Symbolic protocol analysis for monoidal equational theories

Abstract

We consider the design of automated procedures for analyzing the (in)security of cryptographic protocols in the Dolev-Yao model for a bounded number of sessions when we take into account some algebraic properties satisfied by the operators involved in the protocol. This leads to a more realistic model than what we get under the perfect cryptography assumption, but it implies that protocol analysis deals with terms modulo some equational theory instead of terms in a free algebra. The main goal of this paper is to set up a general approach that works for a whole class of monoidal theories which contains many of the specific cases that have been considered so far in an ad-hoc way (e.g. exclusive or, Abelian groups, exclusive or in combination with the homomorphism axiom). We follow a classical schema for cryptographic protocol analysis which proves first a locality result and then reduces the insecurity problem to a symbolic constraint solving problem. This approach strongly relies on the correspondence between a monoidal theory E and a semiring S E which we use to deal with the symbolic constraints. We show that the well-defined symbolic constraints that are generated by reasonable protocols can be solved provided that unification in the monoidal theory satisfies some additional properties. The resolution process boils down to solving particular quadratic Diophantine equations that are reduced to linear Diophantine equations, thanks to linear algebra results and the well-definedness of the problem. Examples of theories that do not satisfy our additional properties appear to be undecidable, which suggests that our characterization is reasonably tight.

A Proof Theoretic Analysis of Intruder Theories

“…In particular, Delaune, et. al., [16] obtain results similar to what we have here concerning combination of AC theories. One difference between these works and ours is in how this combination is derived.…”

“…A drawback for the approach with explicit destructors is that one needs to consider these destructors together with other algebraic properties in proving decidability, although recent work in combining decidable theories [3] allows one to deal with them modularly. Combination of intruder theories has been considered in [9,3,16], as part of their solution to a more difficult problem of deducibility constraints which assumes active intruders. In particular, Delaune, et.…”

Deducibility Constraints

“…Note however that [2] also considers equivalence properties, that are not covered (yet) by our work. There are also several examples of formal (intruder) proof systems that yield decidable deducibility constraints [16,8,6,5,10]. All these works consider AC-symbols and are incomparable with our results.…”

Challenges in the Automated Verification of Security Protocols

“…There are also a number of results for classes of theories, for instance: subterm theories [11] and monoidal theories [37]. This does not cover however some relevant examples such as the one described in [19].…”

“…[37]): if there is an attack then there is an attack, which is built, stacking pieces of protocol rules. Then, the search space for σ becomes finite, yielding decision algorithms.…”