Using logics to detect implementation-dependent flaws [cryptographic protocol design]

Formal requirements for key distribution protocols

“…This lead to the discovery of an implementation-dependent flaw similar to the one found in [12] and [2], as well as of an attack that pointed out a place where our requirements might be too stringent. As in the earlier case, the discovery of an implementation-dependent flaw does not mean that implementations of the protocol are necessarily or even likely to be flawed, but rather that there is a hidden assumption in the specification whose violation would cause a security flaw.…”

“…As in the earlier case, the discovery of an implementation-dependent flaw does not mean that implementations of the protocol are necessarily or even likely to be flawed, but rather that there is a hidden assumption in the specification whose violation would cause a security flaw. In this case, as in the flaw discovered in [12] and [2], the hidden assumption is that the principals have the ability to recognize different types of data, such as keys, nonces, and timestamps. In [12] and [2] an attack was found on the Neuman-Stubblebine protocol which depends upon the receiver's inability to distinguish a nonce from a key.…”

“…In this case, as in the flaw discovered in [12] and [2], the hidden assumption is that the principals have the ability to recognize different types of data, such as keys, nonces, and timestamps. In [12] and [2] an attack was found on the Neuman-Stubblebine protocol which depends upon the receiver's inability to distinguish a nonce from a key. We do not present the attack here, but note that it depends upon the receiver's confusing the message it generates in the second step in the protocol with the message it receives in the fourth step.…”

The Logic of Authentication Protocols

“…These are known as run internal attacks. An example involving the Neuman-Stubblebine repeated authentication protocol [NS93,CJ97] has been exposed by Syverson in [Syv93b] and by Carlsen in [Car93].…”

Formal verification of type flaw attacks in security protocols

“…In previous work, verification of protocols susceptible to type flaw attacks has been attempted using various formalisms [12,10,8,7,25,11,24]. The attacks considered generally involve simple 'type confusion' attacks in which segments of one type are confused with segments of another type, or in the more advanced models, in which a segment of one type is confused with the concatenation of two or more other segments of varying types [18].…”