Verification of cryptographic protocols: An experiment

Abstract

The objective of this paper is to present the verification of some confidentiality features of the SESAME protocol, an extension of Kerberos. We do that by using the formal approach presented in [7]. This approach is based on the use of state-based general purpose formal methods. It makes a clear separation between modeling of reliable agents and that of intruders. After we have extended this approach to take into account the use of signatures, we use it to formalize SESAME which includes many functionalities among them access control, delegation and multi-level security facilities. The approach is then transposed together with the protocol description quite directly into the Coq prover's formalism. For the sake of conciseness we only describe here formal proofs of confidentiality properties. We prove more precisely the privacy of the session keys in addition to that of the secret keys the principals share with servers. The main advantage of the approach is to provide within a completely formal framework, a systematic verification of a protocol based on its exact and precise specification and not an approximation or simplification of it. The approach is thus complementary with modal logic based methods which allow for a concise, elegant, but superficial verification of protocols: in such logics confidentiality properties, which we prove here to be preserved provided they are true initially, are considered to be hypotheses that are not verified or justified by any formal means.