The inductive approach to verifying cryptographic protocols

Abstract

Informal arguments that cryptographic protocols are secure can be made rigorous using inductive definitions. The approach is based on ordinary predicate calculus and copes with infinite-state systems. Proofs are generated using Isabelle/HOL. The human effort required to analyze a protocol can be as little as a week or two, yielding a proof script that takes a few minutes to run.Protocols are inductively defined as sets of traces. A trace is a list of communication events, perhaps comprising many interleaved protocol runs. Protocol descriptions incorporate attacks and accidental losses. The model spy knows some private keys and can forge messages using components decrypted from previous traffic. Three protocols are analyzed below: OtwayRees (which uses shared-key encryption), Needham-Schroeder (which uses public-key encryption), and a recursive protocol [9] (which is of variable length).One can prove that event ev always precedes event ev or that property P holds provided X remains secret. Properties can be proved from the viewpoint of the various principals: say, if A receives a final message from B then the session key it conveys is good.

The Mondex Challenge: Machine Checked Proofs for an Electronic Purse

“…Since the environment of the card is assumed to be hostile the message received may be any message that has already been sent, not just one that is directed to the card (this simple model of available messages is also used in many abstract specifications of security protocols, e.g. the traces of [Pau98] The protocol is started by two messages startFrom(msgna, value, msgno) and startTo(msgna, value, msgno) which are sent to the from and to purse respectively by the interface device. These two messages are assumed to be always available, so the initial ether already contains every such message.…”

A Formal Semantics for Protocol Narrations

“…Our definition of analysis refines the usual approach reminiscent of Paulson [Pau98]. Instead of directly defining a "flat" analysis set, we had to define a finitely stratified hierarchy (A n (K)) n∈N .…”

“…We do so by means of projection, focusing on the message components of our knowledge sets. This comparison is mainly intended to help readers who are familiar with Paulson's inductive approach (see [Pau98]) to better understand our formalism. In particular, we show that the stratified analysis of a message set yields a complete knowledge seed.…”

SET Cardholder Registration: The Secrecy Proofs

“…We use the inductive method of protocol verification, which has been described elsewhere [11,13]. This operational semantics assumes a population of honest agents obeying the protocol and a dishonest agent (the Spy) who can steal messages intended for other agents, decrypt them using any keys at his disposal and send new messages as he pleases.…”