Exploiting symmetries when proving equivalence properties for security protocols Vincent Cheval, Steve Kremer, Itsaka Rakotonirina Inria Nancy Grand-Est
Security protocols TLS Wifi @ PASS E-voting E-passport 2 24
Security protocols TLS Wifi @ 2016 (early ver. 1.3) 2017 (WPA2) PASS E-voting E-passport 2010 (Helios) 2013 (BAC) 2 24
Symbolic attacker model = protocol’s logic in an adversarial environment, with perfect cryptography 3 24
Symbolic attacker model = protocol’s logic in an adversarial environment, with perfect cryptography Crypto = equations: Dishonest parties can: read / overwrite e.g. dec(enc(m, k), k) = m messages (symmetric encryption) no other behaviours DoS 3 24
Privacy as indistinguishability Anonymity Alice Bob 4 24
Privacy as indistinguishability Anonymity Alice Bob yes no no yes Vote privacy … 4 24
Privacy as indistinguishability Behavioural indistinguishability for all potential attackers Anonymity Alice Bob yes no no yes Vote privacy … 4 24
Privacy as indistinguishability yes no no yes 5 24
Privacy as indistinguishability yes no no yes Equivalence coNEXP-complete for a fixed number of participants [S&P18] S. Kremer, V. Cheval, I. Rakotonirina. DEEPSEC: Deciding equivalence properties in security protocols — theory and practice 5 24
Privacy as indistinguishability yes no no yes Observation ! Equivalence coNEXP-complete Each time, the two processes for a fixed number of participants share a common structure [S&P18] S. Kremer, V. Cheval, I. Rakotonirina. DEEPSEC: Deciding equivalence properties in security protocols — theory and practice 5 24
Contributions A refinement of trace equivalence for processes with structural similarities Partial-order reductions for any process for this new equivalence Integration into the DeepSec prover 6 24
Trace equivalence
Modelling indistinguishability A simple example 8 24
Modelling indistinguishability A simple example enc(0,k) enc(1,k) t 8 24
Modelling indistinguishability A simple example enc(0,k) enc(1,k) t out(c, enc(0,k)) out(c, enc(1,k)) 8 24
Modelling indistinguishability A simple example enc(0,k) enc(1,k) k k t out(c, enc(0,k)) out(c, enc(1,k)) | out(d, k) out(d, k) | 8 24
Modelling indistinguishability A simple example enc(0,k) enc(1,k) k k t out(c, enc(0,k)) out(c, enc(1,k)) | out(d, k) out(d, k) | m 1 m 2 Distinguishing execution: 8 24
Modelling indistinguishability A simple example enc(0,k) enc(1,k) k k t out(c, enc(0,k)) out(c, enc(1,k)) | out(d, k) out(d, k) | m 1 m 2 ? Distinguishing execution: + test dec(m 1 ,m 2 ) = 0 8 24
Modelling indistinguishability Formalism P 0 P 1 iff ∀ t ∈ Traces(P i ), ∃ t’ ∈ Traces(P 1-i ), t ~ t’ t 9 24
Modelling indistinguishability Formalism algebra of finite concurrent processes P 0 P 1 iff ∀ t ∈ Traces(P i ), ∃ t’ ∈ Traces(P 1-i ), t ~ t’ t 9 24
Modelling indistinguishability Formalism in(c,x). P P | Q algebra of finite concurrent processes out(c,u). P if u = v then P else Q P 0 P 1 iff ∀ t ∈ Traces(P i ), ∃ t’ ∈ Traces(P 1-i ), t ~ t’ t 9 24
Modelling indistinguishability Formalism in(c,x). P P | Q algebra of finite concurrent processes out(c,u). P if u = v then P else Q P 0 P 1 iff ∀ t ∈ Traces(P i ), ∃ t’ ∈ Traces(P 1-i ), t ~ t’ t sequences of inputs/outputs in an active adversarial environment 9 24
Modelling indistinguishability Formalism in(c,x). P P | Q algebra of finite concurrent processes out(c,u). P if u = v then P else Q P 0 P 1 iff ∀ t ∈ Traces(P i ), ∃ t’ ∈ Traces(P 1-i ), t ~ t’ t sequences of inputs/outputs in an active adversarial environment out(c,u) ⇒ adds u to the attacker’s knowledge in(c,x) ⇒ receives a term from the attacker 9 24
Modelling indistinguishability Formalism in(c,x). P P | Q algebra of finite concurrent processes out(c,u). P if u = v then P else Q P 0 P 1 iff ∀ t ∈ Traces(P i ), ∃ t’ ∈ Traces(P 1-i ), t ~ t’ t sequences of inputs/outputs in static indistinguishability of an active adversarial environment sequences of inputs/outputs out(c,u) ⇒ adds u to the attacker’s knowledge in(c,x) ⇒ receives a term from the attacker 9 24
Trace equivalence… in practice
A combinatorial fact … … action’ 1,1 action’ n,1 action 1,1 action n,1 … … … … … … action’ 1,p action’ n,p action n,p action 1,p … … 11 24
A combinatorial fact n sessions … … action’ 1,1 action’ n,1 action 1,1 action n,1 p actions … … … … per session … … action’ 1,p action’ n,p action n,p action 1,p … … 11 24
A combinatorial fact n sessions … … action’ 1,1 action’ n,1 action 1,1 action n,1 p actions … … … … per session … … action’ 1,p action’ n,p action n,p action 1,p … … Goal ∀ seq. of actions a 1 a 2 … a np , ∃ equivalent seq. of actions a’ 1 a’ 2 … a’ np 11 24
A combinatorial fact n sessions … … action’ 1,1 action’ n,1 action 1,1 action n,1 p actions … … … … per session … … action’ 1,p action’ n,p action n,p action 1,p … … Goal ∀ seq. of actions a 1 a 2 … a np , ∃ equivalent seq. of actions a’ 1 a’ 2 … a’ np ~(np)! matchings Actions 11 24
A combinatorial fact n sessions … … action’ 1,1 action’ n,1 action 1,1 action n,1 p actions … … … … per session … … action’ 1,p action’ n,p action n,p action 1,p … … Goal ∀ seq. of actions a 1 a 2 … a np , ∃ equivalent seq. of actions a’ 1 a’ 2 … a’ np ~(np)! matchings ~n! matchings Actions Sessions 11 24
Why matching sessions? instead of individual actions … … action’ 1,1 action’ n,1 action 1,1 action n,1 … … … … … … action’ 1,p action’ n,p action n,p action 1,p … … 12 24
Why matching sessions? instead of individual actions … … action’ 1,1 action’ n,1 action 1,1 action n,1 … … … … … … action’ 1,p action’ n,p action n,p action 1,p … … Reduces combinatorial explosion Sound, and often sufficient to prove trace equivalence 12 24
Why matching sessions? instead of individual actions … … action’ 1,1 action’ n,1 action 1,1 action n,1 … … … … … … action’ 1,p action’ n,p action n,p action 1,p … … Reduces combinatorial explosion Actually a realistic attacker model e.g. for an adversary observing ports Sound, and often sufficient to dynamically allocated to each session prove trace equivalence 12 24
Formally: process pairing 13 24
Formally: process pairing (M ATCH ) (P 1 | … | P n , Q 1 | … | Q n ) (P 1 ,Q σ (1) ), …, (P 1 , Q σ (n) ) σ permutation of {1,…,n} 13 24
Formally: process pairing (M ATCH ) (P 1 | … | P n , Q 1 | … | Q n ) (P 1 ,Q σ (1) ), …, (P 1 , Q σ (n) ) σ permutation of {1,…,n} 훼 훼 훼 (E XEC ) (P,Q) (P’,Q’) if P → P’ and Q → Q’ (in the single-process semantics) 13 24
Formally: process pairing (M ATCH ) (P 1 | … | P n , Q 1 | … | Q n ) (P 1 ,Q σ (1) ), …, (P 1 , Q σ (n) ) σ permutation of {1,…,n} 훼 훼 훼 (E XEC ) (P,Q) (P’,Q’) if P → P’ and Q → Q’ (in the single-process semantics) Trace Equiv. ∀ t ∈ Traces(P), ∃ t’ ∈ Traces(Q), t ~ t’ 13 24
Formally: process pairing (M ATCH ) (P 1 | … | P n , Q 1 | … | Q n ) (P 1 ,Q σ (1) ), …, (P 1 , Q σ (n) ) σ permutation of {1,…,n} 훼 훼 훼 (E XEC ) (P,Q) (P’,Q’) if P → P’ and Q → Q’ (in the single-process semantics) Trace Equiv. ∀ t ∈ Traces(P), ∃ t’ ∈ Traces(Q), t ~ t’ Equiv. by session ∃ t 2 ∈ Traces(P,Q), snd(t 2 ) = t’ 13 24
Optimisations
For trace equivalence [CONCUR15] D. Baelde, S. Delaune, L. Hirschi. Partial-order reductions for security protocols 15 24
For trace equivalence [CONCUR15] D. Baelde, S. Delaune, L. Hirschi. Partial-order reductions for security protocols ∀ t ∈ Traces(P), ∃ t’ ∈ Traces(Q), t ~ t’ 15 24
For trace equivalence [CONCUR15] D. Baelde, S. Delaune, L. Hirschi. Partial-order reductions for security protocols ∀ t ∈ Traces(P), ∃ t’ ∈ Traces(Q), t ~ t’ reduce the number of traces to check? 15 24
For trace equivalence [CONCUR15] D. Baelde, S. Delaune, L. Hirschi. Partial-order reductions for security protocols ∀ t ∈ Traces(P), ∃ t’ ∈ Traces(Q), t ~ t’ reduce the number of traces to check? Main theorem If P,Q are determinate, it is sufficient to consider traces up to permutation of adjacent independent actions. 15 24
For trace equivalence [CONCUR15] D. Baelde, S. Delaune, L. Hirschi. Partial-order reductions for security protocols ∀ t ∈ Traces(P), ∃ t’ ∈ Traces(Q), t ~ t’ reduce the number of traces to check? Main theorem If P,Q are determinate, it is sufficient to consider traces up to permutation of adjacent independent actions. independent 15 24 Concurrent actions with no data flow
Recommend
More recommend
