Cross-Tool Semantics for Protocol Security Goals SSR December 5, - PowerPoint PPT Presentation

Cross-Tool Semantics for Protocol Security Goals SSR December 5, 2016 Gaithersburg, MD Joshua D. Guttman, John D. Ramsdell, Paul D. Rowe The MITRE Corporation {guttman, ramsdell, prowe}@mitre.org

2 Transparency in Security Standardization § Public trust in standardized security protocols is based in transparency – Rigorous analysis can help rule out hidden insecurities § True transparency requires – Reproducibility of results – By multiple, independent parties – Using a diversity of methods or tools § Sometimes analysis can be opaque – Reliance on expert knowledge – Reliance on specific tool set

3 ISO/IEC 29128 § Standardized framework for the verification of cryptographic protocols Self-assessment evidence Protocol Adversary Security description model properties § Highest assurance level (4) requires – Formal, tool-supported, analysis of unbounded sessions § Reproducibility calls for tool-independent inputs – We claim our first-order language of security goals is tool-independent

4 Main Contributions Impact: § Improve reproducibility of formal analyses Technical: § New semantics of first-order language for security goals – Originally designed for strand spaces (CPSA) – Adapted for applied 𝜌 (ProVerif) § Proof of compatibility of the two semantics

5 Compatible Cross-Tool Semantics Applied 𝝆 Strand spaces - 𝐶 *+, ℙ P 𝑔 𝒣ℒ(ℙ) 𝒣ℒ( P ) ⊨ ⊨ strand traces - runs 𝐶 .*

6 Simple Example Protocol (SEP) 𝒃 𝑩 ⟶ 𝑪: 𝑙 𝒕𝒍(𝒃) 𝒒𝒍(𝒄) 𝒕 𝑪 ⟶ 𝑩: 𝒆 < Clients 𝐵 may not always choose symmetric key 𝑙 randomly Servers 𝐶 always choose data d randomly

7 Sample Goals 𝑩 has finished a session with 𝑪 ; If 𝑪 previously transmitted 𝒆 with then 𝑪 ’s private decryption key 𝒒𝒍 𝑪 ?𝟐 and matching parameters is uncompromised the session key 𝒍 is freshly chosen 𝒆 remains confidential and then

8 Goal Language Protocol-Dependent Protocol-Independent § Role position predicates § Ordering and equality – InitStart(n), RespDone(m) – Preceq(m,n), Coll(m,n), d = d’ § Parameter predicates § Freshness and secrecy – Self(n,a), SessKey(m,k) – Unq(d), UnqAt(m,d), Non(sk(a))

9 Sample Goal Formalized 𝑩 has finished a session with 𝑪 ; If 𝑪 ’s private decryption key 𝒒𝒍 𝑪 ?𝟐 𝑪 previously transmitted 𝒆 with then and matching parameters is uncompromised the session key 𝒍 is freshly chosen and ∀ n,a,b,k,d. ∃ m. InitDone(n) ∧ Self(n,a) ∧ Peer(n,b) ∧ RespDone(m) ∧ Self(m,b) ∧ Peer(m,a) ∧ ⟹ SessKey(n,k) ∧ Data(n,d) ∧ SessKey(n,k) ∧ Data(m,d) ∧ Non(pk(b) -1 ) ∧ Unq(k) Preceq(m,n)

10 Applied 𝝆 Syntax out ℓ 𝑑, 𝑣 . 𝑄 𝑄, 𝑅 = in 𝑑, 𝑦 . 𝑄 let 𝑦 ∶ s = 𝑤 in 𝑄 else 𝑅 0 sum 𝑜 R ∶ s . 𝑄 (𝑄 ∣ 𝑅) new 𝑜 ∶ s . 𝑄 !new 𝑢𝑗𝑒 . out 𝑑, 𝑢𝑗𝑒 . 𝑄 [\ , 𝑜 R ∈ 𝒪 [] ) ℓ . 𝑄 (𝑑, 𝑢𝑗𝑒 ∈ 𝐷ℎ, 𝑦 ∈ 𝒴, 𝑜 ∈ 𝒪

11 Applied 𝝆 Protocols ` 𝑩 ⟶ 𝑪: 𝑙 [<(`) a<(b) [ 𝑪 ⟶ 𝑩: 𝑒 < Init = !new 𝑢𝑗𝑒 . out 𝑑, 𝑢𝑗𝑒 . ` sum 𝑏 ∶ agt . sum 𝑐 ∶ agt . sum 𝑙: skey . out InitStart ( 𝑢𝑗𝑒, 𝑙 [<(`) ) . a<(b) in ( 𝑢𝑗𝑒, 𝑨 ) . let 𝑒 ∶ data = 𝑒𝑓𝑑 [ 𝑨, 𝑙 in InitDone . 𝟏 Resp = !new 𝑢𝑗𝑒 . out 𝑑, 𝑢𝑗𝑒 . sum 𝑏 ∶ agt . sum 𝑐 ∶ agt . in ( 𝑢𝑗𝑒, 𝑨 ) . let 𝑦: ⊤ = 𝑒𝑓𝑑 ` 𝑨, 𝑡𝑙(𝑐) in [ ) . 𝟏 let 𝑙: skey = 𝑤𝑓𝑠 𝑦, 𝑞𝑙(𝑏) in RespStart . new 𝑒 ∶ data . out RespDone ( 𝑢𝑗𝑒, 𝑒 <

12 Operational Trace Semantics !new 𝑢𝑗𝑒 . out 𝑑, 𝑢𝑗𝑒 . ` sum 𝑏 ∶ agt . sum 𝑐 ∶ agt . sum 𝑙: skey . out InitStart ( 𝑢𝑗𝑒, 𝑙 [<(`) ) . a<(b) in ( 𝑢𝑗𝑒, 𝑨 ) . let 𝑒 ∶ data = 𝑒𝑓𝑑 [ 𝑨, 𝑙 in InitDone . 𝟏 !new 𝑢𝑗𝑒 . out 𝑑, 𝑢𝑗𝑒 . sum 𝑏 ∶ agt . sum 𝑐 ∶ agt . in ( 𝑢𝑗𝑒, 𝑨 ) . let 𝑦: ⊤ = 𝑒𝑓𝑑 ` 𝑨, 𝑡𝑙(𝑐) in [ ) . 𝟏 let 𝑙 ∶ skey = 𝑤𝑓𝑠 𝑦, 𝑞𝑙(𝑏) in RespStart . new 𝑒 ∶ data . out RespDone ( 𝑢𝑗𝑒, 𝑒 <

13 Operational Trace Semantics !new 𝑢𝑗𝑒 . out 𝑑, 𝑢𝑗𝑒 . ` sum 𝑏 ∶ agt . sum 𝑐 ∶ agt . sum 𝑙: skey . out InitStart ( 𝑢𝑗𝑒, 𝑙 [<(`) ) . a<(b) in ( 𝑢𝑗𝑒, 𝑨 ) . let 𝑒 ∶ data = 𝑒𝑓𝑑 [ 𝑨, 𝑙 in InitDone . 𝟏 !new 𝑢𝑗𝑒 . out 𝑑, 𝑢𝑗𝑒 . sum 𝑏 ∶ agt . sum 𝑐 ∶ agt . in ( 𝑢𝑗𝑒, 𝑨 ) . let 𝑦: ⊤ = 𝑒𝑓𝑑 ` 𝑨, 𝑡𝑙(𝑐) in [ ) . 𝟏 let 𝑙 ∶ skey = 𝑤𝑓𝑠 𝑦, 𝑞𝑙(𝑏) in RespStart . new 𝑒 ∶ data . out RespDone ( 𝑢𝑗𝑒, 𝑒 <

14 Operational Trace Semantics !new 𝑢𝑗𝑒 . out 𝑑, 𝑢𝑗𝑒 . ` sum 𝑏 ∶ agt . sum 𝑐 ∶ agt . sum 𝑙: skey . out InitStart ( 𝑢𝑗𝑒, 𝑙 [<(`) ) . a<(b) in ( 𝑢𝑗𝑒, 𝑨 ) . let 𝑒 ∶ data = 𝑒𝑓𝑑 [ 𝑨, 𝑙 in InitDone . 𝟏 !new 𝑢𝑗𝑒 . out 𝑑, 𝑢𝑗𝑒 . sum 𝑏 ∶ agt . sum 𝑐 ∶ agt . in ( 𝑢𝑗𝑒, 𝑨 ) . let 𝑦: ⊤ = 𝑒𝑓𝑑 ` 𝑨, 𝑡𝑙(𝑐) in [ ) . 𝟏 let 𝑙 ∶ skey = 𝑤𝑓𝑠 𝑦, 𝑞𝑙(𝑏) in RespStart . new 𝑒 ∶ data . out RespDone ( 𝑢𝑗𝑒, 𝑒 <

15 Operational Trace Semantics !new 𝑢𝑗𝑒 . out 𝑑, 𝑢𝑗𝑒 . ` sum 𝑏 ∶ agt . sum 𝑐 ∶ agt . sum 𝑙: skey . out InitStart ( 𝑢𝑗𝑒, 𝑙 [<(`) ) . a<(b) in ( 𝑢𝑗𝑒, 𝑨 ) . let 𝑒 ∶ data = 𝑒𝑓𝑑 [ 𝑨, 𝑙 in InitDone . 𝟏 !new 𝑢𝑗𝑒 . out 𝑑, 𝑢𝑗𝑒 . sum 𝑏 ∶ agt . sum 𝑐 ∶ agt . in ( 𝑢𝑗𝑒, 𝑨 ) . let 𝑦: ⊤ = 𝑒𝑓𝑑 ` 𝑨, 𝑡𝑙(𝑐) in [ ) . 𝟏 let 𝑙 ∶ skey = 𝑤𝑓𝑠 𝑦, 𝑞𝑙(𝑏) in RespStart . new 𝑒 ∶ data . out RespDone ( 𝑢𝑗𝑒, 𝑒 < (InitStart , out 𝑢𝑗𝑒, 𝑛 k , 𝓕 𝟐 ).

16 Operational Trace Semantics !new 𝑢𝑗𝑒 . out 𝑑, 𝑢𝑗𝑒 . ` sum 𝑏 ∶ agt . sum 𝑐 ∶ agt . sum 𝑙: skey . out InitStart ( 𝑢𝑗𝑒, 𝑙 [<(`) ) . a<(b) in ( 𝑢𝑗𝑒, 𝑨 ) . let 𝑒 ∶ data = 𝑒𝑓𝑑 [ 𝑨, 𝑙 in InitDone . 𝟏 !new 𝑢𝑗𝑒 . out 𝑑, 𝑢𝑗𝑒 . sum 𝑏 ∶ agt . sum 𝑐 ∶ agt . in ( 𝑢𝑗𝑒, 𝑨 ) . let 𝑦: ⊤ = 𝑒𝑓𝑑 ` 𝑨, 𝑡𝑙(𝑐) in [ ) . 𝟏 let 𝑙 ∶ skey = 𝑤𝑓𝑠 𝑦, 𝑞𝑙(𝑏) in RespStart . new 𝑒 ∶ data . out RespDone ( 𝑢𝑗𝑒, 𝑒 < (InitStart , out 𝑢𝑗𝑒, 𝑛 k , 𝓕 𝟐 ).

17 Operational Trace Semantics !new 𝑢𝑗𝑒 . out 𝑑, 𝑢𝑗𝑒 . ` sum 𝑏 ∶ agt . sum 𝑐 ∶ agt . sum 𝑙: skey . out InitStart ( 𝑢𝑗𝑒, 𝑙 [<(`) ) . a<(b) in ( 𝑢𝑗𝑒, 𝑨 ) . let 𝑒 ∶ data = 𝑒𝑓𝑑 [ 𝑨, 𝑙 in InitDone . 𝟏 !new 𝑢𝑗𝑒 . out 𝑑, 𝑢𝑗𝑒 . sum 𝑏 ∶ agt . sum 𝑐 ∶ agt . in ( 𝑢𝑗𝑒, 𝑨 ) . let 𝑦: ⊤ = 𝑒𝑓𝑑 ` 𝑨, 𝑡𝑙(𝑐) in [ ) . 𝟏 let 𝑙 ∶ skey = 𝑤𝑓𝑠 𝑦, 𝑞𝑙(𝑏) in RespStart . new 𝑒 ∶ data . out RespDone ( 𝑢𝑗𝑒, 𝑒 < (InitStart , out 𝑢𝑗𝑒, 𝑛 k , 𝓕 𝟐 ). ( ⊥ , in 𝑢𝑗𝑒, 𝑛 n , 𝓕 𝟑 ).

18 Operational Trace Semantics !new 𝑢𝑗𝑒 . out 𝑑, 𝑢𝑗𝑒 . ` sum 𝑏 ∶ agt . sum 𝑐 ∶ agt . sum 𝑙: skey . out InitStart ( 𝑢𝑗𝑒, 𝑙 [<(`) ) . a<(b) in ( 𝑢𝑗𝑒, 𝑨 ) . let 𝑒 ∶ data = 𝑒𝑓𝑑 [ 𝑨, 𝑙 in InitDone . 𝟏 !new 𝑢𝑗𝑒 . out 𝑑, 𝑢𝑗𝑒 . sum 𝑏 ∶ agt . sum 𝑐 ∶ agt . in ( 𝑢𝑗𝑒, 𝑨 ) . let 𝑦: ⊤ = 𝑒𝑓𝑑 ` 𝑨, 𝑡𝑙(𝑐) in [ ) . 𝟏 let 𝑙 ∶ skey = 𝑤𝑓𝑠 𝑦, 𝑞𝑙(𝑏) in RespStart . new 𝑒 ∶ data . out RespDone ( 𝑢𝑗𝑒, 𝑒 < (InitStart , out 𝑢𝑗𝑒, 𝑛 k , 𝓕 𝟐 ). ( ⊥ , in 𝑢𝑗𝑒, 𝑛 n , 𝓕 𝟑 ).

19 Operational Trace Semantics !new 𝑢𝑗𝑒 . out 𝑑, 𝑢𝑗𝑒 . ` sum 𝑏 ∶ agt . sum 𝑐 ∶ agt . sum 𝑙: skey . out InitStart ( 𝑢𝑗𝑒, 𝑙 [<(`) ) . a<(b) in ( 𝑢𝑗𝑒, 𝑨 ) . let 𝑒 ∶ data = 𝑒𝑓𝑑 [ 𝑨, 𝑙 in InitDone . 𝟏 !new 𝑢𝑗𝑒 . out 𝑑, 𝑢𝑗𝑒 . sum 𝑏 ∶ agt . sum 𝑐 ∶ agt . in ( 𝑢𝑗𝑒, 𝑨 ) . let 𝑦: ⊤ = 𝑒𝑓𝑑 ` 𝑨, 𝑡𝑙(𝑐) in [ ) . 𝟏 let 𝑙 ∶ skey = 𝑤𝑓𝑠 𝑦, 𝑞𝑙(𝑏) in RespStart . new 𝑒 ∶ data . out RespDone ( 𝑢𝑗𝑒, 𝑒 < (InitStart , out 𝑢𝑗𝑒, 𝑛 k , 𝓕 𝟐 ). ( ⊥ , in 𝑢𝑗𝑒, 𝑛 n , 𝓕 𝟑 ). (RespStart , ⊥ , 𝓕 𝟒 ).

20 Operational Trace Semantics !new 𝑢𝑗𝑒 . out 𝑑, 𝑢𝑗𝑒 . ` sum 𝑏 ∶ agt . sum 𝑐 ∶ agt . sum 𝑙: skey . out InitStart ( 𝑢𝑗𝑒, 𝑙 [<(`) ) . a<(b) in ( 𝑢𝑗𝑒, 𝑨 ) . let 𝑒 ∶ data = 𝑒𝑓𝑑 [ 𝑨, 𝑙 in InitDone . 𝟏 !new 𝑢𝑗𝑒 . out 𝑑, 𝑢𝑗𝑒 . sum 𝑏 ∶ agt . sum 𝑐 ∶ agt . in ( 𝑢𝑗𝑒, 𝑨 ) . let 𝑦: ⊤ = 𝑒𝑓𝑑 ` 𝑨, 𝑡𝑙(𝑐) in [ ) . 𝟏 let 𝑙 ∶ skey = 𝑤𝑓𝑠 𝑦, 𝑞𝑙(𝑏) in RespStart . new 𝑒 ∶ data . out RespDone ( 𝑢𝑗𝑒, 𝑒 < (InitStart , out 𝑢𝑗𝑒, 𝑛 k , 𝓕 𝟐 ). ( ⊥ , in 𝑢𝑗𝑒, 𝑛 n , 𝓕 𝟑 ). (RespStart , ⊥ , 𝓕 𝟒 ).