Formal analysis of some secure procedures for certificate delivery

Abstract

Abstract. The paper describes and formally analyzes two communication protocols to manage the secure emission of digital certificates. The formal analysis is carried out by means of a software tool for the automatic verification of cryptographic protocols with finite behaviour. The tool is able to discover, at a conceptual level, attacks against security procedures. The methodology is general enough to be applied to several kinds of cryptographic procedures and protocols. It is opinion of the authors that this survey contributes towards a better understanding of the structure and aims of a protocol, both for developers, analyzers and final users.

Towards Security Analyses of an Identity Federation Protocol for Web Services in Convergent Networks

“…Research in this active branch of computer security has led to a variety of formal techniques; some of these are based on process algebras [8]- [11]; others on proof techniques for authentication logic [12]- [14]; some exploit type systems and other static analyses [15], [16]; yet others use automata [17]. A common analysis strategy is to test the behaviour of one's protocol specification within a hostile environment, by running it in a setting in which the presence of honest participants is complemented with a malicious adversary.…”

“…To do so we use Crypto-CCS, a CCS-like process algebra with cryptographic primitives [2], [18], [19], in combination with the Partial Model Checking Security Analyzer PaMoChSA [3], [11], [20] developed by the Security group of IIT-CNR.…”