Know Your Enemy

Abstract

We present a symbolic framework, based on a modular operational semantics, for formalizing different notions of compromise relevant for the design and analysis of cryptographic protocols. The framework's rules can be combined to specify different adversary capabilities, capturing different practically-relevant notions of key and state compromise. The resulting adversary models generalize the models currently used in different domains, such as security models for authenticated key exchange. We extend an existing securityprotocol analysis tool, Scyther, with our adversary models. This extension systematically supports notions such as weak perfect forward secrecy, key compromise impersonation, and adversaries capable of statereveal queries. Furthermore, we introduce the concept of a protocol-security hierarchy, which classifies the relative strength of protocols against different adversaries.In case studies, we use Scyther to analyse protocols and automatically construct protocol-security hierarchies in the context of our adversary models. Our analysis confirms known results and uncovers new attacks. Additionally, our hierarchies refine and correct relationships between protocols previously reported in the cryptographic literature.

On Post-compromise Security

“…The justification is that practical scenarios exist in which one, but not the other, might be compromised. (Further discussion can be found in [1]. )…”

A Unified Symbolic Analysis of WireGuard

“…We adopt the methodology from [5] with some adaptations to our protocol. An adversary model, as defined in [5], is a combination of adversarial compromise.…”

“…We adopt the methodology from [5] with some adaptations to our protocol. An adversary model, as defined in [5], is a combination of adversarial compromise. To outline our model, we consider four dimensions of adversarial compromise: which kind of data is compromised, whose data it is, when the compromise occurs and which type of compromise it is.…”

When Good Components Go Bad

“…Attacker Models for Dynamic Compromise. While our model of dynamic compromise is specific to secure compilation of unsafe languages, related notions of compromise have been studied in the setting of cryptographic protocols, where, for instance, a participant's secret keys could inadvertently be leaked to a malicious adversary, who could then use them to impersonate the victim [16,17,28,32]. This model is also similar to Byzantine behavior in distributed systems [19,53], in which the "Byzantine failure" of a node can cause it to start behaving in an arbitrary way, including generating arbitrary data, sending conflicting information to different parts of the system, and pretending to be a correct node.…”