Efficiently Deciding Equivalence for Standard Primitives and Phases

Abstract

Privacy properties like anonymity or untraceability are now well identified, desirable goals of many security protocols. Such properties are typically stated as equivalence properties. However, automatically checking equivalence of protocols often yields efficiency issues. We propose an efficient algorithm, based on graph planning and SATsolving. It can decide equivalence for a bounded number of sessions, for protocols with standard cryptographic primitives and phases (often necessary to specify privacy properties), provided protocols are well-typed, that is encrypted messages cannot be confused. The resulting implementation, SAT-Equiv, demonstrates a significant speed-up w.r.t. other existing tools that decide equivalence, covering typically more than 100 sessions. Combined with a previous result, SAT-Equiv can now be used to prove security, for some protocols, for an unbounded number of sessions.

A Decidable Class of Security Protocols for Both Reachability and Equivalence Properties

“…For this, we have to characterise the form of the test involved in such a witness. We use for that the alternative definition of static inclusion already introduced in [18].…”

“…Let φ, ψ be such that dom(φ) = dom(ψ). We write φ simple s ψ if: As established in [18] for a slightly different set of primitives, this notion of static inclusion is equivalent to the original one.…”

Fine-Grained Trackability in Protocol Executions

“…Since our threat model is arguably strong 16 (i.e., gNBs have to leak decrypted traffic), our findings do not say that C-RNTIs and 5G-S-TMSIs are necessarily/always not useful in masking long-term identifiers such as the IMSIs.…”

“…We define a framework called TrackDev that encompasses several distinct trackability notions. There are privacy notions close to ours, such as (non)-traceability [31], [44] or (un)linkability [19], whereby the latter was studied particularly as part of formal verification in, e.g., [10], [15], [16], [19], [5], [33]. But, as per Pfitzmann's report [39], there are many subtle differences amongst notions related to this.…”

The Hitchhiker’s Guide to Decidability and Complexity of Equivalence Properties in Security Protocols

“…Processes P 0 and P 1 are then trace equivalent when for all traces P i tr = ⇒ (P, Φ), i ∈ {0, 1}, there exists P 1−i tr = ⇒ (P , Φ ) such that the frames Φ and Φ are statically equivalent. Automated verification of trace equivalence has been studied intensively for security protocols [7,20,21,22] and received strong tool support [17,18,23,32,33]. We refer to this problem as TRACEEQ:…”