Typing and Compositionality for Security Protocols: A Generalization to the Geometric Fragment

Abstract

Abstract. We integrate, and improve upon, prior relative soundness results of two kinds. The first kind are typing results showing that any security protocol that fulfils a number of sufficient conditions has an attack if it has a well-typed attack. The second kind considers the parallel composition of protocols, showing that when running two protocols in parallel allows for an attack, then at least one of the protocols has an attack in isolation. The most important generalization over previous work is the support for all security properties of the geometric fragment.

Stateful Protocol Composition

“…With sets we can model events, e.g., asserting an event e amounts to inserting e into a distinguished set of events while checking whether e has previously occurred (or not) corresponds to a positive (respectively negative) set-membership check. We therefore support all security properties expressible in the geometric fragment [1]. This covers many standard reachability goals such as authentication; it seems that any significantly richer fragment of first-order logic would be incompatible with our result.…”

Alice and Bob: Reconciling Formal Models and Implementation

“…One may think of the variables as parameters of a protocol description that must be instantiated for a concrete execution of the protocol; in our example, the variables A and B shall be instantiated with concrete agent names such as a, b or the intruder p 4 , whereas X and Y should be instantiated with random numbers that are freshly chosen by A and B, respectively.…”

“…By default, the interpretation of SPS is untyped, i.e., types are used only by the SPS translator to check that the user did not specify any ill-typed terms. The types can however be used to generate a more restrictive typed model and under certain conditions this restriction is without loss of attacks [4]. The type Agent has a special relevance: constants and variables of this type we call roles, and the symbol Role in the above grammar must only be used for identifiers of type Agent.…”

“…Then we can define (independent of the concrete protocol) a violation of secrecy as a state where the intruder has learned Payload but is neither A nor B. We do not give here more details on goals, because from a semantical point of view we just treat the events as if they were messages on a special channel to a "referee" who decides if the present state is an attack; the handling of these events is uniform for a wide class of goals [4] and only limited by the abilities of current verification tools. In textual representation, we will simply write event(t) where t is a term characterizing the event.…”

A Methodology for Protocol Verification Applied to EMV® 1

“…Beyond their implementation in different tools, we formally specify the functions behaviour in VDM, the same language that is being used here for the formal specification of AnB. This is different from other approaches [1,2,5], which compile AnB to different languages (e.g. CSP [32], operational strands [31], IF [3]), with a formally specified compilation strategy/set of rules which consider uninterpreted functions only symbolically.…”