On-the-fly Trace Generation Approach to the Security Analysis of Cryptographic Protocols: Coloured Petri Nets-based Method

In this paper, we present a Petri net based methodology for the formal modelling and analysis of cryptographic protocols. We set up modelling rules that represent the protocols in terms of Petri nets. The modelling produces formal descriptions for the protocols with good visibility and layered abstraction. In particular, the descriptions clearly visualize the causal relations and constraints among the data flows in the protocols. An intruder model is introduced to formulate intruder attacks and to generate test cases against the cryptographic protocols. A procedure that exhaustively generates the test cases and searches for states that violate specified security criteria, is also proposed. We demonstrate the value of this methodology by applying it to a number of published protocols. In this way, we are able to reveal security flaws of these protocols. This methodology is applicable to both public-key and private-key based cryptographic protocols.

I examine the use of automated theorem-proving for reductionist security arguments in cryptography and discuss three papers that purport to show the potential of computer-assisted proof-writing and proof-checking. I look at the proofs that the authors give to illustrate the “game-hopping” technique — for Full-Domain Hash signatures, ElGamal encryption, and Cramer-Shoup encryption — and ask whether there is evidence that automated theorem-proving can contribute anything of value to the security analysis of cryptographic protocols.

Security protocols over open networks and distributed systems: formal methods for their analysis, design, and verification

This work presents a general framework for describing cryptographic protocols and analyzing their security. The framework allows specifying the security requirements of practically any cryptographic task in a unified and systematic way. Furthermore, in this framework the security of protocols is preserved under a general composition operation, called universal composition. The proposed framework with its security-preserving composition operation allows for modular design and analysis of complex cryptographic protocols from simpler building blocks. Moreover, within this framework, protocols are guaranteed to maintain their security in any context, even in the presence of an unbounded number of arbitrary protocol sessions that run concurrently in an adversarially controlled manner. This is a useful guarantee, which allows arguing about the security of cryptographic protocols in complex and unpredictable environments such as modern communication networks.

The Cryptographic Protocol Shapes Analyzer cpsa determines if a cryptographic protocol achieves authentication and secrecy goals. It can be difficult to ensure that an implementation of a protocol matches up with what cpsa analyzed, and therefore be sure the implementation achieves the security goals determined by cpsa.Roletran is a program distributed with cpsa that translates a role in a protocol into a language independent description of a procedure that is easily translated into an existing computer language. This paper shows how we ensure the procedure produced by Roletran is faithful to strand space semantics and therefore achieves the security goals determined by cpsa.Real implementations of cryptographic functions make use of probabilistic encryption, but cpsa will conclude that two encryptions are the same if they are constructed with the same plaintext and key. The paper concludes by showing how we ensure that executions of generated code that make use of probabilistic encryption achieve the goals determined by cpsa.

The author distinguishes between 'heuristic' and 'holistic' issues in the formal analysis of cryptographic protocols and discusses the contribution semantics can make to settling these issues.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

The automated and formal analysis of cryptographic primitives, security protocols and Application Programming Interfaces (APIs) up to date has been focused on discovering attacks that completely break the security of a system. However, there are attacks that do not immediately break a system but weaken the security sufficiently for the adversary. We term these attacks partial attacks and present the first methodology for the modeling and automated analysis of this genre of attacks by describing two approaches. The first approach reasons about entropy and was used to simulate and verify an attack on the ECB|ECB|OFB triple-mode DES block-cipher. The second approach reasons about possibility sets and was used to simulate and verify an attack on the personal identification number (PIN) derivation algorithm used in the IBM 4758 Common Cryptographic Architecture.

Representation of ignorance about large numbers --- agent a does not know agent b's key --- is not feasible in standard Kripke semantics. The paper introduces register models that allow for compact representation of such ignorance. This is used to design a sound an complete language for number guessing games. The probabilities generated by our semantics allow for and motivate Monte Carlo model checking for register models. We show that the approach can be extended to a real life setting, namely the analysis of cryptographic security protocols. We look at a well known security protocol for secret key distribution over an insecure network, and point out how this can be analyzed with our modified version of Kripke semantics.

Regular tree languages are a popular device for reachability analysis over term rewrite systems, with many applications like analysis of cryptographic protocols, or confluence and termination analysis. At the heart of this approach lies tree automata completion, first introduced by Genet for left-linear rewrite systems. Korp and Middeldorp introduced so-called quasi-deterministic automata to extend the technique to non-left-linear systems. In this paper, we introduce the simpler notion of quasi-compatible automata, which are slightly more general than quasi-deterministic, compatible automata. This notion also allows us to decide whether a regular tree language is closed under rewriting, a problem which was not known to be decidable before. Several of our results have been formalized in the theorem prover Isabelle/HOL. This allows to certify automatically generated non-confluence and termination proofs that are using tree automata techniques.

Security protocols (cryptographic protocol) have been widely used to not only achieve traditional goals of data confidentiality, integrity and authentication, but also secure a variety of other desired characteristics of computer-mediated transactions recently. To guarantee reliable protocols, a great deal of formal methods has been undertaken not only to develop diverse tools with specialized purpose or general purpose, but also to apply them to the analysis of realistic protocols. Many of them have been proved to be useful in detecting some intuitive attacks in security protocols. In many cases, a useful feedback is supplied to designers in order to improve the protocol’s security. For both beginners and experienced researchers, this book will present useful information on relevant technologies that can be extended or adapted. A comprehensive introduction to the basic concepts and core techniques will be presented. In this chapter, we explain what is security protocols and how they can be used to ensure secure transactions, what challenging issues in e-commerce (electronic commerce) are, why security protocol analysis important, how they are performed, and what are the ongoing efforts and relevant work. We will also explain the limitations in previous work and why it is important to develop new approaches. These questions will be briefly answered. In particular, we will focus on the discussion regarding secure transaction protocols. Finally, some emerging issues and the ways they are being met are also described.KeywordsModel CheckFormal MethodTemporal LogicSecurity ProtocolLinear Temporal LogicThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Roles in cryptographic protocols do not always have a linear execution, but may include choice points causing the protocol to continue along different paths. In this paper we address the problem of representing choice in the strand space model of cryptographic protocols, particularly as it is used in the Maude-NPA cryptographic protocol analysis tool. To achieve this goal, we develop and give formal semantics to a process algebra for cryptographic protocols that supports a rich taxonomy of choice primitives for composing strand spaces. In our taxonomy, deterministic and non-deterministic choices are broken down further. Non-deterministic choice can be either explicit, i.e., one of two paths is chosen, or implicit, i.e., the value of a variable is chosen non-deterministically. Likewise, deterministic choice can be either an explicit if-then-else choice, i.e., one path is chosen if a predicate is satisfied, while the other is chosen if it is not, or implicit deterministic choice, i.e., execution continues only if a certain pattern is matched. We have identified a class of choices which includes finite branching and some cases of infinite branching, which we address in this paper. We provide a bisimulation result between the expected forwards execution semantics of the new process algebra and the original symbolic backwards semantics of Maude-NPA that preserves attack reachability. We have fully integrated the process algebra syntax and its transformation into strands in Maude-NPA. We illustrate its expressive power and naturalness with various examples, and show how it can be effectively used in formal analysis. This allows users to write protocols from now on using the process syntax, which is more convenient for expressing choice than the strand space syntax, in which choice can only be specified implicitly, via two or more strands that are identical until the choice point.

Only very little is known about the automatic analysis of cryptographic protocols for game-theoretic security properties. In this paper, we therefore study decidability and complexity of the model checking problem for AMC-formulas over infinite state concurrent game structures induced by cryptographic protocols and the Dolev-Yao intruder. We show that the problem is NEXPTIME-complete when making reasonable assumptions about protocols and for an expressive fragment of AMC, which contains, for example, all properties formulated by Kremer and Raskin in fair ATL for contract-signing and non-repudiation protocols. We also prove that our assumptions on protocols are necessary to obtain decidability, unless other restrictions are imposed on protocols.

We consider the so called ``cryptographic protocols`` whose aim is to ensure some security properties when communication channels are not reliable. Such protocols usually rely on cryptographic primitives. Even if it is assumed that the cryptographic primitives are perfect, the security goals may not be achieved: the protocol itself may have weaknesses which can be exploited by an attacker. We survey recent work on decision techniques for the cryptographic protocol analysis.

In recent years, PUF-based schemes have not only been suggested for the basic security tasks of tamper sensitive key storage or system identification, but also for more complex cryptographic protocols like oblivious transfer (OT), bit commitment (BC), or key exchange (KE). These more complex protocols are secure against adversaries in the stand-alone, good PUF model. In this survey, a shortened version of [17], we explain the stronger bad PUF model and PUF re-use model. We argue why these stronger attack models are realistic, and that existing protocols, if used in practice, will need to face these. One consequence is that the design of advanced cryptographic PUF protocols needs to be strongly reconsidered. It suggests that Strong PUFs require additional hardware properties in order to be broadly usable in such protocols: Firstly, they should ideally be erasable, meaning that single PUF-responses can be erased without affecting other responses. If the area efficient implementation of this feature turns out to be difficult, new forms of Controlled PUFs [3] (such as Logically Erasable and Logically Reconfigurable PUFs [6]) may suffice in certain applications. Secondly, PUFs should be certifiable, meaning that one can verify that the PUF has been produced faithfully and has not been manipulated in any way afterwards. The combined implementation of these features represents a pressing and challenging problem for the PUF hardware community.

General E-unification is an important tool in cryptographic protocol analysis, where the equational theory E represents properties of the cryptographic algorithm, and uninterpreted function symbols represent other functions. Some important properties are XOR, Abelian groups, and homomorphisms over them. Polynomial time algorithms exist for unification in those theories. However, the general E-unification problem in these theories is NP-complete, and existing algorithms are highly nondeterministic. We give a mostly deterministic set of inference rules for solving general E-unification modulo XOR with (or without) a homomorphism, and prove that it is sound, complete and terminating. These inference rules have been implemented in Maude, and are being incorporated into the Maude NPA. They are designed in such a way so that they can be extended to an Abelian group with a homomorphism.