A Computationally Sound Mechanized Prover for Security Protocols P. - - PowerPoint PPT Presentation

▶
a computationally sound mechanized prover for security
SMART_READER_LITE
LIVE PREVIEW

A Computationally Sound Mechanized Prover for Security Protocols P. - - PowerPoint PPT Presentation

Sep 03, 2023 350 likes •592 views

A Computationally Sound Mechanized Prover for Security Protocols P. Cogn ee, D. Kolokosso, F. M ejean, L. Pillard, J. Tharaud National School of Applied Mathematics and Computer Science, ENSIMAG 27 November 2009 P. Cogn ee, D.

slide-1
SLIDE 1

A Computationally Sound Mechanized Prover for Security Protocols

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud

National School of Applied Mathematics and Computer Science, ENSIMAG

27 November 2009

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 1 / 22

slide-2
SLIDE 2

Presentation overview

1 CryptoVerif and Semantic 2 Equivalences 3 Game Transformations 4 Proof for Security

Security Primitives Criteria for proving Secrecy Properties Proof Strategy

5 Results and Conclusion

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 2 / 22

slide-3
SLIDE 3

Presentation overview

1 CryptoVerif and Semantic 2 Equivalences 3 Game Transformations 4 Proof for Security

Security Primitives Criteria for proving Secrecy Properties Proof Strategy

5 Results and Conclusion

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 3 / 22

slide-4
SLIDE 4

CryptoVerif and Semantic

CryptoVerif A Computationally Sound Mechanized Prover for Security Protocols Bruno Blanchet (CNRS, ENS, Paris)

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 4 / 22

slide-5
SLIDE 5

CryptoVerif and Semantic

2 approaches for proving secrecy properties of security protocols : Symbolic : {< a, x >}k, a deduction system (e.g. Dolev-Yao model), proofs based on constraint solving, . . . Computational : 10101001010 . . . , a PPTT machine, proofs based on cryptographic assumption (→ CryptoVerif)

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 5 / 22

slide-6
SLIDE 6

CryptoVerif and Semantic

CryptoVerif is a sequence of games transformations : first game = real protocol represented in process calculus final game = no variables, only arrays of booleans Two consecutive games cannot be distinguished.

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 6 / 22

slide-7
SLIDE 7

CryptoVerif and Semantic

Process calculus = pi-calculus + cryptographic primitives Pi-calculus : probabilitic semantic over bistrings

input process, output process arrays of booleans, replication parallel composition, channel restriction

Cryptographic primitives : functions over bistrings (blackboxes)

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 7 / 22

slide-8
SLIDE 8

Presentation overview

1 CryptoVerif and Semantic 2 Equivalences 3 Game Transformations 4 Proof for Security

Security Primitives Criteria for proving Secrecy Properties Proof Strategy

5 Results and Conclusion

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 8 / 22

slide-9
SLIDE 9

Observational equivalence

Definition, more important result Adversary represented by Context C[.] → a context C: process with an hole, having access to V, set of Variables Processes Q,Q’, verifying invariant-rules if |Pr[C[Q] → 1] − Pr[C[Q′] → 1]| is negligible then Q ≈V Q′ The adversary cannot distinguish which process have been used.

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 9 / 22

slide-10
SLIDE 10

Observational equivalence

Definition, more important result Adversary represented by Context C[.] → a context C: process with an hole, having access to V, set of Variables Processes Q,Q’, verifying invariant-rules if |Pr[C[Q] → 1] − Pr[C[Q′] → 1]| is negligible then Q ≈V Q′ The adversary cannot distinguish which process have been used. Which purpose ? if Q ≈V Q′ then GAME1[Q] →≈ GAME2[Q’] using syntactic and primitives transformations

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 9 / 22

slide-11
SLIDE 11

Presentation overview

1 CryptoVerif and Semantic 2 Equivalences 3 Game Transformations 4 Proof for Security

Security Primitives Criteria for proving Secrecy Properties Proof Strategy

5 Results and Conclusion

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 10 / 22

slide-12
SLIDE 12

Game Transformations

Goal : transform the process that represents the initial protocol into a process on which security property can be proved directly. It consists in : syntactic transformations (RemoveAssign(x), SArename(x), Simplify()) applying the definition of security of primitives : axioms used by the prover to transform a game into another equivalent game

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 11 / 22

slide-13
SLIDE 13

Security Primitives

What means the security primitives ? Cryptographic fonctions like enc, mac, keygen . . . Designed like black-boxes here e.g : MAC (Message Authentification Code) linked with check relation : check(m,k,mac(m,k)) = true Guaranties Authenticity and integrity of a message

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 12 / 22

slide-14
SLIDE 14

Security Primitives

Predefined transformation for security primitives: check Because, mac is UF-CMA ( difficult to forge), then we can replace check(m,k,t) with: find j < N such that defined (x[j]) ∧ (m = x[j])∧check’(m,k,t) then true , else false It means that he adversary can compute check only if he has already computed mac(m,k);

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 13 / 22

slide-15
SLIDE 15

Security Primitives

enc Because enc is IND-CPA we can replace : enc(x, keygen(r)) with : enc′(Z(x), keygen′(r)) where Z(x) returns a bitstring of the same length than x Intuitively, it means that adversary cannot distinguish the cyphering of 2 same-size messages

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 14 / 22

slide-16
SLIDE 16

Presentation overview

1 CryptoVerif and Semantic 2 Equivalences 3 Game Transformations 4 Proof for Security

Security Primitives Criteria for proving Secrecy Properties Proof Strategy

5 Results and Conclusion

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 15 / 22

slide-17
SLIDE 17

Proof for Security : Criteria for proving Secrecy Properties

Secrecy Criterias:

  • ne-session secrecy

secrecy Lemma If Q ≈x Q′ and Q preserves the one-session secrecy of x then Q′ preserves the one-session secrecy of x. The same result holds for secrecy. We can then apply the following mechanism, to prove that oneprotocol preserves the one-session secrecy of x:

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 16 / 22

slide-18
SLIDE 18

Presentation overview

1 CryptoVerif and Semantic 2 Equivalences 3 Game Transformations 4 Proof for Security

Security Primitives Criteria for proving Secrecy Properties Proof Strategy

5 Results and Conclusion

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 17 / 22

slide-19
SLIDE 19

Proof for Security : Proof Strategy

How do we organize transformations in order to prove protocols: // if we can apply crypto transformations while(Is_transformable() == 1) { apply_crypto_transform() //the game is modified Simplify() if(Is_transformable() == 0) then //we apply, if necessary, syntactic transformations RemoveAssign() SARename() if(IsSecret()) then return "SUCCESS" } return "FAILED"

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 18 / 22

slide-20
SLIDE 20

Presentation overview

1 CryptoVerif and Semantic 2 Equivalences 3 Game Transformations 4 Proof for Security

Security Primitives Criteria for proving Secrecy Properties Proof Strategy

5 Results and Conclusion

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 19 / 22

slide-21
SLIDE 21

Results

Tests of the prover on a number of protocols : configuration in which participants run sessions with the adversary prove secrecy of keys for sessions between participants. But some cases of failure : Needham-Schroeder public-key : limitation for NA Needham-Schroeder shared-key : does not prove the secrecy of the exchanged key (only in the corrected version) Denning-Sacco public-key, Yahalom : the same but for the

  • ne-session secrecy
  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 20 / 22

slide-22
SLIDE 22

Conclusion

Results are conclusive : using CryptoVerif prover to prove protocols in the computational model, without relying on the Dolev-Yao model, is a great

  • progress. Briefly :

limitations in some cryptographic primitives (Diffie-Hellman key agreements) best suited for proving security protocols such as encryption and signatures.

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 21 / 22

slide-23
SLIDE 23

Conclusion

Questions ?

  • P. Cogn´

ee, D. Kolokosso, F. M´ ejean, L. Pillard, J. Tharaud (National School of Applied Mathematics and Computer Science, ENSIMAG) A Computationally Sound Mechanized Prover for Security Protocols 27 November 2009 22 / 22