Probabilistic Polynomial-Time Process Calculus and Security Protocol Analysis

Abstract

Abstract. We prove properties of a process calculus that is designed for analysing security protocols. Our long-term goal is to develop a form of protocol analysis, consistent with standard cryptographic assumptions, that provides a language for expressing probabilistic polynomial-time protocol steps, a specification method based on a compositional form of equivalence, and a logical basis for reasoning about equivalence.The process calculus is a variant of CCS, with bounded replication and probabilistic polynomial-time expressions allowed in messages and boolean tests. To avoid inconsistency between security and nondeterminism, messages are scheduled probabilistically instead of nondeterministically. We prove that evaluation of any process expression halts in probabilistic polynomial time and define a form of asymptotic protocol equivalence that allows security properties to be expressed using observational equivalence, a standard relation from programming language theory that involves quantifying over all possible environments that might interact with the protocol.We develop a form of probabilistic bisimulation and use it to establish the soundness of an equational proof system based on observational equivalences. The proof system is illustrated by a formation derivation of the assertion, well-known in cryptography, that El Gamal encryption's semantic security is equivalent to the (computational) Decision Diffie-Hellman assumption. This example demonstrates the power of probabilistic bisimulation and equational reasoning for protocol security.

Declassification: Dimensions and principles

“…This is related to the approaches found in Laud's work [40,41] and Mitchell et al's work on polynomial-time process calculus (see, e.g., [44,52]). …”

“…When: The semantic consistency principle critically depends on the underlying semantics. For complexity-sensitive security definitions [40,41,44,52,75,76], semantic consistency requires complexity-preserving transformations. Otherwise, for example, a program which cannot leak in polynomial time could be sped up by a transformation that compromises security.…”

Computational indistinguishability logic

“…Abadi and Gordon [1] use observational equivalence to formulate secrecy in the spi-calculus, and define a sound equational theory for proving observational equivalence between two processes; Figure 6: Implementation of signing oracle and OH oracle in PSS2 using the equational theory, they establish the security of common protocols. While the spi-calculus relies on a symbolic model of cryptography, Mitchell et al [32] develop a theory of observational equivalence in a process algebra for probabilistic polynomial time computation, and show how to use the equivalence to reason about cryptographic primitives. In particular, they develop a proof system for bisimulation for their process algebra.…”

Handling Encryption in an Analysis for Secure Information Flow

“…Instead of the usual assumption that cryptographic primitives are perfectly secure-they are modeled as functions for which only a very restricted set of formulas holds ( [5,1] are among the most prominent examples), one attempts to take into account that the cryptographic primitives may be implemented by any algorithm satisfying some complex complexity-theoretical definition; dealing with those definitions is an issue that both the analyses for secure information flow and the analyses of cryptographic protocols must handle. Mitchell et al [14,15,16] extended the spi-calculus [1] with (polynomial) bounds on message lengths and execution time, and developed a probabilistic semantics for this extension. This has allowed them to prove the protocols correct with respect to polynomially bounded adversaries, where the cryptographic primitives that the protocols employ are real ones.…”