Armando, Alessandro

Basin, David

Cuellar, Jorge

Rusinowitch, Michaël

Viganò, Luca

RERO DOC Digital Library

Automated Reasoning for SecurityProtocol AnalysisExperience over the past 20 years has shown that, even assuming perfectcryptography, the design of security protocols (or cryptographic protocols, asthey are sometimes called) is highly error-prone and that conventional validationtechniques based on informal arguments or testing are not up to the task. It isnow widely recognized that only formal analysis can provide the level ofassurance required by both the developers and the users of the protocols.Work in this direction initially started in the security community, butrecently there has been a tremendous progress thanks to contributions fromdifferent automated reasoning communities, such as automated deduction,model checking, and artificial intelligence. Moreover, there has been anotherwave of progress in foundations for analyzing protocols and their properties byapplying nonclassical logics, such as epistemic and belief logics. A largenumber of formal methods and tools have thus been developed that have beenquite successful in analyzing many protocols, that is, in proving the correctnessof the protocols or in identifying attacks on them. Thus, this progress canbe seen as one of the recent success stories of the automated reasoningcommunity.In July 2004, the first workshop on Automated Reasoning for SecurityProtocol Analysis (ARSPA ’04) took place as a satellite event of the 2nd In-ternational Joint Conference on Automated Reasoning (IJCAR ’04).This special issue is based on 21 submissions, following an open call forpapers motivated by the success of the workshop. After refereeing, we selectedfive papers for publication. These papers offer a good overview of the currentresearch on automated reasoning techniques and tools for the formal specifica-tion, analysis, and verification of security protocols.The paper Verifying the SET Purchase Protocols, by Bella, Massacci, andPaulson, details the first verification results for the complete purchase protocolsof SET (Secure Electronic Transaction, a suite of protocols proposed by aconsortium of credit card companies and software corporations to secure e-commerce transactions). Using Isabelle and the inductive method, they show thatthe protocols’ primary goal is indeed met. However, a lack of explicitness in thedual signature makes some agreement properties fail: it is impossible to provethat the cardholder meant to send his credit card details to the very paymentgateway that receives them. Although the protocols’ complexity and size makesJournal of Automated Reasoning (2006) 36: 1Y3DOI: 10.1007/s10817-005-9014-x# Springer 2005verification difficult, compared with other protocols, the authors’ effort hasyielded significant insights.In the paper Formal Analysis of MultiParty Contract Signing Chadha,Kremer, and Scedrov analyze the multiparty contract-signing protocols of Garayand MacKenzie (GM) and of Baum and Waidner (BW). They use a finite-statetool, MOCHA, that allows for the specification of protocol properties in abranching-time temporal logic with a game semantics. While their analysis doesnot reveal any errors in the BW protocol, in the GM protocol they discoverserious problems with fairness for four signers and an oversight regarding abuse-freeness for three signers. They thus propose a complete revision of the GMsubprotocols in order to restore fairness.In the paper Decision Procedures for the Security of Protocols withProbabilistic Encryption against Offline Dictionary Attacks, Delaune andJacquemard consider the problem of automatic protocol verification when somedata, such as poorly chosen passwords, can be guessed by dictionary attacks.They propose an inference system that extends a set of DolevYYao intruderdeduction rules with the introduction of a probabilistic encryption operator andguessing abilities for the intruder. They show that the intruder deduction problemin this extended model is decidable in PTIME. This result yields an NP decisionprocedure for the protocol insecurity problem in the presence of apassive intruder, while the same problem is proved to be NP-complete in theactive case.In the paper Decidability Issues for Extended Ping-Pong Protocols, Hu¨tteland Srba use techniques from process algebra to investigate the class of ping-pong protocols introduced by Dolev and Yao. They show that all nontrivialproperties, including reachability and equivalence checking with respect to theentire van Glabbeek’s spectrum, become undecidable for a very simple recursiveextension of the protocol. The result holds even if a nondeterministic choiceoperator is not allowed, but reachability is shown to be decidable in polynomialtime if only two parties are participating in the protocol. They also show that thecalculus is capable of an implicit description of the active intruder, including fullanalysis and synthesis of messages in the sense of Amadio, Lugiez, andVanacke`re. Further, they show that reachability analysis for a replicativeprotocol variant is decidable.The starting point of the paper Attacking Group Protocols by RefutingIncorrect Inductive Conjectures, by Steel and Bundy, is the observation thatautomated tools for finding attacks on flawed security protocols often fail to dealadequately with group protocols. The reason is that the abstractions made toimprove performance on fixed two- or three-party protocols either preclude themodeling of group protocols or permit modeling only in a fixed scenario, whichcan prevent attacks from being discovered. Their paper describes CORAL, a toolfor finding counterexamples to incorrect inductive conjectures, which they haveused to model protocols for both group key agreement and group key2 ALESSANDRO ARMANDO ET AL.management, without any restrictions on the scenario. They used CORAL todiscover six previously unknown attacks on three group protocols.This special issue could not have been possible without the excellent work ofthe additional reviewers, to whom we express special thanks: Pedro Ada˜o (ISTLisbon, Portugal), Massimo Benerecetti (Universita` di Napoli FFederico II_,Italy), Carlos Caleiro (IST Lisbon, Portugal), Luca Compagna (Universita` diGenova, Italy), Giorgio Delzanno (Universita` di Genova, Italy), Pierre Ganty(Universite´ Libre de Bruxelles, Belgium), Paul Hankes Drielsma (ETH Zurich,Switzerland), Pierre-Cyrille He´am (Universite´ de Franche-Comte´, France), FelixKlaedtke (ETH Zurich, Switzerland), Monika Maidl (Siemens AG Mu¨nchen,Germany), Jacopo Mantovani (Universita` di Genova, Italy), Paulo Mateus (ISTLisbon, Portugal), Laurent Mazare´ (VERIMAG, France), Adriano Peron(Universita` di Napoli FFederico II_, Italy), Graham Steel (University ofEdinburgh, Scotland), Sorin Stratulat (Universite´ de Metz, France), TomaszTruderung (LORIA-INRIA-Lorraine, France), Mathieu Turuani (LORIA-INRIA-Lorraine, France), Laurent Vigneron (LORIA-INRIA-Lorraine, France), andDavid von Oheimb (Siemens AG Mu¨nchen, Germany).We further thank all the authors for their work in preparing and revising thepapers, and the JAR editors who made all this possible.The Editors of the Special IssueAlessandro ArmandoUniversita di Genova, ItalyDavid BasinETH Zurich, SwitzerlandJorge CuellarSiemens AG Mu¨nchen, GermanyMichae¨l RusinowitchLORIA-INRIA-Lorraine, FranceLuca Vigano`ETH Zurich, SwitzerlandAUTOMATED REASONING FOR SECURITY PROTOCOL ANALYSIS 3

Automated Reasoning for Security Protocol Analysis

http://doc.rero.ch/record/311598/files/10817_2005_Article_9014.pdf

Automated Reasoning for Security Protocol Analysis

Abstract

Similar works

Full text

Available Versions

RERO DOC Digital Library