A meta-notation for protocol analysis

Cervesato, Iliano; Durgin, Nancy Ann; Lincoln, Patrick; Mitchell, John C.; Scedrov, Andre

doi:10.1109/csfw.1999.779762

Cited by 160 publications

(201 citation statements)

References 24 publications

Supporting

Mentioning

198

Contrasting

Unclassified

Order By: Relevance

“…In contrast, existing symbolic models (e.g. [24,54,22]) directly address the more complex multi-session case, even in the symbolic model. Consequently, our symbolic modeling involves fewer runtime states and thus lends to more effective mechanical analysis.…”

Section: Generalmentioning

confidence: 98%

Universally Composable Symbolic Analysis of Mutual Authentication and Key-Exchange Protocols

Canetti¹,

Herzog

2006

Theory of Cryptography

104

121

View full text Add to dashboard Cite

Abstract. Symbolic analysis of cryptographic protocols is dramatically simpler than full-fledged cryptographic analysis. In particular, it is simple enough to be automated. However, symbolic analysis does not, by itself, provide any cryptographic soundness guarantees. Following recent work on cryptographically sound symbolic analysis, we demonstrate how Dolev-Yao style symbolic analysis can be used to assert the security of cryptographic protocols within the universally composable (UC) security framework. Consequently, our methods enable security analysis that is completely symbolic, and at the same time cryptographically sound with strong composability properties.More specifically, we concentrate on mutual authentication and keyexchange protocols. We restrict attention to protocols that use publickey encryption as their only cryptographic primitive and have a specific restricted format. We define a mapping from such protocols to Dolev-Yao style symbolic protocols, and show that the symbolic protocol satisfies a certain symbolic criterion if and only if the corresponding cryptographic protocol is UC-secure. For mutual authentication, our symbolic criterion is similar to the traditional Dolev-Yao criterion. For key exchange, we demonstrate that the traditional Dolev-Yao style symbolic criterion is insufficient, and formulate an adequate symbolic criterion.Finally, to demonstrate the viability of our treatment, we use an existing tool to automatically verify whether some prominent key-exchange protocols are UC-secure.

show abstract

Section: Generalmentioning

confidence: 98%

Universally Composable Symbolic Analysis of Mutual Authentication and Key-Exchange Protocols

Canetti¹,

Herzog

2006

Theory of Cryptography

104

121

View full text Add to dashboard Cite

show abstract

“…We formalize state change using multiset rewriting (MSR) [4,9]. Strands contain special state synchronization events that synchronize them with the state of the principal executing the strands, as formalized in Definition 11.…”

Section: Protocol Behavior and Mutable Statementioning

confidence: 99%

“…We represent states by multisets of facts, and state change by multiset rewriting [4,9], although with several differences from Mitchell, Scedrov et al First, they use multiset rewriting to model protocol and communication behavior, as well as the states of the principals. We instead use strands for the protocol and communication behavior.…”

Section: Introductionmentioning

confidence: 99%

State and Progress in Strand Spaces: Proving Fair Exchange

Guttman

2010

J Autom Reasoning

View full text Add to dashboard Cite

Many cryptographic protocols are intended to coordinate state changes among principals. Exchange protocols, for instance, coordinate delivery of new values to the participants, i.e. additions to the set of values they possess. An exchange protocol is fair if it ensures that delivery of new values is balanced: If one participant obtains a new possession via the protocol, then all other participants will, too.Understanding this balanced coordination of different principals in a distributed system requires relating (long-term) state to (short-term) protocol activities. Fair exchange also requires progress assumptions.In this paper we adapt the strand space framework to protocols, such as fair exchange, that coordinate state changes. We regard the state as a multiset of facts, and we allow protocol actions to cause local changes in this state via multiset rewriting. Second, progress assumptions stipulate that some channels are resilient-and guaranteed to deliver messagesand some principals will not stop at critical steps. Our proofs of correctness cleanly separate protocol properties, such as authentication and confidentiality, from properties about progress and state evolution.G. Wang's recent fair exchange protocol illustrates the approach.

show abstract

“…The main systematic or formal approaches include specialised logics such as BAN logic [13,19,27], special-purpose tools designed for cryptographic protocol analysis [39], and theorem proving [55,56] and model-checking techniques using several general purpose tools [43,46,51,61,63]. Although these approaches differ in significant ways, all reflect the same basic assumptions about the way an adversary may interact with the protocol or attempt to decrypt encrypted messages.…”

Section: Introductionmentioning

confidence: 99%

Probabilistic Polynomial-Time Process Calculus and Security Protocol Analysis

Mitchell

2001

Programming Languages and Systems

View full text Add to dashboard Cite

Abstract. We prove properties of a process calculus that is designed for analysing security protocols. Our long-term goal is to develop a form of protocol analysis, consistent with standard cryptographic assumptions, that provides a language for expressing probabilistic polynomial-time protocol steps, a specification method based on a compositional form of equivalence, and a logical basis for reasoning about equivalence.The process calculus is a variant of CCS, with bounded replication and probabilistic polynomial-time expressions allowed in messages and boolean tests. To avoid inconsistency between security and nondeterminism, messages are scheduled probabilistically instead of nondeterministically. We prove that evaluation of any process expression halts in probabilistic polynomial time and define a form of asymptotic protocol equivalence that allows security properties to be expressed using observational equivalence, a standard relation from programming language theory that involves quantifying over all possible environments that might interact with the protocol.We develop a form of probabilistic bisimulation and use it to establish the soundness of an equational proof system based on observational equivalences. The proof system is illustrated by a formation derivation of the assertion, well-known in cryptography, that El Gamal encryption's semantic security is equivalent to the (computational) Decision Diffie-Hellman assumption. This example demonstrates the power of probabilistic bisimulation and equational reasoning for protocol security.

show abstract

A meta-notation for protocol analysis

Cited by 160 publications

References 24 publications

Universally Composable Symbolic Analysis of Mutual Authentication and Key-Exchange Protocols

Universally Composable Symbolic Analysis of Mutual Authentication and Key-Exchange Protocols

State and Progress in Strand Spaces: Proving Fair Exchange

Probabilistic Polynomial-Time Process Calculus and Security Protocol Analysis

Contact Info

Product

Resources

About