Leakiness is Decidable for Well-Founded Protocols

Fröschle, Sibylle

doi:10.1007/978-3-662-46666-7_10

Cited by 6 publications

(24 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We provide in Section V-C a detailed comparison with our result. In brief, our result are incomparable since [15] considers a larger class of primitives but a less accurate security property and more restriction on the protocols (e.g. ciphertext forwarding is again prohibited and as in [12] a typed model is considered).…”

Section: Introductionmentioning

confidence: 88%

“…Dougherty and Guttman [14] have recently proposed a decidability result dedicated to Diffie-Hellman protocols. Contemporaneously to our work, Sybille Fröschle [15] has proposed a new decidability result for the "leakiness" property and the class of "well-founded protocols". We provide in Section V-C a detailed comparison with our result.…”

Section: Introductionmentioning

confidence: 93%

“…Therefore, the nonce N b could potentially be learnt at step 4 and be reused earlier (at Step 2 for example). Note that such a protocol would be declared leaky in [15].…”

Section: Dependency Graphmentioning

confidence: 99%

“…Sibylle Fröschle has recently obtained [15] a decidability result for an unbounded number of sessions, for the property of "leakiness". Our decidability result differs from Fröschle's result on several general points, in particular in terms of primitives and properties that can be handled.…”

Section: Detailed Comparison With [15]mentioning

confidence: 99%

“…Our decidability result differs from Fröschle's result on several general points, in particular in terms of primitives and properties that can be handled. Strictly speaking the two results are incomparable since we study trace equivalence while [15] analyses "leakiness", a specially designed property that implies secrecy. In this section, we highlight the main similarities and differences of the two approaches.…”

Section: Detailed Comparison With [15]mentioning

confidence: 99%

See 4 more Smart Citations

Decidability of Trace Equivalence for Protocols with Nonces

Chrétien

Cortier

Delaune

2015

2015 IEEE 28th Computer Security Foundations Symposium

View full text Add to dashboard Cite

show abstract

Section: Introductionmentioning

confidence: 88%

Section: Introductionmentioning

confidence: 93%

“…Therefore, the nonce N b could potentially be learnt at step 4 and be reused earlier (at Step 2 for example). Note that such a protocol would be declared leaky in [15].…”

Section: Dependency Graphmentioning

confidence: 99%

Section: Detailed Comparison With [15]mentioning

confidence: 99%

Section: Detailed Comparison With [15]mentioning

confidence: 99%

See 3 more Smart Citations

Decidability of Trace Equivalence for Protocols with Nonces

Chrétien

Cortier

Delaune

2015

2015 IEEE 28th Computer Security Foundations Symposium

View full text Add to dashboard Cite

show abstract

One Vote Is Enough for Analysing Privacy

Delaune

Lallemand

2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Electronic voting promises the possibility of convenient and efficient systems for recording and tallying votes in an election. To be widely adopted, ensuring the security of the cryptographic protocols used in e-voting is of paramount importance. However, the security analysis of this type of protocols raises a number of challenges, and they are often out of reach of existing verification tools. In this paper, we study vote privacy, a central security property that should be satisfied by any e-voting system. More precisely, we propose the first formalisation of the state-of-the-art BPRIV notion in the symbolic setting. To ease the formal security analysis of this notion, we propose a reduction result allowing one to bound the number of voters and ballots needed to mount an attack. Our result applies on a number of case studies including several versions of Helios, Belenios, JCJ/Civitas, and Prêt-à-Voter. For some of these protocols, thanks to our result, we are able to conduct the analysis relying on the automatic tool Proverif. ⋆ The research leading to these results has received funding from the European Research Council (ERC) under the European Union's Horizon 2020 research and innovation program (grant agreement No 714955-POPSTAR), as well as from the French National Research Agency (ANR) under the project TECAP.done e.g. in [18]. The only existing result in that context is the result proposed in [4], where the authors give bounds on the number of voters and ballotsrespectively 3 and 10 -needed for an attack on the SWAP notion This allows them to carry out several case studies using Proverif. No such results, however, exist for the newer and more general BPRIV definition.Contributions. Our contributions are threefold. First, we propose a definition of BPRIV adapted for the symbolic model. BPRIV has been first introduced in the computational setting where some subtleties regarding the communication model have been overlooked. Second, we identify some conditions under which BPRIV can be analysed considering only one honest voter and k dishonest ones. Actually, in most usual cases, we have k = 1, and the number of ballots being tallied is reduced to 1. These reduction results are generic, in particular we do not assume anything regarding the equational theory,and our result applies for different counting functions. Revoting is also allowed. Finally, we apply our result on several e-voting protocols from the literature relying on the tool Proverif. Our bounds for BPRIV, better than those obtained in [4] when considering SWAP, allow us to analyse many protocols in a reasonable time (whereas several hours were needed in some cases in [4]). We also identify an issue in the security analysis performed in [4] where a protocol has been declared secure while it is not. Modelling security protocolsWe model security protocols in the symbolic model with a process algebra inspired from the applied pi-calculus [2]. Our model is mostly standard, except that in order to model the stateful nature of e-voting protocols, we cons...

show abstract

Causality, Behavioural Equivalences, and the Security of Cyberphysical Systems

Fröschle

2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Leakiness is Decidable for Well-Founded Protocols

Cited by 6 publications

References 17 publications

Decidability of Trace Equivalence for Protocols with Nonces

Decidability of Trace Equivalence for Protocols with Nonces

One Vote Is Enough for Analysing Privacy

Causality, Behavioural Equivalences, and the Security of Cyberphysical Systems

Contact Info

Product

Resources

About