Automated Analysis and Synthesis of Block-Cipher Modes of Operation

Abstract

Block ciphers such as AES are deterministic, keyed functions that operate on small, fixed-size blocks. Block-cipher modes of operation define a mechanism for probabilistic encryption of arbitrary length messages using any underlying block cipher. A mode of operation can be proven secure (say, against chosen-plaintext attacks) based on the assumption that the underlying block cipher is a pseudorandom function. Such proofs are complex and error-prone, however, and must be done from scratch whenever a new mode of operation is developed. We propose an automated approach for the security analysis of block-cipher modes of operation based on a "local" analysis of the steps carried out by the mode when handling a single message block. We model these steps as a directed, acyclic graph, with nodes corresponding to instructions and edges corresponding to intermediate values. We then introduce a set of labels and constraints on the edges, and prove a meta-theorem showing that any mode for which there exists a labeling of the edges satisfying these constraints is secure (against chosen-plaintext attacks). This allows us to reduce security of a given mode to a constraint-satisfaction problem, which in turn can be handled using an SMT solver. We couple our security-analysis tool with a routine that automatically generates viable modes; together, these allow us to synthesize hundreds of secure modes.

Program Synthesis Using Dual Interpretation

“…We first provide an example from public key cryptography inspired by the work in [2] that consist on synthesizing padding schemes. Our second example is related to symmetric key encryption, and builds upon the work presented in [13].…”

“…Recent effort in the automation of the analysis of block cipher modes include [6,13]. In contrast to [6], which suffers from the limitation that the analyzed mode must operate on a fixed number of blocks, the work in [13] models the operation that is carried out when encrypting a single block, exploiting the common structure of block cipher modes of operation mentioned above.…”

Automation and Modularity of Cryptographic Proofs in the Computational Model

“…Finally, we would like to stress that our work on synthesis of padding based encryption schemes has opened the door for the application of this technique in cryptography and has inspired a stream of work on different domains [11,81,12,96,65], providing evidence that machine-assisted design of cryptographic constructions can be realised by resorting to relatively simple ideas from program synthesis.…”

“…Malozemoff et al [81] apply synthesis to construct block-cipher modes of operation satisfying confidentiality. Barthe et al [12] use a similar approach to synthesize structure preserving signatures building on an extension of the Generic Group Analyzer [11] to interactive assumptions.…”

“…Barthe et al [12] use a similar approach to synthesize structure preserving signatures building on an extension of the Generic Group Analyzer [11] to interactive assumptions. Hoang et al [65] build on [81] and extend it to obtain modes of operation that also satisfy integrity. Ambrona et al [5] build on [12] and develop a new method to automatically prove security statements in the Generic Group Model.…”