1 © IBM, A Reactively Secure Dolev-Yao-style Cryptographic Library DIMACS, June 2004 Michael Backes, Birgit Pfitzmann, Michael Waidner IBM Research, Zurich

2 © IBM, But can we justify The Big Picture Designed by CAD Verified by CAV Signature Signature Hashfunction Hashfunction Encryption Encryption Key establishment Key establishment Idealized Crypto given ?

3 © IBM, Limits of Automation Full arithmetic is out Probability theory just developing So how do current tools handle cryptography?

4 © IBM, Dolev-Yao Model Idea [DY81] Abstraction as term algebras, e.g., D x (E x (E x (m))) Cancelation Rules, e.g., D x E x =  Well-developed proof theories Abstract data types Equational 1 st -order logic Important for security proofs Inequalities! (Everything that cannot be derived.) Known as “initial model” Important goal: Justify or replace

5 © IBM, Dolev-Yao Model – Variants [Ours] Operators and equations sym enc, pub enc, nonce, payload, pairing, sigs,... Inequalities assumed across operators! Untyped or typed Destructors explicit or implicit Abstraction from probabilism Finite selection, counting, multisets Surrounding protocol language Special-purpose, CSP, pi- calculus,... [any] sign Epk’ (, ) pk mN [EG82, M83, EGS85...]

6 © IBM, Overview of Our Approach Precise system model allowing cryptographic and abstract operations “As secure as” with composition theorem Preservation theorems for security properties Concrete pairs of idealizations and secure realizations In particular: Dolev-Yao style cryptographic library Detailed Proofs Poly-time, cryptographic bisimulations with static information flow analysis, …

7 © IBM, Other Work on DY Justification [AR00, AJ01, L01]: symmetric encryption, passive [HLM03]: public-key encryption, passive [MW04]: public-key encryption, much more restricted, slightly more efficient [L04]: Active symmetric encryption (earlier than ours).

8 © IBM, Idea: Whatever happens with real system could also happen with ideal system. Reactive Simulatability H  A  H A’  Real system Ideal system M2M2M2M2 M1M1M1M1 TH Indistinguishability of random variables view real (H)  view ideal (H) [Y82, GMW87, GM95, LMMS98, HM00, PW00, PW01, C01, …]

9 © IBM, Composition  Given: Does this hold?  And transitivity   

10 © IBM, Cryptographic Idealization Layers Encryption as E(pk, 1 len(m) ) Secure channels Small real abstractions [LMMS98, PW00, C01,...] Low-level crypto (not abstract) Auth/sigs as statement database Real auth/sig’s + integrity lookup Larger abstractions [PW00, PW01, CK02, BJP02,...] Certified mail... [PSW00] Normal cryptographic definitions [LMMS98, C01,...] [GM95] [BPW03...] Related: [SM93,P93] [CL01] VSS Creden- tials...

11 © IBM, Dolev-Yao-style Crypto Abstractions Recall: Term algebra, inequalities Major tasks: Represent ideal and real library in the same way to higher protocols Prevent honest users from stupidity with real crypto objects, but don’t restrict adversary E.g., sending a bitstring that’s almost a signature What imperfections are tolerable / must be allowed?

12 © IBM, Ideal Cryptographic Library E mpk E m Term 1Term 2Not globally known Term 3 Commands, payloads, terms? Payloads / test results, terms? TH UV No crypto outputs! Deterministic! A handles For U: For V: For A: T u,2 T v,1 T a,1 T u,3 - T u,1 -

13 © IBM, Ideal Cryptographic Library (2) TH UV E Epk m Term 4...  T u,4  encrypt(T u,1, T u,3 ) get_type(T v,2 ) T v,3 := decrypt(...) received(U, T v,2 ) send(V, T u,4 ) A E mpk E m Term 1Term 2Term 3 For U: For V: For A: T u,2 T v,1 T a,1 T u,3 - T u,1 -

14 © IBM, Main Differences to Dolev-Yao Tolerable imperfections: Lengths of encrypted messages cannot be kept secret Adversary may include incorrect messages inside encryptions Signature schemes can have memory

15 © IBM, Real Cryptographic Library Commands, payloads, handles Payloads / test results, handles pk c 1  E(pk, m) c 2  E(pk, m) Real system UV No crypto outputs! A c1c1 Bitstrings

16 © IBM, Main Additions to Given Cryptosystems Standard model, standard assumptions Type tags Tagging with keys Additional randomization (e.g., needed when correct machines use A’s keys)

17 © IBM, Proof of Correct Simulation (2) Probabilistic bisimulations Combined system With error sets (of runs) With info-flow analysis Reduction proofs for collisions, guesses, forgeries

18 © IBM, Summary Needham-Schroeder-Lowe (hand-proved) sometimes better TBD: Tool proof; more primitives & variants 