Section: New Results
Security protocol verification
Cryptographic protocols are successfully analyzed using formal methods and many techniques have appeared in the litterature [Oops!] . However, formal approaches usually consider the encryption schemes as black boxes and assume that an adversary cannot learn anything from an encrypted message except if he has the key. Such an assumption is too strong in general since some attacks exploit in a clever way the interaction between protocol rules and properties of cryptographic operators.
In the context of security protocol verification, two PhD theses have been defended this year. Heinrich Hoerdegen [Oops!] has studied the link between several symbolic models and the encoding of the cryptographic primitives used in practice to translate from one model to another. He has also proposed a first setting for recursive protocols. Eugen Zalinescu [Oops!] has obtained four main contributions in decidability and transfer results: the treatment of more involved cryptographic primitives like CBC encryption, blind signatures; a link between simple and strong secrecy [Oops!] ; the decidability of the existence of key cycles [Oops!] and a methodology for designing secure protocols [Oops!] .
Extension of the Dolev-Yao model
Some attacks exploit in a clever way the interaction between protocol rules and algebraic properties of cryptographic operators. In  , we provide a list of such properties and attacks as well as existing formal approaches for analyzing cryptographic protocols under algebraic properties.
Unbounded number of sessions. We have proposed a new class of security protocols using XOR, for which secrecy after an unbounded number of sessions is decidable [Oops!] . The new class is important as it contains examples of key-management APIs of Hardware Security Modules, such as the IBM 4758 CCA API, which lie outside the classes for which secrecy has previously been shown to be decidable. We have further investigated this class of applications in [Oops!] where we model key conjuring , the process by which an attacker obtains an unknown, encrypted key by repeatedly calling a cryptographic API function with random values in place of keys. We propose a formalism for detecting computationally feasible key conjuring operations, incorporated into a Dolev-Yao style model of the security API. We show that security in the presence of key conjuring operations is decidable for a particular class of APIs, which includes the key management API ofIBM's Common Cryptographic Architecture (CCA).
General equational theories. We have derived decision procedures for symbolic analysis of protocols that apply to several algebraic operators associated with general classes of intruder theories.
Focusing on ground deducibility and static equivalence (checking whether two sequences of messages are indistinguishable to an attacker), we have shown [Oops!] that decidability results can be easily combined for any disjoint equational theories: if the deducibility and indistinguishability relations are decidable for two disjoint theories, they are also decidable for their union. As an application, new decidability results can be obtained using this combination theorem. In [Oops!] , [Oops!] we propose a general setting for solving deducibility and indistinguishability for an important class (called monoidal) of these theories. Our setting relies on the correspondence between a monoidal theory E and a semiring which allows us to give an algebraic characterization of the deducibility and indistinguishability problems. As a consequence we recover easily existing decidability results and obtain several new ones.
In cryptographic protocols analysis, a treacherous set of terms is one from which an intruder can get access to what was intended to be secret, by adding on to the top of a sequence of elements of this set, a cap formed of symbols legally part of his/her knowledge. In [Oops!] , we give sufficient conditions on the rewrite system modeling the intruder's abilities, such as using encryption and decryption functions, to ensure that it is decidable if such caps exist. The following classes of intruder systems are studied: linear, dwindling, -strong, and optimally reducing; and depending on the class considered, the cap problem (“find a cap for a given set of terms”) is shown respectively to be in P, NP-complete, decidable, and undecidable.
Soundness of the Dolev-Yao model
All the previous results rely on symbolic models of protocol executions in which cryptographic primitives are abstracted by symbolic expressions. This approach enables significantly simple and often automated proofs. However, the guarantees that it offers have been quite unclear compared to cryptographic models that consider issues of complexity and probability. Cryptographic models capture a strong notion of security, guaranteed against all probabilistic polynomial-time attacks.
We have shown in recent years that it is possible to obtain the best of both cryptographic and formal worlds in the case of public encryption: fully automated proofs and strong, clear security guarantees. Specifically, for the case of protocols that use signatures and asymmetric encryption, we have established that symbolic integrity and secrecy proofs are sound with respect to the computational model.
These soundness results require to explicitly represent the dependency of ciphertexts on randomness as labels. We have shown in [Oops!] that for a large class of security properties (that includes rather standard formulations for secrecy and authenticity properties), security of protocols in the simpler model implies security in the label-based model. Based on these results, we have implemented an AVISPA module for verifying security properties in a standard cryptographic model.
Designing secure protocols
We have proposed in [Oops!] a general transformation that maps a cryptographic protocol that is secure in an extremely weak sense (essentially in a model where no adversary is present) into a protocol that is secure against a fully active adversary which interacts with an unbounded number of protocol sessions, and has absolute control over the network. The transformation works for arbitrary protocols with any number of participants, written with usual cryptographic primitives. Our transformation provably preserves a large class of security properties that contains secrecy and authenticity.
An important byproduct contribution is a modular protocol development paradigm where designers focus their effort on an extremely simple execution setting – security in more complex settings being ensured by our generic transformation. Conceptually, the transformation is very simple, and has a clean, well motivated design. Each message is tied to the session for which it is intended via digital signatures and on-the-fly generated session identifiers, and prevents replay attacks by encrypting the messages under the recipient's public key.
Even when a protocol has been proved secure, there is absolutely no guarantee if the protocol is executed in an environment where other protocols, possibly sharing some common identities and keys like public keys or long-term symmetric keys, are executed. In [Oops!] , we show that security of protocols can be easily composed. More precisely, we show that whenever a protocol is secure, it remains secure even in an environment where arbitrary protocols are executed, provided each encryption contains some tag identifying each protocol, like e.g. the name of the protocol.
Security properties and advanced class of protocols
Most previous results focus on secrecy and authentication for simple protocols like the ones from Clark & Jacob library. We explore several directions to cover more complex protocols and security properties.
Non-repudiation protocols have an important role in many areas where secured transactions with proofs of participation are necessary. Formal methods are clever and without error, therefore using them for verifying such protocols is crucial. In this purpose, in collaboration with F. Klay (France Telecom R&D) and J. Santiago (UFRN, Natal) [Oops!] , we have shown how to partially represent non-repudiation as a combination of authentications on the Fair Zhou-Gollmann protocol. Because of the limits of this method, we have defined a new one based on the handling of the knowledge of protocol participants. This method is very general and is of natural use, as it consists in adding simple annotations, like for authentication problems. The method is very easy to implement in tools able to handle participants knowledge. We have implemented it in the AVISPA Tool and analyzed the optimistic Cederquist-Corin-Dashti protocol, discovering two unknown attacks [Oops!] . This extension of the AVISPA Tool for handling non-repudiation opens a highway to the specification of many other properties, without any more change in the tool itself.
Some cryptographic tasks, such as contract signing and other related tasks, need to ensure complex, branching time security properties. When defining such properties one needs to deal with subtle problems regarding the scheduling of non-deterministic decisions, the delivery of messages sent on resilient (non-adversarially controlled) channels, fair executions (executions where no party, both honest and dishonest, is unreasonably precluded to perform its actions), and defining strategies of adversaries against all possible non-deterministic choices of parties and arbitrary delivery of messages via resilient channels. In [Oops!] , [Oops!] we develop a cryptographic model that deals with all of the above problems. Based on this model and a new notion of fair scheduling, we provide a definition of a prominent branching time property of contract signing protocols, namely balance, and give the first cryptographic proof that the Asokan-Shoup-Waidner two-party contract signing protocol is balanced.
Two styles of definitions are usually considered to express that a security protocol preserves the confidentiality of a data s . Reachability-based secrecy means that s should never be disclosed while equivalence-based secrecy states that two executions of a protocol with distinct instances for s should be indistinguishable to an attacker. In [Oops!] , we have initiated a systematic investigation of the situations where syntactic secrecy entails strong secrecy. We have shown that in the passive case, reachability-based secrecy actually implies equivalence-based secrecy for digital signatures, symmetric and asymmetric encryption provided that the primitives are probabilistic. For active adversaries, we provide sufficient (and rather tight) conditions on the protocol for this implication to hold.
Group Protocols. Emerging applications require secure group communications involving hierarchical architecture protocols. Designing such secure hierarchical protocols is not straightforward, and their verification becomes a major issue in order to avoid any possible security attack and vulnerability. Several attempts have been made to deal with formal verification of group protocols, but to our knowledge, none of them did address the security of hierarchical ones. In [Oops!] , in collaboration with the MADYNES project, we have presented the specific challenges and security issues of hierarchical secure group communications, and the work that we did for their verification. We have also shown how the AtSe back-end of the AVISPA tool was used to verify one of these protocols.
Intruder knowledge approximation
When the number of sessions is unbounded, the security problem of cryptographic protocols is undecidable. Hence, we have proposed automated computations of over and under-approximations of the intruder knowledge using tree automata techniques  . These approximation techniques are implemented in TA4SP  , one of the tools of the AVISPA platform.
In  , we have shown how to semi-decide whether a security protocol using algebraic properties of cryptographic primitives is safe. Our current work improves the over-approximation-based algorithms in  by providing a new quadratic completion algorithm to efficiently handle algebraic properties.
Recently, we have investigated the dual - insecurity - problem: in [Oops!] we explain how to semi-decide whether a protocol using cryptographic primitive algebraic properties is unsafe. We have shown that under some constraints – often satisfied in practice – on the term rewriting systems modeling protocols it is possible to detect attacks in the rewriting model. The proposed approach for detecting attacks is currently supported by the tool TA4SP successfully applied for analysing the NSPK-xor protocol and the Diffie-Hellman protocol. However, some efforts have still to be done in order to raise a real attack from the diagnostic done in the rewriting model.