Formal Analysis of SET and NSL Protocols Using the Interpretation Functions-Based Method

Abstract

Most applications in the Internet such as e-banking and e-commerce use the SET and the NSL protocols to protect the communication channel between the client and the server. Then, it is crucial to ensure that these protocols respect some security properties such as confidentiality, authentication, and integrity. In this paper, we analyze the SET and the NSL protocols with respect to the confidentiality (secrecy) property. To perform this analysis, we use the interpretation functions-based method. The main idea behind the interpretation functions-based technique is to give sufficient conditions that allow to guarantee that a cryptographic protocol respects the secrecy property. The flexibility of the proposed conditions allows the verification of dailylife protocols such as SET and NSL. Also, this method could be used under different assumptions such as a variety of intruder abilities including algebraic properties of cryptographic primitives. The NSL protocol, for instance, is analyzed with and without the homomorphism property. We show also, using the SET protocol, the usefulness of this approach to correct weaknesses and problems discovered during the analysis.

A Semi-Decidable Procedure for Secrecy in Cryptographic Protocols

“…Finally we give the way to build reliable selection-based interpretation functions. Similar techniques based on selections were proposed in previous works, especially in [5,7,8] to build universal functions based on the selection of the direct key of encryption and in [15] to check correspondences in protocols. But first of all, we present the notion of well-protected messages that have valuable properties that we will use in the definition of reliable selections.…”

“…Besides, building these functions is not easy and their existence is not always possible [4]. In [5][6][7][8], Houmani et al presented universal functions called interpretation functions to statically analyze a protocol for secrecy. An interpretation function needs to meet some conditions to be "good enough" to run an analysis.…”

New Functions for Secrecy on Real Protocols

“…Finally we give the way to build reliable selectionbased interpretation functions. Similar techniques based on selections were proposed in previous works, especially in [8,10,11] to build universal functions based on the selection of the direct key of encryption and in [18] to check correspondences in protocols. But first of all, we present the notion of well-protected messages that have valuable properties that we will use in the definition of reliable selections.…”

“…Similarly, Houmani et al [8][9][10][11] presented universal functions that they named the interpretation functions to statically analyze a protocol. An interpretation function needs to meet some conditions to be "enough good" for the analysis.…”

A Secure Electronic Transaction Payment Protocol Design and Implementation

“…SET (Secure Electronic Transaction) come to resolve the weakness of SSL in authentication and protection of sensitive information, SET ensures payment integrity, confidentiality and authentication of merchants and cardholders [8]. But SET is characterized by the complexity and the cost supported by the merchant (compared to the alternative proposed by SSL) because of the logistics of certificates distributing and client software installation, also it's difficult to manage nonrepudiation.…”