Verification of Security Protocols eronique Cortier 1 V July 2nd, - - PowerPoint PPT Presentation

▶
verification of security protocols
SMART_READER_LITE
LIVE PREVIEW

Verification of Security Protocols eronique Cortier 1 V July 2nd, - - PowerPoint PPT Presentation

Mar 11, 2023 508 likes •2.12k views

Introduction on security protocols Formal models Going further Towards more guarantees Verification of Security Protocols eronique Cortier 1 V July 2nd, 2010 Movep 2010 1 LORIA, CNRS - INRIA Cassis project, Nancy Universities 1/102 V

slide-1
SLIDE 1

Introduction on security protocols Formal models Going further Towards more guarantees

Verification of Security Protocols

V´ eronique Cortier1 July 2nd, 2010

Movep 2010

1LORIA, CNRS - INRIA Cassis project, Nancy Universities 1/102 V´ eronique Cortier Verification of Security Protocols

slide-2
SLIDE 2

Introduction on security protocols Formal models Going further Towards more guarantees

LORIA (Nancy)

Size : 500 researchers, among which about 150 permanent researchers and 150 PhD students.

2/102 V´ eronique Cortier Verification of Security Protocols

slide-3
SLIDE 3

Introduction on security protocols Formal models Going further Towards more guarantees

Where is it ?

Well connected to : Paris, France (90 minutes) Luxembourg (90-120 minutes) Saarbrucken, Germany (120 minutes)

3/102 V´ eronique Cortier Verification of Security Protocols

slide-4
SLIDE 4

Introduction on security protocols Formal models Going further Towards more guarantees

What kind of research ?

Research themes High-performance calculations, simulation and visualization Model checking, security, rewriting systems Parallel, distributed and communicating systems Models and algorithms for bio-sciences Natural Language Processing and multi-modal communication Knowledge representation and processing

4/102 V´ eronique Cortier Verification of Security Protocols

slide-5
SLIDE 5

Introduction on security protocols Formal models Going further Towards more guarantees

Regular job offers !

PhD positions Post-doc positions Permanent positions (CNRS, INRIA, Universities)

5/102 V´ eronique Cortier Verification of Security Protocols

slide-6
SLIDE 6

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Outline of the talk

1

Introduction on security protocols Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

2

Formal models Messages Intruder Protocol Solving constraint systems

3

Going further Undecidability Horn clauses Adding equational theories Some results

4

Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

6/102 V´ eronique Cortier Verification of Security Protocols

slide-7
SLIDE 7

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Context : cryptographic protocols

Cryptographic protocols are widely used in everyday life. → They aim at securing communications over public or insecure networks.

7/102 V´ eronique Cortier Verification of Security Protocols

slide-8
SLIDE 8

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

On the web

  • HTTPS, i.e. the SSL

protocol for ensuring confidentiality

  • password-based

authentication

8/102 V´ eronique Cortier Verification of Security Protocols

slide-9
SLIDE 9

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Credit Card payment

It is a real card ? Is the pin code protected ?

9/102 V´ eronique Cortier Verification of Security Protocols

slide-10
SLIDE 10

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Pay-per-view devices

− − − − − − − → ← − − − − − − − Checks your identity You should be granted access to the movie only once You should not be able to broadcast the movie to other people

10/102 V´ eronique Cortier Verification of Security Protocols

slide-11
SLIDE 11

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Electronic voting

The result corresponds to the votes. Each vote is confidential. No partial result is leaked before the end of the election Only voters can vote and at most once Coercion resistance

11/102 V´ eronique Cortier Verification of Security Protocols

slide-12
SLIDE 12

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Electronic purse

It should not possible to add money without paying. It should not be possible to create fake electronic purse.

12/102 V´ eronique Cortier Verification of Security Protocols

slide-13
SLIDE 13

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Security goals

Cryptographic protocols aim at preserving confidentiality of data (e.g. pin code, medical files, ...) ensuring authenticity (Are you really talking to your bank ? ?) ensuring anonymous communications (for e-voting protocols, ...) protecting against repudiation (I never sent this message ! !) ... ⇒ Cryptographic protocols vary depending on the application.

13/102 V´ eronique Cortier Verification of Security Protocols

slide-14
SLIDE 14

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

How does this work ?

14/102 V´ eronique Cortier Verification of Security Protocols

slide-15
SLIDE 15

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

How does this work ?

A cryptographic protocol : Protocol describes how each participant should behave in

  • rder to get e.g. a common key.

Cryptographic makes uses of cryptographic primitives (e.g. encryption, signatures, hashes, ...)

14/102 V´ eronique Cortier Verification of Security Protocols

slide-16
SLIDE 16

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Credit Card payment

It is a real card ? Is the pin code protected ?

15/102 V´ eronique Cortier Verification of Security Protocols

slide-17
SLIDE 17

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Behavior in the usual case

The waiter introduces the credit card. The waiter enters the amount m of the transaction on the terminal. The terminal authenticates the card. The customer enters his secret code. If the amount m is greater than 100 euros (and in only 20% of the cases)

The terminal asks the bank for authentication of the card. The bank provides authentication.

16/102 V´ eronique Cortier Verification of Security Protocols

slide-18
SLIDE 18

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

More details

4 actors : Bank, Customer, Card and Terminal. Bank owns a signing key K −1

B , secret,

a verification key KB, public, a secret symmetric key for each credit card KCB, secret. Card owns Data : last name, first name, card’s number, expiration date, Signature’s Value VS = {hash(Data)}K −1

B ,

secret key KCB. Terminal owns the verification key KB for bank’s signatures.

17/102 V´ eronique Cortier Verification of Security Protocols

slide-19
SLIDE 19

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Credit card payment Protocol (in short)

The terminal reads the card : 1. Ca → T : Data, {hash(Data)}K −1

B 18/102 V´ eronique Cortier Verification of Security Protocols

slide-20
SLIDE 20

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Credit card payment Protocol (in short)

The terminal reads the card : 1. Ca → T : Data, {hash(Data)}K −1

B

The terminal asks for the secret code : 2. T → Cu : secret code? 3. Cu → Ca : 1234 4. Ca → T : ok

18/102 V´ eronique Cortier Verification of Security Protocols

slide-21
SLIDE 21

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Credit card payment Protocol (in short)

The terminal reads the card : 1. Ca → T : Data, {hash(Data)}K −1

B

The terminal asks for the secret code : 2. T → Cu : secret code? 3. Cu → Ca : 1234 4. Ca → T : ok The terminal calls the bank : 5. T → B : auth? 6. B → T : Nb 7. T → Ca : Nb 8. Ca → T : {Nb}KCB 9. T → B : {Nb}KCB 10. B → T : ok

18/102 V´ eronique Cortier Verification of Security Protocols

slide-22
SLIDE 22

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Some flaws

The security was initially ensured by : the cards were very difficult to reproduce, the protocol and the keys were secret. But cryptographic flaw : 320 bits keys can be broken (1988), logical flaw : no link between the secret code and the authentication of the card, fake cards can be build.

19/102 V´ eronique Cortier Verification of Security Protocols

slide-23
SLIDE 23

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Some flaws

The security was initially ensured by : the cards were very difficult to reproduce, the protocol and the keys were secret. But cryptographic flaw : 320 bits keys can be broken (1988), logical flaw : no link between the secret code and the authentication of the card, fake cards can be build. → “YesCard” build by Serge Humpich (1998 in France).

19/102 V´ eronique Cortier Verification of Security Protocols

slide-24
SLIDE 24

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

How does the “YesCard” work ?

Logical flaw 1. Ca → T : Data, {hash(Data)}K −1

B

2. T → Ca : secret code? 3. Cu → Ca : 1234 4. Ca → T : ok

20/102 V´ eronique Cortier Verification of Security Protocols

slide-25
SLIDE 25

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

How does the “YesCard” work ?

Logical flaw 1. Ca → T : Data, {hash(Data)}K −1

B

2. T → Ca : secret code? 3. Cu → Ca′ : 2345 4. Ca′ → T : ok

20/102 V´ eronique Cortier Verification of Security Protocols

slide-26
SLIDE 26

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

How does the “YesCard” work ?

Logical flaw 1. Ca → T : Data, {hash(Data)}K −1

B

2. T → Ca : secret code? 3. Cu → Ca′ : 2345 4. Ca′ → T : ok Remark : there is always somebody to debit. → creation of a fake card

20/102 V´ eronique Cortier Verification of Security Protocols

slide-27
SLIDE 27

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

How does the “YesCard” work ?

Logical flaw 1. Ca → T : Data, {hash(Data)}K −1

B

2. T → Ca : secret code? 3. Cu → Ca′ : 2345 4. Ca′ → T : ok Remark : there is always somebody to debit. → creation of a fake card 1. Ca′ → T : XXX, {hash(XXX)}K −1

B

2. T → Cu : secret code? 3. Cu → Ca′ : 0000 4. Ca′ → T : ok

20/102 V´ eronique Cortier Verification of Security Protocols

slide-28
SLIDE 28

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

How to exchange a secret with commutative encryption

First : a small challenge for your nephews / nieces / cousins / children.

21/102 V´ eronique Cortier Verification of Security Protocols

slide-29
SLIDE 29

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

A completely fictitious town

Two types of inhabitants : Sedentary inhabitants stay at their home Post office workers deliver boxes between sedentary inhabitants

22/102 V´ eronique Cortier Verification of Security Protocols

slide-30
SLIDE 30

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

A completely fictitious town

Two types of inhabitants : Sedentary inhabitants stay at their home Post office workers deliver boxes between sedentary inhabitants Axiom 1 Post office workers may steal any unlocked box (Reminder : this scenario is entirely fictitious !) Axiom 2 The content of locked boxes CANNOT be theft. Challenge How Alice (sedentary) can send a gift to Bob (also sedentary) ?

22/102 V´ eronique Cortier Verification of Security Protocols

slide-31
SLIDE 31

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Commutative Symmetric encryption

Symmetric encryption, denoted by {m}k Encryption Decryption clef clef Hello Alice Obawbhe Nyvpr Hello Alice The same key is used for encrypting and decrypting. Commutative (symmetric) encryption (e.g. RSA) {{m}k1}k2 = {{m}k2}k1

23/102 V´ eronique Cortier Verification of Security Protocols

slide-32
SLIDE 32

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Exchanging a secret with commutative encryption (RSA)

{pin : 3443}kalice − − − − − − − − − − − →

24/102 V´ eronique Cortier Verification of Security Protocols

slide-33
SLIDE 33

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Exchanging a secret with commutative encryption (RSA)

{pin : 3443}kalice − − − − − − − − − − − →

{pin : 3443}kalice

ff

kbob

← − − − − − − − − − − − − − − −

24/102 V´ eronique Cortier Verification of Security Protocols

slide-34
SLIDE 34

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Exchanging a secret with commutative encryption (RSA)

{pin : 3443}kalice − − − − − − − − − − − →

{pin : 3443}kalice

ff

kbob

← − − − − − − − − − − − − − − − {pin : 3443}kbob − − − − − − − − − − − → Since

  • {pin : 3443}kalice
  • kbob

=

  • {pin : 3443}kbob
  • kalice

24/102 V´ eronique Cortier Verification of Security Protocols

slide-35
SLIDE 35

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Exchanging a secret with commutative encryption (RSA)

{pin : 3443}kalice − − − − − − − − − − − →

{pin : 3443}kalice

ff

kbob

← − − − − − − − − − − − − − − − {pin : 3443}kbob − − − − − − − − − − − → → It does not work ! (Authentication problem)

24/102 V´ eronique Cortier Verification of Security Protocols

slide-36
SLIDE 36

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Exchanging a secret with commutative encryption (RSA)

{pin : 3443}kalice − − − − − − − − − − − →

{pin : 3443}kalice

ff

kbob

← − − − − − − − − − − − − − − − {pin : 3443}kbob − − − − − − − − − − − → → It does not work ! (Authentication problem) {pin : 3443}kalice − − − − − − − − − − − →

{pin : 3443}kalice

ff

kintruder

← − − − − − − − − − − − − − − − − − {pin : 3443}kintruder − − − − − − − − − − − − →

24/102 V´ eronique Cortier Verification of Security Protocols

slide-37
SLIDE 37

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Another example The “famous” Needham-Schroeder public key protocol

(and its associated Man-In-The-Middle Attack)

25/102 V´ eronique Cortier Verification of Security Protocols

slide-38
SLIDE 38

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Public key encryption

Public key : pk(A) Encryption : {m}pk(A) Encryption Decryption public key private key Hello Alice Obawbhe Nyvpr Hello Alice Encryption with the public key and decryption with the private key. Invented only in the late 70’s !

26/102 V´ eronique Cortier Verification of Security Protocols

slide-39
SLIDE 39

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Needham-Schroeder public key protocol

Na Random number (called nonce) generated by A. Nb Random number (called nonce) generated by B.

  • A

→ B : {A, Na}pub(B) B → A : {Na, Nb}pub(A) A → B : {Nb}pub(B)

27/102 V´ eronique Cortier Verification of Security Protocols

slide-40
SLIDE 40

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Needham-Schroeder public key protocol

Na Random number (called nonce) generated by A. Nb Random number (called nonce) generated by B.

A → B : {A, Na}pub(B)

  • B

→ A : {Na, Nb}pub(A) A → B : {Nb}pub(B)

27/102 V´ eronique Cortier Verification of Security Protocols

slide-41
SLIDE 41

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Needham-Schroeder public key protocol

Na Random number (called nonce) generated by A. Nb Random number (called nonce) generated by B.

A → B : {A, Na}pub(B) B → A : {Na, Nb}pub(A)

  • A

→ B : {Nb}pub(B)

27/102 V´ eronique Cortier Verification of Security Protocols

slide-42
SLIDE 42

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Needham-Schroeder public key protocol

Na Random number (called nonce) generated by A. Nb Random number (called nonce) generated by B.

A → B : {A, Na}pub(B) B → A : {Na, Nb}pub(A) A → B : {Nb}pub(B)

Questions : Is Nb secret between A and B ? When B receives {Nb}pub(B), does this message really come from A ?

27/102 V´ eronique Cortier Verification of Security Protocols

slide-43
SLIDE 43

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Needham-Schroeder public key protocol

Na Random number (called nonce) generated by A. Nb Random number (called nonce) generated by B.

A → B : {A, Na}pub(B) B → A : {Na, Nb}pub(A) A → B : {Nb}pub(B)

Questions : Is Nb secret between A and B ? When B receives {Nb}pub(B), does this message really come from A ? → An attack was discovered in 1996, 17 years after the publication

  • f the protocol !

27/102 V´ eronique Cortier Verification of Security Protocols

slide-44
SLIDE 44

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Man in the middle attack

{A,Na}pub(P)

− − − − − − − →

{A,Na}pub(B)

− − − − − − − →

28/102 V´ eronique Cortier Verification of Security Protocols

slide-45
SLIDE 45

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Man in the middle attack

{A,Na}pub(P)

− − − − − − − →

{A,Na}pub(B)

− − − − − − − →

{ Na,Nb}pub(A)

← − − − − − − − − −

{ Na,Nb}pub(A)

← − − − − − − − − −

28/102 V´ eronique Cortier Verification of Security Protocols

slide-46
SLIDE 46

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Man in the middle attack

{A,Na}pub(P)

− − − − − − − →

{A,Na}pub(B)

− − − − − − − →

{ Na,Nb}pub(A)

← − − − − − − − − −

{ Na,Nb}pub(A)

← − − − − − − − − −

{Nb}pub(P)

− − − − − − →

{Nb}pub(B)

− − − − − − →

28/102 V´ eronique Cortier Verification of Security Protocols

slide-47
SLIDE 47

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Man in the middle attack

{A,Na}pub(P)

− − − − − − − →

{A,Na}pub(B)

− − − − − − − →

{B,Na,Nb}pub(A)

← − − − − − − − − −

{B,Na,Nb}pub(A)

← − − − − − − − − −

{Nb}pub(P)

− − − − − − →

{Nb}pub(B)

− − − − − − → Fixing the flaw : add the identity of B.

28/102 V´ eronique Cortier Verification of Security Protocols

slide-48
SLIDE 48

Introduction on security protocols Formal models Going further Towards more guarantees Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example

Outline of the talk

1 Introduction on security protocols Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example 2 Formal models Messages Intruder Protocol Solving constraint systems 3 Going further Undecidability Horn clauses Adding equational theories Some results 4 Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

29/102 V´ eronique Cortier Verification of Security Protocols

slide-49
SLIDE 49

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

Difficulty

Presence of an attacker may read every message sent on the net, may intercept and send new messages. ⇒ The system is infinitely branching

30/102 V´ eronique Cortier Verification of Security Protocols

slide-50
SLIDE 50

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

A naive approach

Why not modeling security protocol using a (possibly extended) automata ?

Init Step 1 Step 2 Success Failure A sends Msg1 B sends Msg2 A accepts Msg2 restart Invalid message Invalid message

31/102 V´ eronique Cortier Verification of Security Protocols

slide-51
SLIDE 51

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

How to model a security protocol ?

Init Step 1 Step 2 Success Failure A sends Msg1 B sends Msg2 A accepts Msg2 restart Invalid message Invalid message

The output of each participants strongly depends on the data received inside the message. At each step, a malicious user (called the adversary) may create arbitrary messages. The output of the adversary strongly depends on the messages sent on the network. → It is important to have a tight modeling of the messages.

32/102 V´ eronique Cortier Verification of Security Protocols

slide-52
SLIDE 52

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

An appropriate datastructure : Terms

Given a signature F of symbols with an arity e.g. {enc, pair, a, b, c, na, nb} and a set X of variables, the set of terms T(F, X) is inductively defined as follows : constants terms (e.g. a, b, c, na, nb) are terms variables are terms f (t1, . . . , tn) is a term whenever t1, . . . , tn are terms. Intuition : from words to trees. → There exists automata on trees instead of (classical) automata

  • n words, see e.g. TATA http ://tata.gforge.inria.fr/

33/102 V´ eronique Cortier Verification of Security Protocols

slide-53
SLIDE 53

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

Messages

Messages are abstracted by terms. Agents : a, b, . . . Nonces : n1, n2, . . . Keys : k1, k2, . . Cyphertext : enc(m, k) Concatenation : pair(m1, m2) Example : The message {A, Na}K is represented by : enc(pair(A, Na), K)

K

  • {}

A Na

Intuition : only the structure of the message is kept.

34/102 V´ eronique Cortier Verification of Security Protocols

slide-54
SLIDE 54

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

Intruder abilities

Composition rules T ⊢ u T ⊢ v T ⊢ u , v T ⊢ u T ⊢ v T ⊢ enc(u, v) T ⊢ u T ⊢ v T ⊢ enca(u, v)

35/102 V´ eronique Cortier Verification of Security Protocols

slide-55
SLIDE 55

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

Intruder abilities

Composition rules T ⊢ u T ⊢ v T ⊢ u , v T ⊢ u T ⊢ v T ⊢ enc(u, v) T ⊢ u T ⊢ v T ⊢ enca(u, v) Decomposition rules u ∈ T T ⊢ u T ⊢ u , v T ⊢ u T ⊢ u , v T ⊢ v T ⊢ enc(u, v) T ⊢ v T ⊢ u T ⊢ enca(u, pub(v)) T ⊢ priv(v) T ⊢ u

35/102 V´ eronique Cortier Verification of Security Protocols

slide-56
SLIDE 56

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

Intruder abilities

Composition rules T ⊢ u T ⊢ v T ⊢ u , v T ⊢ u T ⊢ v T ⊢ enc(u, v) T ⊢ u T ⊢ v T ⊢ enca(u, v) Decomposition rules u ∈ T T ⊢ u T ⊢ u , v T ⊢ u T ⊢ u , v T ⊢ v T ⊢ enc(u, v) T ⊢ v T ⊢ u T ⊢ enca(u, pub(v)) T ⊢ priv(v) T ⊢ u Deducibility relation A term u is deducible from a set of terms T, denoted by T ⊢ u, if there exists a prooftree witnessing this fact.

35/102 V´ eronique Cortier Verification of Security Protocols

slide-57
SLIDE 57

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

A simple protocol

Bob, k Alice, enc(s, k)

36/102 V´ eronique Cortier Verification of Security Protocols

slide-58
SLIDE 58

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

A simple protocol

Bob, k Alice, enc(s, k) Question ? Can the attacker learn the secret s ?

36/102 V´ eronique Cortier Verification of Security Protocols

slide-59
SLIDE 59

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

A simple protocol

Bob, k Alice, enc(s, k) Answer : Of course, Yes ! Alice, enc(s, k) enc(s, k) Bob, k k s

36/102 V´ eronique Cortier Verification of Security Protocols

slide-60
SLIDE 60

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

Decision of the intruder problem

Given A set of messages S and a message m Question Can the intruder learn m from S that is S ⊢ m ? This problem is decidable in polynomial time. (left as exercice)

37/102 V´ eronique Cortier Verification of Security Protocols

slide-61
SLIDE 61

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

Decision of the intruder problem

Given A set of messages S and a message m Question Can the intruder learn m from S that is S ⊢ m ? This problem is decidable in polynomial time. (left as exercice) Lemma (Locality) If there is a proof of S ⊢ m then there is a proof that only uses the subterms of S and m.

37/102 V´ eronique Cortier Verification of Security Protocols

slide-62
SLIDE 62

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

Protocol description

Protocol : A → B : {pin}ka B → A : {{pin}ka}kb A → B : {pin}kb A protocol is a finite set of roles : role Π(1) corresponding to the 1st participant played by a talking to b : init

ka

→ enc(pin, ka) enc(x, ka) → x.

38/102 V´ eronique Cortier Verification of Security Protocols

slide-63
SLIDE 63

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

Protocol description

Protocol : A → B : {pin}ka B → A : {{pin}ka}kb A → B : {pin}kb A protocol is a finite set of roles : role Π(1) corresponding to the 1st participant played by a talking to b : init

ka

→ enc(pin, ka) enc(x, ka) → x. role Π(2) corresponding to the 2nd participant played by b with a : x

kb

→ enc(x, kb) enc(y, kb) → stop.

38/102 V´ eronique Cortier Verification of Security Protocols

slide-64
SLIDE 64

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

Secrecy via constraint solving [Millen et al]

Constraint systems are used to specify secrecy preservation under a particular, finite scenario. Scenario rcv(u1)

N1

→ snd(v1) rcv(u2)

N2

→ snd(v2) . . . rcv(un)

Nn

→ snd(vn) Constraint System C =        T0 u1 T0, v1 u2 ... T0, v1, .., vn s where T0 is the initial knowledge of the attacker. Remark : Constraint Systems may be used more generally for trace-based properties, e.g. authentication.

39/102 V´ eronique Cortier Verification of Security Protocols

slide-65
SLIDE 65

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

Secrecy via constraint solving [Millen et al]

Constraint systems are used to specify secrecy preservation under a particular, finite scenario. Scenario rcv(u1)

N1

→ snd(v1) rcv(u2)

N2

→ snd(v2) . . . rcv(un)

Nn

→ snd(vn) Constraint System C =        T0 u1 T0, v1 u2 ... T0, v1, .., vn s where T0 is the initial knowledge of the attacker. Solution of a constraint system A substitution σ such that for every T u ∈ C, uσ is deducible from Tσ, that is uσ ⊢ Tσ.

39/102 V´ eronique Cortier Verification of Security Protocols

slide-66
SLIDE 66

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

Example of a system constraint

A → B : {pin}ka B → A : {{pin}ka}kb A → B : {pin}kb and the attacker initially knows T0 = {init}. One possible associated constraint system is : C =    {init} init {init, {pin}ka} {x}ka {init, {pin}ka, x} pin Is there a solution ?

40/102 V´ eronique Cortier Verification of Security Protocols

slide-67
SLIDE 67

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

Example of a system constraint

A → B : {pin}ka B → A : {{pin}ka}kb A → B : {pin}kb and the attacker initially knows T0 = {init}. One possible associated constraint system is : C =    {init} init {init, {pin}ka} {x}ka {init, {pin}ka, x} pin Is there a solution ? Of course yes, simply consider x = pin !

40/102 V´ eronique Cortier Verification of Security Protocols

slide-68
SLIDE 68

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

How to solve constraint system ?

Given C =        T0 u1 T0, v1 u2 ... T0, v1, .., vn un+1 Question Is there a solution σ of C ?

41/102 V´ eronique Cortier Verification of Security Protocols

slide-69
SLIDE 69

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

An easy case : “solved constraint systems”

Given C =        T0 x1 T0, v1 x2 ... T0, v1, .., vn xn+1 Question Is there a solution σ of C ?

42/102 V´ eronique Cortier Verification of Security Protocols

slide-70
SLIDE 70

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

An easy case : “solved constraint systems”

Given C =        T0 x1 T0, v1 x2 ... T0, v1, .., vn xn+1 Question Is there a solution σ of C ? Of course yes ! Consider e.g. σ(x1) = · · · = σ(xn+1) = t ∈ T0.

42/102 V´ eronique Cortier Verification of Security Protocols

slide-71
SLIDE 71

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

Decision procedure [Millen / Comon-Lundh]

Goal : Transformation of the constraints in order to obtain a solved constraint system.

C = 8 > > < > > : T0 u1 T0, v1 u2 ... T0, v1, .., vn un+1

SOLVED

⊥ ⊥ C1 C2 C3 C4

C has a solution iff C C′ with C′ in solved form.

43/102 V´ eronique Cortier Verification of Security Protocols

slide-72
SLIDE 72

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

Intruder step

The intruder can built messages R5 : C ∧ T f (u, v)

  • C ∧ T u ∧ T v

for f ∈ {, enc, enca}

44/102 V´ eronique Cortier Verification of Security Protocols

slide-73
SLIDE 73

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

Intruder step

The intruder can built messages R5 : C ∧ T f (u, v)

  • C ∧ T u ∧ T v

for f ∈ {, enc, enca} Example : a, k enc(x, y, k)

  • a, k k

a, k x a, k y

44/102 V´ eronique Cortier Verification of Security Protocols

slide-74
SLIDE 74

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

Eliminating redundancies

k x k, enc(s, x) s The constraint enc(s, x) s will be satisfied as soon as k x is satisfied.

45/102 V´ eronique Cortier Verification of Security Protocols

slide-75
SLIDE 75

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

Eliminating redundancies

k x k, enc(s, x) s The constraint enc(s, x) s will be satisfied as soon as k x is satisfied. R1 : C ∧ T u C if T ∪ {x | T ′ x ∈ C, T ′ T} ⊢ u

45/102 V´ eronique Cortier Verification of Security Protocols

slide-76
SLIDE 76

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

Unsolvable constraints

R4 : C ∧ T u ⊥ if var(T, u) = ∅ and T ⊢ u Example : . . . a, enc(s, k) s . . .

  • ⊥

46/102 V´ eronique Cortier Verification of Security Protocols

slide-77
SLIDE 77

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

Guessing equalities

1 Example : k, enc(enc(x, k′), k) enc(a, k′)

R2 : C ∧ T u σ Cσ ∧ Tσ uσ u′ ∈ st(T) if σ = mgu(u, u′), u, u′ ∈ X, u = u′

47/102 V´ eronique Cortier Verification of Security Protocols

slide-78
SLIDE 78

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

Guessing equalities

1 Example : k, enc(enc(x, k′), k) enc(a, k′)

R2 : C ∧ T u σ Cσ ∧ Tσ uσ u′ ∈ st(T) if σ = mgu(u, u′), u, u′ ∈ X, u = u′

2 Example : enc(s, a, x), enc(y, b, k), k s

R3 : C ∧ T v σ Cσ ∧ Tσ vσ u, u′ ∈ st(T) if σ = mgu(u, u′), u, u′ ∈ X, u = u′

47/102 V´ eronique Cortier Verification of Security Protocols

slide-79
SLIDE 79

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

NP-procedure for solving constraint systems

C = 8 > > < > > : T0 u1 T0, v1 u2 ... T0, v1, .., vn un+1

SOLVED

⊥ ⊥ C1 C2 C3 C4

Theorem C has a solution iff C C′ with C′ in solved form. is terminating in polynomial time.

48/102 V´ eronique Cortier Verification of Security Protocols

slide-80
SLIDE 80

Introduction on security protocols Formal models Going further Towards more guarantees Messages Intruder Protocol Solving constraint systems

Example of tool : Avispa Platform

Collaborators LORIA, France DIST, Italy ETHZ, Switzer- land Siemens, Germany www.avispa-project.org

49/102 V´ eronique Cortier Verification of Security Protocols

slide-81
SLIDE 81

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Limitations of this approach ?

Are you ready to use any protocol verified with this technique ?

50/102 V´ eronique Cortier Verification of Security Protocols

slide-82
SLIDE 82

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Limitations of this approach ?

Are you ready to use any protocol verified with this technique ? Only a finite scenario is checked. → What happens if the protocol is used one more time ? The underlying mathematical properties of the primitives are abstracted away.

50/102 V´ eronique Cortier Verification of Security Protocols

slide-83
SLIDE 83

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

How to decide security for unlimited sessions ?

→ In general, it is undecidable ! (i.e. there exists no algorithm for checking e.g. secrecy) How to prove undecidability ?

51/102 V´ eronique Cortier Verification of Security Protocols

slide-84
SLIDE 84

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

How to decide security for unlimited sessions ?

→ In general, it is undecidable ! (i.e. there exists no algorithm for checking e.g. secrecy) How to prove undecidability ? Post correspondence problem (PCP) input {(ui, vi)}1≤i≤n, ui, vi ∈ Σ∗

  • utput ∃n, i1, . . . , in

ui1 · · · uin = vi1 · · · vin Example : {(bab, b), (ab, aba), (a, baba)} Solution ?

51/102 V´ eronique Cortier Verification of Security Protocols

slide-85
SLIDE 85

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

How to decide security for unlimited sessions ?

→ In general, it is undecidable ! (i.e. there exists no algorithm for checking e.g. secrecy) How to prove undecidability ? Post correspondence problem (PCP) input {(ui, vi)}1≤i≤n, ui, vi ∈ Σ∗

  • utput ∃n, i1, . . . , in

ui1 · · · uin = vi1 · · · vin Example : {(bab, b), (ab, aba), (a, baba)} Solution ? → Yes, 1,2,3,1. babababab babababab

51/102 V´ eronique Cortier Verification of Security Protocols

slide-86
SLIDE 86

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

How to encode PCP in protocols ?

Given {(ui, vi)}1≤i≤n, we construct the following protocol P : A → B : {u1, v1}Kab, . . . , {uk, vk}Kab B : {x, y}Kab → A : {x, u1, y, v1}Kab, {s}{x,u1,x,u1}Kab , . . . , {x, uk, y, vk}Kab, {s}{x,uk,x,uk}Kab where a1 · a2 · · · an denotes the term · · · a1, a2, a3, . . . an.

52/102 V´ eronique Cortier Verification of Security Protocols

slide-87
SLIDE 87

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

How to encode PCP in protocols ?

Given {(ui, vi)}1≤i≤n, we construct the following protocol P : A → B : {u1, v1}Kab, . . . , {uk, vk}Kab B : {x, y}Kab → A : {x, u1, y, v1}Kab, {s}{x,u1,x,u1}Kab , . . . , {x, uk, y, vk}Kab, {s}{x,uk,x,uk}Kab where a1 · a2 · · · an denotes the term · · · a1, a2, a3, . . . an. Then there is an attack on P iff there is a solution to the Post Correspondence Problem with entry {(ui, vi)}1≤i≤n.

52/102 V´ eronique Cortier Verification of Security Protocols

slide-88
SLIDE 88

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

How to circumvent undecidability ?

Find decidable subclasses of protocols. Design semi-decision procedure, that works in practice ...

53/102 V´ eronique Cortier Verification of Security Protocols

slide-89
SLIDE 89

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

How to model an unbounded number of sessions ?

“For any x, if the agent A receives enc(x, ka) then A responds with x.” → Use of first-order logic.

54/102 V´ eronique Cortier Verification of Security Protocols

slide-90
SLIDE 90

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Intruder

Horn clauses perfectly reflects the attacker symbolic manipulations

  • n terms.

I(x), I(y) ⇒ I(< x, y >) pairing I(x), I(y) ⇒ I({x}y) encryption I({x}y), I(y) ⇒ I(x) decryption I(< x, y >) ⇒ I(x) projection I(< x, y >) ⇒ I(y) projection

55/102 V´ eronique Cortier Verification of Security Protocols

slide-91
SLIDE 91

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Protocol

Protocol : A → B : {pin}ka B → A : {{pin}ka}kb A → B : {pin}kb Horn clauses : ⇒ I({pin}ka) I(x) ⇒ I({x}kb) I({x}ka) ⇒ I(x)

56/102 V´ eronique Cortier Verification of Security Protocols

slide-92
SLIDE 92

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Protocol

Protocol : A → B : {pin}ka B → A : {{pin}ka}kb A → B : {pin}kb Horn clauses : ⇒ I({pin}ka) I(x) ⇒ I({x}kb) I({x}ka) ⇒ I(x) Secrecy property is a reachability (accessibility) property ¬I(pin) Then there exists an attack iff the set of formula corresponding to Intruder manipulations + protocol + property is NOT satisfiable.

56/102 V´ eronique Cortier Verification of Security Protocols

slide-93
SLIDE 93

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

How to decide satisfiability ? → Resolution techniques

57/102 V´ eronique Cortier Verification of Security Protocols

slide-94
SLIDE 94

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Some vocabulary

First order logic Atoms P(t1, . . . , tn) where ti are terms, P is a predicate Literals P(t1, . . . , tn) or ¬P(t1, . . . , tn) closed under ∨, ∧, ¬, ∃, ∀ Clauses : Only universal quantifiers Horn Clauses : at most one positive literal A1, . . . , An ⇒ B where Ai, B are atoms.

58/102 V´ eronique Cortier Verification of Security Protocols

slide-95
SLIDE 95

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Binary resolution

A, B are atoms and C, D are clauses. An intuitive rule A ⇒ C A C In other words ¬A ∨ C A C

59/102 V´ eronique Cortier Verification of Security Protocols

slide-96
SLIDE 96

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Binary resolution

A, B are atoms and C, D are clauses. An intuitive rule A ⇒ C A C In other words ¬A ∨ C A C Generalizing ¬A ∨ C B Cθ θ = mgu(A, B) (i.e. Aθ = Bθ)

59/102 V´ eronique Cortier Verification of Security Protocols

slide-97
SLIDE 97

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Binary resolution

A, B are atoms and C, D are clauses. An intuitive rule A ⇒ C A C In other words ¬A ∨ C A C Generalizing ¬A ∨ C B Cθ θ = mgu(A, B) (i.e. Aθ = Bθ) Generalizing a bit more ¬A ∨ C B ∨ D Cθ ∨ Dθ θ = mgu(A, B) Binary resolution

59/102 V´ eronique Cortier Verification of Security Protocols

slide-98
SLIDE 98

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Binary resolution and Factorization

¬A ∨ C B ∨ D θ = mgu(A, B) Cθ ∨ Dθ Binary resolution A ∨ B ∨ C θ = mgu(A, B) Aθ ∨ Cθ Factorisation Theorem (Soundness and Completeness) Binary resolution and factorisation are sound and refutationally complete, i.e. a set of clauses C is not satisfiable if and only if ⊥ (the empty clause) can be obtained from C by binary resolution and factorisation. Exercise : Why do we need the factorisation rule ?

60/102 V´ eronique Cortier Verification of Security Protocols

slide-99
SLIDE 99

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Example

C = {¬I(s), I(k1), I({s}k1,k1), I({x}y), I(y) ⇒ I(x), I(x), I(y) ⇒ I(x, y)

¬I(s) I({s}k1,k1) I({x}y), I(y) ⇒ I(x) I(k1, k1) ⇒ s I(k1) I(k1) I(x), I(y) ⇒ I(x, y) I(y) ⇒ I(k1, y) I(k1, k1) I(s) ⊥

61/102 V´ eronique Cortier Verification of Security Protocols

slide-100
SLIDE 100

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

But it is not terminating !

I(y) ⇒ I(s, y) I(y) ⇒ I(s, y) I(s) I(s) I(x), I(y) ⇒ I(x, y) I(y) ⇒ I(s, y) I(s, s) I(s, s, s) I(s, s, s, s) · · · → This does not yield any decidability result.

62/102 V´ eronique Cortier Verification of Security Protocols

slide-101
SLIDE 101

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Ordered Binary resolution and Factorization

Let < be any order on clauses. ¬A ∨ C B ∨ D θ = mgu(A, B) Aθ < Cθ ∨ Dθ Cθ ∨ Dθ Ordered binary resolution A ∨ B ∨ C θ = mgu(A, B) Aθ < Cθ Aθ ∨ Cθ Ordered factorisation

63/102 V´ eronique Cortier Verification of Security Protocols

slide-102
SLIDE 102

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Ordered Binary resolution and Factorization

Let < be any order on clauses. ¬A ∨ C B ∨ D θ = mgu(A, B) Aθ < Cθ ∨ Dθ Cθ ∨ Dθ Ordered binary resolution A ∨ B ∨ C θ = mgu(A, B) Aθ < Cθ Aθ ∨ Cθ Ordered factorisation Theorem (Soundness and Completeness) Ordered binary resolution and factorisation are sound and refutationally complete provided that < is liftable ∀A, B, θ A < B ⇒ Aθ < Bθ

63/102 V´ eronique Cortier Verification of Security Protocols

slide-103
SLIDE 103

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Examples of liftable orders

∀A, B, θ A < B ⇒ Aθ < Bθ First example : subterm order P(t1, . . . , tn) < Q(u1, . . . , uk) iff any ti is a subterm of u1, . . . , uk → extended to clauses as follows : C1 < C2 iff any literal of C1 is smaller than some literal of C2. Exercise : Show that C is not satisfiable by ordered resolution (and factorisation).

64/102 V´ eronique Cortier Verification of Security Protocols

slide-104
SLIDE 104

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Examples of liftable orders - continued

Second example : P(t1, . . . , tn) Q(u1, . . . , uk) iff

1 depth(P(t1, . . . , tn)) ≤ depth(Q(u1, . . . , uk)) 2 For any variable x,

depthx(P(t1, . . . , tn)) ≤ depthx(Q(u1, . . . , uk)) f x f x f y a

?

  • f

x h h h y

65/102 V´ eronique Cortier Verification of Security Protocols

slide-105
SLIDE 105

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Examples of liftable orders - continued

Second example : P(t1, . . . , tn) Q(u1, . . . , uk) iff

1 depth(P(t1, . . . , tn)) ≤ depth(Q(u1, . . . , uk)) 2 For any variable x,

depthx(P(t1, . . . , tn)) ≤ depthx(Q(u1, . . . , uk)) f x f x f y a

  • f

x h h h y

65/102 V´ eronique Cortier Verification of Security Protocols

slide-106
SLIDE 106

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Examples of liftable orders - continued

Second example : P(t1, . . . , tn) Q(u1, . . . , uk) iff

1 depth(P(t1, . . . , tn)) ≤ depth(Q(u1, . . . , uk)) 2 For any variable x,

depthx(P(t1, . . . , tn)) ≤ depthx(Q(u1, . . . , uk)) f x f x f y a

  • f

x h h h y Exercise : Show that ∀A, B, θ A B ⇒ Aθ Bθ

65/102 V´ eronique Cortier Verification of Security Protocols

slide-107
SLIDE 107

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Back to protocols

Intruder clauses are of the form ±I(f (x1, . . . , xn)), ±I(xi), ±I(xj) Protocol clauses ⇒ I({pin}ka) I(x) ⇒ I({x}kb) I({x}ka) ⇒ I(x) At most one variable per clause !

66/102 V´ eronique Cortier Verification of Security Protocols

slide-108
SLIDE 108

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Back to protocols

Intruder clauses are of the form ±I(f (x1, . . . , xn)), ±I(xi), ±I(xj) Protocol clauses ⇒ I({pin}ka) I(x) ⇒ I({x}kb) I({x}ka) ⇒ I(x) At most one variable per clause ! Theorem Given a set C of clauses such that each clause of C either contains at most one variable

  • r is of the form ±I(f (x1, . . . , xn)), ±I(xi), ±I(xj)

Then ordered () binary resolution and factorisation is terminating.

66/102 V´ eronique Cortier Verification of Security Protocols

slide-109
SLIDE 109

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Decidability for an unbounded number of sessions

Corollary For any protocol that can be encoded with clauses of the previous form, then checking secrecy is decidable. But how to deal with protocols that need more than one variable per clause ?

67/102 V´ eronique Cortier Verification of Security Protocols

slide-110
SLIDE 110

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

ProVerif

Developed by Bruno Blanchet, Paris, France. No restriction on the clauses Implements a sound semi-decision procedure (that may not terminate). Based on a resolution strategy well adapted to protocols. performs very well in practice !

Works on most of existing protocols in the literature Is also used on industrial protocols (e.g. certified email protocol, JFK, Plutus filesystem)

68/102 V´ eronique Cortier Verification of Security Protocols

slide-111
SLIDE 111

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

What formal methods allow to do ?

In general, secrecy preservation is undecidable.

69/102 V´ eronique Cortier Verification of Security Protocols

slide-112
SLIDE 112

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

What formal methods allow to do ?

In general, secrecy preservation is undecidable. For a bounded number of sessions, secrecy is co-NP-complete [RusinowitchTuruani CSFW01] → several tools for detecting attacks (Casper, Avispa platform... )

69/102 V´ eronique Cortier Verification of Security Protocols

slide-113
SLIDE 113

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

What formal methods allow to do ?

In general, secrecy preservation is undecidable. For a bounded number of sessions, secrecy is co-NP-complete [RusinowitchTuruani CSFW01] → several tools for detecting attacks (Casper, Avispa platform... ) For an unbounded number of sessions

for one-copy protocols, secrecy is DEXPTIME-complete [CortierComon RTA03] [SeildVerma LPAR04] for message-length bounded protocols, secrecy is DEXPTIME-complete [Durgin et al FMSP99] [Chevalier et al CSL03]

→ some tools for proving security (ProVerif, EVA Platform)

69/102 V´ eronique Cortier Verification of Security Protocols

slide-114
SLIDE 114

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Limitations of this approach ?

Are you ready to use any protocol verified with this technique ? Only a finite scenario is checked. → What happens if the protocol is used one more time ? The underlying mathematical properties of the primitives are abstracted away.

70/102 V´ eronique Cortier Verification of Security Protocols

slide-115
SLIDE 115

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Motivation

Back to our running example : A → B : {pin}ka B → A : {{pin}ka}kb A → B : {pin}kb We need the equation for the commutativity of encryption {{z}x}y = {{z}y}x

71/102 V´ eronique Cortier Verification of Security Protocols

slide-116
SLIDE 116

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Some other examples

Encryption-Decryption theory dec(enc(x, y), y) = x π1(x, y) = x π2(x, y) = y EXclusive Or x ⊕ (y ⊕ z) = z x ⊕ y = y ⊕ x x ⊕ x = x ⊕ 0 = x Diffie-Hellmann exp(exp(z, x), y) = exp(exp(z, y), x)

72/102 V´ eronique Cortier Verification of Security Protocols

slide-117
SLIDE 117

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

E-voting protocols

First phase : V → A : sign(blind(vote, r), V ) A → V : sign(blind(vote, r), A) Voting phase : V → C : sign(vote, A) ...

73/102 V´ eronique Cortier Verification of Security Protocols

slide-118
SLIDE 118

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Equational theory for blind signatures

[Kremer Ryan 05] checksign(sign(x, y), pk(y)) = x unblind(blind(x, y), y) = x unblind(sign(blind(x, y), z), y) = sign(x, z)

74/102 V´ eronique Cortier Verification of Security Protocols

slide-119
SLIDE 119

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Deduction

M ∈ T T ⊢E M T ⊢E M1 · · · T ⊢E Mk f ∈ Σ T ⊢E f (M1, . . . , Mk) T ⊢ M M =E M′ T ⊢ M′

75/102 V´ eronique Cortier Verification of Security Protocols

slide-120
SLIDE 120

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Deduction

M ∈ T T ⊢E M T ⊢E M1 · · · T ⊢E Mk f ∈ Σ T ⊢E f (M1, . . . , Mk) T ⊢ M M =E M′ T ⊢ M′ Example : E := dec(enc(x, y), y) = x and T = {enc(secret, k), k}. T ⊢ enc(secret, k) T ⊢ k f ∈ Σ T ⊢ dec(enc(secret, k), k) dec(enc(x, y), y) = x T ⊢ secret

75/102 V´ eronique Cortier Verification of Security Protocols

slide-121
SLIDE 121

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Rewriting systems

For analyzing equational theories, we (try to) associate to E a finite convergent rewriting system R such that : u =E v iff u ↓= v ↓ Definition (Characterization of the deduction relation) Let t1, . . . tn and u be terms in normal form. {t1, . . . tn} ⊢ u iff ∃C s.t. C[t1, . . . , tn] →∗ u (Also called Cap Intruder problem [Narendran et al])

76/102 V´ eronique Cortier Verification of Security Protocols

slide-122
SLIDE 122

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Some results with equational theories

Security problem Bounded number of sessions Unbounded number of sessions Commutative encryption co-NP-complete [CKRT04] Ping-pong protocols : co-NP-complete [Turuani04] Exclusive Or Decidable [CS03,CKRT03] One copy - No nonces : Decidable [CLC03] Two-way automata - No nonces : Decidable [Verma03] Abelian Groups Decidable [Shmatikov04] Two-way automata - No nonces : Decidable [Verma03] Prefix encryption co-NP-complete [CKRT03] Abelian Groups and Modular Exponentiation General case : Decidable [Shmatikov04] Restricted protocols : co-NP-complete [CKRT03] AC properties of the Modular Exponentiation No nonces : Semi-Decision Procedure [GLRV04]

77/102 V´ eronique Cortier Verification of Security Protocols

slide-123
SLIDE 123

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

And now are you ready to use any protocol verified with these techniques ? Assuming : Analysis for an unbounded number of sessions With equational theories

78/102 V´ eronique Cortier Verification of Security Protocols

slide-124
SLIDE 124

Introduction on security protocols Formal models Going further Towards more guarantees Undecidability Horn clauses Adding equational theories Some results

Outline of the talk

1 Introduction on security protocols Context Security Protocols : how does it work ? Commutative encryption (RSA) Needham-Schroeder Example 2 Formal models Messages Intruder Protocol Solving constraint systems 3 Going further Undecidability Horn clauses Adding equational theories Some results 4 Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

79/102 V´ eronique Cortier Verification of Security Protocols

slide-125
SLIDE 125

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Specificity of cryptographic models

Messages are bitstrings Real encryption algorithm Real signature algorithm General and powerful adversary → very little abstract model

80/102 V´ eronique Cortier Verification of Security Protocols

slide-126
SLIDE 126

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Encryption : the old time Caesar encryption : A → E, B → F, C → G, . . . Cypher Disk (L´ eone Battista Alberti 1466)

81/102 V´ eronique Cortier Verification of Security Protocols

slide-127
SLIDE 127

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Encryption : the old time Caesar encryption : A → E, B → F, C → G, . . . Cypher Disk (L´ eone Battista Alberti 1466) → subject to statistical analysis (Analyzing letter frequencies)

81/102 V´ eronique Cortier Verification of Security Protocols

slide-128
SLIDE 128

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Encryption : mechanized time Automatic substitutions and permutations Enigma

82/102 V´ eronique Cortier Verification of Security Protocols

slide-129
SLIDE 129

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Encryption nowadays

→ Based on algorithmically hard problems. RSA Function n = pq, p et q primes. e : public exponent x → xe mod n easy (cubic) y = xe → x mod n difficult x = yd o` u d = e−1 mod φ(n)

83/102 V´ eronique Cortier Verification of Security Protocols

slide-130
SLIDE 130

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Encryption nowadays

→ Based on algorithmically hard problems. RSA Function n = pq, p et q primes. e : public exponent x → xe mod n easy (cubic) y = xe → x mod n difficult x = yd o` u d = e−1 mod φ(n) Diffie-Hellman Problem Given A = ga and B = gb, Compute DH(A, B) = gab

83/102 V´ eronique Cortier Verification of Security Protocols

slide-131
SLIDE 131

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Encryption nowadays

→ Based on algorithmically hard problems. RSA Function n = pq, p et q primes. e : public exponent x → xe mod n easy (cubic) y = xe → x mod n difficult x = yd o` u d = e−1 mod φ(n) Diffie-Hellman Problem Given A = ga and B = gb, Compute DH(A, B) = gab → Based on hardness of integer factorization.

83/102 V´ eronique Cortier Verification of Security Protocols

slide-132
SLIDE 132

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Estimations for integer factorization

Module Operations (bits) (in log2) 512 58 1024 80 2048 111 4096 149 8192 156 ≈ 260 years → Lower bound for RSA and Diffie-Hellman.

84/102 V´ eronique Cortier Verification of Security Protocols

slide-133
SLIDE 133

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

How does an encryption algorithm look like ? Example : OAEP [Bellare Rogaway]

M n k1 r k2 G H s t ⊕ ⊕

M : plaintext of length n r : randomness of length k0 G, H : hash function fk : trapdoor function EK(x; r) = fK(s||t)

85/102 V´ eronique Cortier Verification of Security Protocols

slide-134
SLIDE 134

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Cryptographic models

Encryption is only one component of cryptographic models Cryptographic primitives : encryption, signatures, ... Protocol model Adversary Security notions

86/102 V´ eronique Cortier Verification of Security Protocols

slide-135
SLIDE 135

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Setting for cryptographic protocols

Protocol : Message exchange program using cryptographic primitives Adversary A : any probabilistic polynomial Turing machine, i.e. any probabilistic polynomial program. polynomial : captures what is feasible probabilistic : the adversary may try to guess some information

87/102 V´ eronique Cortier Verification of Security Protocols

slide-136
SLIDE 136

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Definition of secrecy preservation

→ Several notions of secrecy : One-Wayness : The probability for an adversary A to compute the secret s against a protocol P is negligible (smaller than any inverse

  • f polynomial).

∀p polynomial ∃η0 ∀η ≥ η0 Prη

m,r[A(PK) = s] ≤

1 p(η) η : security parameter = key length

88/102 V´ eronique Cortier Verification of Security Protocols

slide-137
SLIDE 137

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Not strong enough !

The adversary may be able to compute half of the secret message. There is no guarantee in case that some partial information on the secret is known.

89/102 V´ eronique Cortier Verification of Security Protocols

slide-138
SLIDE 138

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Not strong enough !

The adversary may be able to compute half of the secret message. There is no guarantee in case that some partial information on the secret is known. → Introduction of a notion of indistinguishability.

89/102 V´ eronique Cortier Verification of Security Protocols

slide-139
SLIDE 139

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Indistinguishability

The secrecy of s is defined through the following game : Two values n0 and n1 are randomly generated instead of s ; The adversary interacts with the protocol where s is replaced by nb, b ∈ {0, 1} ; We give the pair (n0, n1) to the adversary ; The adversary gives b′, The data s is secret if Pr[b = b′] − 1

2 is a negligible function.

90/102 V´ eronique Cortier Verification of Security Protocols

slide-140
SLIDE 140

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

A typical cryptographic proof

1 Assume that some algorithmic problem P is difficult (E.g. RSA

  • r integer factorization or Discrete Log or CDH, DDH, ...)

2 Suppose that a (polynomial probabilistic) adversary A breaks

the protocol security with non negligible probability

91/102 V´ eronique Cortier Verification of Security Protocols

slide-141
SLIDE 141

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

A typical cryptographic proof

1 Assume that some algorithmic problem P is difficult (E.g. RSA

  • r integer factorization or Discrete Log or CDH, DDH, ...)

2 Suppose that a (polynomial probabilistic) adversary A breaks

the protocol security with non negligible probability

3 Build out of A an adversary B that solves P. 91/102 V´ eronique Cortier Verification of Security Protocols

slide-142
SLIDE 142

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

A typical cryptographic proof

1 Assume that some algorithmic problem P is difficult (E.g. RSA

  • r integer factorization or Discrete Log or CDH, DDH, ...)

2 Suppose that a (polynomial probabilistic) adversary A breaks

the protocol security with non negligible probability

3 Build out of A an adversary B that solves P. 4 Conclude that the protocol is secure provided P is difficult. 91/102 V´ eronique Cortier Verification of Security Protocols

slide-143
SLIDE 143

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Formal and Cryptographic approaches

Formal approach Cryptographic approach Messages terms bitstrings Encryption idealized algorithm Adversary idealized any polynomial algorithm Secrecy property reachability-based property indistinguishability Guarantees unclear strong Protocol may be complex usually simpler

92/102 V´ eronique Cortier Verification of Security Protocols

slide-144
SLIDE 144

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Formal and Cryptographic approaches

Formal approach Cryptographic approach Messages terms bitstrings Encryption idealized algorithm Adversary idealized any polynomial algorithm Secrecy property reachability-based property indistinguishability Guarantees unclear strong Protocol may be complex usually simpler Proof automatic by hand, tedious and error-prone Link between the two approaches ?

92/102 V´ eronique Cortier Verification of Security Protocols

slide-145
SLIDE 145

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Composition of the two approaches

Automatic cryptographically sound proofs

Ideal protocol protocol Implemented

  • f the cryptographic primitives
  • f idealized protocols

Formal approach: verification encryption algorithm algorithm signature Cryptographers: verification

93/102 V´ eronique Cortier Verification of Security Protocols

slide-146
SLIDE 146

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

A common setting

Same setting in formal and cryptographic models Adversary Protocol corrupt(a1, . . . , al) private keys of a1, . . . , al new(i, a1, . . . , ak) sid = (s, i, (a1, . . . , ak)) send(sid, m) m′

94/102 V´ eronique Cortier Verification of Security Protocols

slide-147
SLIDE 147

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Formal Intruder Deduction Rules

S⊢m1 S⊢m2 S⊢m1 ,m2 S⊢m1 ,m2 S⊢mi

i ∈ {1, 2}

S⊢ek(b) S⊢m S⊢{m}adv(i)

ek(b)

i ∈ N

S⊢{m}l

ek(b)

S⊢dk(b) S⊢m S⊢sk(b) S⊢m S⊢[m]adv(i)

sk(b)

i ∈ N

S⊢[m]l

sk(b)

S⊢m

95/102 V´ eronique Cortier Verification of Security Protocols

slide-148
SLIDE 148

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Result : Soundness of trace properties

Theorem (extension of [Micciancio Warinschi TCC’04]) Every concrete trace is the image of a valid formal trace, except with negligible probability.

96/102 V´ eronique Cortier Verification of Security Protocols

slide-149
SLIDE 149

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Result : Soundness of trace properties

Theorem (extension of [Micciancio Warinschi TCC’04]) Every concrete trace is the image of a valid formal trace, except with negligible probability. Corollary : Let Π be protocol, Ps an arbitrary predicate on formal traces and Pc its corresponding predicate on concrete traces. Then Π | =s Ps implies Π | =c Pc.

96/102 V´ eronique Cortier Verification of Security Protocols

slide-150
SLIDE 150

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Result : Soundness of trace properties

Theorem (extension of [Micciancio Warinschi TCC’04]) Every concrete trace is the image of a valid formal trace, except with negligible probability. Corollary : Let Π be protocol, Ps an arbitrary predicate on formal traces and Pc its corresponding predicate on concrete traces. Then Π | =s Ps implies Π | =c Pc. Applications : authentication, secrecy, ...

96/102 V´ eronique Cortier Verification of Security Protocols

slide-151
SLIDE 151

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Hypotheses on the Implementation

encryption : IND-CCA2 → the adversary cannot distinguish between {n0}k and {n1}k even if he has access to encryption and decryption oracles. signature : randomized and existentially unforgeable under chosen-message attack i.e. one can not produce a valid pair (m, σ) parsing :

each bit-string has a label which indicates his type (identity, nonce, key, signature, ...)

  • ne can retrieve the (public) encryption key from an encrypted

message.

  • ne can retrieve the signed message from the signature

skip the proof 97/102 V´ eronique Cortier Verification of Security Protocols

slide-152
SLIDE 152

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Proof idea

Proof technique : Reducing the protocol security to the robustness

  • f the primitives (which itself reduces to hardness of algorithmic

problem like integer factorization). A breaks P ⇒ A′ breaks { } or sign

98/102 V´ eronique Cortier Verification of Security Protocols

slide-153
SLIDE 153

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Proof idea

Proof technique : Reducing the protocol security to the robustness

  • f the primitives (which itself reduces to hardness of algorithmic

problem like integer factorization). A breaks P ⇒ A′ breaks { } or sign Example : If a computational (concrete) adversary A is able to compute {na}Ka out of {< A, na >}Ka, Then we can build an adversary A′ that breaks the encryption { }Ka.

98/102 V´ eronique Cortier Verification of Security Protocols

slide-154
SLIDE 154

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Proof idea

Key result : every concrete trace is the image of a valid formal trace, except with negligible probability. init(1, a, b) → {a, na}Kb {na}Kbnon valid ! ↑ ↓ ↑ A : init(1, a, b) m1 → send(m2)

99/102 V´ eronique Cortier Verification of Security Protocols

slide-155
SLIDE 155

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Proof idea

Key result : every concrete trace is the image of a valid formal trace, except with negligible probability. init(1, a, b) → {a, na}Kb {na}Kbnon valid ! ↑ ↓ ↑ A : init(1, a, b) m1 → send(m2) Using the adversary A, we build an adversary A′ that breaks encryption. A′ : (a, n0

a, a, n1 a) → encryption

  • racle

→ {a, nα

a }Kb

99/102 V´ eronique Cortier Verification of Security Protocols

slide-156
SLIDE 156

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Proof idea

Key result : every concrete trace is the image of a valid formal trace, except with negligible probability. init(1, a, b) → {a, na}Kb {na}Kbnon valid ! ↑ ↓ ↑ A : init(1, a, b) m1 → send(m2) Using the adversary A, we build an adversary A′ that breaks encryption. A′ : (a, n0

a, a, n1 a) → encryption

  • racle

→ {a, nα

a }Kb

→ A → {nα

a }Kb

99/102 V´ eronique Cortier Verification of Security Protocols

slide-157
SLIDE 157

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Proof idea

Key result : every concrete trace is the image of a valid formal trace, except with negligible probability. init(1, a, b) → {a, na}Kb {na}Kbnon valid ! ↑ ↓ ↑ A : init(1, a, b) m1 → send(m2) Using the adversary A, we build an adversary A′ that breaks encryption. A′ : (a, n0

a, a, n1 a) → encryption

  • racle

→ {a, nα

a }Kb

→ A → {nα

a }Kb → decryption

  • racle

→ nα

a → α

99/102 V´ eronique Cortier Verification of Security Protocols

slide-158
SLIDE 158

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Correspondence of secrecy properties

Theorem Symbolic secrecy implies cryptographic indistinguishability. For protocols with only public key encryption, signatures and nonces Provided the public key encryption and the signature algorithms verify strong existing cryptographic properties (IND-CCA2, existentially unforgeable),

100/102 V´ eronique Cortier Verification of Security Protocols

slide-159
SLIDE 159

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Conclusion

Formal methods form a powerful approach for analyzing security protocols Makes use of classical techniques in formal methods : term algebra, equational theories, clauses and resolution techniques, tree automata, etc. ⇒ Many decision procedures Several automatic tools

For successfully detecting attacks on protocols (e.g. Casper, Avispa) For proving security for an arbitrary number of sessions (e.g. ProVerif)

Provides cryptographic guarantees under classical assumptions

  • n the implementation of the primitives

101/102 V´ eronique Cortier Verification of Security Protocols

slide-160
SLIDE 160

Introduction on security protocols Formal models Going further Towards more guarantees Cryptographic models Linking Formal and cryptographic models Extension to indistinguishability Conclusion

Some current directions of research

Enriching the symbolic model

Considering more equational theories (e.g. theories for e-voting protocols) Adding more complex structures for data (list, XML, ...) Considering recursive protocols (e.g. group protocol) where the number of message exchanges in a session is not fixed Proving more complex security properties like equivalence-based properties (e.g. for anonymity or e-voting protocols)

With cryptographic guarantees

Combining formal and cryptographic models for more complex primitives and security properties. How far can we go ? Is it possible to consider weaker cryptographic primitives ?

102/102 V´ eronique Cortier Verification of Security Protocols