Union and Intersection Types for Secure Protocol Implementations

Abstract

Abstract.We present a new type system for verifying the security of cryptographic protocol implementations. The type system combines prior work on refinement types, with union, intersection, and polymorphic types, and with the novel ability to reason statically about the disjointness of types. The increased expressivity enables the analysis of important protocol classes that were previously out of scope for the type-based analyses of protocol implementations. In particular, our types can statically characterize: (i) more usages of asymmetric cryptography, such as signatures of private data and encryptions of authenticated data; (ii) authenticity and integrity properties achieved by showing knowledge of secret data; (iii) applications based on zero-knowledge proofs. The type system comes with a mechanized proof of correctness and an efficient type-checker.

Logical Foundations of Secure Resource Management in Protocol Implementations

“…Among various static analysis approaches, security type systems have played a major role, since they are able to statically provide security proofs for an unbounded number of concurrent executions, even in presence of an active attacker; they are modular, and scale remarkably well in practice. Recent research has shown that it is possible to leverage generalpurpose theorem proving techniques to develop powerful type systems for the verification of a wide range of security properties on application code, thus narrowing the gap between the formal model designed for the analysis and the actual implementation of the protocols [4,2,26]. The integration between type systems and theorem proving is achieved by resorting to a form of dependent types, known as refinement types.…”

Union, intersection and refinement types and reasoning about type disjointness for secure protocol implementations

“…This extends the scope of the existing type-based analyses of protocol implementations to important classes of cryptographic protocols that were not covered so far, including protocols based on zeroknowledge proofs. Our type system comes with a mechanized proof of correctness and an efficient implementation [21].…”

“…The type-checker consists of around 2.5kLOC, while the whole tool-chain has over 5kLOC. All the tools are available online [21].…”

“…The tool-chain we have developed additionally contains the automatic code generator for zero-knowledge proofs, an interpreter, and a visual debugger. The formalization and the implementation are available online [21].…”

“…Our Coq formalization [21] totals more than 14kLOC, 11 out of which more than 1.5kLOC are just definitions. We used Ott [115] to generate a large part of these definitions from a 1kLOC long Ott specification, but for the more complex rules we often 11 All code size figures include whitespace and comments.…”