A derivation system and compositional logic for security protocols

Abstract

messages. We propose a general framework for deriving security protocols from simple components, using composition, refinements, and transformations. As a case study, we examine the structure of a family of key exchange protocols that includes Station-To-Station (STS), ISO-9798-3, Just Fast Keying (JFK), IKE and related protocols, deriving all members of the family from two basic protocols. In order to associate formal proofs with protocol derivations, we extend our previous security protocol logic with preconditions, temporal assertions, composition rules, and several other improvements. Using the logic, which we prove is sound with respect to the standard symbolic model of protocol execution and attack (the "Dolev-Yao model"), the security properties of the standard signature based Challenge-Response protocol and the Diffie-Hellman key exchange protocol are established. The ISO-9798-3 protocol is then proved correct by composing the correctness proofs of these two simple protocols. Although our current formal logic is not sufficient to modularly prove security for all of our current protocol derivations, the derivation system provides a framework for further improvements.

Analysis of EAP-GPSK Authentication Protocol

“…In the symbolic model, protocol execution and the possible actions of an attacker are characterized using a symbolic model of computation that allows nondeterminism but does not incorporate probability or computational complexity bounds. In addition to many model checking and bug-finding efforts, there have been some significant correctness proofs carried using the symbolic model, including mechanically checked formal proofs [13,14], unformalized but mathematical proofs about a multiset rewriting model [15][16][17], and work using compositional formal logic approaches [18][19][20][21][22]. Several groups of researchers have taken steps to connect the symbolic model to the probabilistic polynomial-time computational model used in cryptographic studies, e.g., [23-29, 3, 4, 30].…”

Formal Proofs of Cryptographic Security of Diffie-Hellman-Based Protocols

“…Most demonstrated approaches for proving security of complex network protocols, of the scale that appear in IEEE and IETF standards, use a simplified model of protocol execution based on symbolic computation and highly idealized cryptography [9,16,19,24]. However, proofs about symbolic computation do not provide the same level of assurance as proofs about probabilistic polynomial-time attacks.…”

“…The axioms presented in this paper are used in Protocol Composition Logic (PCL) [24,26,41,25,39]. Our formalization uses the characterization of "good key" from [27], but improves on previous work in several respects: (i) we fix a bug in the DH axiom in [27] by using the "DHStrongSecretive" formulas developed in the paper, (ii) we present a general inductive method for proving secrecy conditions for Diffie-Hellman key exchange, and (iii) we present axioms for reasoning from ciphertext integrity assumptions.…”

“…Additional background appears in [24,26,41,25,39]. Modelling protocols A protocol is given by a set of roles, each specifying a sequence of actions to be executed by an honest agent.…”

“…More generally, Abadi and Rogaway [1] initiated computationally sound symbolic analysis of static equivalence, with extensions and completeness explored in [37,2]; a recent extension to Diffie-Hellman appears in [15], covering only passive adversaries, not the stronger active adversaries used in the present paper. Protocol Composition Logic [24] was used in a case study of 802.11i [29], has previous computational semantics [26], and was used to study protocol composition and key exchange [27]. In other studies of DHKE, [30] uses a symbolic model, while [36] imposes nonstandard protocol assumptions.…”