Combining algorithms for deciding knowledge in security protocols Mathilde Arnaud, Véronique Cortier and Stéphanie Delaune LORIA, CNRS & INRIA project Cassis, Nancy, France September 10, 2007 S. Delaune (LORIA – Projet Cassis) Deciding knowledge September 10, 2007 1 / 20
Context: cryptographic protocols Cryptographic protocols small programs designed to secure communication ( e.g. secrecy) use cryptographic primitives ( e.g. encryption, hash function, . . . ) Presence of an attacker may read every message sent on the network, may intercept and send new messages according to its deduction capabilities. S. Delaune (LORIA – Projet Cassis) Deciding knowledge September 10, 2007 2 / 20
Context: cryptographic protocols Cryptographic protocols small programs designed to secure communication ( e.g. secrecy) use cryptographic primitives ( e.g. encryption, hash function, . . . ) Presence of an attacker may read every message sent on the network, may intercept and send new messages according to its deduction capabilities. S. Delaune (LORIA – Projet Cassis) Deciding knowledge September 10, 2007 2 / 20
A simple protocol → Does the attacker know secret? − S. Delaune (LORIA – Projet Cassis) Deciding knowledge September 10, 2007 3 / 20
Attacker power (in formal models) − → The attacker can do symbolic manipulations on messages. Messages are abstracted by terms ... encryption { x } y , pairing � x , y � , . . . ... together with an equational theory classical theory (E enc ): proj 1 ( � x , y � ) = x proj 2 ( � x , y � ) = y dec ( enc ( x , y ) , y ) = x exclusive or (E xor ): ( x ⊕ y ) ⊕ z = x ⊕ ( y ⊕ z ) x ⊕ y = y ⊕ x x ⊕ 0 = x x ⊕ x = 0 S. Delaune (LORIA – Projet Cassis) Deciding knowledge September 10, 2007 4 / 20
Knowledge Understanding security protocols often requires reasoning about knowledge of the attacker. Two main kinds of knowledge deduction, static equivalence – indistinguishability − → rely on an underlying equational theory − → often used as subroutines in many decision procedures S. Delaune (LORIA – Projet Cassis) Deciding knowledge September 10, 2007 5 / 20
Deduction T ⊢ E M 1 · · · T ⊢ E M k f ∈ Σ M ∈ T T ⊢ E M T ⊢ E f ( M 1 , . . . , M k ) T ⊢ M M = E M ′ T ⊢ M ′ Example: Let E := dec ( enc ( x , y ) , y ) = x and T = { enc ( secret , k ) , k } . T ⊢ enc ( secret , k ) T ⊢ k f ∈ Σ T ⊢ dec ( enc ( secret , k ) , k ) dec ( enc ( x , y ) , y ) = x T ⊢ secret S. Delaune (LORIA – Projet Cassis) Deciding knowledge September 10, 2007 6 / 20
Deduction T ⊢ E M 1 · · · T ⊢ E M k f ∈ Σ M ∈ T T ⊢ E M T ⊢ E f ( M 1 , . . . , M k ) T ⊢ M M = E M ′ T ⊢ M ′ Example: Let E := dec ( enc ( x , y ) , y ) = x and T = { enc ( secret , k ) , k } . T ⊢ enc ( secret , k ) T ⊢ k f ∈ Σ T ⊢ dec ( enc ( secret , k ) , k ) dec ( enc ( x , y ) , y ) = x T ⊢ secret S. Delaune (LORIA – Projet Cassis) Deciding knowledge September 10, 2007 6 / 20
Deduction is not always sufficient → The intruder knows the values yes and no ! The real question Is the intruder able to tell whether Alice sends yes or no? S. Delaune (LORIA – Projet Cassis) Deciding knowledge September 10, 2007 7 / 20
Static equivalence (indistinguishability relation) frame = set of restricted names + sequence of messages n . { M 1 / x 1 , . . . , M ℓ / φ = ν ˜ x ℓ } Examples: If the key k is not revealed, we have that φ 1 = ν k . { enc ( yes , k ) / x } and φ 2 = ν k . { enc ( no , k ) / x } If the key k is revealed, we have that ψ 1 = ν k . { k / x 1 , enc ( yes , k ) / x 2 } and ψ 2 = ν k . { k / x 1 , enc ( no , k ) / x 2 } S. Delaune (LORIA – Projet Cassis) Deciding knowledge September 10, 2007 8 / 20
Static equivalence (indistinguishability relation) frame = set of restricted names + sequence of messages n . { M 1 / x 1 , . . . , M ℓ / φ = ν ˜ x ℓ } Examples: If the key k is not revealed, we have that φ 1 = ν k . { enc ( yes , k ) / x } and φ 2 = ν k . { enc ( no , k ) / x } If the key k is revealed, we have that ψ 1 = ν k . { k / x 1 , enc ( yes , k ) / x 2 } and ψ 2 = ν k . { k / x 1 , enc ( no , k ) / x 2 } S. Delaune (LORIA – Projet Cassis) Deciding knowledge September 10, 2007 8 / 20
Static equivalence (indistinguishability relation) frame = set of restricted names + sequence of messages n . { M 1 / x 1 , . . . , M ℓ / φ = ν ˜ x ℓ } Examples: If the key k is not revealed, we have that φ 1 = ν k . { enc ( yes , k ) / x } and φ 2 = ν k . { enc ( no , k ) / x } If the key k is revealed, we have that ψ 1 = ν k . { k / x 1 , enc ( yes , k ) / x 2 } and ψ 2 = ν k . { k / x 1 , enc ( no , k ) / x 2 } S. Delaune (LORIA – Projet Cassis) Deciding knowledge September 10, 2007 8 / 20
Static equivalence (indistinguishability relation) frame = set of restricted names + sequence of messages n . { M 1 / x 1 , . . . , M ℓ / φ = ν ˜ x ℓ } Examples: If the key k is not revealed, we have that φ 1 = ν k . { enc ( yes , k ) / x } and φ 2 = ν k . { enc ( no , k ) / x } − → indistinguishable If the key k is revealed, we have that ψ 1 = ν k . { k / x 1 , enc ( yes , k ) / x 2 } and ψ 2 = ν k . { k / x 1 , enc ( no , k ) / x 2 } − → distinguishable S. Delaune (LORIA – Projet Cassis) Deciding knowledge September 10, 2007 8 / 20
Goal of this paper Our contribution We propose combination algorithms (PTIME) for deduction and static equivalence for disjoint equational theories. A modular approach − → Deciding interesting theories can be done by reducing the decision to simpler theories. New decidability results Deduction and static equivalence are decidable in PTIME for subterm theories ( e.g. E enc ) and exclusive or (E xor ) [Abadì&Cortier,06], [Chevalier et al. ,03]. − → those problems are also decidable in PTIME for E enc ∪ E xor . S. Delaune (LORIA – Projet Cassis) Deciding knowledge September 10, 2007 9 / 20
Goal of this paper Our contribution We propose combination algorithms (PTIME) for deduction and static equivalence for disjoint equational theories. A modular approach − → Deciding interesting theories can be done by reducing the decision to simpler theories. New decidability results Deduction and static equivalence are decidable in PTIME for subterm theories ( e.g. E enc ) and exclusive or (E xor ) [Abadì&Cortier,06], [Chevalier et al. ,03]. − → those problems are also decidable in PTIME for E enc ∪ E xor . S. Delaune (LORIA – Projet Cassis) Deciding knowledge September 10, 2007 9 / 20
Related works Combination for unification Our procedures rely on combination algorithms for solving unification modulo E = E 1 ∪ E 2 (E 1 and E 2 are disjoint) − → [Schmidt-Schauss,89], [Baader&Schulz,96] Combination for deduction (active case) We follow the approach developed in [Chevalier&Rusinowitch,05] − → combination algorithm for deduction in the presence of an active attacker (they take into account the rules of the protocol) − → they do not consider static equivalence S. Delaune (LORIA – Projet Cassis) Deciding knowledge September 10, 2007 10 / 20
Outline of the talk Introduction 1 Deduction 2 Static equivalence 3 Conclusion 4 S. Delaune (LORIA – Projet Cassis) Deciding knowledge September 10, 2007 11 / 20
Deduction Lemma (characterization of deduction) φ ⊢ E M if and only if there exists a term ζ such that ζφ = E M. − → Such a term ζ is a recipe of the term M. Example: E := dec ( enc ( x , y ) , y ) = x . φ = ν k .ν s . { enc ( s , k ) / x 1 , k / x 2 } We have that φ ⊢ E s . Indeed ζ = dec ( x 1 , x 2 ) is a recipe of s . Deduction problem for the equational theory E built over Σ . Entries : A frame φ and a term M (both built over Σ ) Question : φ ⊢ E M ? S. Delaune (LORIA – Projet Cassis) Deciding knowledge September 10, 2007 12 / 20
Deduction Lemma (characterization of deduction) φ ⊢ E M if and only if there exists a term ζ such that ζφ = E M. − → Such a term ζ is a recipe of the term M. Example: E := dec ( enc ( x , y ) , y ) = x . φ = ν k .ν s . { enc ( s , k ) / x 1 , k / x 2 } We have that φ ⊢ E s . Indeed ζ = dec ( x 1 , x 2 ) is a recipe of s . Deduction problem for the equational theory E built over Σ . Entries : A frame φ and a term M (both built over Σ ) Question : φ ⊢ E M ? S. Delaune (LORIA – Projet Cassis) Deciding knowledge September 10, 2007 12 / 20
Main result for deduction Theorem (Combination for deduction) Let (Σ 1 , E 1 ) and (Σ 2 , E 2 ) be two disjoint equational theories. If deduction is decidable for (Σ 1 , E 1 ) and (Σ 2 , E 2 ) then deduction is decidable for (Σ 1 ∪ Σ 2 , E 1 ∪ E 2 ) . Our algorithm Let φ be a frame and M be a term built over Σ 1 ∪ Σ 2 . 1 compute the subterms (alien subterms) of φ and M . 2 saturation of φ by subterms which are deducible either in E 1 or in E 2 − → abstraction of alien factors by fresh names 3 check if M ∈ sat ( φ ) . − → completeness obtained thanks to a locality lemma. − → our algorithm is polynomial (in the DAG-size of the inputs) S. Delaune (LORIA – Projet Cassis) Deciding knowledge September 10, 2007 13 / 20
Recommend
More recommend
