Reduction of Equational Theories for Verification of Trace Equivalence: Re-encryption, Associativity and Commutativity

Abstract

Abstract. Verification of trace equivalence is difficult to automate in general because it requires relating two infinite sets of traces. The problem becomes even more complex when algebraic properties of cryptographic primitives are taken in account in the formal model. For example, no verification tool or technique can currently handle automatically a realistic model of re-encryption or associative-commutative operators. In this setting, we propose a general technique for reducing the set of traces that have to be analyzed to a set of local traces. A local trace restricts the way in which some function symbols are used, and this allows us to perform a second reduction, by showing that some algebraic properties can be safely ignored in local traces. In particular, local traces for re-encryption will contain only a bounded number of re-encryptions for any given ciphertext, leading to a sound elimination of equations that model re-encryption. For associativity and commutativity, local traces will determine a canonical use of the associativecommutative operator, where reasoning modulo AC is no stronger than reasoning without AC. We illustrate these results by considering a non-disjoint combination of equational theories for the verification of vote privacy in Prêtà Voter. ProVerif can not handle the input theory as it is, but it does terminate with success on the theory obtained using our reduction result.

A survey of symbolic methods for establishing equivalence-based properties in cryptographic protocols

“…More recently, theoretical foundations have been provided for this technique and soundness of this extension has been proved [82]. A reduction result to get rid of some particular equations (that cannot be handled by the ProVerif tool) has been devised in [83]. Relying on it, a first automated proof of privacy for the protocol Prêtà Voter (that uses re-encryption and associative/commutative operators) has been carried out with success.…”

Automated Verification of Dynamic Root of Trust Protocols

“…In [22] and respectively [2], it is shown how to handle an unbounded number of Diffie-Hellman exponentiations and respectively reencryptions in ProVerif. Surprisingly, the underlying associative-commutative properties of Diffie-Hellman help in [22], while [2] can rely on the fact that a re-encryption does not change the semantics of a ciphertext. Another case where an unbounded number of operations is problematic is file sharing [8].…”

When Are Three Voters Enough for Privacy Properties?

“…Some techniques and tools [7,8,9,10] for indistinguishability properties have recently been developed to automatically check indistinguishability properties and some of them can handle part of the primitives needed in e-voting. For example, ProVerif and Akiss have both been successfully applied to analyse some voting protocols [5,10,11,12,13,14]. However, a third source of difficulty is the fact that voting systems are typically parametrized by the number of voters: both the bulletin board and the tally processes have to process as many ballots as they receive.…”

“…SPEC [8], Akiss [10], and APTE [9]) can only handle a finite number of sessions. So case studies have to consider a finite number of voters [10,12,13,14] unless proofs are conducted by hand [13,15].…”

“…In case one wishes to adapt this proof to Belenios [19], our reduction result would alleviate the proof. The Prêt-à-Voter [20] protocol (PaV) has been analysed using ProVerif for 2 honest voters [12]. Adding a third, dishonest, voter, we can apply our result and obtain the first proof of vote privacy for an arbitrary number of voters.…”