Analysing privacy-type properties in cryptographic protocols - PowerPoint PPT Presentation

Analysing privacy-type properties in cryptographic protocols Stéphanie Delaune Univ Rennes, CNRS, IRISA, France Thursday, July 12th, 2018

Cryptographic protocols everywhere ! Cryptographic protocols ◮ small programs designed to secure communication ( e.g. secrecy, authentication, anonymity, . . . ) ◮ use cryptographic primitives ( e.g. encryption, signature, . . . . . . ) The network is unsecure! Communications take place over a public network like the Internet.

Cryptographic protocols everywhere ! Cryptographic protocols ◮ small programs designed to secure communication ( e.g. secrecy, authentication, anonymity, . . . ) ◮ use cryptographic primitives ( e.g. encryption, signature, . . . . . . ) It becomes more and more important to protect our privacy.

Electronic passport − → studied in [Arapinis et al. , 10] An e-passport is a passport with an RFID tag embedded in it. The RFID tag stores: ◮ the information printed on your passport, ◮ a JPEG copy of your picture.

Electronic passport − → studied in [Arapinis et al. , 10] An e-passport is a passport with an RFID tag embedded in it. The RFID tag stores: ◮ the information printed on your passport, ◮ a JPEG copy of your picture. The Basic Access Control (BAC) protocol is a key establishment protocol that has been designed to also ensure unlinkability. ISO/IEC standard 15408 Unlinkability aims to ensure that a user may make multiple uses of a service or resource without others being able to link these uses together .

Basic Acccess Control (BAC) protocol Passport Reader ( K E , K M ) ( K E , K M )

Basic Acccess Control (BAC) protocol Passport Reader ( K E , K M ) ( K E , K M ) get_challenge

Basic Acccess Control (BAC) protocol Passport Reader ( K E , K M ) ( K E , K M ) get_challenge N P , K P N P

Basic Acccess Control (BAC) protocol Passport Reader ( K E , K M ) ( K E , K M ) get_challenge N P , K P N P N R , K R { N R , N P , K R } KE , MAC KM ( { N R , N P , K R } KE )

Basic Acccess Control (BAC) protocol Passport Reader ( K E , K M ) ( K E , K M ) get_challenge N P , K P N P N R , K R { N R , N P , K R } KE , MAC KM ( { N R , N P , K R } KE ) { N P , N R , K P } KE , MAC KM ( { N P , N R , K P } KE )

Basic Acccess Control (BAC) protocol Passport Reader ( K E , K M ) ( K E , K M ) get_challenge N P , K P N P N R , K R { N R , N P , K R } KE , MAC KM ( { N R , N P , K R } KE ) { N P , N R , K P } KE , MAC KM ( { N P , N R , K P } KE ) K seed = K P ⊕ K R K seed = K P ⊕ K R

How cryptographic protocols can be attacked?

How cryptographic protocols can be attacked? Logical attacks ◮ can be mounted even assuming perfect cryptography, ֒ → replay attack, man-in-the middle attack, . . . ◮ subtle and hard to detect by “eyeballing” the protocol This is the so-called Dolev-Yao attacker !

How cryptographic protocols can be attacked? Logical attacks ◮ can be mounted even assuming perfect cryptography, ֒ → replay attack, man-in-the middle attack, . . . ◮ subtle and hard to detect by “eyeballing” the protocol Example: An authentication flaw on the Needham Schroeder protocol A → B : { A , N A } pub( B ) B → A : { N A , N B } pub( A ) A → B : { N B } pub( B ) NS protocol (1978)

How cryptographic protocols can be attacked? Logical attacks ◮ can be mounted even assuming perfect cryptography, ֒ → replay attack, man-in-the middle attack, . . . ◮ subtle and hard to detect by “eyeballing” the protocol Example: An authentication flaw on the Needham Schroeder protocol A → B : { A , N A } pub( B ) A → B : { A , N A } pub( B ) B → A : { N A , N B } pub( A ) B → A : { N A , N B , B } pub( A ) A → B : { N B } pub( B ) A → B : { N B } pub( B ) NS protocol (1978) NS-Lowe protocol (1995)

How cryptographic protocols can be attacked? Logical attacks ◮ can be mounted even assuming perfect cryptography, ֒ → replay attack, man-in-the middle attack, . . . ◮ subtle and hard to detect by “eyeballing” the protocol Example: FREAK attack by Barghavan et al. (2015) A logical flaw that allows a man-in-the- middle attacker to downgrade connections from ’strong’ RSA to ’export grade’ RSA.

How cryptographic protocols can be attacked? Logical attacks ◮ can be mounted even assuming perfect cryptography, ֒ → replay attack, man-in-the middle attack, . . . ◮ subtle and hard to detect by “eyeballing” the protocol Example: A traceability attack on the BAC protocol (2010) privacy issue The register - Jan. 2010

French electronic passport − → the passport must reply to all received messages. Passport Reader ( K E , K M ) ( K E , K M ) get_challenge N P , K P N P N R , K R { N R , N P , K R } KE , MAC KM ( { N R , N P , K R } KE )

French electronic passport − → the passport must reply to all received messages. Passport Reader ( K E , K M ) ( K E , K M ) get_challenge N P , K P N P N R , K R { N R , N P , K R } KE , MAC KM ( { N R , N P , K R } KE ) If MAC check fails mac_error

French electronic passport − → the passport must reply to all received messages. Passport Reader ( K E , K M ) ( K E , K M ) get_challenge N P , K P N P N R , K R { N R , N P , K R } KE , MAC KM ( { N R , N P , K R } KE ) If MAC check succeeds If nonce check fails nonce_error

An attack on the French passport [Chothia & Smirnov, 10] An attacker can track a French passport , provided he has once witnessed a successful authentication.

An attack on the French passport [Chothia & Smirnov, 10] An attacker can track a French passport , provided he has once witnessed a successful authentication. Part 1 of the attack. The attacker eavesdropes on Alice using her passport and records message M . M = { N R , N P , K R } K E , MAC K M ( { N R , N P , K R } K E )

An attack on the French passport [Chothia & Smirnov, 10] An attacker can track a French passport , provided he has once witnessed a successful authentication. Part 1 of the attack. The attacker eavesdropes on Alice using her passport and records message M . M = { N R , N P , K R } K E , MAC K M ( { N R , N P , K R } K E ) Part 2 of the attack. In presence of an unknown passport ( K ′ E , K ′ M ), the attacker replays the message M and checks the error code he receives. 1. MAC check failed: K ′ M � = K M = ⇒ ???? is not Alice K ′ 2. MAC check succeeded: M = K M = ⇒ ???? is Alice

Outline Does the protocol satisfy a security property? Modelling | | ϕ = Outline of the remaining of this talk 1. Modelling cryptographic protocols and their security properties 2. Designing verification algorithms − → we focus here on privacy-type security properties

Part I Modelling cryptographic protocols and their security properties

Two major families of models ... ... with some advantages and some drawbacks. Computational model ◮ + messages are bitstring, a general and powerful adversary ◮ – manual proofs, tedious and error-prone Symbolic model ◮ – abstract model, e.g. messages are terms ◮ + automatic proofs

Two major families of models ... ... with some advantages and some drawbacks. Computational model ◮ + messages are bitstring, a general and powerful adversary ◮ – manual proofs, tedious and error-prone Symbolic model ◮ – abstract model, e.g. messages are terms ◮ + automatic proofs Some results allowed to make a link be- tween these two very different models. − → Abadi & Rogaway 2000

Back to the BAC protocol Nonces n r , n p , and keys k r , k p , k e , k m are modelled using names Cryptographic primitives are modelled using function symbols ◮ encryption/decryption: senc / 2, sdec / 2 ◮ concatenation/projections: � , � / 2, proj 1 / 1, proj 2 / 1 ◮ mac construction: mac / 2 sdec(senc( x , y ) , y ) = x proj 1 ( � x , y � ) = x proj 2 ( � x , y � ) = y

Back to the BAC protocol Nonces n r , n p , and keys k r , k p , k e , k m are modelled using names Cryptographic primitives are modelled using function symbols ◮ encryption/decryption: senc / 2, sdec / 2 ◮ concatenation/projections: � , � / 2, proj 1 / 1, proj 2 / 1 ◮ mac construction: mac / 2 sdec(senc( x , y ) , y ) = x proj 1 ( � x , y � ) = x proj 2 ( � x , y � ) = y Exclusive-or operator: ⊕ of arity 2 and 0 (neutral element) x ⊕ ( y ⊕ z ) = ( x ⊕ y ) ⊕ z x ⊕ x = 0 x ⊕ y = y ⊕ x x ⊕ 0 = x

Protocols as processes Syntax [Abadi & Fournet, 01] P , Q := 0 null process in( c , x ) . P input out( c , u ) . P output if u = v then P else Q conditional P | Q parallel composition ! P replication new n . P fresh name generation

Protocols as processes Syntax [Abadi & Fournet, 01] P , Q := 0 null process in( c , x ) . P input out( c , u ) . P output if u = v then P else Q conditional P | Q parallel composition ! P replication new n . P fresh name generation Modelling Passport’s role P BAC ( k E , k M ) = new n P . new k P . out( n P ) . in( � z E , z M � ) . if z M = mac( z E , k M ) then if n P = proj 1 (proj 2 (sdec( z E , k E ))) then out( � m , mac( m , k M ) � ) else out( nonce _ error ) else out( mac _ error ) where m = senc( � n P , � proj 1 ( z E ) , k P �� , k E ).