Deriving Key Distribution Protocols and their Security Properties

Abstract

We apply the derivational method of protocol verification to key distribution protocols. This method assembles the security properties of a protocol by composing the guarantees offered by embedded fragments and patterns. It has shed light on fundamental notions such as challenge-response and fed a growing taxonomy of protocols. Here, we similarly capture the essence of key distribution, authentication timestamps and key confirmation. With these building blocks, we derive the authentication properties of the Needham-Schroeder shared-key and the Denning-Sacco protocols, and of the cores of Kerberos 4 and 5.The main results of this research were obtained in 2003-04 and appeared in [3]. The present document collects proofs omitted for space reasons and unpublished background material.Cervesato was partially supported by ONR under Grant N000149910150; significant portions of this work were completed while he was at Tulane University. Pavlovic was supported by ONR N00014-03-C-0237 and by NSF CCR-0345397. Report Documentation Page Form Approved OMB No. 0704-0188Public reporting burden for the collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to Washington Headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington VA 22202-4302. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to a penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

Approaches to Developing Key Distribution Protocols Based on Quantum Key Distribution

“…Subject authentication [16] ensures one party's confidence by providing evidence and/or credentials of the identity of the second party participating in the protocol, verifying that the second party indeed participated during the current protocol run. Message authentication [17], [18] requires the protocol to provide means to ensure that the received message or data segment was created by a specific party at some (usually unspecified) point in the past and that this data has not been tampered with or forged.…”

An Encapsulated Authentication Logic for Reasoning about Key Distribution Protocols

“…The interested reader will find further details, as well as a semantics of protocol execution, in [4].…”

“…An observation Q A is similarly mapped to a formula Φ A . Dually, an arbitrary formula Φ can be validated against a run Q, realizing a form of model checking [4].…”

“…The formula characterizing the runs compatible with each principal's observations is extended as in Section 4.3 [4].…”

“…The semantics of actions is formalized in [4]. We will often use partial descriptions of actions, and elide e.g., the source and the destination, as in m or (y), and merge a reception and subsequent matches, writing (m).…”