encryption. Complexity of our procedure (Active Case). General procedure for monoidal theories (AG,ACUN). Applications Web Services. Elliptic curves. Others properties on new protocols: Authentification, Fairness, Timestamps...

E-auction Wireless

36 / 37

slide-74
SLIDE 74

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Conclusion

Thank you for your attention. Questions ?

37 / 37