A logic of authentication

Abstract

Autllcnt.icntioii protocols a.re the basis of seciuity iii many clisti~il~utetl systems, mid it, is therefore esseiitial to eiisure t,lia.t t,liese prot~ocols function correctly. Uufortuiia.tely, t,licir tlcsign 1~s beeii estremcIy error prone. hbst of the ~xotocols found iii the literature coutniii redundancies or security flaws.A siinple logic 1ia.s aHowed us to describe the beliefs of trustworthy parties involved iii a~utllentica.tioil protocols alit1 the evol11tioii of these beliefs as a consequence of conliiiunicat,ioii. We lia.ve been able to esplain a. va.riety of ~lut,lieiit,icatic.)ii protocols foriiially, to discover subtleties a,nd errors in tliein, and to suggest iiiiprovenieiits. Iii this p"l"rr we pleseut, the logic al~rl t,lleil give the results of 011r aimlysis of four l~~~l~lisl~etl 1xotocols, clxxxzii either liecilllsc of their pract.ica,l iinpc)rtance or Ixcn.use they serve t,o illust.rate 0111' lllctllcKl.

Software Security Assurance: A State-of-Art Report (SAR)

“…To verify the correctness of protocols and implementations of cryptographic algorithms, systems engineers and researchers may apply formal methods. An example is BAN (Burrows-Abadi-Needham) logic, [350] which provides a formal method for reasoning about the logic of belief of principals in cryptographic protocols. Formal methods can also be used to find bugs in security protocol designs.…”

On simple and secure key distribution

“…Figure 3 illustrates a naive version of a secure 3PKDP. 4 It is constructed by simply putting together two r u n s of 2PKDP. 5 One notable aspect is that the key being distributed in messages 2 and 4 is one and the same { K ab .…”

“…T h e only additional information available to the attacker from 3PKDP (as opposed to two unrelated runs of 2PKDP) is the fact that the same key is being distributed to A and B. H o wever, not knowing either the key or the masking expression, the attacker can only try to play X OR-ing "games" and factor out K ab by 3 We note that the problemof malicious insiders does not exist in two-party k ey distribution. 4 A more sophisticated protocol would optimize the numberof protocol ows and minimize the size of each o w. At this point, however, we are not yet concerned with optimization. 5 This version of the protocol only intends to show the properties of the key distribution, and doesn't deal with synchronizing A and B (how does B know that A wants to communicate?).…”

Cryptographic protocol flaws: know your enemy

“…The protocol is flawed because signatures obviously can not provide message confidentiality. The absurd gap between the protocol definition and its intended goal is explained by the fact that the protocol was never intended to be used in a real environment, but to highlight a particular limitation of the BAN [7] protocol analysis logic.…”

“…This is unfortunate because it allows an adversary to trivially impersonate the originator of the message by substituting the original signature for his own. (According to the definitions in section 5, the second flaw in the X.509 protocol described in [7] would be labelled a single-role oracle flaw. )…”