Universally Composable Security

This paper discusses the decision problem concerning security for such cryptographic protocols as the cryptographic key distribution protocols and the digital signature protocols. A cryptographic protocol and its utilization environment are considered secure if an opponent cannot know the secret message or forge a signature successfully by wiretapping or communication function is secure. This paper presents a sufficient condition under which the security problem is decidable. Dolev et al. also investigated the decision problem of the security, but they discussed only the simple case where the cryptographic key is not the object of manipulation (i.e., key generation and distribution are not included in the protocol), and a decision method is presented in which the decision can be made in a polynomial time. By contrast, this paper discusses the problem including the case where the cryptographic key can be an object of manipulation. The key delivery protocol by Ehrsam et al. and the digital signature protocol by Needham et al. satisfy the sufficient condition for the decidability given in this paper. Under the sufficient condition given in this paper, the security can again be decided in a polynomial time.

Though much attention has been paid to the research on the security of cryptographic protocols in the last two decades, no perfect solution is a.vailable. In this paper, we firstly present some explicit assumptions, and the properties that a secure protocol should hold, then divide the total security of cryptographic protocols into some partial securities based on those properties, and finally give our protocol which is surprisingly simple and prove its total security based on those assumptions and the capacity of BAN-like of proving the session key safeness of cryptographic protocols.

Security protocols over open networks and distributed systems: formal methods for their analysis, design, and verification

Representation of ignorance about large numbers --- agent a does not know agent b's key --- is not feasible in standard Kripke semantics. The paper introduces register models that allow for compact representation of such ignorance. This is used to design a sound an complete language for number guessing games. The probabilities generated by our semantics allow for and motivate Monte Carlo model checking for register models. We show that the approach can be extended to a real life setting, namely the analysis of cryptographic security protocols. We look at a well known security protocol for secret key distribution over an insecure network, and point out how this can be analyzed with our modified version of Kripke semantics.

State space reduction in the Maude-NRL Protocol Analyzer

In this paper, we present a Petri net based methodology for the formal modelling and analysis of cryptographic protocols. We set up modelling rules that represent the protocols in terms of Petri nets. The modelling produces formal descriptions for the protocols with good visibility and layered abstraction. In particular, the descriptions clearly visualize the causal relations and constraints among the data flows in the protocols. An intruder model is introduced to formulate intruder attacks and to generate test cases against the cryptographic protocols. A procedure that exhaustively generates the test cases and searches for states that violate specified security criteria, is also proposed. We demonstrate the value of this methodology by applying it to a number of published protocols. In this way, we are able to reveal security flaws of these protocols. This methodology is applicable to both public-key and private-key based cryptographic protocols.

Most Petri nets-based methods that have been developed to analyze cryptographic protocols provide the analysis of one attack trace only. Only a few of them offer the analysis of multiple attack traces, but they are rather inefficient. Analogously, the limitation of the analysis of one attack trace occurs in most model checking methods for cryptographic protocols. In this paper, we propose a very simple but practical Coloured Petri nets-based model checking method for the analysis of cryptographic protocols, which overcomes these limitations. Our method offers an efficient analysis of multiple attack traces. We apply our method to two case studies which are TMN authenticated key exchanged protocol and Micali's contract signing protocol. Surprisingly, our simple method is very efficient when the numbers of attack traces and states are large. Also, we find many new attacks in those protocols.

The automated and formal analysis of cryptographic primitives, security protocols and Application Programming Interfaces (APIs) up to date has been focused on discovering attacks that completely break the security of a system. However, there are attacks that do not immediately break a system but weaken the security sufficiently for the adversary. We term these attacks partial attacks and present the first methodology for the modeling and automated analysis of this genre of attacks by describing two approaches. The first approach reasons about entropy and was used to simulate and verify an attack on the ECB|ECB|OFB triple-mode DES block-cipher. The second approach reasons about possibility sets and was used to simulate and verify an attack on the personal identification number (PIN) derivation algorithm used in the IBM 4758 Common Cryptographic Architecture.

This paper surveys some recent work on applications of polynomials (over finite fields) to the design of various cryptographic protocols. It is based on a talk given at the 3rd Conference on Security in Communication Networks, 2002.

The universal composability framework is a new approach for designing and analyzing the security of cryptographic protocols. In this framework, the security of protocols is maintained under a general protocol composition operation. In the paper, we propose the universal composability framework for the analysis of proxy threshold signature and present a universally composable secure proxy threshold signature scheme which is the first one in this area. The proposed scheme is suitable for the mobile agents, which should migrate across different environment through network. Furthermore, we give the concrete analysis of the reduction to prove the security of the proposed scheme.

To ensure private message exchange among the group members, it is desirable to construct secure and efficient group key management schemes. Moreover, these schemes are more versatile if they could support dynamic join or leave of group members. In IET Information Security 2014, Vijayakumar et al. have introduced such a group key management scheme with lightweight overheads in both computation and communication. And this scheme has been used as a building block in many cryptographic protocols afterwards. In this paper, the authors demonstrate that Vijayakumar's scheme suffers some potential security weaknesses. First, after participating in the group communications for some sessions, a group member may still be able to obtain the group key after it leaves the group, and this violates the claimed security property of forward secrecy. Second, some colluding group members may derive another group member's long term secret key, and obviously, this has more serious consequences. One of the main reasons for the existence of these attacks is that the security analyses in Vijayakumar's scheme are informal and they cannot cover the dynamic environment. To address this issue, the authors’ suggestion is that heuristic arguments of security are not adequate in the design of cryptographic protocols, but formal security definitions and proofs are required.

Security protocols (cryptographic protocol) have been widely used to not only achieve traditional goals of data confidentiality, integrity and authentication, but also secure a variety of other desired characteristics of computer-mediated transactions recently. To guarantee reliable protocols, a great deal of formal methods has been undertaken not only to develop diverse tools with specialized purpose or general purpose, but also to apply them to the analysis of realistic protocols. Many of them have been proved to be useful in detecting some intuitive attacks in security protocols. In many cases, a useful feedback is supplied to designers in order to improve the protocol’s security. For both beginners and experienced researchers, this book will present useful information on relevant technologies that can be extended or adapted. A comprehensive introduction to the basic concepts and core techniques will be presented. In this chapter, we explain what is security protocols and how they can be used to ensure secure transactions, what challenging issues in e-commerce (electronic commerce) are, why security protocol analysis important, how they are performed, and what are the ongoing efforts and relevant work. We will also explain the limitations in previous work and why it is important to develop new approaches. These questions will be briefly answered. In particular, we will focus on the discussion regarding secure transaction protocols. Finally, some emerging issues and the ways they are being met are also described.KeywordsModel CheckFormal MethodTemporal LogicSecurity ProtocolLinear Temporal LogicThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The Cryptographic Protocol Shapes Analyzer cpsa determines if a cryptographic protocol achieves authentication and secrecy goals. It can be difficult to ensure that an implementation of a protocol matches up with what cpsa analyzed, and therefore be sure the implementation achieves the security goals determined by cpsa.Roletran is a program distributed with cpsa that translates a role in a protocol into a language independent description of a procedure that is easily translated into an existing computer language. This paper shows how we ensure the procedure produced by Roletran is faithful to strand space semantics and therefore achieves the security goals determined by cpsa.Real implementations of cryptographic functions make use of probabilistic encryption, but cpsa will conclude that two encryptions are the same if they are constructed with the same plaintext and key. The paper concludes by showing how we ensure that executions of generated code that make use of probabilistic encryption achieve the goals determined by cpsa.

When implementing systems using a secure data connection between components, it is important to analyze the security of data transmission. Secure data transfer is achieved by using cryptographic protocols. It is important to verify the security of cryptographic protocols already implemented in the system, since this is the last iteration of their compilation in the form of their implementation in the selected programming language. The paper proposes a scheme and approaches for creating an automated security verifier of cryptographic protocol implementations. The problems that arise when implementing cryptographic protocols in programming languages are described. A verification scheme based on the use of a source code analyzer for extracting the structure of cryptographic protocols, translating their structure of the Alice-Bob format protocol into the specification language for formal verifiers, and dynamic analysis of the implementation code is presented. The approaches for the implementation of the analyzer, translator and dynamic analyser are described, as well as the future work.

This paper explores the complexity-theoretic approach to the transmission of knowledge that was introduced by Goldwasser, Micali. and Rackoff, and further studied by a number of authors. Roughly speaking, a protocol designed to solve a given computational problem is said to be minimum-knowledge if its outputs give no more information than an oracle for the problem would give to a user whose computational resources are polynomially bounded. This notion has important consequences for the design of cryptographic protocols. A few slightly different definitions have been given in the literature: some of the results included here have been published previously without proofs. This paper proposes a uniform definition. collects the known results and proves them, and describes the problems that are still not understood.