Symbolic and Computational Mechanized Verification of the ARINC823 Avionic Protocols

Abstract

Abstract-We present the first formal analysis of two avionic protocols that aim to secure air-ground communications, the ARINC823 public-key and shared-key protocols. We verify these protocols both in the symbolic model of cryptography, using ProVerif, and in the computational model, using CryptoVerif. While we confirm many security properties of these protocols, we also find several weaknesses, attacks, and imprecisions in the standard. We propose fixes for these problems. This case study required the specification of new cryptographic primitives in CryptoVerif. It also illustrates the complementarity between symbolic and computational verification. I. INTRODUCTIONSecuring electronic communications between aircrafts and ground entities (control towers, airlines) becomes more and more important. Indeed, such electronic communications convey more and more important information and aircrafts are prominent targets for attacks, such as terrorist attacks. So, even if most air-ground communications are currently sent in the clear, the adoption of secured communications seems unavoidable.Several [34]) in order to secure these communications. In this paper, we study the ARINC823 standard [2]. This standard aims to secure ACARS (Aircraft Communications Addressing and Reporting System) messages. These messages are short text messages, which include air traffic control messages, such as clearance messages, flight plans, weather information, as well as maintenance messages, so that needed maintenance operations can be planed at the next airport.In addition to security (authentication and secrecy of the messages), other goals are apparent in the design of the standard:• Bandwidth: the available bandwidth is limited and the ACARS messages are relatively short, so the protocol is designed to minimize the additional bandwidth required for security.• Resistance to failures: the messages are conveyed even in case of failure of the security system. • Flexibility: the protocol is designed to provide different levels of security: authentication and secrecy, authentication only, and no security, on a message-per-message basis. These additional goals justify the design of specific protocols. The ARINC823 standard provides two such protocols:

A Little More Conversation, a Little Less Action, a Lot More Satisfaction: Global States in ProVerif

“…The only protocol that we fail to address is the avionic protocol [11] as it requires to prove an injective property. We plan to explore how to (soundly) improve the treatment of disequalities for injective queries in ProVerif, as we did for non injective queries.…”

“…Several protocols include counters (e.g. Yubikey [34], avionic protocols [11]) and their security rely on the fact that a counter cannot take twice the same value. In voting protocols, the voting server typically maintains a table that contains the list of voters that have voted so far, which can be crucial when revotes are forbidden [21].…”

“…To our knowledge, we provide the first automatic proof in ProVerif of protocols with a true representation of counters. In previous approaches, counters were abstracted by fresh nonces or by arbitrary values controlled by the attacker (avionic protocol [11]).…”

BeleniosVS: Secrecy and Verifiability Against a Corrupted Voting Device

“…ProVerif is a state-of-the art automatic prover for security protocols. It has already been used to analyse hundreds of protocols of the literature, including TLS [24], voting protocols [25], and avionic protocols [26]. We chose an automatic tool to conduct our security analysis in order to analyse multiple corruption scenarios.…”

Symbolic Verification of Distance Bounding Protocols

“…Since its beginning in 80s, a lot of progress has been done in this area, and it is now a common good practice to formally analyse protocols using symbolic techniques in order to spot flaws possibly before their deployment, as it was recently done e.g. in TLS 1.3 [7,17], or for an avionic protocol [9].…”