Formal Development of Authentication Protocols

Sound Security Protocol Transformations

“…Examples are classical refinement and using abstract channels with security properties [17,4] and Guttman's protocol transformations based on strand spaces [9,8]. Sprenger and Basin [17] have recently proposed a refinement strategy for security protocols that spans several different abstraction levels (including, e.g., confidential and authentic channels).…”

“…Protocol transformations are interesting for at least two applications: we can use them (1) to develop (families of) protocols by refinement [17,9,16,7,6,4] and (2) to abstract existing protocols for the more efficient tool-based verification of their properties [11]. Abstraction and refinement correspond bottom-up and top-down views on (the same) protocol transformations.…”

Developing security protocols by refinement

“…In contrast, in related work such as [6,9,12,23], the authors do not continue the refinements down to the level of a standard Dolev-Yao model based on an algebra of cryptographic messages; some use ad-hoc, protocol-dependent intruder definitions. This makes it difficult to compare their models with existing work on protocol modeling and verification and to know for which adversaries their properties hold.…”

“…There have been other proposals for developing security protocols by refinement using different formalisms such as the B method [9], its combination with CSP [12], I/O automata [23], and ASMs [6]. None of these continue their refinements to the level of a full Dolev-Yao intruder.…”

“…None of these continue their refinements to the level of a full Dolev-Yao intruder. Either they only consider an intruder that is passive [23], defined ad-hoc [6,12], or corresponds to our Level 2 intruder [9]. This makes a comparison of their results with standard protocol models difficult.…”