Logic for Protocol Composition A. Datta, A. Derek, J. Mitchell, D. Pavlovic

Goals uProtocol derivation Build security protocols by combining parts from standard sub-protocols uProof of correctness Prove protocols correct using logic that follows steps of derivation Current state of our art: derivation and correctness proofs not quite in sync

Example 1 uDiffie-Hellman X  Y: g x Y  X: g y Shared secret (with someone) –X deduces: Knows(Z,g xy ) כֿ Knows(Z,y) Authenticated Identity Protection

Example 2 uChallenge Response: A  B: m, A B  A: n, sig B {n, m, A} A  B: sig A {m, n, B} Shared secret (with someone) Authenticated –A deduces: Created (B, n) Λ Sent (B, msg2) Identity Protection

Composition uISO protocol: A  B: g a, A B  A: g b, sig B {g b, g a, A} A  B: sig A {g a, g b, B} Shared secret g ab Authenticated Identity Protection

Refinement uEncrypt signatures: A  B: g a, A B  A: g b, E K {sig B {g b, g a, A}} A  B: E K {sig A {g a, g b, B}} Shared secret g ab Authenticated Identity Protection

Basic challenge-response CR CR-E CR-S 1 CR-E 1 NSL 0 STS 0 CR-S

Basic challenge-response CR CR-E CR-S 1 CR-E 1 NSL 0 STS 0 CR-S c(m) r(m) A B A: “B was alive after m was generated.” B: “X wants to talk, and knows that I am alive.” [A and B know each other.]

E B (m) m A B A: “B was alive after m was generated.” B: “X wants to talk, and knows that I am alive.” [A and B know each other.] Basic challenge-response CR CR-E CR-S 1 CR-E 1 NSL 0 STS 0 CR-S

E B (m) m A B E A (n) n Basic challenge-response CR CR-E CR-S 1 CR-E 1 NSL 0 STS 0 CR-S

E B (m) A B m,E A (n) n Basic challenge-response CR CR-E CR-S 1 CR-E 1 NSL 0 STS 0 CR-S

E B (m) A B E A (m,n) E B (n) Basic challenge-response CR CR-E CR-S 1 CR-E 1 NSL 0 STS 0 CR-S

Basic challenge-response CR CR-E CR-S 1 CR-E 1 NSL 0 STS 0 CR-S m S B (m) A B

Basic challenge-response CR CR-E CR-S 1 CR-E 1 NSL 0 STS 0 CR-S m S B (m) A B n S A (n)

Basic challenge-response CR CR-E CR-S 1 CR-E 1 NSL 0 STS 0 CR-S m S B (m),n A B S A (n)

Basic challenge-response CR CR-E CR-S 1 CR-E 1 NSL 0 STS 0 CR-S m S B (m),n,n A B S A (n),m

Basic challenge-response CR CR-E CR-S 1 CR-E 1 NSL 0 STS 0 CR-S m S B (m,n),n A B S A (n,m) B: “A wants to talk, was alive after n was generated and knows that I am alive after m.” [A and B know each other.] A: “B accepts session, was alive after m was generated and knows that I am alive after n.”

STS family m=g x, n=g y k=g xy STS 0H STS a STS aH STS H STS 0 STS PH JFK 1 distribute certificates cookie open responder JFK 0 symmetric hash JFK protect identities RFK STS P

m=g x, n=g y k=g xy m S B (m,n),n S A (n,m) STS family STS 0H STS a STS aH STS H STS 0 STS PH JFK 1 distribute certificates cookie open responder JFK 0 symmetric hash JFK protect identities STS P RFK

m=g x, n=g y k=g xy STS family STS 0H STS a STS aH STS H STS 0 STS PH JFK 1 distribute certificates cookie open responder JFK 0 m n, H mn m, n, H mn,S A (m,n) S B (n,m) symmetric hash JFK protect identities STS P RFK

m=g x, n=g y k=g xy m C B, S B (m,n),n C A, S A (n,m) STS family STS 0H STS a STS aH STS H STS 0 STS PH JFK 1 distribute certificates cookie open responder JFK 0 symmetric hash JFK protect identities RFK STSP

m=g x, n=g y k=g xy m n, H mn m, n, H mn,C A, S A (m,n) C B, S B (n,m) STS family STS 0H STS a STS aH STS H STS 0 STS PH JFK 1 distribute certificates cookie open responder JFK 0 symmetric hash JFK protect identities RFK STS+

m=g x, n=g y k=g xy m n, C B, H mn m, n, H mn,C A, S A (m,n) S B (n,m) STS family STS 0H STS a STS aH STS H STS 0 JFK 1 distribute certificates cookie open responder JFK 0 STS PH JFK protect identities symmetric hash RFK STS P

m=g x, n=g y k=g xy m n, C B, E k (S B (n, m)) C A, E k (S A (m,n)) m=g x n=g y k=g xy STS family STS 0H STS a STS aH STS H STS 0 JFK 1 distribute certificates cookie open responder JFK 0 STS PH JFK protect identities symmetric hash RFK STS P

m n, H mn m, n, H mn, C A, E k (S A (m,n)) C B, E k (S B (n, m)) m=g x n=g y k=g xy m=g x, n=g y k=g xy STS family STS 0H STS a STS aH STS H STS 0 JFK 1 distribute certificates cookie open responder JFK 0 STS PH JFK protect identities symmetric hash RFK STS P

m=g x, n=g y k=g xy STS family STS 0H STS a STS aH STS H STS 0 STS PH JFK 1 distribute certificates cookie open responder JFK 0 m n, C B, H mn m, n, H mn, C A,E k (S A (m,n,C B )) E k (S B (n, m)) m=g x n=g y k=g xy JFK protect identities symmetric hash RFK STS P

m n, E k (C B, S B (n, m)) E k (C A, S A (m,n)) m=g x n=g y k=g xy m=g x, n=g y k=g xy STS family STS 0H STS a STS aH STS H STS 0 JFK 1 distribute certificates cookie open responder symmetric hash JFK 0 STS PH JFK protect identities RFK STS P

m n, H mn m, n, H mn, E k (C A, S A (m,n)) E k (C B, S B (n, m)) m=g x n=g y k=g xy m=g x, n=g y k=g xy STS family STS 0H STS a STS aH STS H STS 0 STS PH JFK 1 distribute certificates cookie open responder JFK 0 symmetric hash JFK protect identities RFK STS P

m=g x, n=g y k=g xy STS family STS 0H STS a STS aH STS H STS 0 STS PH JFK 1 distribute certificates cookie open responder JFK 0 symmetric hash JFK protect identities RFK m n, C B, H mn m, n, H mn, E k (C A, S A (m,n,C B )) E k (S B (n, m)) m=g x n=g y k=g xy STS P

m n, H mn m, n, H mn, E k (C A,S A (m,n)), #(I) E k (C B,S B (n, m)), #(R) m=g x n=g y k=g xy m=g x, n=g y k=g xy STS family STS 0H STS a STS aH STS H STS 0 STS PH JFK 1 distribute certificates cookie open responder JFK 0 symmetric hash JFK protect identities RFK STS P

Protocol logic uAlice’s information Protocol Private data Sends and receives Honest Principals, Attacker Send Receive Protocol Private Data

Example (over used) { A, Nonce a } { Nonce a, … } KaKa Kb AB uAlice assumes that only Bob has Kb -1 u Alice generated Nonce a and knows that some X decrypted first message u Since only X knows Kb -1, Alice knows X=Bob

More subtle example: Bob’s view { A, Nonce a } { Nonce a, B, Nonce b } { Nonce b } KaKa Kb AB u Bob assumes that Alice follows protocol u Since Alice responds to second message, Alice must have sent the first message

Execution model uProtocol “Program” for each protocol role uInitial configuration Set of principals and key Assignment of  1 role to each principal uRun xx zz  {x} B  ({x} B )  {z} B  decr A B C ({z} B ) Position in run

Formulas true at a position in run uAction formulas a ::= Send(P,m) | Receive (P,m) | New(P,t) | Decrypt (P,t) | Verify (P,t) uFormulas  ::= a | Has(P,t) | Fresh(P,t) | Honest(N) | Contains(t1, t2) |  |  1   2 |  x  |  |  uExample After(a,b) =  (b   a)

Modal Formulas uAfter actions, condition [ actions ] P  where P =  princ, role id  uBefore/after assertions  [ actions ] P  uComposition rule  [ S ] P   [ T ] P   [ ST ] P 

Example: Bob’s view of NSL uBob knows he’s talking to Alice [ recv encrypt( Key(B),  A,m  ); new n; send encrypt( Key(A),  m, B, n  ); recv encrypt( Key(B), n ) ] B Honest(A)  Csent(A, msg1)  Csent(A, msg3) where Csent(A, …)  Created(A, …)  Sent(A, …) msg1msg3

Modal Formulas uAfter actions, condition [ actions ] P  where P =  princ, role id  uBefore/after assertions  [ actions ] P  uComposition rule  [ S ] P   [ T ] P   [ ST ] P 

Soundness of composition rule uFormula  [ S ] P  uMeans For any sequence of actions S’ If [ S’ ] P  then [ S’S ] P  uTherefore  [ S ] P   [ T ] P   [ ST ] P 

Application DH + CR = ISO uInitiator role of DH [ new a ] I Fresh(I, g a )  HasAlone(I, a) uInitiator role of CR Fresh(I, m) [send … receive … B… send] Honest(B)  ActionsInOrder(…) uCombination Substitute g a for m in CR Apply composition rule, persistence Obtain assertion about ISO initiator

Additional issues uReasoning about honest principals Invariance rule, called “honesty rule” uPreservation of invariants under composition If we prove Honest(X)   for protocol 1 and compose with protocol 2, is formula still true?

Bidding conventions (motivation) uBlackwood response to 4NT –5  : 0 or 4 aces –5  : 1 ace –5 : 2 aces –5  : 3 aces uReasoning If my partner is following Blackwood, then if she bid 5, she must have 2 aces

OLD Honesty rule (rule scheme)  roles R of Q.  initial segments A  R. Q |- [ A ] X  Q |- Honest(X)   This is a finitary rule: –Typical protocol has 2-3 roles –Typical role has 1-3 receives –Only need to consider A waiting to receive

Honesty rule uPreliminary: basic sequence of actions B is a basic sequence of S if S = S 1 BS 2 and B, S 2 begin with read uRule [ ] X  For all B  BasicSeq(Q).  [B] X  Q |- Honest(X)   uExample Honest(X)  (Sent(X, m2)  Recd(X, m1))

Treatment of Invariants uProve assertions from invariants  |-  […] P  uInvariant weakening rule  |-  […] P     ’ |-  […] P  uProve invariants from protocol Q |-  Q’ |-  Q  Q’ |-  If combining protocols, extend assertions to combined invariants Use honesty (invariant) rule to show that both protocols preserve assumed invariants

Conclusions uComposition  [ S ] P   [ T ] P   [ ST ] P  uInvariant combination  |-  […] P     ’ |-  […] P  Q |-  Q’ |-  Q  Q’ |- 