Typing Messages for Free in Security Protocols: The Case of Equivalence Properties

Abstract

Privacy properties such as untraceability, vote secrecy, or anonymity are typically expressed as behavioural equivalence in a process algebra that models security protocols. In this paper, we study how to decide one particular relation, namely trace equivalence, for an unbounded number of sessions. Our first main contribution is to reduce the search space for attacks. Specifically, we show that if there is an attack then there is one that is well-typed. Our result holds for a large class of typing systems and a large class of determinate security protocols. Assuming finitely many nonces and keys, we can derive from this result that trace equivalence is decidable for an unbounded number of sessions for a class of tagged protocols, yielding one of the first decidability results for the unbounded case. As an intermediate result, we also provide a novel decision procedure in the case of a bounded number of sessions.

SAT-Equiv: An Efficient Tool for Equivalence Properties

“…However, this bound is far from being practical. In this section, we show that the small attack property of [19] still holds even if our semantics has slightly changed (due to eager evaluation) and we further demonstrate that the number of constants can be significantly reduced since only three constants need to be considered (and no nonces), in addition to those explicitly mentioned in the protocol.…”

“…Recently, [19] has established how to reduced the search space for attacks by bounding the size of messages involved in a minimal attack. From a theoretical point of view, this also yields a bound on the number of nonces/constants involved in such a minimal attack.…”

“…We consider here a variant of the calculus provided in [19] in order to benefit from its main result, which guarantees a "small attack" property: when there is an attack, there is a well-typed attack.…”

“…As in [19], we consider type-compliant protocols, and we restrict ourselves to typing systems that preserve the structure of terms. A typing system is defined as follows.…”

“…Here, we do not bound a priori the format of the messages. Instead, we rely on a recent result [19] that shows that if there is an attack, that is a witness of non equivalence between two protocols P and Q, then there is a "small" attack, where messages comply to a certain format (induced by a type). This result holds for deterministic protocols that use symmetric keys and pairing.…”