Logic of Authentication Dennis Kafura Derived from materials authored by: Burrows, Abadi, Needham CS 6204, Spring 2005 1
Goals and Scope ♦ Goals – develop a formalism to reason about authentication protocols – uses • determine guarantees provided by a protocol • compare assumptions needed by different protocols • identify extraneous protocol steps ♦ Out of scope concerns – defects in practical implementations (e.g., deadlocks) – hostile or malicious parties CS 6204, Spring 2005 2
Outline ♦ Notation – Symbols for keys, principals, etc. – Constructs related to beliefs, signatures, etc. ♦ Formalism – Logic postulates : formal rules for reasoning about beliefs – Annotations of protocol steps – Usual logical primitives (conjunction denoted by “,”) ♦ Method – Form idealized protocol – Define assumptions – Prove properties based on logic postulates ♦ Examples – Kerberos – Andrews Secure RPC handshake – Needham-Schroeder Public Key Protocol – CCITT/X.509 Protocol CS 6204, Spring 2005 3
Notation ♦ Principals – A, B, S, … ♦ Keys – Shared keys: K ab , K bs – Public keys: K a , K b ,… – Secret keys: K a-1 , K b-1 , … ♦ Statements – N a , N b ,… CS 6204, Spring 2005 4
Constructs P believes X P is entitled to believe that (or may act as if) X is true P sees X P received a message containing X P said X P sent a message containing X at some time in the past P controls X P is authoritative for X fresh (X) X is within the current run of the protocol P � K � Q K is a shared secret key between P and Q � K � P P has public key K P =X= Q X is a shared secret between P and Q {X} K X encrypted with K <X> Y X combined with Y CS 6204, Spring 2005 5
Logic Postulates (1) (1) Message meaning rules: Secret key Public key Shared secret CS 6204, Spring 2005 6
Logic Postulates (2) (2) Nonce Verification rule: (3) Jurisdiction rule: CS 6204, Spring 2005 7
Logic Postulates (3) (4) Visibility rules: (5) Freshness rule: CS 6204, Spring 2005 8
Annotations and Goals The steps in a protocol are annotated with logical formulas before the first step and after each step: • if X holds before the message P � Q : Y then both X and Q sees Y holds afterwards, • if Y can be derived from X by the logical postulates then Y holds whenever X holds. Conjunctions can be “broken” (i.e., if P said (X,Y) then P said X ) The logic can be used to prove various authentication goals, such as: CS 6204, Spring 2005 9
Kerberos: messages “Real” protocol: “Idealized” protocol: CS 6204, Spring 2005 10
11 Kerberos: assumptions CS 6204, Spring 2005
Kerberos: message 2 (1) A sees { T S , A � K ab � B, {T S , A � K ab � B} Kbs } Kas by annotation rule. (2) A believes S said (T S , A � K ab � B, {T S , A � K ab � B} Kbs ) by assumption A believes A � K as � S and message meaning rule. (3) A believes S said (T S , A � K ab � B) by breaking conjunctions. (4) A believes S believes (T S , A � K ab � B) by assumption A believes fresh(T S ) and nonce verification rule. (5) A believes S believes (A � K ab � B) by breaking conjunctions . (6) A believes S controls (A � K ab � B) by instantiating K ab in assumption A believes S controls (A � K � B). (7) A believes (A � K ab � B) by jurisdiction rule. CS 6204, Spring 2005 12
Kerberos: message 3 (part 1) (1) B sees {T S , A � K ab � B} Kbs , {T a , A � K ab � B} Kab by annotation rule. (2) B believes S said (T S , A � K ab � B), by breaking conjunctions, assumption A believes A � K bs � S and message meaning rule. (3) B believes S believes (T S , A � K ab � B) by assumption A believes fresh(T S ) and nonce verification rule. (4) B believes S believes (A � K ab � B) by breaking conjunctions . (5) B believes S controls (A � K ab � B) by instantiating K ab in assumption B believes S controls (A � K � B). (6) B believes (A � K ab � B) by jurisdiction rule. CS 6204, Spring 2005 13
Kerberos: message 3 (part 2) (1) B sees {T a , A � K ab � B} Kab by breaking conjunctions and annotation rule. (2) B believes A said (T a , A � K ab � B), by proof that B believes A � K ab � B and message meaning rule. (3) B believes A believes (T a , A � K ab � B) by assumption B believes fresh(T a ) and nonce verification rule. (4) B believes A believes (A � K ab � B) by breaking conjunctions . CS 6204, Spring 2005 14
Kerberos: message 4 (1) A sees {T a , A � K ab � B} Kab by breaking conjunctions and annotation rule. (2) A believes B said (T a , A � K ab � B), by proof that B believes A � K ab � B and message meaning rule. (3) A believes B believes (T a , A � K ab � B) by assumption A believes fresh(T a ) and nonce verification rule. (4) A believes B believes (A � K ab � B) by breaking conjunctions . CS 6204, Spring 2005 15
Recommend
More recommend
