State Separation for Code-Based Game-Playing Proofs

Brzuska, Chris; Delignat-Lavaud, Antoine; Fournet, Cédric; Kohbrok, Konrad; Kohlweiss, Markulf

doi:10.1007/978-3-030-03332-3_9

Cited by 15 publications

(35 citation statements)

References 43 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This prevents from committing to any particular programming language, while keeping a clean operational semantics. This approach is also advocated in [10], which follows a similar approach. Other works on composition (e.g., [5,7]) rely on specific execution models.…”

Section: Related Workmentioning

confidence: 99%

“…a stronger attacker that has access to the context, is not new. This is the basis of many works, including [8][9][10]18]. The main difference, that we wish to emphasize, is that these works do not support long term shared secrets, used in different components.…”

Section: Related Workmentioning

confidence: 99%

“…The main difference, that we wish to emphasize, is that these works do not support long term shared secrets, used in different components. Notably, the oracles of [10] are only used to decompose protocols with state passing. Our notion of simulatability allows sharing long term secret by granting the attacker access to oracles that depend on the secrets (for instance, signing oracles).…”

Section: Related Workmentioning

confidence: 99%

“…As far as we know, the existing composition results that follow the "top-down" approach cannot be used in situations where there is both a "state passing", as in key exchange protocols, and shared long term secrets. For instance, in the nice framework of [10], the same public key cannot be used by several protocols, a key point for reducing security of multiple sessions to security of one session.…”

mentioning

confidence: 99%

“…This is also a difficulty since the attacker on a protocol component might use the other components: we need a proof with respect to a stronger attacker. In [10], such a strong attacker can be simulated by a standard one, because there is no shared long term secret.…”

mentioning

confidence: 99%

See 4 more Smart Citations

Oracle Simulation: A Technique for Protocol Composition with Long Term Shared Secrets

Comon

Jacomme

Scerri³

2020

Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

We provide a composition framework together with a variety of composition theorems allowing to split the security proof of an unbounded number of sessions of a compound protocol into simpler goals. While many proof techniques could be used to prove the subgoals, our model is particularly well suited to the Computationally Complete Symbolic Attacker (CCSA) model.We address both sequential and parallel composition, with state passing and long term shared secrets between the protocols. We also provide with tools to reduce multi-session security to single session security, with respect to a stronger attacker. As a consequence, our framework allows, for the first time, to perform proofs in the CCSA model for an unbounded number of sessions.To this end, we introduce the notion of O-simulation: a simulation by a machine that has access to an oracle O. Carefully managing the access to long term secrets, we can reduce the security of a composed protocol, for instance P Q, to the security of P (resp. Q), with respect to an attacker simulating Q (resp. P ) using an oracle O. As demonstrated by our case studies the oracle is most of the time quite generic and simple.These results yield simple formal proofs of composed protocols, such as multiple sessions of key exchanges, together with multiple sessions of protocols using the exchanged keys, even when all the parts share long terms secrets (e.g. signing keys). We also provide with a concrete application to the SSH protocol with (a modified) forwarding agent, a complex case of long term shared secrets, which we formally prove secure.

show abstract

Section: Related Workmentioning

confidence: 99%