Cryptographically Sound Security Proofs for Basic and Public-Key Kerberos

Abstract

We present a computational analysis of basic Kerberos with and without its public-key extension PKINIT in which we consider authentication and key secrecy properties. Our proofs rely on the Dolev-Yaostyle model of Backes, Pfitzmann, and Waidner, which allows for mapping results obtained symbolically within this model to cryptographically sound proofs if certain assumptions are met. This work was the first verification at the computational level of such a complex fragment of an industrial protocol. By considering a recently fixed version of PKINIT, we extend symbolic correctness results we previously attained in the DolevYao model to cryptographically sound results in the computational model.

Breaking and Fixing Public-Key Kerberos

“…Although our work is carried out by hand, a variety of automated approaches exist for symbolic proofs [10][11][12][13][14][15][16][17] and have also been applied to deployed protocols (e.g., [18][19][20]). In a recent collaboration with M. Backes, we have started extending our results from the abstract Dolev-Yao model examined here to the more concrete computational model [21]. Interestingly, the results described in more detail here served as a blueprint for the much more fine-grained proofs in [21].…”

“…The main outcome of this effort was that the fixes examined here were proved to be correct at the cryptographic level [21]. The computationally sound proofs in the BPW model were conducted symbolically by hand [21] and there appears to be a strong relation to the symbolic proof technique used in this work. Gaining a better understanding of how these two methods relate will be subject to future work.…”

“…In a recent collaboration with M. Backes, we have started extending our results from the abstract Dolev-Yao model examined here to the more concrete computational model [21]. Interestingly, the results described in more detail here served as a blueprint for the much more fine-grained proofs in [21]. Furthermore, we have started exploring automated security proofs of Kerberos [22] using the tool CryptoVerif [23,24], which works directly within the computational model.…”

On Cryptographically Strong Bindings of SAML Assertions to Transport Layer Security

“…The original Kerberos protocol and related three party schemes have been intensely studied without finding severe security deficiencies (Boldyreva & Kumar, 2007;Backes, Cervesato, Jaggard, Scedrov, & Tsay, 2006). However, their browser-based offspring-federated identity management protocols-turned out to have some vulnerabilities: In addition to the mentioned Microsoft Passport analyses of Kormann and Rubin (2000), Slemko (2001), andGroß (2003) analyzes SAML, an alternative single sign on protocol, and shows that the protocol is vulnerable to adaptive attacks where the adversary intercepts the authentication token contained in the URL.…”