A Formal Semantics for Protocol Narrations

Abstract

Protocol narrations are a widely-used informal means to describe, in an idealistic manner, the functioning of cryptographic protocols as a single intended sequence of cryptographic message exchanges among the protocol's participants. Protocol narrations have also been informally "turned into" a number of formal protocol descriptions, e.g., using the spi-calculus. In this paper, we propose a direct formal operational semantics for protocol narrations that fixes a particular and, as we argue, well-motivated interpretation on how the involved protocol participants are supposed to execute. Based on this semantics, we explain and formally justify a natural and precise translation of narrations into spi-calculus. An optimised translation has been implemented in OCaml, and we report on case studies that we have carried out using the tool.

Efficient Java Code Generation of Security Protocols Specified in AnB/AnBx

“…Each AnB action on a plain channel A → B : M is simply translated to an equivalent action A → B : τ (M ). In contrast to the original work [14], we found more convenient, for efficiency reasons we are going to detail later, to distinguish between symmetric and asymmetric encryption. Moreover, we introduced the support of operators like hmac, kap, kas and user defined functions.…”

“…The core of this phase ( §3) is the automatic generation of the consistency checks derived from the static information of protocol narrations. The underlying theory is a formal operational semantics for protocol narrations, proposed by Briais and Nestmann [14].Since the language features considered in [14] are insufficient to model many real protocols (and even less expressive than those available in AnB ) we extended the executable narration semantics to support MACs, key agreements (i.e Diffie-Hellmann), tuples and user-defined functions. In this way it is possible to model a wider and more realistic range of applications.…”

“…The checks are expressed by means of consistency formulas, and given the high number of generated formulas, the tool applies some simplification strategies which offer good results in practice. In the original proposal [14] some simplification was already implemented but this turned out to be insufficient to deal with some large protocols. We changed the rule of analysis and synthesis applied to messages and expressions in order to improve the computation of checks and prune the checks that were inconsistent with the behavior of the cryptographic functions used in the implementation.…”

“…For instance, this is useful to simulate that an agent A and a server S initially share a secret key kAS: Table 1. Syntax of the executable narrations (Extensions with respect to [14] are marked with *. However, when computing checks, as in [14], pairs are used instead of tuples for performance reasons.…”

“…Such checks cannot be easily derived by hand, given that in theory in 3KP there are more than 10,000 possible different equality checks, as computed by the algorithm described in [14], that can be done by the acquirer. The good news is that they can be reduced to just a couple of dozen with an appropriate modelling of the cryptographic primitives, reordering and variable substitutions, with the added benefit of improving the efficiency of the application.…”