From Security Protocols to Pushdown Automata

Abstract

Abstract. Formal methods have been very successful in analyzing security protocols for reachability properties such as secrecy or authentication. In contrast, there are very few results for equivalence-based properties, crucial for studying e.g. privacy-like properties such as anonymity or vote secrecy. We study the problem of checking equivalence of security protocols for an unbounded number of sessions. Since replication leads very quickly to undecidability (even in the simple case of secrecy), we focus on a limited fragment of protocols (standard primitives but pairs, one variable per protocol's rules) for which the secrecy preservation problem is known to be decidable. Surprisingly, this fragment turns out to be undecidable for equivalence. Then, restricting our attention to deterministic protocols, we propose the first decidability result for checking equivalence of protocols for an unbounded number of sessions. This result is obtained through a characterization of equivalence of protocols in terms of equality of languages of (generalized, real-time) deterministic pushdown automata.

Typing Messages for Free in Security Protocols: The Case of Equivalence Properties

“…Compared to [13], we no longer need to restrict the number of variables per transition (to one), we allow variables in key positions, and we are more flexible in the control-flow of the program (we may have arbitrary sequences of in and out actions).…”

“…To our knowledge, the only decidability result for an unbounded number of sessions is [13]. It is shown that trace equivalence can be reduced to the equality of languages of pushdown automata.…”

DEEPSEC: Deciding Equivalence Properties in Security Protocols Theory and Practice

“…This class of processes is however insufficient for most anonymity properties. Finally, decidability results for an unbounded number of sessions were proposed in [CCD15b,CCD15a], but with severe restrictions on processes and equational theories.…”

Decidability of Trace Equivalence for Protocols with Nonces

“…[6], [9] for trace properties and [10], [11] for equivalence). However, protocols do use nonces in practice.…”