A method for unbounded verification of privacy-type properties

Abstract

In this paper, we consider the problem of verifying anonymity and unlinkability in the symbolic model, where protocols are represented as processes in a variant of the applied pi calculus, notably used in the ProVerif tool. Existing tools and techniques do not allow to verify directly these properties, expressed as behavioral equivalences. We propose a different approach: we design two conditions on protocols which are sufficient to ensure anonymity and unlinkability, and which can then be effectively checked automatically using ProVerif. Our two conditions correspond to two broad classes of attacks on unlinkability, i.e. data and control-flow leaks. This theoretical result is general enough that it applies to a wide class of protocols based on a variety of cryptographic primitives. In particular, using our tool, UKano, we provide the first formal security proofs of protocols such as BAC and PACE (e-passport), Hash-Lock (RFID authentication), etc. Our work has also lead to the discovery of new attacks, including one on the LAK protocol (RFID authentication) which was previously claimed to be unlinkable (in a weak sense).

Automated Unbounded Verification of Stateful Cryptographic Protocols with Exclusive OR

“…Note that the protocol is claimed to be untraceable in [34] for a weaker notion of unlinkability. Strong unlinkability as being checked here may be considered too strong but [41], [40] discuss how a variant of the attack found here constitutes a practical privacy breach.…”

“…Those constructions are unrelated in general [23], it seems that UK 3 is strictly stronger than the others [41] for realistic classes of protocols. Comparing the three notions is out the scope of this paper but being able to analyze all of them enables us to provide more fine-grained security guarantees.…”

“…Note that for all unlinkability notions, we are considering finitely many agents and sessions only. For the case of strong unlinkability (UK 3 ), this is due to a known lack of precision of diff-equivalence when it comes to verifying such strong properties [40], [41]. Fortunately, for a bounded number of sessions only, one can overcome this limitation in TAMARIN using a simplified swapping approach [20].…”

Efficient Verification of Cryptographic Protocols with Dynamic Epistemic Logic

“…There have been many works of literature (e.g., [24][25][26][27][28]) that employ process calculus. Typed process calculus displays security information (e.g., [29][30][31][32][33]) by the idea of standard static-analysis.…”

A Method for Proving Unlinkability of Stateful Protocols

“…While most of these communications rely on cryptography to ensure secrecy or authenticity, little is done to protect the user's privacy. Contactless cards and cell phones reveal identities in clear [30], [31], and several traceability attacks are available even when anonymity is ensured [6], [7], [21], [13]. It has thus become easy to track individuals through their personal devices.…”