A Unification Algorithm for Analysis of Protocols with Blinded Signatures

Abstract

Abstract. Analysis of authentication cryptographic protocols, particularly finding flaws in them and determining a sequence of actions that an intruder can take to gain access to the information which a given protocol purports not to reveal, has recently received considerable attention. One effective way of detecting flaws is to hypothesize an insecure state and determine whether it is possible to get to that state by a legal sequence of actions permitted by the protocol from some legal initial state which captures the knowledge of the principals and the assumptions made about an intruder's behavior. Relations among encryption and decryption functions as well as properties of number theoretic functions used in encryption and decryption can be specified as rewrite rules. This, for example, is the approach used by the NRL Protocol Analyzer, which uses narrowing to reason about such properties of cryptographic and number-theoretic functions. Following [14], a related approach is proposed here in which equation solving modulo most of these properties of cryptographic and numbertheoretic functions is done by developing new unification algorithms for such theories. A new unification algorithm for an equational theory needed to reason about protocols that use the Diffie-Hellman algorithm is developed. In this theory, multiplication forms an Abelian group; exponentiation function distributes over multiplication, and exponents can commute. This theory is useful for analyzing protocols which use blinded signatures. It is proved that the unification problem over this equational theory can be reduced to the unification problem modulo the theory of Abelian groups with commuting homomorphisms with an additional constraint. Baader's unification algorithm for the theory of Abelian groups with commuting homomorphisms, which reduces the unification problem to solving equations over the polynomial ring over the integers with the commuting homomorphisms serving as indeterminates, is generalized to give a unification algorithm over the theory of Abelian groups with commuting homomorphism with a linear constraint. It is also shown that the unification problem over a (simple) extension of the equational theory considered here (which is also an extension of the equational theory considered in [14]) is undecidable.

Protocol analysis in Maude-NPA using unification modulo homomorphic encryption

“…We could either determine if we could restrict ourselves to decidable subcases via judicious use of sorts, or we could incorporate existing unification algorithms applicable to encryption homomorphic over Abelian groups, e.g. the algorithm of Kapur et al [28] into Maude-NPA. We are investigating these options.…”

Symbolic protocol analysis with an Abelian group operator or Diffie–Hellman exponentiation

“…It would be interesting to know whether the results of this paper, especially the existence of conservative solutions, can be extended to algebraic theories other than Abelian groups, or to richer equational theories that more accurately represent properties of the relevant cryptographic functions. At the same time, recent undecidability results for equational unification [KNW02,KNW03] suggest that the symbolic constraint solving problem is undecidable in the presence of rich equational theories. Therefore, it is very likely that symbolic analysis can be fully automated only for abstract protocol models, or for protocols that employ cryptographic primitives without visible mathematical properties.…”

“…Recent research by Narendran et al focuses on decidability of unification modulo the equational theory of multiplication and exponentiation [MN02,KNW02,KNW03]. While equational unification is an important subproblem in symbolic protocol analysis, unification alone is insufficient to decide whether a particular symbolic attack trace is feasible.…”

“…In particular, exponentials are not multiplied with each other, i.e., terms such as Ü ½ ¡ Ý ¾ do not appear in the protocol specification, nor is the attacker permitted to multiply exponentials. This restriction is necessary to preserve decidability, since it has been shown that unification (and, therefore, the symbolic analysis problem) is undecidable in the presence of equational theories for both Abelian groups and exponentiation [KNW02,KNW03]. This does not affect our ability to analyze protocols such as GDH since they satisfy the restriction (a similar restriction is adopted by [PQ01]).…”

Unification modulo a partial theory of exponentiation

“…The second is extending the axiom set to include additional algebraic operators such as modular addition. Several other papers, including [8,6,5,7], have also considered the unification problem for equational systems that contain some type of exponentiation. For convenience, we give a condensed overview of a selection of these results in Table 1.…”