A survey of symbolic methods for establishing equivalence-based properties in cryptographic protocols

Delaune, Stéphanie; Hirschi, Lucca

doi:10.1016/j.jlamp.2016.10.005

Cited by 21 publications

(15 citation statements)

References 96 publications

(131 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The precision issue of diff-equivalence is well-known (acknowledged e.g. in [37,28,21,35]). So far, the main approach that has been developed to solve this issue consists in modifying the notion of diff-equivalence to get closer to trace equivalence.…”

Section: Introductionmentioning

confidence: 99%

A method for unbounded verification of privacy-type properties

Hirschi

Baelde

Delaune

2019

JCS

Self Cite

View full text Add to dashboard Cite

In this paper, we consider the problem of verifying anonymity and unlinkability in the symbolic model, where protocols are represented as processes in a variant of the applied pi calculus, notably used in the ProVerif tool. Existing tools and techniques do not allow to verify directly these properties, expressed as behavioral equivalences. We propose a different approach: we design two conditions on protocols which are sufficient to ensure anonymity and unlinkability, and which can then be effectively checked automatically using ProVerif. Our two conditions correspond to two broad classes of attacks on unlinkability, i.e. data and control-flow leaks. This theoretical result is general enough that it applies to a wide class of protocols based on a variety of cryptographic primitives. In particular, using our tool, UKano, we provide the first formal security proofs of protocols such as BAC and PACE (e-passport), Hash-Lock (RFID authentication), etc. Our work has also lead to the discovery of new attacks, including one on the LAK protocol (RFID authentication) which was previously claimed to be unlinkable (in a weak sense).

show abstract

Section: Introductionmentioning

confidence: 99%

A method for unbounded verification of privacy-type properties

Hirschi

Baelde

Delaune

2019

JCS

Self Cite

View full text Add to dashboard Cite

show abstract

“…Moving from trace to equivalence properties is far from being straightforward as exemplified by the research effort on equivalence these past 10 years (see e.g. [18] for a survey).…”

Section: Introductionmentioning

confidence: 99%

SAT-Equiv: An Efficient Tool for Equivalence Properties

Cortier

Dallon

Delaune

2017

2017 IEEE 30th Computer Security Foundations Symposium (CSF)

View full text Add to dashboard Cite

To cite this version:Véronique Cortier, Antoine Dallon, Stéphanie Delaune. SAT Abstract-Automatic tools based on symbolic models have been successful in analyzing security protocols. Such tools are particularly adapted for trace properties (e.g. secrecy or authentication), while they often fail to analyse equivalence properties.Equivalence properties can express a variety of security properties, including in particular privacy properties (vote privacy, anonymity, untraceability). Several decision procedures have already been proposed but the resulting tools are rather inefficient.In this paper, we propose a novel algorithm, based on graph planning and SAT-solving, which significantly improves the efficiency of the analysis of equivalence properties. The resulting implementation, SAT-Equiv, can analyze several sessions where most tools have to stop after one or two sessions.

show abstract

“…We may want compilation to preserve this "runs faster than" relation between the two program behaviors against arbitrary target contexts. Similarly, in any source context, the behaviors of P 1 and P 2 may be equal and we may want the compiler to preserve such trace equivalence [17,28,32] in arbitrary target contexts. This last criterion, which we call Robust Trace Equivalence Preservation (RTEP) in Figure 1, is interesting because in various determinate settings [27,42] it coincides with preserving observational equivalence, the security-relevant part of full abstraction (see §5).…”

Section: Robustly Preserving Relational Hyperpropertiesmentioning

confidence: 99%

Journey Beyond Full Abstraction: Exploring Robust Property Preservation for Secure Compilation

Abate

Blanco

Garg

et al. 2019

2019 IEEE 32nd Computer Security Foundations Symposium (CSF)

View full text Add to dashboard Cite

Good programming languages provide helpful abstractions for writing secure code, but the security properties of the source language are generally not preserved when compiling a program and linking it with adversarial code in a low-level target language (e.g., a library or a legacy application). Linked target code that is compromised or malicious may, for instance, read and write the compiled program's data and code, jump to arbitrary memory locations, or smash the stack, blatantly violating any source-level abstraction. By contrast, a fully abstract compilation chain protects source-level abstractions all the way down, ensuring that linked adversarial target code cannot observe more about the compiled program than what some linked source code could about the source program. However, while research in this area has so far focused on preserving observational equivalence, as needed for achieving full abstraction, there is a much larger space of security properties one can choose to preserve against linked adversarial code. And the precise class of security properties one chooses crucially impacts not only the supported security goals and the strength of the attacker model, but also the kind of protections a secure compilation chain has to introduce.We are the first to thoroughly explore a large space of formal secure compilation criteria based on robust property preservation, i.e., the preservation of properties satisfied against arbitrary adversarial contexts. We study robustly preserving various classes of trace properties such as safety, of hyperproperties such as noninterference, and of relational hyperproperties such as trace equivalence. This leads to many new secure compilation criteria, some of which are easier to practically achieve and prove than full abstraction, and some of which provide strictly stronger security guarantees. For each of the studied criteria we propose an equivalent "property-free" characterization that clarifies which proof techniques apply. For relational properties and hyperproperties, which relate the behaviors of multiple programs, our formal definitions of the property classes themselves are novel. We order our criteria by their relative strength and show several collapses and separation results. Finally, we adapt existing proof techniques to show that even the strongest of our secure compilation criteria, the robust preservation of all relational hyperproperties, is achievable for a simple translation from a statically typed to a dynamically typed language.(∀C T . ∀t 1 , .., t k , ..(∀i.C T [P i ] t i ) ⇒ (t 1 , .., t k , ..) ∈ R)

show abstract

A survey of symbolic methods for establishing equivalence-based properties in cryptographic protocols

Cited by 21 publications

References 96 publications

A method for unbounded verification of privacy-type properties

A method for unbounded verification of privacy-type properties

SAT-Equiv: An Efficient Tool for Equivalence Properties

Journey Beyond Full Abstraction: Exploring Robust Property Preservation for Secure Compilation

Contact Info

Product

Resources

About