StatVerif: Verification of stateful processes

Abstract

Abstract-We present StatVerif, which is an extension the ProVerif process calculus with constructs for explicit state, in order to be able to reason about protocols that manipulate global state. Global state is required by protocols used in hardware devices (such as smart cards and the TPM), as well as by protocols involving databases that store persistent information. We provide the operational semantics of StatVerif. We extend the ProVerif compiler to a compiler for StatVerif: it takes processes written in the extended process language, and produces Horn clauses. Our compilation is carefully engineered to avoid many false attacks. We prove the correctness of the StatVerif compiler. We illustrate our method on two examples: a small hardware security device, and a contract signing protocol. We are able to prove their desired properties automatically.

The TAMARIN Prover for the Symbolic Analysis of Security Protocols

“…Examples include the TESLA protocols, the security device and contract signing examples from [1], the keyserver protocol from [11], and the exclusive secrets and envelope protocol models for TPMs from [5]. In each case, our results are more general or the analysis is more efficient than previous results.…”

“…The ProVerif tool [2] has been extended to partially handle DH with inverses [8], bilinear pairings [12], and mutable global state [1]. From a user perspective, Tamarin provides a more expressive property specification language that, e. g., allows for direct specification of temporal properties.…”

“…It has more difficulty dealing with properties that depend on the precise state of agent sessions and mutable global state. The extension [1] for mutable global state is subject to several restrictions and the protocol models require additional manual abstraction steps. Similarly, the DH and bilinear pairing extensions work under some restrictions, e. g., exponents in the specification must be ground.…”

Formal analysis of privacy in Direct Anonymous Attestation schemes

“…Accordingly, we believe the definition is necessary, but may not be sufficient. This limitation could be overcome by introducing a stateful variant of the applied pi calculus, indeed, Arapinis, Ritter & Ryan [ARR11] make some progress in this direction. A further limitation of our privacy definition is the restriction to settings with one issuer, indeed, this corresponds to the cryptographic game.…”

Dynamic Measurement and Protected Execution: Model and Analysis

“…For these reasons, we wish to use StatVerif [2] for our analysis; it is an extension of ProVerif which can deal with protocols that have persistent state. Unfortunately, StatVerif does not reliably terminate when the state space is infinite, such as in the case studies we are using in this paper.…”