A Logic and an Interactive Prover for the Computational Post-Quantum Security of Protocols

Abstract

We provide the first mechanized post-quantum sound security protocol proofs. We achieve this by developing PQ-BC, a computational first-order logic that is sound with respect to quantum attackers, and corresponding mechanization support in the form of the PQ-Squirrel prover.Our work builds on the classical BC logic [7] and its mechanization in the Squirrel [5] prover. Our development of PQ-BC requires making the BC logic sound for a single interactive quantum attacker. We implement the PQ-Squirrel prover by modifying Squirrel, relying on the soundness results of PQ-BC and enforcing a set of syntactic conditions; additionally, we provide new tactics for the logic that extend the tool's scope.Using PQ-Squirrel, we perform several case studies, thereby giving the first mechanical proofs of their computational post-quantum security. These include two generic constructions of KEM based key exchange, two sub-protocols from IKEv1 and IKEv2, and a proposed post-quantum variant of Signal's X3DH protocol. Additionally, we use PQ-Squirrel to prove that several classical Squirrel case studies are already post-quantum sound.

The Squirrel Prover and its Logic

“…Our work demonstrates that this approach offers a straightforward, high-level strategy for conducting computer-assisted proofs of cryptographic protocols, offering asymptotic security guarantees within the computational model. This is reinforced by the development of the interactive prover Squirrel and its application across different case studies [Baelde et al 2021;Baelde et al 2022;Cremers et al 2022;Baelde et al 2024], summarized in Figure 4. The number of LoC mentioned includes both the model and the proof script.…”

“…The case studies are divided into two blocks, with non-stateful protocols first and then stateful ones. The Squirrel prover was extended to post-quantum security proofs in [Cremers et al 2022], the corresponding protocols with security guarantees against a quantum attacker are indicated with a ⋆. Ongoing and Future Work.…”

“…The CCSA logic was later extended into a meta-logic, which served as basis for the first version of Squirrel [Baelde et al 2021], before being generalized to a fully-fledged higher-order logic in [Baelde et al 2023]. The Squirrel tool is a proof assistant developed in a collaborative effort, which has been successfully used on a variety of case studies [Baelde et al 2022;Comon et al 2020;Cremers et al 2022]. Instructions for installing the system are available on its website, together with a user manual, tutorials, and an in-browser interface for playing with the tool without installing it: https://squirrel-prover.github.io…”

Methodology of Testing the Security of Cryptographic Protocols Using the CMMTree Framework

“…To verify the security of the protocol, we can also use formal proofs, e.g., BAN logic [21], Real-Or-Random (ROR) [22], Random Oracle Model (ROM) [23], or Syverson-Van Oorschot (SVO) [24]. However, these proofs are very complex, so for verifying protocols, we mostly used the tools that automatically implement the described methods for verifying protocols (Scyther [25,26], Tamarin [27,28], ProVerif [29][30][31], AVISPA [32], or the tool mentioned in [5]).…”

Key Agreement and Authentication Protocols in the Internet of Things: A Survey

“…When verifying security protocols, we can use methods such as time automatics [28,29], BAN logic [30], GNY logic [31], real-or-random (ROR) [32], random Oracle model (ROM) [33], or Syverson-Van Oorschot (SVO) logic [34]. In addition, protocol verification is possible with such tools as Scyther [35,36], Tamarin [37,38], ProVerif [39][40][41], Avispa [42], or the tools mentioned in [22,43], or [44].…”