Protocol analysis in Maude-NPA using unification modulo homomorphic encryption

Abstract

A number of new cryptographic protocols are being designed to secure applications such as video-conferencing and electronic voting. Many of them rely upon cryptographic functions with complex algebraic properties that must be accounted for in order to be correctly analyzed by automated tools. Maude-NPA is a cryptographic protocol analysis tool based on narrowing and typed equational unification which takes into account these algebraic properties. It has already been used to analyze protocols involving bounded associativity, modular exponentiation, and exclusive-or. All of the above can be handled by the same general variant-based equational unification technique. However, there are important properties, in particular homomorphic encryption, that cannot be handled by variantbased unification in the same way. In these cases the best available approach is to implement specialized unification algorithms and combine them within a modular framework. In this paper we describe how we apply this approach within Maude-NPA, with respect to encryption homomorphic over a free operator. We also describe the use of Maude-NPA to analyze several protocols using such an encryption operation. To the best of our knowledge, this * S. is the first implementation of homomorphic encryption of any sort in a tool for verifying the security of a protocol in the presence of active attackers.

Bounded ACh unification

“…So, it is important to analyze cryptographic protocols in the homomorphism theory. Some of the algorithms and details in this direction can be seen in Anantharaman et al (2010Anantharaman et al ( , 2012; Escobar et al (2011). However, none of those results perform ACh unification because that is undecidable.…”

“…Unification modulo equational theories play a significant role in symbolic cryptographic protocol analysis Escobar et al (2007). An overview and references for some of the algorithms may be seen in Escobar et al (2011); Kapur et al (2003); Narendran et al (2015). One such equational theory is the distributive axioms: x × (y + z) = (x × y) + (x × z); (y + z) × x = (y × x) + (z × x).…”

Modeling and Verifying Security Protocols with the Applied Pi Calculus and ProVerif

“…Hence, it is sound and complete, but may not terminate. It supports cryptographic primitives defined by convergent rewrite rules plus associativity and commutativity (Escobar et al, 2007), as well as homomorphic encryption (Escobar et al, 2011), while ProVerif does not support associativity nor homomorphic encryption. It initially focused on reachability properties and was recently extended to prove some equivalences (Santiago et al, 2014), using the same idea as ProVerif (see §3.4).…”

Twenty years of rewriting logic

“…But finitary algorithms for theories E ∪ B not having the finite variant property, e.g., homomorphic encryption, are also supported by Maude-NPA. In this way, we have formally analyzed protocols of the form R = ( , E ∪B, R), where E ∪B can be a cryptographic theory involving a combination of functionalities such as: (i) encryption-decryption; (ii) bounded associativity; (iii) Diffie-Hellman exponentiation; (iv) exclusive or; and (v) homomorphic encryption [178,179,181,183,412]. In general, of course, protocol analysis with an unbounded number of sessions is undecidable.…”