Systematic design of a family of attack-resistant authentication protocols

Abstract

The pervasive use of open networks and distributed systems poses serious threats to the security of end-to-end communications and network components themselves. A necessary foundation for securing a network is the ability to reliably authenticate communication partners and other network entities. One-way, password-based authentication techniques are not sufficient to cope with the issues at hand. Modern designs rely on two-way, cryptographic authentication protocols. However, most existing designs suffer from one or more limitations: They require synchronization of local clocks, they are subject to export restrictions because of the way they use cryptographic functions, they are not amenable to use in lower layers of network protocols because of the size and complexity of messages they use, etc. Designing such cryptographic protocols for large and dynamic network communities presents substantial challenges in terms of ease of use, efficiency, flexibility, and above all security. This paper discusses the above challenges, shows how a few simple protocols, including one being standardized by ISO, can easily be broken, and derives a series of desirable properties that authentication protocols should exhibit to meet the requirements of future large and dynamic network communities. Then the paper describes a methodology that was developed to systematically build a canonical description of a family of cryptographic two-way authentication protocols that are as simple as possible yet resistant to a wide class of attacks, efficient, easy to implement and use, and amenable to many different networking environments. It also discusses several possible embodiments of the canonical protocol that present various advantages in specific distributed system scenarios.

Establishing and preserving protocol security goals

“…As an idea for protocol design, it goes back at least to Bird et al [7]. In a key special case, "protocol composition," it dates from the 1990s [41, e.g.].…”

A hierarchy of authentication specifications

“…In several cases, this is due to an intruder launching a mirror attack, simply reflecting an agent's messages back at himself; examples appear in [2]. In other, more subtle attacks, an intruder attacks an agent by using a second run of a protocol with the same agent , so as to use the second run as an oracle; for example the attack on the BAN version of the Yahalom protocol [3] in [24].…”

Security Goals and Protocol Transformations

“…The safe protocol transformation problem is not new. As an idea for protocol design, it goes back at least to Bird et al [5]. In a key special case, "protocol composition," it dates from the 1990s [21, e.g.].…”