Inductive trace properties for computational security

Abstract

Protocol authentication properties are generally trace-based, meaning that authentication holds for the protocol if authentication holds for individual traces (runs of the protocol and adversary). Computational secrecy conditions, on the other hand, often are not trace based: the ability to computationally distinguish a system that transmits a secret from one that does not is measured by overall success on the set of all traces of each system. Non-trace-based properties present a challenge for inductive or compositional methods: induction is a natural way of reasoning about traces of a system, but it does not appear directly applicable to non-trace properties. We therefore investigate the semantic connection between trace properties that could be established by induction and non-trace-based security requirements. Specifically, we prove that a certain trace property implies computational secrecy and authentication properties, assuming the encryption scheme provides chosen ciphertext security and ciphertext integrity. We also prove a similar theorem for computational secrecy assuming Decisional Diffie-Hellman and a chosen plaintext secure encryption scheme. A. Roy et al. / Inductive trace properties for computational securityAlice participated in the same session of the same protocol. However, many natural secrecy conditions in the computational model are not trace based.Computational indistinguishability, for example, requires that no computational observer can feasibly distinguish a situation in which a secret is transmitted from a situation in which some non-informative values are transmitted instead. If we look at a single trace, this gives no real information about how likely an observer is to succeed over the set of all traces. Instead, we must look at the probability distribution on traces, and determine the probability of success over the entire distribution. Computational indistinguishability and other non-trace properties present a challenge for proving secrecy properties of protocols, since trace-based properties are naturally amenable to induction on the length of a trace, while non-trace-based properties are not. If we assume inductively that a trace-based property holds, this means it holds for (almost) all traces, and we can consider the effect of adding one more step to each trace. If the effect preserves the property on each trace, then we conclude that the property holds for the protocol as a whole. Since this form of argument only works for trace-based properties, it does not appear applicable to important computational security properties.In this paper, we develop foundations for inductive proofs of computational security properties by proving connections between selected trace properties and useful non-trace properties. This effort is motivated by our interest in extending Computational Protocol Composition Logic (Computational PCL) [27,28,47,48] to computational secrecy properties, and using that logic to prove properties of standard and useful protocols. However, we do not develop the applica...

Fully automated analysis of padding-based encryption in the computational model

“…However, these systems reason about constructions described in mathematical vernacular, and are thus not readily amenable to automation. Similar formalisms exist for cryptographic protocols [28], but these are not automated either.…”

On the protocol composition logic PCL

“…The comments in Section 4.2 apply only to the extensions found in [20,21]. Our comments here do not cover the recent extensions to basic PCL for the analysis of secrecy, as found in [24], nor the computational variants of PCL, as found in e.g. [15].…”

Computationally sound analysis of protocols using bilinear pairings

“…But computational soundness for this primitive has only been considered in a few works. In [24,19,35,36], results for protocols based on Diffie-Hellman exponentiation are given for the computational protocol composition logic. Herzog presents in [25] an abstract model for Diffie-Hellman key exchange protocols; however in this work the abstract model is very different from classical Dolev-Yao models for modular exponentiation [16] as the adversary is extended with the capability of applying arbitrary polynomial time functions.…”