Timed Spi-Calculus with Types for Secrecy and Authenticity - PowerPoint PPT Presentation

Timed Spi-Calculus with Types for Secrecy and Authenticity Christian Haack Alan Jeffrey CTI, DePaul University Bell Labs, Lucent Technology fpl.cs.depaul.edu/chaack fpl.cs.depaul.edu/ajeffrey Timed Spi-Calculus with Types for Secrecy and Authenticity – p.1/ ??

Type Systems for Protocol Verification Type systems for verifying secrecy and/or authenticity in the spi-calculus: Abadi, Abadi/Blanchet, Gordon/Jeffrey, and more. Other methods and systems for protocol verification: model checking (e.g. Casper), BAN logic, proof assistants (e.g. Isabelle), automatic theorem provers (e.g. ProVerif), static analysis, and more. Timed Spi-Calculus with Types for Secrecy and Authenticity – p.2/ ??

Type Systems for Protocol Verification Type systems for verifying secrecy and/or authenticity in the spi-calculus: Abadi, Abadi/Blanchet, Gordon/Jeffrey, and more. Other methods and systems for protocol verification: model checking (e.g. Casper), BAN logic, proof assistants (e.g. Isabelle), automatic theorem provers (e.g. ProVerif), static analysis, and more. Typechecking (our approach): Human help required: type annotations. No finiteness needed. For instance, arbitrary many session runs are allowed. Our type systems are incomplete. Timed Spi-Calculus with Types for Secrecy and Authenticity – p.2/ ??

Why Timed Spi? Untimed spi-calculus models perfect cryptography. Timed Spi-Calculus with Types for Secrecy and Authenticity – p.3/ ??

Why Timed Spi? Untimed spi-calculus models perfect cryptography. A more realistic model: Distinguish between long- and short-term keys. Short-term keys can be cracked given enough time. Such a model allows us to express key compromise attacks. Timed Spi-Calculus with Types for Secrecy and Authenticity – p.3/ ??

Why Timed Spi? Untimed spi-calculus models perfect cryptography. A more realistic model: Distinguish between long- and short-term keys. Short-term keys can be cracked given enough time. Such a model allows us to express key compromise attacks. Prime examples: key distribution protocols (KDPs) The distributed session keys are short-term. KDPs must make sure that received session keys have been recently generated. Previous type systems for untimed spi did not verify recency, our new type system for timed spi does. Timed Spi-Calculus with Types for Secrecy and Authenticity – p.3/ ??

Example: NSSK A,B, na A S { ℓ 1 � na , B, kab , { ℓ 2 � A, kab �} kbs �} kas A S { ℓ 2 � A, kab �} kbs A B { ℓ 3 � nb �} kab A B { ℓ 4 � nb �} kab A B Goal: At the end of a complete run both A and B want to be sure that kab is a fresh, secret short-term key shared with the other principal. Timed Spi-Calculus with Types for Secrecy and Authenticity – p.4/ ??

An Attack on NSSK A,B, na A S { ℓ 1 � na , B, kab , { ℓ 2 � A, kab �} kbs �} kas A S { ℓ 2 � A, oldkab �} kbs A I B { ℓ 3 � nb �} oldkab A I B { ℓ 4 � nb �} oldkab A I B B falsely believes that oldkab is a fresh, secret short-term key shared with A . But really oldkab is an expired key that has been cracked by I . Timed Spi-Calculus with Types for Secrecy and Authenticity – p.5/ ??

Expressing NSSK in Typed Spi ∆ P B ( a : Un , b : Un , s : Un , kbs : lt - Key , net : Un ) = inp net ( ctxt : Un ); { ℓ 2 � A, kab �} kbs B decrypt ctxt is { x : lt - Auth } kbs ; · match x is ℓ 2 � a, kab : ? � ; { ℓ 3 � nb �} kab B · new ( nb : Un ); ( out net ℓ 3 � nb � | { ℓ 4 � nb �} kab B inp net ( ctxt ′ : Un ); · decrypt ctxt ′ is { y : ? } kbs ; match y is ℓ 4 � nb � ; st - secret ( kab )) Timed Spi-Calculus with Types for Secrecy and Authenticity – p.6/ ??

Expressing NSSK in Typed Spi ∆ P B ( a : Un , b : Un , s : Un , kbs : lt - Key , net : Un ) = inp net ( ctxt : Un ); { ℓ 2 � A, kab �} kbs B decrypt ctxt is { x : lt - Auth } kbs ; · match x is ℓ 2 � a, kab : ? � ; { ℓ 3 � nb �} kab B · new ( nb : Un ); ( out net ℓ 3 � nb � | { ℓ 4 � nb �} kab B inp net ( ctxt ′ : Un ); · decrypt ctxt ′ is { y : ? } kbs ; match y is ℓ 4 � nb � ; st - secret ( kab )) ∆ System ( a : Un , b : Un , s : Un , net : Un ) = new ( kas : lt - Key ); new ( kbs : lt - Key ); ! P A ( a, b, s, kas , net ) | ! P B ( a, b, s, kbs , net ) | ! P S ( a, b, s, kas , kbs , net ) Timed Spi-Calculus with Types for Secrecy and Authenticity – p.6/ ??

Our Model of Time A clock-tick represents the end of an epoch, which is the time required for cracking short-term keys. Timed Spi-Calculus with Types for Secrecy and Authenticity – p.7/ ??

Our Model of Time A clock-tick represents the end of an epoch, which is the time required for cracking short-term keys. New primitive: crack M is { x : Un } y : Un ; P Cracking uses up all time of the current epoch. All other actions are instantaneous. Cracking allows us to express key-compromising attackers, for instance, the attack on NSSK. Timed Spi-Calculus with Types for Secrecy and Authenticity – p.7/ ??

Our Model of Time A clock-tick represents the end of an epoch, which is the time required for cracking short-term keys. New primitive: crack M is { x : Un } y : Un ; P Cracking uses up all time of the current epoch. All other actions are instantaneous. Cracking allows us to express key-compromising attackers, for instance, the attack on NSSK. Specification primitive for short-term secrecy: st - secret ( M ) A short-term secret is secret within the current epoch. Timed Spi-Calculus with Types for Secrecy and Authenticity – p.7/ ??

Our Model of Time A clock-tick represents the end of an epoch, which is the time required for cracking short-term keys. New primitive: crack M is { x : Un } y : Un ; P Cracking uses up all time of the current epoch. All other actions are instantaneous. Cracking allows us to express key-compromising attackers, for instance, the attack on NSSK. Specification primitive for short-term secrecy: st - secret ( M ) A short-term secret is secret within the current epoch. Specification primitives for short-term authenticity. Timed Spi-Calculus with Types for Secrecy and Authenticity – p.7/ ??

Our Model of Time A clock-tick represents the end of an epoch, which is the time required for cracking short-term keys. New primitive: crack M is { x : Un } y : Un ; P Cracking uses up all time of the current epoch. All other actions are instantaneous. Cracking allows us to express key-compromising attackers, for instance, the attack on NSSK. Specification primitive for short-term secrecy: st - secret ( M ) A short-term secret is secret within the current epoch. Specification primitives for short-term authenticity. Input expires with a clock-tick, modelling timeout. Timed Spi-Calculus with Types for Secrecy and Authenticity – p.7/ ??

Operational Semantics Instantaneous reductions as usual ... out N M | inp N ( x : T ); P → P { x ← M } Timed Spi-Calculus with Types for Secrecy and Authenticity – p.8/ ??

Operational Semantics Instantaneous reductions as usual ... out N M | inp N ( x : T ); P → P { x ← M } ... plus tick-reductions that use up a clock tick. σ Q σ → P ′ → Q ′ P P | Q σ → Q | Q ′ Q = st - secret ( K ) or Q = public ( K ) σ crack { M } K is { x : T } y : U ; P | Q → P { x, y ← M, K } | public ( K ) st - secret ( M ) σ σ → public ( M ) inp N ( x : T ); P → 0 Timed Spi-Calculus with Types for Secrecy and Authenticity – p.8/ ??

Operational Semantics Instantaneous reductions as usual ... out N M | inp N ( x : T ); P → P { x ← M } ... plus tick-reductions that use up a clock tick. σ Q σ → P ′ → Q ′ P P | Q σ → Q | Q ′ Q = st - secret ( K ) or Q = public ( K ) σ crack { M } K is { x : T } y : U ; P | Q → P { x, y ← M, K } | public ( K ) st - secret ( M ) σ σ → public ( M ) inp N ( x : T ); P → 0 ( → ∪ σ ∆ → ) ∗ ⇒ = Timed Spi-Calculus with Types for Secrecy and Authenticity – p.8/ ??

Robust Safety An opponent is an Un -typed process, that does not contain secrecy declarations τ - secret ( M ) . Timed Spi-Calculus with Types for Secrecy and Authenticity – p.9/ ??

Robust Safety An opponent is an Un -typed process, that does not contain secrecy declarations τ - secret ( M ) . ... but opponents may declare public ( M ) . Timed Spi-Calculus with Types for Secrecy and Authenticity – p.9/ ??

Robust Safety An opponent is an Un -typed process, that does not contain secrecy declarations τ - secret ( M ) . ... but opponents may declare public ( M ) . P is safe iff P �⇒ public ( M ) | τ - secret ( M ) | Q . Timed Spi-Calculus with Types for Secrecy and Authenticity – p.9/ ??

Robust Safety An opponent is an Un -typed process, that does not contain secrecy declarations τ - secret ( M ) . ... but opponents may declare public ( M ) . P is safe iff P �⇒ public ( M ) | τ - secret ( M ) | Q . P is robustly safe if P | O is safe for all opponents O . Timed Spi-Calculus with Types for Secrecy and Authenticity – p.9/ ??

Robust Safety An opponent is an Un -typed process, that does not contain secrecy declarations τ - secret ( M ) . ... but opponents may declare public ( M ) . P is safe iff P �⇒ public ( M ) | τ - secret ( M ) | Q . P is robustly safe if P | O is safe for all opponents O . For instance: NSSK is safe. NSSK it is not robustly safe. Timed Spi-Calculus with Types for Secrecy and Authenticity – p.9/ ??