An Algebra for Symbolic Diffie-Hellman Protocol Analysis

Abstract

Abstract. We study the algebra underlying symbolic protocol analysis for protocols using Diffie-Hellman operations. Diffie-Hellman operations act on a cyclic group of prime order, together with an exponentiation operator. The exponents form a finite field: this rich algebraic structure has resisted previous symbolic approaches. We define an algebra that validates precisely the equations that hold almost always as the order of the cyclic group varies. We realize this algebra as the set of normal forms of a particular rewriting theory. The normal forms allow us to define our crucial notion of indicator, a vector of integers that summarizes how many times each secret exponent appears in a message. We prove that the adversary can never construct a message with a new indicator in our adversary model. Using this invariant, we prove the main security goals achieved by UM, a protocol using Diffie-Hellman for implicit authentication. , appear to be out of reach of known symbolic techniques. Indeed, for these protocols, computational techniques have led to arduous proofs after which controversy remains [27,29,30,33]. In this paper, we develop algebraic ideas that allow us to give rigorous proofs of security goals such as authentication and confidentiality in a symbolic model. Moreover, our techniques also help identify the security goals that the protocol does not achieve.DH protocols work in a cyclic group of prime order q, which we will write multiplicatively, using an agreed-upon generator g. For a particular session, A and B choose random values x, y respectively, raising a base g to these scalar powers:

Formalisation of Bayesian concealment

“…Dougherty and Guttman [4] define a formal theory of fields in order to prove the security of a modification of Diffie-Hellman key exchange protocol against manin-the-middle attack. The result is not a direct theorem of the formal system but a conclusion of a discussion of informal logic with an aid of formal theory.…”

Certified Synthesis of Efficient Batch Verifiers

“…These works focus on a simpler setting; in particular, they do not consider big operators. Dougherty and Guttman [30] consider an equational theory without pairings, but with division (essentially to reason about fields, rather than rings); extending our work to account for division (in the case of prime order groups) is an important avenue for further work.…”