Using Data Flow Analysis for Automatic Checking of Computational - PowerPoint PPT Presentation

Using Data Flow Analysis for Automatic Checking of Computational Confidentiality in Cryptographic Protocols Peeter Laud Tartu University and Cybernetica AS (joint work with Michael Backes) Teooriapäevad Voorel, 29.09–01.10.2006 – p. 1/33

A distributed system. . . . . . can be modeled as application logic protocol logic cryptographic layer and network stack secure authentic insecure A Our task: analyse it! Does it preserve the secrecy of certain data? Teooriapäevad Voorel, 29.09–01.10.2006 – p. 2/33

The simulatable cryptographic library May serve as the cryptographic layer / network stack. Takes API calls from the layer above to generate new encryption/decryption keys, encrypt and decrypt; both symmetrically and asymmetrically generate new signature keys, sign and verify; take and return (unstructured) data; construct and destruct tuples; send messages to other parties. Receives messages from other parties and forwards them to the layer above. The overlying layer accesses all messages through handles. Teooriapäevad Voorel, 29.09–01.10.2006 – p. 3/33

The abstract cryptographic library application logic protocol logic cryptographic layer and network stack messages on insecure and authentic channels A scheduling A monolithic library — consists of a single machine. Cannot be directly implemented. Main part — a database of terms recording their structure and parties that have access to them. Terms in the database ≈ terms in the Dolev-Yao model. Possible operations also similar to the Dolev-Yao model. Teooriapäevad Voorel, 29.09–01.10.2006 – p. 4/33

Terms Teooriapäevad Voorel, 29.09–01.10.2006 – p. 5/33

Terms x 1 := nonce () h1 nonce Teooriapäevad Voorel, 29.09–01.10.2006 – p. 5/33

Terms x 1 := nonce () x 2 := asymkeypair () h1 h2 nonce sk pk Teooriapäevad Voorel, 29.09–01.10.2006 – p. 5/33

Terms x 1 := nonce () x 2 := asymkeypair () x 3 := pubkey ( x 2 ) h1 h2 h3 nonce sk pk Teooriapäevad Voorel, 29.09–01.10.2006 – p. 5/33

Terms x 1 := nonce () x 2 := asymkeypair () x 3 := pubkey ( x 2 ) x 4 := store (10110 . . . ) h4 data 10110... h1 h2 h3 nonce sk pk Teooriapäevad Voorel, 29.09–01.10.2006 – p. 5/33

Terms x 1 := nonce () x 2 := asymkeypair () x 3 := pubkey ( x 2 ) x 4 := store (10110 . . . ) x 5 := ( x 4 , x 1 , x 3 ) h5 (,,) h4 data 10110... h1 h2 h3 nonce sk pk Teooriapäevad Voorel, 29.09–01.10.2006 – p. 5/33

Terms x 1 := nonce () x 2 := asymkeypair () x 3 := pubkey ( x 2 ) x 4 := store (10110 . . . ) h6 pk x 5 := ( x 4 , x 1 , x 3 ) h5 x 6 := receive (,,) h4 data 10110... h1 h2 h3 nonce sk pk Teooriapäevad Voorel, 29.09–01.10.2006 – p. 5/33

Terms x 1 := nonce () x 2 := asymkeypair () x 3 := pubkey ( x 2 ) h1 x 4 := store (10110 . . . ) sk pk x 5 := ( x 4 , x 1 , x 3 ) h5 (,,) h4 data y 1 := asymkeypair () 10110... h1 h2 h3 nonce sk pk Teooriapäevad Voorel, 29.09–01.10.2006 – p. 5/33

Terms x 1 := nonce () x 2 := asymkeypair () x 3 := pubkey ( x 2 ) h1 x 4 := store (10110 . . . ) sk pk x 5 := ( x 4 , x 1 , x 3 ) h2 h5 (,,) h4 data y 1 := asymkeypair () 10110... y 2 := pubkey ( y 1 ) h1 h2 h3 nonce sk pk Teooriapäevad Voorel, 29.09–01.10.2006 – p. 5/33

Terms x 1 := nonce () x 2 := asymkeypair () x 3 := pubkey ( x 2 ) h1 x 4 := store (10110 . . . ) h6 sk pk x 5 := ( x 4 , x 1 , x 3 ) h2 h5 x 6 := receive (,,) h4 data y 1 := asymkeypair () 10110... y 2 := pubkey ( y 1 ) send y 2 h1 h2 h3 nonce sk pk Teooriapäevad Voorel, 29.09–01.10.2006 – p. 5/33

Terms x 1 := nonce () h7 enc x 2 := asymkeypair () x 3 := pubkey ( x 2 ) h1 x 4 := store (10110 . . . ) h6 sk pk x 5 := ( x 4 , x 1 , x 3 ) h2 h5 x 6 := receive (,,) x 7 := pubenc ( x 6 , x 5 ) h4 data y 1 := asymkeypair () 10110... y 2 := pubkey ( y 1 ) send y 2 h1 h2 h3 nonce sk pk Teooriapäevad Voorel, 29.09–01.10.2006 – p. 5/33

Terms x 1 := nonce () h7 enc h3 x 2 := asymkeypair () x 3 := pubkey ( x 2 ) h1 x 4 := store (10110 . . . ) h6 sk pk x 5 := ( x 4 , x 1 , x 3 ) h2 h5 x 6 := receive (,,) x 7 := pubenc ( x 6 , x 5 ) h4 send x 7 data y 1 := asymkeypair () 10110... y 2 := pubkey ( y 1 ) send y 2 h1 h2 h3 y 3 := receive nonce sk pk Teooriapäevad Voorel, 29.09–01.10.2006 – p. 5/33

Terms x 1 := nonce () h7 enc h3 x 2 := asymkeypair () x 3 := pubkey ( x 2 ) h1 x 4 := store (10110 . . . ) h6 sk pk x 5 := ( x 4 , x 1 , x 3 ) h2 h5 x 6 := receive (,,) h4 x 7 := pubenc ( x 6 , x 5 ) h4 send x 7 data y 1 := asymkeypair () 10110... y 2 := pubkey ( y 1 ) send y 2 h1 h2 h3 y 3 := receive nonce sk pk y 4 := pubdec ( y 1 , y 3 ) Teooriapäevad Voorel, 29.09–01.10.2006 – p. 5/33

Terms x 1 := nonce () h7 enc x 2 := asymkeypair () h3 x 3 := pubkey ( x 2 ) x 4 := store (10110 . . . ) h1 x 5 := ( x 4 , x 1 , x 3 ) h6 sk pk x 6 := receive h2 h5 x 7 := pubenc ( x 6 , x 5 ) (,,) h4 send x 7 h4 y 1 := asymkeypair () data y 2 := pubkey ( y 1 ) 10110... send y 2 y 3 := receive h1 h2 h3 y 4 := pubdec ( y 1 , y 3 ) h5 nonce sk pk y 5 := 2 _ of _ 3( y 4 ) Teooriapäevad Voorel, 29.09–01.10.2006 – p. 5/33

Dolev-Yao vs. simul. cryptolib There exists a large body of work analysing protocols with semantics in the Dolev-Yao model. Our abstract cryptographic library is very similar to it. Some differences: The adversary can learn public key from an asymmetric encryption, the identity of the key from a symmetric encryption. The adversary can create “empty” ciphertexts and garbage terms. The adversary can modify signatures (but cannot change the signed text), empty symmetric ciphertexts — can fix the plaintext. The methods for Dolev-Yao carry over. Teooriapäevad Voorel, 29.09–01.10.2006 – p. 6/33

Simulatability ∃ Sim , such that for all A and almost all H : H A ≈ H Sim A The views of the user H must be indistinguishable. Conditions on H nontrivial, but not too restrictive. Teooriapäevad Voorel, 29.09–01.10.2006 – p. 7/33

A protocol participant Theorem. (B & Pf, S&P ’05) A protocol participant keeps a data item M received from above API calls secret if M is passed downwards only Program as unstructured data. M will not become known to the adversary. API calls M does not affect the control flow of the Program. Simulation also requires No encryption cycles A symmetric key used by a participant does not become known to the adversary Teooriapäevad Voorel, 29.09–01.10.2006 – p. 8/33

Program Language Variables x ∈ Var . Constants / values n, v ∈ Z . Abstract channels c ∈ Chan . Expressions | | ::= symkey ( i ) asymkeypair () e n | | symenc ( e, e ) | asymenc ( e, e ) x | ( e, . . . , e ) | symdec ( e, e ) | asymdec ( e, e ) π j | | | i ( e ) nonce () pubkey ( e ) | | store ( e ) retrieve ( e ) Processes Threads P ::= P act | P inact | Reject receive c x from x ′ .P ::= T P inact ::= T 1 | · · · | T n | ! receive c x from x ′ .P let x := e in P else P ′ P act ::= Program: T 1 | · · · | T n | if e = e then P else P ′ | send c e to e.P inact Teooriapäevad Voorel, 29.09–01.10.2006 – p. 9/33

Processing a message A machine implementing the protocol logic contains a list of threads, each with its own state. When a message M arrives, with the abstract channel C the apparent sender Y then we attempt to give it to the first thread. Teooriapäevad Voorel, 29.09–01.10.2006 – p. 10/33

Giving a message to a thread M Message T 1 T 2 T k − 1 T k T k +1 T n Y Sender S 1 S 2 S k − 1 S k S k +1 S n C Abstr. channel (!) receive c x from x ′ .P Compare c and C . If c = C then. . . Teooriapäevad Voorel, 29.09–01.10.2006 – p. 11/33

Starting the execution of a thread M Message T 1 T 2 T k − 1 T k T k +1 T n Y Sender S 1 S 2 S k − 1 S k S k +1 S n C Abstr. channel (!) receive C x from x ′ .P S k [ x �→ M, x ′ �→ Y ] P Execute: Teooriapäevad Voorel, 29.09–01.10.2006 – p. 12/33

Normal end of execution M Message T 1 T 2 T k − 1 T k T k +1 T n Y Sender S 1 S 2 S k − 1 S k S k +1 S n C Abstr. channel receive C x from x ′ .P S k [ x �→ M, x ′ �→ Y ] P Execute: T ′ 1 | · · · | T ′ S ′ m T ′ T ′ T 1 T 2 T k − 1 T k +1 T n m 1 S ′ S ′ S 1 S 2 S k − 1 S k +1 S n Teooriapäevad Voorel, 29.09–01.10.2006 – p. 13/33

Normal end of execution M Message T 1 T 2 T k − 1 T k T k +1 T n Y Sender S 1 S 2 S k − 1 S k S k +1 S n C Abstr. channel ! receive C x from x ′ .P S k [ x �→ M, x ′ �→ Y ] P Execute: T ′ 1 | · · · | T ′ S ′ m T ′ T ′ T 1 T 2 T k − 1 T k T k +1 T n m 1 S ′ S ′ S 1 S 2 S k − 1 S k S k +1 S n Teooriapäevad Voorel, 29.09–01.10.2006 – p. 14/33

Abnormal end of execution M Message T 1 T 2 T k − 1 T k T k +1 T n Y Sender S 1 S 2 S k − 1 S k S k +1 S n C Abstr. channel (!) receive C x from x ′ .P S k [ x �→ M, x ′ �→ Y ] P Execute: S ′ Reject T 1 T 2 T k − 1 T k T k +1 T n S 1 S 2 S k − 1 S k S k +1 S n Teooriapäevad Voorel, 29.09–01.10.2006 – p. 15/33

Giving a message to a thread M Message T 1 T 2 T k − 1 T k T k +1 T n Y Sender S 1 S 2 S k − 1 S k S k +1 S n C Abstr. channel (!) receive c x from x ′ .P Compare c and C . If c � = C then T 1 T 2 T k − 1 T k T k +1 T n S 1 S 2 S k − 1 S k S k +1 S n Teooriapäevad Voorel, 29.09–01.10.2006 – p. 16/33