Towards Producing Formally Checkable Security Proofs, Automatically

Integrating Automated and Interactive Protocol Verification

“…In contrast, our work, which is closer to the first kind of approach, shows that this proof generation procedure does indeed work in practice for many protocols, comparable to the results of [16]. We see the main benefit of our approach in the fact that we can indeed use the output of established verification tools dedicated to the domain of security protocols.…”

“…We see the main benefit of our approach in the fact that we can indeed use the output of established verification tools dedicated to the domain of security protocols. However, note that the work of [16] and ours have some major differences which makes results hard to compare. First, we consider a reference model where the protocol is modeled as a set of traces; the generated proofs are with respect to this reference model and all abstractions are merely part of the automatic tools.…”

“…First, we consider a reference model where the protocol is modeled as a set of traces; the generated proofs are with respect to this reference model and all abstractions are merely part of the automatic tools. In contrast, [16] considers only one protocol model based on Horn clauses, close to the abstract model in our paper. Taking the soundness of all these abstractions for granted is a weakness of [16].…”

“…The work most closely related to ours is a recent paper by Goubault-Larrecq who similarly considers generating proofs for an interactive theorem prover from the output of automated tools [16]. He considers a setting where the protocol and goal are given as a set S of Horn clauses; the tool output is a set S ∞ of Horn clauses that are in some sense saturated and such that the protocol has an attack iff a contradiction is derivable.…”

Beyond Provable Security Verifiable IND-CCA Security of OAEP

“…As a result, sequences of games can sometimes be inferred automatically; yet, at the same time, the connection between CryptoVerif proofs and standard cryptographic proofs is not as strong as one would desire. Finally, CryptoVerif in its current form acts more like a proof engine than a proof checker, and thus does not comply with the objective of verifiable security-see however [17] for preliminary work on certifying successful runs of CryptoVerif. Courant et al [14] have also developed an automated prover for proving asymptotic security of encryption schemes based on one-way functions.…”