Automated Verification of Equivalence Properties of Cryptographic Protocols

Abstract

Abstract. Indistinguishability properties are essential in formal verification of cryptographic protocols. They are needed to model anonymity properties, strong versions of confidentiality and resistance to offline guessing attacks, and can be conveniently modeled using process equivalences. We present a novel procedure to verify equivalence properties for bounded number of sessions. Our procedure is able to verify trace equivalence for determinate cryptographic protocols. On determinate protocols, trace equivalence coincides with observational equivalence which can therefore be automatically verified for such processes. When protocols are not determinate our procedure can be used for both under-and over-approximations of trace equivalence, which proved successful on examples. The procedure can handle a large set of cryptographic primitives, namely those which can be modeled by an optimally reducing convergent rewrite system. Although, we were unable to prove its termination, it has been implemented in a prototype tool and has been effectively tested on examples, some of which were outside the scope of existing tools.

DEEPSEC: Deciding Equivalence Properties in Security Protocols Theory and Practice

“…First, we wish to lift the restriction of subterm convergent equational theories. Even though the problem becomes quickly undecidable for more general rewrite theories, we plan to design a partially correct, i.e., sound, complete, but not necessarily terminating, procedure, as the procedure underlying the Akiss tool [CCCK16]. Second, we plan to avoid the restriction to destructor rewrite systems to more general ones.…”

“…The Apte tool [Che14] covers the same primitives but allows else branches and decides trace equivalence exactly. On the contrary, the Akiss tool [CCCK16] allows for user-defined cryptographic primitives. Partial correctness of Akiss is shown for primitives modelled by an arbitrary convergent rewrite system that has the finite variant property [CD05].…”

“…Let us also highlight one small, yet substantial difference with existing work: we do not consider cryptographic primitives (rewrite systems) as constants of the problem. As most modern verification tools allow for user-specified primitives [BSC16,SMCB13,SEMM14,CCCK16], our approach seems to better fit this reality. Typically, all existing procedures for static equivalence can only be claimed ptime because of this difference and are actually exponential in the sizes of signature or equational theory.…”

Verifying Privacy by Little Interaction and No Process Equivalence

“…AKiSs supports a larger variety of cryptographic primitives than ProVerif and the current version of the Inductive Method. In (Chadha et al, 2012), Chadha et al conjecture that all those which can be modelled in a rewrite system with a specific convergence property are supported. Notably, trapdoor commitments can be modelled.…”

“…In (Chadha et al, 2012), a new cryptographic process calculus is introduced alongside a novel procedure for checking equivalence. Specifically, under-and overapproximations of ≈ t are introduced, the fine-grained trace equivalence ≈ f t and the coarse trace equivalence ≈ ct .…”