A Computationally Complete Symbolic Attacker for Equivalence Properties

Abstract

International audienceWe consider the problem of computational indistinguishability of protocols. We design a symbolic model, amenable to automated deduction, such that a successful inconsistency proof implies computational indistinguishability. Conversely, symbolic models of distinguishability provide clues for likely computational attacks. We follow the idea we introduced earlier for reachability properties, axiomatizing what an attacker cannot violate. This results a computationally complete symbolic attacker, and ensures unconditional computational soundness for the symbolic analysis. We present a small library of computationally sound, modular axioms, and test our technique on an example protocol. Despite additional difficulties stemming from the equivalence properties, the models and the soundness proofs turn out to be simpler than they were for reachability properties

Formal Analysis of Vote Privacy Using Computationally Complete Symbolic Attacker

“…We limit our attention in this paper to their indistinguishability framework given in [8]. The CCSA framework is similar to the DY framework in the sense that explicit symbolic adversarial messages are created.…”

“…Hence the security formula obtained this way must be derived as a logical consequence of the axioms A using first-order inference. If the formula is derived and the axioms in A shown to be computationally sound then the protocol Π is computationally secure according to Theorem 1 in [8].…”

“…As Bana and Comon defined it in [8] σ η,ρ = 0. Function symbols in G representing adversarial computation are interpreted as probabilistic polynomialtime algorithms and they also act on the outputs of the PPT algorithms in their arguments, but they can also use randomness from ρ 2 .…”

“…In particular, we use the computationally complete symbolic attacker technique for indistinguishability properties introduced by Bana and Comon in [8] (a.k.a. CCSA framework).…”

“…CCSA technique was first introduced by Bana and Comon in [9] for reachability properties and then for indistinguishability properties in [8]. Since then it has been used to find new attacks to the Needham-Schroeder-Lowe protocol [10,11]; to treat algebraic operations notoriously difficult to reason about in the DY model, such as exponentiation along with it the decisional Diffie-Hellmann property and versions of the Diffie-Hellman key-exchange protocol [12]; to verify unlinkability of RFID protocols [13]; and to analyze key wrapping API's [14].…”