Security Analysis Of Protocol Research Articles

Preface of Special Issue on “Computer Security: Foundations and Automated Reasoning”

The papers in this volume form a special issue on “Computer Security: Foundations and Automated Reasoning”. This special issue is part of a series of special issues, traditionally associated with the ARSPA workshop on Automated Reasoning for Security Protocol Analysis. The 2008 ARSPA workshop was organized in conjunction with WITS, the Workshop on Issues in the Theory of Security, and with FCS, the workshop on Foundations of Computer Security. ARSPA was set up to bring together researchers and practitioners working on developing and applying automated reasoning techniques and tools for the formal specification and analysis of security protocols. WITS is the official annual workshop organized by the IFIP Working Group 1.7 on “Theoretical Foundations of Security Analysis and Design”, established to promote the investigation of the theoretical foundations of security, discovering and promoting new areas of application of theoretical techniques in computer security and supporting the systematic use of formal techniques in the development of security related applications. Finally, the workshop FCS continues a tradition, initiated with the Workshops on Formal Methods and Security Protocols (FMSP) in 1998 and 1999, continued with the Workshop on Formal Methods and Computer Security (FMCS) in 2000, and finally with the LICS

Constraint differentiation: Search-space reduction for the constraint-based analysis of security protocols

We introduce constraint differentiation, a powerful technique for reducing search when model-checking security protocols using constraint-based methods. Constraint differentiation works by eliminating certain kinds of redundancies that arise in the search space when using constraints to represent and manipulate the messages that may be sent by an active intruder. We define constraint differentiation in a general way, independent of the technical and conceptual details of the underlying constraint-based method and protocol model. Formally, we prove that constraint differentiation terminates and is correct, under the assumption that the original constraint-based approach has these properties. Practically, as a concrete case study, we have integrated this technique into OFMC, a state-of-the-art model-checker for security protocol analysis, and demonstrated its effectiveness by extensive experimentation. Our results show that constraint differentiation substantially reduces search and considerably improves the performance of OFMC, enabling its application to a wider class of problems.

Universally Composable Symbolic Security Analysis

In light of the growing complexity of cryptographic protocols and applications, it becomes highly desirable to mechanize—and eventually automate—the security analysis of protocols. A natural step towards automation is to allow for symbolic security analysis. However, the complexity of mechanized symbolic analysis is typically exponential in the space and time complexities of the analyzed system. Thus, full automation via direct analysis of the entire given system has so far been impractical even for systems of modest complexity. We propose an alternative route to fully automated and efficient security analysis of systems with no a priori bound on the complexity. We concentrate on systems that have an unbounded number of components, where each component is of small size. The idea is to perform symbolic analysis that guarantees composable security. This allows applying the automated analysis only to individual components, while still guaranteeing security of the overall system. We exemplify the approach in the case of authentication and key-exchange protocols of a specific format. Specifically, we formulate and mechanically assert symbolic properties that correspond to concrete security properties formulated within the Universally Composable security framework. As an additional contribution, we demonstrate that the traditional symbolic secrecy criterion for key exchange provides an inadequate security guarantee (regardless of the complexity of verification) and propose a new symbolic criterion that guarantees composable concrete security.

Efficient decision procedures for message deducibility and static equivalence

We consider two standard notions in formal security protocol analysis: message deducibility and static equivalence under equational theories. We present new polynomial-time algorithms for deciding both notions under subterm convergent equational theories and under a theory representing symmetric encryption with the prex property. For these equational theories, polynomial-time algorithms for the decision problems associated to both notions are well-known (although this has not been proven for static equivalence under the prex theory). However, our algorithms have a signicantly better asymptotic complexity than existing approaches. As an application, we use our algorithm for static equivalence to discover off-line guessing attacks on the Kerberos protocol when implemented using a symmetric encryption scheme for which the prex property holds.

The principle of guarantee availability for security protocol analysis

Conformity to prudent design principles is an established approach to protocol correctness although it is not free of limitations. We term goal availability a design principle that is often implicitly followed, prescribing protocols to aim at principal-centric goals. Adherence to a design principle is normally established through protocol analysis that is an evaluation of whether a protocol achieves its goals. However, the literature shows that there exists no clear guidance on how to conduct and interpret such an analysis, a process that is only left to the analyzer’s skill and experience. Goal availability has the desirable feature that its supporting protocol analysis can be precisely guided by what becomes a principle of realistic analysis, which we call guarantee availability. It prescribes that the outcome of the analysis, which is the set of guarantees confirming the protocol goals, be practically applicable by the protocol participants. In consequence, the guarantees must be based on assumptions that the principals have the capacity to verify. Our focus then turns entirely to protocol analysis, because an analysis conforming to guarantee availability signifies that the analyzed protocol conforms to goal availability. Existing analysis of (both classical and deployed) protocols has been reconsidered with the aim of studying their conformity to guarantee availability. Some experiments clarify the relationships between goal availability and the existing design principles, with particular reference to explicitness. Other experiments demonstrate that boosting an analysis with guarantee availability generally makes it deeper, unveiling additional protocol niceties that depending on the analyzer’s skills may remain overseen otherwise. In particular, an established claim about a protocol (made using a well-known formal method) can be subverted.

Modeling and Reasoning about an Attacker with Cryptanalytical Capabilities

We propose a probabilistic framework for the analysis of security protocols. The proposed framework allows one to model and reason about attackers that extend the usual Dolev-Yao adversary with explicit probabilistic statements representing properties of cryptographic primitives and the attacker's (partial) information about secret messages. The expressive power of these probabilistic statements is illustrated, namely by representing a standard security notion like indistinguishability under chosen plaintext attacks. We present an entropy-based approach to estimate the probability of a successful attack on a protocol given the prescribed knowledge of the attacker. We prove that, for an attacker whose knowledge increases with the security parameter, computing this quantity is NP-hard in the security parameter. However, we are still able to analyze a few meaningful and illustrative examples. Finally, we obtain a result which may be used to prove that a certain amount of probabilistic knowledge (about the properties of the cryptography being used) is not enough for allowing an attacker to correctly uncover a secret with non-negligible probability.

Security of RFID Protocols – A Case Study

In the context of Dolev-Yao style analysis of security protocols, we investigate the security claims of a recently proposed RFID authentication protocol. We exhibit a flaw which has gone unnoticed in RFID protocol literature and present the resulting attacks on authentication, untraceability, and desynchronization resistance. We analyze and discuss the authors' proofs of security. References to other vulnerable protocols are given.

Adding Branching to the Strand Space Model

The strand space model is one of the most successful and widely used formalisms for analysing security protocols. This might seem surprising given that the model is not able to reflect choice points in a protocol execution: the key concept in the strand space model is that of a bundle, which models exactly one possible execution of a security protocol. Inspired by the branching processes of Petri nets, we show that branching can be introduced into the strand space model in a very natural way: bundles can be generalized to branching bundles, which are able to capture several conflicting protocol executions. Our investigations of the theory of branching bundles will motivate the concept of symbolic branching bundles, and culminate in the result that every protocol has a strand space semantics in terms of a largest symbolic branching bundle. We hope our results provide a strong theoretical basis for comparing models and providing process calculi semantics in security protocol analysis. Altogether our work is related but different to a series of works by Crazzolara and Winskel. Throughout we will profit from a close relationship of the strand space model to event structures, which has already been pointed out by these authors.

Rewriting Techniques in the Constraint Solver

The constraint solver is a symbolic cryptographic protocol security analysis tool that is based on a unique term rewriting approach. Several of the design characteristics of this tool, and the reasons for them, are discussed and placed in perspective with other approaches. The constraint solver uses a free message algebra and a bounded-process network model with a Dolev-Yao attacker. These choices yield simplicity and decidability.

TPMC: A Model Checker For Time–Sensitive Security Protocols

In this paper we consider the problem of verifying time–sensitive security protocols, where temporal aspects explicitly appear in the description. In previous work, we proposed Timed HLPSL, an extension of the specification language HLPSL (originally developed in the Avispa Project), where quantitative temporal aspects of security protocols can be specified. In this work, a model checking tool, TPMC, for the analysis of security protocols is presented, which employs THLPSL as a specification language and UPPAAL as the model checking engine. To illustrate the tool, we provide a specification of the Wide Mouthed Frog protocol in THLPSL, and report some experimental results on a number of timed and untimed security protocols.

Evaluating the Vulnerability of Network Traffic Using Joint Security and Routing Analysis

Joint analysis of security and routing protocols in wireless networks reveals vulnerabilities of secure network traffic that remain undetected when security and routing protocols are analyzed independently. We formulate a class of continuous metrics to evaluate the vulnerability of network traffic as a function of security and routing protocols used in wireless networks. We develop two complementary vulnerability definitions using set theoretic and circuit theoretic interpretations of the security of network traffic, allowing a network analyst or an adversary to determine weaknesses in the secure network. We formalize node capture attacks using the vulnerability metric as a nonlinear integer programming minimization problem and propose the GNAVE algorithm, a Greedy Node capture Approximation using Vulnerability Evaluation. We discuss the availability of security parameters to the adversary and show that unknown parameters can be estimated using probabilistic analysis. We demonstrate vulnerability evaluation using the proposed metrics and node capture attacks using the GNAVE algorithm through detailed examples and simulation.

Formal analysis of IEEE 802.11i

As one of the most representative theorem proving techniques used to analyze security protocols,the strand spaces theory has been successfully applied to prove a plenty of typical protocols.Based on the related document,we improved the Strand Space Model(SSM) of IEEE 802.11i protocols,and verified the security and authentication property.The result of the analysis proves the correctness of the IEEE 802.11i protocols in the present penetrator model.

Model checking wireless sensor network security protocols: TinySec + LEAP + TinyPK

In this paper, a formal analysis of security protocols in the field of wireless sensor networks is presented. Three complementary protocols, TinySec, LEAP and TinyPK, are modelled using the high-level formal language HLPSL, and verified using the model checking tool AVISPA, where two main security properties are checked: authenticity and confidentiality of messages. As a result of this analysis, two attacks have been found: a man-in-the-middle-attack and a type flaw attack. In both cases confidentiality is compromised and an intruder may obtain confidential data from a node in the network. Two solutions to these attacks are proposed in the paper.

On BAN logic and hash functions or: how an unjustified inference rule causes problems

BAN logic, an epistemic logic for analyzing security protocols, contains an unjustifiable inference rule. The inference rule assumes that possession of H(X) (i.e., the cryptographic hash value of X) counts as a proof of possession of X, which is not the case. As a result, BAN logic exhibits a problematic property, which is similar to unsoundness, but not strictly equivalent to it. We will call this property ‘unsoundness’ (with quotes). The property is demonstrated using a specially crafted protocol, the two parrots protocol. The ‘unsoundness’ is proven using the partial semantics which is given for BAN logic. Because of the questionable character of the semantics of BAN logic, we also provide an alternative proof of ‘unsoundness’ which we consider more important.

Rule-based dependency models for security protocol analysis

Security protocol analysis has been discussed for quite some time in the past few years. Although formal methods have been widely used to identify various vulnerabilities, mainly susceptibility to freshness attacks and impersonation, the arisen incon

Animation of Natural Language Specifications of Authentication Protocols

Problem Statement: A few visualization tools have been created for protocol design and analysis. Although these tools provide an environment for designing security protocols, each one has its own protocol definition language (its also called informal specification language). The problem is that the user should understand the language which related to the used tool in order to define an exist protocol or design a new one. For specification, a language needs to be intuitive as well as easily usable and understandable by the security protocol engineer. It must be able to precisely and unambiguously specify the behavior of security protocol. Approach: In this study, we propose an approach for protocol specification based on the Natural language definitions of protocol semantics. By using programmatic semantics together with animations, representational flexibility of different protocol demonstration is retained for as long as it is needed. Result: This study provides an environment that can be used by protocols designers to develop and investigate different scenarios of security protocols especially authentication protocols. Natural Language Protocol Specifications (NLPS) approach is used to define the protocol. The environment accepts the natural language text of protocol specifications and converts it to animations of protocol behavior. Conclusions/Recommendations: NLPS environment can really help protocol designer to consider and investigate the behavior of security protocols. It can also be used for teaching-learning security protocol concepts. In further, we will consider the possibility of analyzing security protocols using our NLPS environment and animation techniques in order to improve the correctness; that is determining whether or not the intended security properties of a protocol do hold.

Adaptive Threat Modeling for Secure Ad Hoc Routing Protocols

Secure routing protocols for mobile ad hoc networks provide the required functionality for proper network operation. If the underlying routing protocol cannot be trusted to follow the protocol operations, additional trust layers, such as authentication, cannot be obtained. Threat models drive analysis capabilities, affecting how we evaluate trust. Current attacker threat models limit the results obtained during protocol security analysis over ad hoc routing protocols. Developing a proper threat model to evaluate security properties in mobile ad hoc routing protocols presents a significant challenge. If the attacker strength is too weak, we miss vital security flaws. If the attacker strength is too strong, we cannot identify the minimum required attacker capabilities needed to break the routing protocol. In this paper we present an adaptive threat model to evaluate route discovery attacks against ad hoc routing protocols. Our approach enables us to evaluate trust in the ad hoc routing process and allows us to identify minimum requirements an attacker needs to break a given routing protocol.

Chosen-name Attacks: An Overlooked Class of Type-flaw Attacks

In the context of Dolev-Yao style analysis of security protocols, we consider the capability of an intruder to dynamically choose and assign names to agents. This capability has been overlooked in all significant protocol verification frameworks based on formal methods. We identify and classify new type-flaw attacks arising from this capability.Several examples of protocols that are vulnerable to this type of attack are given, including Lowe's modification of KSL. The consequences for automatic verification tools are discussed.

An Open Approach for the Applied Pi Calculus

A notion of open bisimulation is proposed for the Applied Pi Calculus, which extends π-calculus in order to facilitate analyzing security protocols. Our notion is based on the labeled transition system, and takes a knowledge aware open approach to model knowledge in security protocols. It is shown to be sound to labeled bisimilarity and is a congruent relation. As a running example, we analyze two e-commerce protocol, namely iKP and Ferguson’s electronic cash protocol, by Applied Pi and open bisimilarity.

The layered games framework for specifications and analysis of security protocols

We establish rigorous foundations to the use of modular and layered design for building complex distributed systems, resilient to failures and attacks. Layering is a key to the design of the internet and other distributed systems. Hence, solid, theoretical foundations are essential, especially when considering adversarial settings. A protocol realises a layer (over some lower layer) if it 'wins' with high probability, a specified game, when running over any implementation of the lower layer. This is in contrast to existing frameworks allowing modular design of cryptographic protocols, where protocols must emulate an ideal functionality. Ideal functionalities are a very elegant method for specifications, but we argue that often, game-based specifications are more appropriate, to avoid over-specification ('forcing' a particular design) and under specification (e.g. protocols that work poorly for realistic adversaries). Our results allow specification and analysis of each layer independently, then combining the results to ensure properties of the complete system.