Formally (?) Deriving Security Protocols Anupam Datta WIP with Ante Derek, John Mitchell, Dusko Pavlovic October 23, 2002

Goals: Build security protocols in a compositional manner, i.e., from standard sub-protocols. Prove formally using logic that the composition process is sound, i.e., the resulting protocol is correct in a precise sense.

Idea: Capture protocol designers’ intuition in a formal framework.

Example 1 Diffie-Hellman: X Y: g x Y X: g y Property 1: Secrecy X deduces: Knows(Z,g xy ) כֿ Knows(Z,y)

Example 2 Challenge Response: A B: m, A B A: n, sig B {n, m, A} A B: sig A {m, n, B} Property 2: Mutual Authentication A deduces: Created (B, n) Λ Sent (B, msg2)

Composition ISO protocol: A B: g a, A B A: g b, sig B {g b, g a, A} A B: sig A {g a, g b, B} Has both Property 1 & Property 2. Can be inferred that A & B have shared secret, g ab.

Refinement Encrypt signatures: (find-and-replace) A B: g a, A B A: g b, E K {sig B {g b, g a, A}} A B: E K {sig A {g a, g b, B}} Has Property 1 & Property 2. Also Property 3: Identity protection

Other applications… By applying a series of other such simple syntactic rules, we derive the JFK protocol ( proposed protocol to replace IKE as the IPSec key exchange protocol). Technical Report:

Formalization

Notation Cord Calculus and Compositional Logic [Durgin, Mitchell, Pavlovic; 2001] Motivation: “Arrows and messages” representation is inadequate. More descriptive language for describing the actions of the protocol participants. Actions: (νx)generate new term x (x)receive term into x send a term t

Challenge-Response revisited A : ( ) [(νm) (x) …] A <> Input interface Output Interface Actions Attach logical assertions to actions [(νm)] A Created (A, m) This assertion is a required precondition to prove mutual authentication.

ISO revisited A : ( ) [(νx)] ; (m) [ (x) …] A <> 1. Generate new x; compute g x 2. Substitute g x for m in the second cord Created (A, g x ) is a precondition. Mutual authentication can be proved like in challenge-response.

Summary Security protocols can be built in an incremental manner by combining sub- protocols. Future work: Formal framework for reasoning that the composition process preserves the properties of the original sub-protocols.