V erification de protocoles cryptographiques en pr esence de th - PowerPoint PPT Presentation

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Pascal Lafourcade LSV, UMR 8643, CNRS, ENS de Cachan & INRIA Futurs LIF, UMR 6166, CNRS & Universit´ e Aix-Marseille 1 Cachan : September 25th 2006 1 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Cryptographic Protocols Osiris communicates with Isis via the net. 2 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Cryptographic Protocols Intruder Osiris communicates with Isis via the net. 2 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Cryptographic Protocols Intruder Osiris communicates with Isis via the net. Secrecy Property: Intruder cannot learn a secret data. 2 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Applications 3 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Cryptography Symmetric Encryption (DES, AES) encryption decryption symmetric key 4 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Cryptography Symmetric Encryption (DES, AES) encryption decryption symmetric key Asymmetric Encryption (RSA) encryption decryption public key private key 4 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Example : 5 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Example : 5 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Example : 5 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Example : Shamir 3-Pass Protocol 1 O → I : { m } K O 5 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Example : Shamir 3-Pass Protocol 1 O → I : { m } K O 2 I → O : {{ m } K O } K I 5 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Example : Shamir 3-Pass Protocol 1 O → I : { m } K O Commutative 2 I → O : {{ m } K O } K I = {{ m } K I } K O Encryption 5 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Example : Shamir 3-Pass Protocol 1 O → I : { m } K O Commutative 2 I → O : {{ m } K O } K I = {{ m } K I } K O Encryption 3 O → I : { m } K I 5 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Attacks Cryptanalysis 6 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Attacks Cryptanalysis 6 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Attacks Cryptanalysis Logical Attack Perfect Encryption hypothesis Needham-Schroeder Public Key Protocol (1978) “Man in the middle attack” [Lowe’96] 6 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Attacks Cryptanalysis Logical Attack + Algebraic properties Perfect Encryption hypothesis Needham-Schroeder Public Key Protocol (1978) “Man in the middle attack” [Lowe’96] 6 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Formal Approach Symbolic abstraction Messages represented by terms - { m } k - � m 1 , m 2 � Perfect encryption hypothesis 7 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Formal Approach Symbolic abstraction Messages represented by terms - { m } k - � m 1 , m 2 � Perfect encryption hypothesis Useful abstraction [Clark & Jacob’97] Automatic verification with Tools: AVISPA, Casper/FDR, Hermes, Murphi, NRL, Proverif, Scyther ... 7 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Formal Approach Symbolic abstraction Messages represented by terms - { m } k - � m 1 , m 2 � Perfect encryption hypothesis + algebraic properties Useful abstraction [Clark & Jacob’97] Automatic verification with Tools: AVISPA, Casper/FDR, Hermes, Murphi, NRL, Proverif, Scyther ... 7 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation The Intruder is the Network (Worst Case) 8 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation The Intruder is the Network (Worst Case) Listen Passive: Intruder deduction problem 8 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation The Intruder is the Network (Worst Case) Listen Intercept message (Re)play message Passive: Intruder deduction problem Delete message Active: Security problem 8 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation The Intruder is the Network (Worst Case) Listen Intercept message (Re)play message Passive: Intruder deduction problem Delete message Active: Security problem Intruder Capabilities (Dolev-Yao Model 80’s) Encryption, Decryption with a key Pairing, Projection. 8 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation The Intruder is the Network (Worst Case) Listen Intercept message (Re)play message Passive: Intruder deduction problem Delete message Active: Security problem Intruder Capabilities (Dolev-Yao Model 80’s) Encryption, Decryption with a key Pairing, Projection. In general security problem undecidable [DLMS’99, AC’01] 8 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation The Intruder is the Network (Worst Case) Listen Intercept message (Re)play message Passive: Intruder deduction problem Delete message Active: Security problem Intruder Capabilities (Dolev-Yao Model 80’s) Encryption, Decryption with a key Pairing, Projection. In general security problem undecidable [DLMS’99, AC’01] Bounded number of session ⇒ Decidability [AL’00, RT’01] 8 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Logical Attack on Shamir 3-Pass Protocol (I) Perfect encryption one-time pad (Vernam Encryption) { m } k = m ⊕ k XOR Properties (ACUN) ( x ⊕ y ) ⊕ z = x ⊕ ( y ⊕ z ) A ssociativity x ⊕ y = y ⊕ x C ommutativity x ⊕ 0 = x U nity x ⊕ x = 0 N ilpotency 9 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Logical Attack on Shamir 3-Pass Protocol (I) Perfect encryption one-time pad (Vernam Encryption) { m } k = m ⊕ k XOR Properties (ACUN) ( x ⊕ y ) ⊕ z = x ⊕ ( y ⊕ z ) A ssociativity x ⊕ y = y ⊕ x C ommutativity x ⊕ 0 = x U nity x ⊕ x = 0 N ilpotency Vernam encryption is a commutative encryption : {{ m } K O } K I = ( m ⊕ K O ) ⊕ K I = ( m ⊕ K I ) ⊕ K O = {{ m } K I } K O 9 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Logical Attack on Shamir 3-Pass Protocol (II) Perfect encryption one-time pad (Vernam Encryption) { m } k = m ⊕ k Shamir 3-Pass Protocol 1 O → I : m ⊕ K O 2 I → O : ( m ⊕ K O ) ⊕ K I 3 O → I : m ⊕ K I Passive attacker : m ⊕ K O m ⊕ K O ⊕ K I m ⊕ K I 10 / 37

V´ erification de protocoles cryptographiques en pr´ esence de th´ eories ´ equationnelles Introduction & Motivation Logical Attack on Shamir 3-Pass Protocol (II) Perfect encryption one-time pad (Vernam Encryption) { m } k = m ⊕ k Shamir 3-Pass Protocol 1 O → I : m ⊕ K O 2 I → O : ( m ⊕ K O ) ⊕ K I 3 O → I : m ⊕ K I Passive attacker : m ⊕ K O ⊕ m ⊕ K O ⊕ K I ⊕ m ⊕ K I = m 10 / 37