Monte Carlo Analysis of Security Protocols: Needham-Schroeder Revisited Radu Grosu SUNY at Stony Brook Joint work with Xiaowan Huang, Scott Smolka, & Ping Yang June 8, DIMACS Workshop on Security Analysis of Protocols

Talk Outline 1.LTL Model Checking 2.Monte Carlo Model Checking 3.Needham-Schroeder 4.Implementation & Results 5.Conclusions & Future Work

Model Checking ? Is system S a model of formula φ?

Model Checking S is a nondeterministic/concurrent system.  is (in our case) an LTL (Linear Temporal Logic) formula. Basic idea: intelligently explore S ’s state space in attempt to establish S ⊨ . Fly in the ointment: State Explosion!

LTL Model Checking An LTL formula is made up of atomic propositions p, boolean connectives , ,  and temporal modalities X (neXt) and U (Until). Every LTL formula  can be translated to a Büchi automaton whose language is set of infinite words satisfying . Automata-theoretic approach: S ⊨  iff L ( B S )  L ( B  ) iff L ( B S  B  )  

Emptiness Checking Checking non-emptiness is equivalent to finding an accepting cycle reachable from initial state (lasso). Double Depth-First Search (DDFS) algorithm can be used to search for such cycles, and this can be done on-the-fly! s1s1 s2s2 s3s3 sksk s k-2 s k-1 s k+1 s k+2 s k+3 snsn DFS 2 DFS 1

Monte Carlo Model Checking (MC 2 ) Sample Space: lassos in B S  B  Random variable Z : –Outcome = 0 if randomly chosen lasso accepting –Outcome = 1 otherwise μ Z = ∑ p i Z i (weighted mean) Compute ( ε,δ )-approx. of μ Z

Monte Carlo Model Checking (MC 2 ) L1 = abcb, L2 = abcdb, L3 = abcdea Pr[L1]= ½, Pr[L2]=¼, Pr[L3]=¼ μ Z = ½ acbd e

Monte Carlo Approximation Problem: Compute the mean value μ Z of a random variable Z distributed in [0,1] when an exact computation of μ Z proves intractable. with error margin  and confidence ratio . Solution: Compute an ( ,  )-approximation of  Z : Has been used to: approximate permanent of 0-1 valued matrices, volume of convex bodies, and, now, expectation that S ⊨  !

Original Solution [Karp, Luby & Madras: Journal of Algorithms 1989] Compute as the mean value of N independent random variables (samples) identically distributed according to Z : Determine N using the Zero-One estimator theorem: Problems: is unknown and can be large.

Stopping Rule Algorithm (SRA) [Dagum, Karp, Luby & Ross: SIAM J Comput 2000] Innovation: computes correct N without using Theorem: E[ N ] ≤ 4 ln(2/  ) / μ Z  2 ;  = 4 ln(2/  ) /  2 ; for (N=0, S=0; S≤  ; N++) S=S+Z N ; = S/N; return ; Problem: is in most interesting cases too large.

Optimal Approx Algorithm (OOA) [Dagum, Karp, Luby & Ross: SIAM J Comput 2000] Compute N using generalized Zero-One estimator: Apply sequential analysis (prediction/correction): 1. Assume  2 is small and compute with SRA( ) 2. Compute  using and 3. Use to correct N and. Expected number of samples is optimal to within a constant factor!

Monte Carlo Model Checking Theorem: MC 2 computes an (ε,δ)-approximation of μ Z in expected time O(N∙D) and uses expected space O(D), where D is the recurrence diameter of B = B S  B . Cf. DDFS which runs in O(2 |S|+|φ| ) time and space.

Needham-Schroeder 1.A  B : { N a, A } K B 2.B  A : { N a, N b } K A 3.A  B : { N b } K B

Breaking & Fixing Needham-Shroeder In 1997, Lowe discovered a replay attack that involves an intruder I masquerading as A in its communication with B. As shown by Lowe, protocol is easily fixed by including identity of responder (B) in 2 nd msg: 2´. B  A : { B, N a, N b } K A

Implementation Implemented DDFS and MC 2 in jMocha model checker for synchronous systems specified using Reactive Modules. Specified NS as a reactive module; all communications go through intruder. Intruder obeys Dolev-Yao model: besides normal communications, can intercept, overhear, and fake messages.

Time and space requirements for DDFS and MC 2 Experimental Results

Variation of µ Z for MC 2 Experimental Results ~

Related Approaches NRL Protocol Analyzer [Meadows 96] Spi-Calculus [Abadi Gordon 97] FDR [Lowe 97] The Strand Space Method [Guttman et al. 98] Isabelle Theorem Prover [Paulson 98] Backward Induction [Kurkowski Mackow 03]

Conclusions Applied Monte Carlo model checking to Needham-Schroeder. Results indicate may be more effective than traditional approaches in discovering attacks. Further experimentation required to draw definitive conclusions. Other Future Work: Use BDDs to improve run time. Also, take samples in parallel!

Monte Carlo Model Checking Randomized algorithm for LTL model checking utilizing automata-theoretic approach. Basic idea: Take N samples: sample = lasso = random walk through B S  B  ending in a cycle. If accepting lasso (counter-example) found, return false. Else return true with certain confidence.