Union, intersection and refinement types and reasoning about type disjointness for secure protocol implementations

Abstract

We present a new type system for verifying the security of reference implementations of cryptographic protocols written in a core functional programming language.The type system combines prior work on refinement types, with union, intersection, and polymorphic types, and with the novel ability to reason statically about the disjointness of types. The increased expressivity enables the analysis of important protocol classes that were previously out of scope for the type-based analyses of reference protocol implementations. In particular, our types can statically characterize:(i) more usages of asymmetric cryptography, such as signatures of private data and encryptions of authenticated data; (ii) authenticity and integrity properties achieved by showing knowledge of secret data; (iii) applications based on zero-knowledge proofs. The type system comes with a mechanized proof of correctness and an efficient type-checker.

Automated type-based analysis of injective agreement in the presence of compromised principals

“…Thus, it prevents digital signatures on private data which is a limitation of our type system inherited from the kinding rules of [7]. This problem can be resolved by adding a number of subkinding and subtyping rules to the type system [18] or by using union and intersection types [6].…”

“…However, it has been shown that ProVerif is not scalable when the number of lines of the protocol specification increases [12]. In another line of research, the source code of a given protocol is annotated by security types and the annotated code is analyzed using a type checker [5,6,14,68,69]. Type-based analysis methods are inherently modular and, in turn, scalable.…”

“…The methods proposed have even been further improved so that more complicated protocols can be analyzed. Notwithstanding, either they do not go beyond non-injective agreement [12,6] or they can only analyze protocols involving so-called public-out-secret-home (POSH) nonce handshakes [13,14]. Moreover, none of these enhanced type systems is equipped with a type inference algorithm, which even hinders their practical application.…”

“…This method has its origin in the first type system devised to check protocols for secrecy [1]. Now, there are many analysis methods and tools based on this idea that can be utilized to verify different kinds of security properties such as authenticity [2,3,4,5,6] and zero-knowledge proofs [6]. To achieve an effective type-based analysis method for security protocols, scholars first decide on a language that is expressive enough to model protocols.…”

Equivalence Properties by Typing in Cryptographic Branching Protocols

“…In particular, mature push-button analysis tools have emerged and have been successfully applied to many protocols from the literature in the context of trace properties such as authentication or confidentiality. These tools employ a variety of analysis techniques, such as model checking (e.g., Avispa [6] and Scyther [31]), Horn clause resolution (e.g., ProVerif [13]), term rewriting (e.g., Scyther [31] and Tamarin [38]), and type systems [7,12,[16][17][18][19][20][21]34,36,37].…”