Multiset rewriting and the complexity of bounded security protocols

Abstract

We formalize the Dolev-Yao model of security protocols, using a notation based on multiset rewriting with existentials. The goals are to provide a simple formal notation for describing security protocols, to formalize the assumptions of the Dolev-Yao model using this notation, and to analyze the complexity of the secrecy problem under various restrictions. We prove that, even for the case where we restrict the size of messages and the depth of message encryption, the secrecy problem is undecidable for the case of an unrestricted number of protocol roles and an unbounded number of new nonces. We also identify several decidable classes, including a DEXP-complete class when the number of nonces is restricted, and an NP-complete class when both the number of nonces and the number of roles is restricted. We point out a remaining open complexity problem, and discuss the implications these results have on the general topic of protocol analysis.

DEEPSEC: Deciding Equivalence Properties in Security Protocols Theory and Practice

“…While many complexity results are known for trace properties [DLM04,RT03], the case of behavioural equivalences remains mostly open. When the attacker is an eavesdropper and cannot interact with the protocol, the indistinguishability problem-static equivalence-has been shown ptime for large classes of cryptographic primitives [AC06,CDK12,CBC10].…”

Breaking and Fixing Public-Key Kerberos

“…We discovered this attack as we were interpreting the specification documents of this protocol [25] in preparation for its formalization in MSR [9,31,32], the specification language for our analysis. We start with a detailed description of the attacker's actions in the AS exchange, the key to the attack.…”

Pattern-Based Abstraction for Verifying Secrecy in Protocols

“…This model assumes perfect cryptographic primitives and a nondeterministic intruder that has total control of the communication network and capacity to forge new messages. It is known that reachability is undecidable for cryptographic protocols in the general case [13], even when a bound is put on the size of messages [12]. Because of these negative results, from the point of view of verification, the best we can hope for is either to identify decidable sub-classes as in [3,24,21] or to develop correct but incomplete verification algorithms as in [22,17,15].…”

“…Recently, Comon, Cortier and Mitchell [7] extended this class allowing pairing and binary encryption while the use of nonces still cannot be expressed in their model. Reachability is decidable for the bounded number of sessions [3,24,21] or when nonce creation is not allowed and the size of messages is bounded [12]. These assumptions are rarely justified in practice.…”