How to prevent type-flaw and multi-protocol attacks on cryptographic protocols under Exclusive-OR

Abstract

Type-flaw attacks and multi-protocol attacks are notorious threats to cryptographic protocol security. They are arguably the most commonly reported attacks on protocols. For nearly fifteen years, researchers have continuously emphasized the importance of preventing these attacks.In their classical works, Heather et al. and Guttman et al. proved that these could be prevented by tagging encrypted messages with distinct constants, in a standard protocol model with a free message algebra [23,21].However, most "real-world" protocols such as SSL 3.0 are designed with the Exclusive-OR (XOR) operator that possesses algebraic properties, breaking the free algebra assumption. These algebraic properties induce equational theories that need to be considered when analyzing protocols that use the operator. This is the problem we consider in this paper: We prove that, under certain assumptions, tagging encrypted components still prevents type-flaw and multi-protocol attacks even in the presence of the XOR operator and its algebraic properties.