Efficient construction of machine-checked symbolic protocol security proofs

Abstract

We embed an untyped security protocol model in the interactive theorem prover Isabelle/HOL and derive a theory for constructing proofs of secrecy and authentication properties. Our theory is based on two key ingredients. The first is an inference rule for enumerating the possible origins of messages known to the intruder. The second is a class of protocol-specific invariants that formalize type assertions about variables in protocol specifications. The resulting theory is well suited for interactively constructing human-readable, protocol security proofs. We additionally give an algorithm that automatically generates Isabelle/HOL proof scripts based on this theory. We provide case studies showing that both interactive and automatic proof construction are efficient. The resulting proofs provide strong correctness guarantees since all proofs, including those deriving our theory from the security protocol model, are machinechecked. S. Meier et al. / Efficient construction of machine-checked symbolic protocol security proofsprover Isabelle/HOL [34]. The protocols verified include the TLS handshake [36], Kerberos IV [8] and SET [7]. As reported in [35], the time required for an expert in interactive theorem proving to model and verify a protocol using this approach ranges from several days for small academic protocols to six weeks for a protocol like the TLS handshake [36].An alternative approach to security protocol verification is to use automatic tools such as ProVerif [11] or Scyther [15]. Such tools have two substantial advantages over interactive approaches: they require less user expertise and produce results orders of magnitude faster. However none of these tools produces machine-checked proofs.We combine the benefits of these two approaches to security protocol verification. We develop a tool-supported framework for the efficient construction of machinechecked protocol security proofs using automatic proof generation, where possible, and interactive proof construction, where required.

Provably repairing the ISO/IEC 9798 standard for entity authentication1

“…We use a version [34] of the SCYTHER-PROOF tool [30] to generate proofs of the authentication properties. Given a description of a protocol and its security properties, the tool generates a proof script that is afterwards automatically checked by the Isabelle/HOL theorem prover [33].…”

“…The interpretation mapping a message pattern to its corresponding message in the context of a thread i and the variable store σ is modeled by the family of partial functions inst σ,i : Pat Msg. In the semantics presented in [30,31], these functions were total. However, we now use partial functions because the lookup of a shared symmetric long-term key always fails if one of the variables is not instantiated to an agent name.…”

“…To generate the correctness proofs, we first extend the SCYTHER-PROOF tool [30] to handle bidirectional keys and injective authentication properties. We then use the tool to generate proof scripts that are checked independently by the Isabelle/HOL theorem prover.…”

“…will use the related SCYTHER-PROOF tool [30] to generate machine-checked proofs of the corrected versions. SCYTHER performs an automatic analysis of security protocols in a Dolev-Yao style model, for an unbounded number of instances.…”

Improving the Security of Cryptographic Protocol Standards

“…Over the past decade, we have conducted numerous case studies with model-checking tools for security protocols, some of which we have developed ourselves. [1][2][3][4] Our analysis shows that many standards su er from security weaknesses, including basic mistakes and well-known aws. In some cases, these weaknesses have been quite serious.…”