Verifying the Independence of Security Protocols

Abstract

Determining if two protocols can be securely run alongside each other requires analyzing the independence of the involved protocols. In this paper we construct a canonical model of security protocols that allows us to conduct a syntactical analysis on the independence of multiple security protocols. By integrating participant knowledge in the model, we are able to detect subtle multi-protocol attacks, where the types of certain message components can not be checked, also known as type-flaw attacks. Of special interest is the construction of messages in the proposed model, which is made by mapping each message component from the regular specification to a type. We provide a theorem for analyzing the independence of security protocols and illustrate its applicability by analyzing two protocols.

Term-Based Composition of Security Protocols

“…By inspecting the rather large number of reported attacks in the literature [14], [18], [20] we can agree that any modification brought upon a protocol can influence its existing security properties. Based on these concerns, the authors have developed in a previous paper [17] a framework for verifying the composability of security protocols.…”

“…The first step towards the composition of these protocols consists in verifying the "key-secrecy independence" security requirement formulated by the authors in [17]. To achieve this, we specify the secret terms for the two involved protocols.…”

“…4, the complete connection is also maintained in the composed protocol. In addition, the second security requirement formulated by the authors in [17], i.e. "message independence", is also satisfied because messages have different cryptographical structures.…”

Informal specification-based performance evaluation of security protocols

“…A collection of strands is called a strand space. The strand space model was introduced by Guttman et all in [9] and extended by the authors with participant knowledge, specialized basic sets and explicit term construction in [10]. The resulting model is called a kstrand space.…”

“…In this section we briefly present the concept of knowledge strands (k-strands) and typed strands (tstrands) used to model protocol participants. For a more detailed presentation, the reader is asked to consult the authors previous work [10].…”