Cryptographic Protocol Verification via Supercompilation (A Case Study)

Abstract

It has been known for a while [35,36,12] that program transformation techniques, in particular, program specialization, can be used to prove the properties of programs automatically. For example, if a program actually implements (in a given context of use) a constant function sufficiently powerful and semantics preserving program transformation may reduce the program to a syntactically trivial "constant" program, pruning unreachable branches and proving thereby the property. Viability of such an approach to verification has been demonstrated in previous works [16,19,18] where it was applied to the verification of parameterized cache coherence protocols and Petri Nets models [11,20]. In this paper we further extend the method and present a case study on its application to the verification of a cryptographic protocol. The protocol is modeled by functional programs at different levels of abstraction and verification via program specialization is done by using Turchin's supercompilation method.

An Experiment in Ping-Pong Protocol Verification by Nondeterministic Pushdown Automata

“…The reduction strategy we are going to use later is to repeatedly apply the identity rules to the rightmost, innermost pair to which they apply. 2 There is no difference between handling a mismatch of keys and of prepended names (the operator pair does not reduce).…”

“…The control over these choices is therefore indirect. On the other hand, case studies [2,22] have shown that a supercompiler [29] can solve a variety of security problems, including cryptographic ping-pong protocols [24].…”

“…Instead of regular expressions, the protocol in question is mapped onto a prefix grammar encoded as a first-order functional program in such a way that it can be used to decide the security question by a program transformer, specifically a supercompiler. This method builds upon work solving other verification problems by general-purpose program transformation (e.g., [2,22]). The main steps of these two methods are shown on the left-and right-most branches in Fig.…”

Verification of Multi-Party Ping-Pong Protocols via Program Transformation

“…For example, in the Needham-Shroeder protocol P N S [x 1 , x 2 ] (which also can be verified by supercompilation [2]) the fact of the intruder receiving the initial random number generated by x 1 does not point to an attack on the protocol. In P N S [x 1 , x 2 ], an attack is a sequence of transmissions that allows an intruder to get the random number generated by x 2 in response to x 1 .…”

“…Let us consider G 2EXP = {a, b, c, A, B, C, e}, R 2EXP , e with the following R 2EXP : R [1] : e → aA R [5] : AA → Λ R [9] : Ba → bB R [2] : Λ → aA R [6] : BB → Λ R [10] : Cb → cC R [3] : Λ → bB R [7] : CC → Λ R [4] : Λ → cC R [8] : c → Λ…”