Automated Verification of Equivalence Properties of Cryptographic Protocols

Abstract

properties are essential in formal verification of cryptographic protocols. They are needed to model anonymity properties, strong versions of confidentiality, and resistance against offline guessing attacks. Indistinguishability properties can be conveniently modeled as equivalence properties. We present a novel procedure to verify equivalence properties for a bounded number of sessions of cryptographic protocols. As in the applied pi calculus, our protocol specification language is parametrized by a first-order sorted term signature and an equational theory that allows formalization of algebraic properties of cryptographic primitives. Our procedure is able to verify trace equivalence for determinate cryptographic protocols. On determinate protocols, trace equivalence coincides with observational equivalence, which can therefore be automatically verified for such processes. When protocols are not determinate, our procedure can be used for both under-and over-approximations of trace equivalence, which proved successful on examples. The procedure can handle a large set of cryptographic primitives, namely those whose equational theory is generated by an optimally reducing convergent rewrite system. The procedure is based on a fully abstract modelling of the traces of a bounded number of sessions of the protocols into first-order Horn clauses on which a dedicated resolution procedure is used to decide equivalence properties. We have shown that our procedure terminates for the class of subterm convergent equational theories. Moreover, the procedure has been implemented in a prototype tool Active Knowledge in Security Protocols and has been effectively tested on examples. Some of the examples were outside the scope of existing tools, including checking anonymity of an electronic voting protocol due to Okamoto.

The next 700 relational program logics

“…Wang et al [2018] verify equivalence between a pair of programs that operate over databases with different schemas using bisimulation invariants over relational algebras with updates. Finally, automatically checking the equivalence of processes in a process calculus is an important building block for security protocol analysis [Blanchet et al 2008;Chadha et al 2016].…”

“…Formally verifying relational properties has a broad range of practical applications. For instance, one might be interested in proving that the observable behaviors of two programs are related, showing for instance that the programs are equivalent [Blanchet et al 2008;Chadha et al 2016;Ştefan Ciobâcă et al 2016;Godlin and Strichman 2010;Hur et al 2012Hur et al , 2014Kundu et al 2009;Timany et al 2018;Wang et al 2018;Yang 2007], or that one refines the other [Timany and Birkedal 2019]. In other cases, one might be interested in relating two runs of a single program, but, as soon as the control flow can differ between the two runs, the compositional verification problem becomes the same as relating two different programs.…”

Cryptographic protocol for multipart missions involving two independent and distributed decision levels in a military context

“…An example of algebraic properties may be the homomorphic property [37], [38] where {m 1 .m 2 } k is equivalent to {m 1 } k . {m 2 } k under the equational theory [34], [39], [40].…”

A Type System for Privacy Properties

“…Numerous model checking-based tools have recently been proposed for the case of a bounded number of sessions, i.e., when protocols are executed a bounded number of times. These tools encompass SPEC [34], APTE [13,24], Akiss [23], or SAT-Equiv [28]. These tools vary in the class of cryptographic primitives and the class of protocols they can consider.…”