A Hybrid Analysis for Security Protocols with State

Abstract

Cryptographic protocols rely on message-passing to coordinate activity among principals. Many richly developed tools, based on wellunderstood foundations, are available for the design and analysis of pure message-passing protocols. However, in many protocols, a principal uses non-local, mutable state to coordinate its local sessions. Cross-session state poses difficulties for protocol analysis tools.We provide a framework for modeling stateful protocols, and a hybrid analysis method. We leverage theorem-proving-specifically, PVS-for reasoning about computations over state. An "enrich-byneed" approach-embodied by CPSA-focuses on the message-passing part. The Envelope Protocol, due to Mark Ryan furnishes a case study.Protocol analysis is largely about message-passing in a model in which every message transmitted is made available to the adversary. The adversary can deliver the messages transmitted by the regular (i.e. compliant) principals, if desired, or not. The adversary can also retain them indefinitely, so that in the future he can deliver them, or messages built from them, repeatedly.However, some protocols also interact with long-term state.

Bundling Evidence for Layered Attestation

“…Attestation Protocols. Finally, works such as [2,6,4,13] study the properties of attestation protocols, typically protocols that use a TPM to report on integrity evidence provided by measurement agents. They tend to focus on the cryptographic protections required to secure the evidence as it is sent over a network.…”

Beyond Subterm-Convergent Equational Theories in Automated Verification of Stateful Protocols

“…Using our new version of the TAMARIN prover we have been able to also check vote privacy (modeled as an equivalence property) and furthermore eligibility (modeled as a trace property). -We also verified the Okamoto e-voting protocol [26] which relies on trapdoor commitments to achieve receipt-freeness. Voter anonymity of this protocol was previously analyzed using the AKISS tool, but we provide the first automated proof of receipt-freeness for this protocol, which was previously only shown manually [16] 1 .…”

“…The need for additional normal-form conditions will become apparent with the following example using the equational theory for trapdoor commitments, needed for instance in Okamoto's voting protocol [26]. Trapdoor commitments are commitments that can be opened to return a different value than the one initially committed, using a special trapdoor.…”

“…The Okamoto protocol [26] is similar to the FOO protocol, but it uses trapdoor commitments and it involves a timeliness member (i.e., a trusted third party) to achieve Receipt-Freeness. Receipt-Freeness means that a voter cannot construct a receipt proving to somebody else that he voted for a certain candidate, in order to prevent votebuying.…”

“…The most usual primitives are encryption and signatures, either symmetric or asymmetric, and cryptographic hash functions. Some security goals may however require more advanced primitives: digital cash may rely on blind signatures to ensure anonymity [21], e-voting protocols may use trapdoor commitments [26] or plaintext equivalence tests [23] to achieve receiptfreeness, and verifiability may rely on zero-knowledge proofs [23,1].…”