On the security of fair non-repudiation protocols

Abstract

We analyzed two non-repudiation protocols and found some new attacks on the fairness and termination property of these protocols. Our attacks are enabled by several inherent design weaknesses, which also apply to other non-repudiation protocols. To prevent these attacks, we propose generic countermeasures that considerably strengthen the design and implementation of non-repudiation protocols. The application of these countermeasures is finally shown by our construction of a new fair non-repudiation protocol

Automatic Methods for Analyzing Non-repudiation Protocols with an Active Intruder

“…We have chosen this protocol as a case study to demonstrate our analysis approach because of the existence of significant related work [4,10,21,25]. The protocol is presented below in Alice&Bob notation, where fNRO, fNRR, fSUB and fCON are labels used to identify the purpose of messages.…”

“…In order to avoid this kind of problems we need to prove that Bob could only own N RO if Alice has actually sent the correct protocol messages. This may be done as for example in [25], [27] or [10] but this is not trivial. 2.…”

“…A session label typically consists of a hash of all message components. Gürgens et al [10] have shown a number of vulnerabilities associated to the use of session labels and, to our knowledge, the CCD protocol is the only optimistic non-repudiation protocol that avoids altogether the use of session labels. This paper presents a method for automatically verifying non-repudiation protocols in presence of an active intruder.…”

“…The TTP can be used as a delivery agent to provide simultaneous share of evidences. The Fair Zhou-Gollmann protocol [30] is a well known example using a TTP as a delivery agent; a significant amount of work has been done over this protocol and its derivations [4,10,21,25,31]. However, instead of passing the complete message through the TTP and thus creating a possible bottleneck, recent evolution of protocols resulted in efficient, optimistic versions, in which the TTP is only involved in case something goes wrong.…”

Fair Payment Protocols for E-Commerce

“…Ever since then, subsequent efforts in this approach resulted in efficient and fair protocols (Asokan et al [3], S. Kremer and O. Markowitch [14], we call them as AK protocol) that can guarantee that both parties can terminate the protocol timely while assuring fairness (called property of timeliness). Although they were attacked for some designing details (see [12]), their messages & rounds optimality (see [23] for detailed discussions) and basic building blocks (main protocol, resolve and abort sub-protocols) are well analyzed and widely accepted.…”