Complexity of automatic verification of cryptographic protocols - PowerPoint PPT Presentation

Complexity of automatic verification of cryptographic protocols Clermont Ferrand 02/02/2017 Vincent Cheval Equipe Pesto, INRIA, Nancy 1

Cryptographic protocols Communication on public network Cryptographic protocols: • Concurrent programs designed to secure communications • Rely on cryptographic primitives 2 / 29

Context The protocol: Honest participants 3 / 29

Context The protocol: Honest participants Controls the network Intruder 3 / 29

Context The protocol: Honest participants Security properties Controls the network Intruder 3 / 29

On the web Protocol HTTPS • Password based authentication • Confidentiality of personal data 4 / 29

Payment with credit card • Authorization through PIN code • Wireless payment • Confidentiality of the transaction • Authenticity of the bank card 5 / 29

Electronic passport • RFID chip inside the passport • Secret key printed on the passport • Confidentiality of personal data • Anonymity • Untraceability 6 / 29

Electronic voting • Vote from personal computer • Vote from dedicated machines • Verifiability of the votes • Confidentiality of the vote • No partial results • One vote per voter • Anonymity of the voter • Coercition resistance 7 / 29

Attacks Designing a secure protocol is hard ! Concrete attacks on: • authentication used by Google Apps • unlinkability of french passports • authentication of credit card (Yes-Card) • vote privacy on the Helios e-voting system • anonymity of routing protocols • … These attacks are the consequence of a bad design and not of a: • implementation bug • weak cryptographic primitives • usage of magical hacking techniques 8 / 29

Existing models Cryptographic model Symbolic model 9 / 29

Existing models Cryptographic model Symbolic model Bitstring Messages 9 / 29

Existing models Cryptographic model Symbolic model Bitstring Messages Real algorithms Cryptographic primitives 9 / 29

Existing models Cryptographic model Symbolic model Bitstring Messages Real algorithms Function symbols Cryptographic primitives 9 / 29

Existing models Cryptographic model Symbolic model Bitstring Terms Messages Real algorithms Function symbols Cryptographic primitives 9 / 29

Existing models Cryptographic model Symbolic model Bitstring Terms Messages Real algorithms Function symbols Cryptographic primitives PPT Idealized Attacker 9 / 29

Existing models Cryptographic model Symbolic model Bitstring Terms Messages Real algorithms Function symbols Cryptographic primitives PPT Idealized Attacker "Easier" and mechanized Difficult and by hand Proofs 9 / 29

Existing models Cryptographic model Symbolic model Bitstring Terms Messages Real algorithms Function symbols Cryptographic primitives PPT Idealized Attacker "Easier" and mechanized Difficult and by hand Proofs Strong and clear Unclear Security guarantees 9 / 29

Symbolic models a, b, c, . . . Variables: Nonces: Symbolic terms x, y, z, . . . Functions symbols: enc , dec , h i , � , . . . enc ( x, y ) h x, y i a ⊕ x h i enc y y x x 10 / 29

Symbolic models a, b, c, . . . Variables: Nonces: Symbolic terms x, y, z, . . . Functions symbols: enc , dec , h i , � , . . . enc ( x, y ) h x, y i a ⊕ x h i enc y y x x dec ( enc ( x, y ) , y ) → x proj 1 ( h x, y i ) ! x Rewrite rules 10 / 29

Symbolic models a, b, c, . . . Variables: Nonces: Symbolic terms x, y, z, . . . Functions symbols: enc , dec , h i , � , . . . enc ( x, y ) h x, y i a ⊕ x h i enc y y x x dec ( enc ( x, y ) , y ) → x proj 1 ( h x, y i ) ! x Rewrite rules dec ( enc ( h m 1 , m 2 i , k ) , k ) ! h m 1 , m 2 i Example: 10 / 29

Symbolic models a, b, c, . . . Variables: Nonces: Symbolic terms x, y, z, . . . Functions symbols: enc , dec , h i , � , . . . enc ( x, y ) h x, y i a ⊕ x h i enc Subterm convergent y y x x dec ( enc ( x, y ) , y ) → x proj 1 ( h x, y i ) ! x Rewrite rules dec ( enc ( h m 1 , m 2 i , k ) , k ) ! h m 1 , m 2 i Example: unblind ( sign ( blind ( x, y ) , z ) , y ) → sign ( x, z ) Monadic convergent 10 / 29

Symbolic models Example : Electronic passport Knows k e Knows k e n T enc ( h n R , n T , k R i , k e ) enc ( h n T , n R , k T i , k e ) Passeport Reader 11 / 29

Symbolic models Example : Electronic passport Freshly generated by Passport Knows k e Knows k e n T enc ( h n R , n T , k R i , k e ) enc ( h n T , n R , k T i , k e ) Passeport Reader 11 / 29

Symbolic models Example : Electronic passport Freshly generated by Passport Knows k e Knows k e n T enc ( h n R , n T , k R i , k e ) enc ( h n T , n R , k T i , k e ) Passeport Reader Reader expects a nonce and returns it 11 / 29

Symbolic models Example : Electronic passport Freshly generated by Passport Knows k e Knows k e n T enc ( h n R , n T , k R i , k e ) enc ( h n T , n R , k T i , k e ) Passeport Reader Freshly generated by Reader Reader expects a nonce and returns it 11 / 29

Symbolic models Example : Electronic passport Knows k e Knows k e n T enc ( h n R , n T , k R i , k e ) enc ( h n T , n R , k T i , k e ) Passeport Reader Knowledge of intruder: nonces he can generate + 1 : n T enc ( h n R , n T , k R i , k e ) 2 : enc ( h n T , n R , k T i , k e ) 3 : 11 / 29

Symbolic models Another trace of the Electronic passport Knows k e Knows k e KO n T enc ( h n R , KO, k R i , k e ) Error Passeport Reader Knowledge of intruder: nonces he can generate (e.g. ) + KO 1 : n T enc ( h n R , KO, k R i , k e ) 2 : 3 : Error 12 / 29

Applied pi calculus 0 Nil P + Q Non deterministic choice P | Q Parallel if u = v then P else Q Test in ( c, x ) .P Input out ( c, u ) .P Output Name restriction ν k.P ! P Replication 13 / 29

Applied pi calculus Knows k e Knows k e n T enc ( h n R , n T , k R i , k e ) enc ( h n T , n R , k T i , k e ) Passeport Reader P ( k e ) = ν n T . out ( c, n T ) . in ( c, x ) . if proj 3 ( dec ( x, k e )) = n T then ν k T . out ( c, h n T , proj 1 ( dec ( x, k e )) , k T i ) else out ( c, Error ) Main process: ! ν k e ! P ( k e ) | R ( k e ) 14 / 29

Trace A trace = one execution of the process P ( k e ) = ν n T . out ( c, n T ) . in ( c, x ) . if proj 3 ( dec ( x, k e )) = n T then ν k T . out ( c, h n T , proj 1 ( dec ( x, k e )) , k T i ) else out ( c, Error ) ( ∅ , ν k e .P ( k e ) , id ) Initial configuration: Substitution representing Set of private names The process the knowledge of the attacker 15 / 29

Trace P ( k e ) = ν n T . out ( c, n T ) . in ( c, x ) . if proj 3 ( dec ( x, k e )) = n T then ν k T . out ( c, h n T , proj 1 ( dec ( x, k e )) , k T i ) else out ( c, Error ) ( ∅ , ν k e .P ( k e ) , id ) w 1 16 / 29

Trace P ( k e ) = ν n T . out ( c, n T ) . in ( c, x ) . if proj 3 ( dec ( x, k e )) = n T then ν k T . out ( c, h n T , proj 1 ( dec ( x, k e )) , k T i ) else out ( c, Error ) ( { k e } , P ( k e ) , id ) ( ∅ , ν k e .P ( k e ) , id ) w 1 16 / 29

Trace P 1 = out ( c, n T ) . in ( c, x ) . if proj 3 ( dec ( x, k e )) = n T then ν k T . out ( c, h n T , proj 1 ( dec ( x, k e )) , k T i ) else out ( c, Error ) ( { k e } , P ( k e ) , id ) ( ∅ , ν k e .P ( k e ) , id ) ( { k e , n T } , P 1 , id ) w 1 16 / 29

Trace P 2 = in ( c, x ) . if proj 3 ( dec ( x, k e )) = n T then ν k T . out ( c, h n T , proj 1 ( dec ( x, k e )) , k T i ) else out ( c, Error ) ( { k e } , P ( k e ) , id ) ( ∅ , ν k e .P ( k e ) , id ) ( { k e , n T } , P 1 , id ) ( { k e , n T } , P 2 , { n T / w 1 } ) out ( c, w 1 ) w 1 16 / 29

Trace P 2 = in ( c, x ) . if proj 3 ( dec ( x, k e )) = n T then ν k T . out ( c, h n T , proj 1 ( dec ( x, k e )) , k T i ) else out ( c, Error ) ( { k e } , P ( k e ) , id ) ( ∅ , ν k e .P ( k e ) , id ) ( { k e , n T } , P 1 , id ) ( { k e , n T } , P 2 , { n T / w 1 } ) out ( c, w 1 ) in ( c, M ) w 1 16 / 29

Trace P 2 = in ( c, x ) . if proj 3 ( dec ( x, k e )) = n T then ν k T . out ( c, h n T , proj 1 ( dec ( x, k e )) , k T i ) else out ( c, Error ) ( { k e } , P ( k e ) , id ) ( ∅ , ν k e .P ( k e ) , id ) ( { k e , n T } , P 1 , id ) ( { k e , n T } , P 2 , { n T / w 1 } ) out ( c, w 1 ) in ( c, M ) w 1 Cannot contain private names 16 / 29

Trace P 2 = in ( c, x ) . if proj 3 ( dec ( x, k e )) = n T then ν k T . out ( c, h n T , proj 1 ( dec ( x, k e )) , k T i ) else out ( c, Error ) ( { k e } , P ( k e ) , id ) ( ∅ , ν k e .P ( k e ) , id ) ( { k e , n T } , P 1 , id ) ( { k e , n T } , P 2 , { n T / w 1 } ) out ( c, w 1 ) in ( c, M ) Can contain variables from the frame, i.e. w 1 Cannot contain private names 16 / 29

Trace P 2 = in ( c, x ) . if proj 3 ( dec ( x, k e )) = n T then ν k T . out ( c, h n T , proj 1 ( dec ( x, k e )) , k T i ) else out ( c, Error ) ( { k e } , P ( k e ) , id ) ( ∅ , ν k e .P ( k e ) , id ) ( { k e , n T } , P 1 , id ) ( { k e , n T } , P 2 , { n T / w 1 } ) out ( c, w 1 ) in ( c, M ) Can contain variables from the frame, i.e. w 1 Cannot contain private names M = h n I , w 1 i Ex: 16 / 29