Models and proofs for security protocols eronique Cortier 1 V 1 - PowerPoint PPT Presentation

Terms Intruder Decidability Models and proofs for security protocols eronique Cortier 1 V´ 1 LORIA, CNRS - INRIA Cassis project, Universit´ e de Lorraine 1/13

Terms Intruder Decidability Messages Messages are abstracted by terms. Agents : a , b , . . . Nonces : n 1 , n 2 , . . . Keys : k 1 , k 2 , . . Cyphertext : enc( m , k ) Concatenation : pair( m 1 , m 2 ) Example : The message { A , N a } K is represented by : {} enc(pair( A , N a ) , K ) �� K A N a Intuition : only the structure of the message is kept. 2/13

Terms Intruder Decidability More formally - Signature Definition (Signature) A signature is a couple ( F , arity) where F is a finite set of function symbols and arity : F �→ N associates an arity to each symbol. Symbols of arity 0 are called constants. 3/13

Terms Intruder Decidability More formally - Signature Definition (Signature) A signature is a couple ( F , arity) where F is a finite set of function symbols and arity : F �→ N associates an arity to each symbol. Symbols of arity 0 are called constants. Example : F = { enc; pair; a ; k ; n 1 ; n 2 } with arity(enc) = 2 arity(pair) = 2 arity( a ) = arity( k ) = 0 arity( n 1 ) = arity( n 2 ) = 0 We may write � t 1 , t 2 � instead of pair( t 1 , t 2 ). 3/13

Terms Intruder Decidability More formally - Terms Given a signature F of symbols with an arity e.g. { enc; pair; a ; k ; n 1 ; n 2 } and a set X of variables, the set of terms T ( F , X ) is inductively defined as follows : constants terms (e.g. a , k , n 1 , n 2 ) are terms variables are terms f ( t 1 , . . . , t n ) is a term whenever t 1 , . . . , t n are terms. Intuition : from words to trees. → There exists automata on trees instead of (classical) automata on words, see e.g. TATA http ://tata.gforge.inria.fr/ 4/13

Terms Intruder Decidability Subterms The set of positions of a term t is a finite set of sequence of integers. n � pos( f ( t 1 , . . . , t n )) = { ǫ } ∪ i · pos( t i ) i =1 5/13

Terms Intruder Decidability Subterms The set of positions of a term t is a finite set of sequence of integers. n � pos( f ( t 1 , . . . , t n )) = { ǫ } ∪ i · pos( t i ) i =1 Definition The subterm t | p of t at position p ∈ pos( t ) is : t | ǫ = t � t i | p if t = f ( t 1 , . . . , t n ) , 1 ≤ i ≤ n = arity( f ) t i · p = undefined otherwise. 5/13

Terms Intruder Decidability Subterms The set of positions of a term t is a finite set of sequence of integers. n � pos( f ( t 1 , . . . , t n )) = { ǫ } ∪ i · pos( t i ) i =1 Definition The subterm t | p of t at position p ∈ pos( t ) is : t | ǫ = t � t i | p if t = f ( t 1 , . . . , t n ) , 1 ≤ i ≤ n = arity( f ) t i · p = undefined otherwise. Definition The term t ′ is a subterm of t if there exists p ∈ pos( t ) such that t ′ = t | p . The set of subterms of t is denoted by st ( t ). 5/13

Terms Intruder Decidability Substitution Definition A substitution σ is a function from a finite subset (called domain, noted dom( σ )) of X to T ( F , X ). The application of a substitution to a term is defined as follows. σ ( x ) = x if x / ∈ dom( σ ) σ ( f ( t 1 , . . . , t n )) = f ( σ ( t 1 ) , . . . , σ ( t n )) We will write t σ instead of σ ( t ). 6/13

Terms Intruder Decidability Inference rules Definition An inference rule is a rule of the form T 1 · · · T n T with T 1 , . . . , T n , T ∈ T ( F , X ). 7/13

Terms Intruder Decidability Intruder abilities Composition rules x y x y x y pair( x , y ) enc( x , y ) enca( x , y ) 8/13

Terms Intruder Decidability Intruder abilities Composition rules x y x y x y pair( x , y ) enc( x , y ) enca( x , y ) Decomposition rules pair( x , y ) pair( x , y ) y x enc( x , y ) y enca( x , pub( y )) priv( y ) x x 8/13

Terms Intruder Decidability Intruder abilities Composition rules x y x y x y pair( x , y ) enc( x , y ) enca( x , y ) Decomposition rules pair( x , y ) pair( x , y ) y x enc( x , y ) y enca( x , pub( y )) priv( y ) x x Deducibility relation A term u is deducible from a set of terms T , denoted by T ⊢ u , if there exists a prooftree witnessing this fact. 8/13

Terms Intruder Decidability A simple protocol � Bob , k � � Alice , enc(s , k) � 9/13

Terms Intruder Decidability A simple protocol � Bob , k � � Alice , enc(s , k) � Question ? Can the attacker learn the secret s ? 9/13

Terms Intruder Decidability A simple protocol � Bob , k � � Alice , enc(s , k) � Answer : Of course, Yes ! � Alice , enc(s , k) � � Bob , k � enc(s , k) k s 9/13

Terms Intruder Decidability More formally - derivability Definition (One step) A term t is derivable in one step from a set S and an inference I t if there exists T 1 · · · T n system I , notd S ⊢ 1 , t 1 , . . . , t n ∈ S , T and a substitution θ such that t i = T i θ t = T θ 10/13

Terms Intruder Decidability More formally - derivability Definition (One step) A term t is derivable in one step from a set S and an inference I t if there exists T 1 · · · T n system I , notd S ⊢ 1 , t 1 , . . . , t n ∈ S , T and a substitution θ such that t i = T i θ t = T θ Definition (Derivable) A term t is derivable from a set of terms S , noted S ⊢ I t if t ∈ S or there exist terms t 1 , . . . , t n such that t n = t and t i +1 is derivable in one step from S ∪ { t 1 , . . . , t i } . The sequence t 1 , . . . , t n is called proof of S ⊢ I t . 10/13

Terms Intruder Decidability Examples � � S = {�� a , k 3 � , k 4 �} � k 1 , k 2 � , a , k 1 , { k 3 } � k 1 , k 1 � 11/13

Terms Intruder Decidability Examples � � S = {�� a , k 3 � , k 4 �} � k 1 , k 2 � , a , k 1 , { k 3 } � k 1 , k 1 � ? S ⊢ k 1 11/13

Terms Intruder Decidability Examples � � S = {�� a , k 3 � , k 4 �} � k 1 , k 2 � , a , k 1 , { k 3 } � k 1 , k 1 � ? S ⊢ k 1 ? ⊢ k 3 S 11/13

Terms Intruder Decidability Examples � � S = {�� a , k 3 � , k 4 �} � k 1 , k 2 � , a , k 1 , { k 3 } � k 1 , k 1 � ? S ⊢ k 1 ? ⊢ k 3 S ? ⊢ � a , k 3 � S 11/13

Terms Intruder Decidability Examples � � S = {�� a , k 3 � , k 4 �} � k 1 , k 2 � , a , k 1 , { k 3 } � k 1 , k 1 � ? S ⊢ k 1 ? ⊢ k 3 S ? ⊢ � a , k 3 � S ? S ⊢ k 4 11/13

Terms Intruder Decidability Examples � � S = {�� a , k 3 � , k 4 �} � k 1 , k 2 � , a , k 1 , { k 3 } � k 1 , k 1 � ? S ⊢ k 1 ? ⊢ k 3 S ? ⊢ � a , k 3 � S ? S ⊢ k 4 ? S ⊢ � a , k 4 � 11/13

Terms Intruder Decidability Decidability What is it ? 12/13

Terms Intruder Decidability Decision of the intruder problem Given A set of messages S and a message m Question Can the intruder learn m from S that is S ⊢ m ? This problem is decidable in polynomial time. Let’s prove it ! 13/13

Terms Intruder Decidability Decision of the intruder problem Given A set of messages S and a message m Question Can the intruder learn m from S that is S ⊢ m ? This problem is decidable in polynomial time. Let’s prove it ! Lemma (Locality) If there is a proof of S ⊢ m then there is a proof that only uses the subterms of S and m. 13/13