1. Chen Advisor: Limin Jia

2.  Whole picture  Process Calculus  Definition of Secrecy and Authenticity  Demo  Comparison  Conclusion

3.  Whole picture  Process Calculus  Definition of Secrecy and Authenticity  Translation into Horn Clauses  Demo  Comparison  Conclusion

4. Original Protocol Pi CalculusHorn ClausesProverif Authenticity Reserved?

5.  Whole picture  Process Calculus  Definition of Secrecy and Authenticity  Translation into Horn Clauses  Demo  Comparison  Conclusion

6.  Extension of pi calculus with: ◦ cryptographic primitives ◦ “begin” & “end” events  Pi calculus: ◦ mathematical formalisms for describing and analyzing properties of concurrent computation

7.  Name: ◦ Free name: Names globally known (also to adversary) ◦ Bound name: Names local to the process  Variable: ◦ Free variable: Variables not used anywhere ◦ Bound name: variables used in the process

8.  Equivalence:  Reduction:

9. Original Protocol Pi CalculusHorn ClausesProverif Process P

10.  A simplified version of Woo and Lam one-way public key authentication protocol

11.  Create secret key sk A & sk B  Create corresponding public keys  Distribute public keys  Create unbounded number of sessions

13.  Whole picture  Process Calculus  Definition of Secrecy and Authenticity  Translation into Horn Clauses  Demo  Comparison  Conclusion

14.  Adversary (attacker) ◦ Closed process: Process without free variables (allow free names)

15.  Secrecy Remember: Q has access to all free names, including channel c

16.  Authenticity ◦ Non-injective agreement:  if event end(M) is executed, then begin(M) has also been executed.

17.  Authenticity ◦ Injective agreement:  The number of executions of end(M) is smaller than that of begin(M). Where is Authenticity?

18.  Authenticity ◦ Non-injective agreement:  if event end(M) is executed, then begin(M) has also been executed.

19.  Authenticity is satisfied when: ◦ B cannot emit his end event without A having emitted her begin event.  End(M) => Begin(M) for all cases.

20. Sarkozy thinks: Sarkozy says: Sarkozy agrees: Authenticity is satisfied when: The other side is indeed Sarkozy!

21. Begin(M): I start my part of the protocol. I think I would talk to Obama End(M): I finish my part of the protocol. I think I have talked to Sarkozy Protocol ensures: Remember: Protocol is lock-stepped!

22. Begin(M): I start my part of the protocol. I think I would talk to Obama End(M): I finish my part of the protocol. I think I has talked to Sarkozy Authenticity is violated when End(M) => Begin(M)!

23.  Authenticity is satisfied when: ◦ B cannot emit his end event without A having emitted her begin event.  End(M) => Begin(M) for all cases.

24. Begin(M): I start my part of the protocol. I think I would talk to Obama End(M): I finish my part of the protocol. I think I has talked to Sarkozy Here End(M) !=> Begin(M)!

25.  Authenticity ◦ Non-injective agreement:  if event end(M) is executed, then begin(M) has also been executed. Correct!

26. We will be back!

27.  Whole picture  Process Calculus  Definition of Secrecy and Authenticity  Translation into Horn Clauses  Demo  Comparison  Conclusion

28.  (P1 Λ P2 Λ…Λ Pn) => u  Our usage: ◦ Patterns ◦ Facts ◦ Rules  Attacker  Protocol

29.  (P1 Λ P2 Λ…Λ Pn) => u  Our usage: ◦ Patterns ◦ Facts ◦ Rules  Attacker  Protocol

30.  (P1 Λ P2 Λ…Λ Pn) => u  Our usage: ◦ Patterns ◦ Facts ◦ Rules  Attacker  Protocol

31.  (P1 Λ P2 Λ…Λ Pn) => u  Our usage: ◦ Patterns ◦ Facts ◦ Rules  Attacker  Protocol

32.  (P1 Λ P2 Λ…Λ Pn) => u  Our usage: ◦ Patterns ◦ Facts ◦ Rules  Attacker  Protocol

33. Original Protocol Pi CalculusHorn ClausesProverif

34.  If c ∈ S, message(c[],M) = attacker(M)  Vo, Vs: ◦ Vo: Set of ordinary variables. ◦ Vs: Set of session identifiers.  ρ : mapping from variables and names to patterns  h : Sequence of facts of message and begin. ◦ Literals of horn clauses we want

36.  [|P|] = [|(vskA).P1|]  [|P1|] = [|(vskB).P2|]  [|P2|] = [|let pkA = pk(skA) in P3|]  [|P3|] = [|let pkB = pk(skB) in P4|]  [|P4|] = [|c.P5|]  ρ : c → c[]  h :  First Horn Clause: message(c[],pk(skA))=attacker(pk(skA[])),skA → skA[], skB → skB[], pkA → pk(skA[]), pkB → pk(skB[])

39. Original Protocol Pi CalculusHorn ClausesProverif B P0,S

40.  B P0,S : Horn clauses of the protocol  B b : Horn clauses of allowed begin event. We are back!

41.  Whole picture  Process Calculus  Definition of Secrecy and Authenticity  Translation into Horn Clauses  Demo  Comparison  Conclusion

42.  Authenticity verification on Proverif

43.  Whole picture  Process Calculus  Definition of Secrecy and Authenticity  Translation into Horn Clauses  Demo  Comparison  Conclusion

44. ProsCons Fully AutomaticSometimes no termination Unlimited number of sessionsSometimes not Complete General cryptographic primitives

45.  Inductive method similar to Proverif ◦ Proverif is kind of automatic  Model checking automatic ◦ Infinate session in Proverif. ProverifInductive Approach Model Checking (Mur phi) AutomaticityYNY Number of States Support Infinite Finite Concurrency Support YY(Manually)Y(limited)

46.  Whole picture  Process Calculus  Definition of Secrecy and Authenticity  Translation into Horn Clauses  Demo  Comparison  Conclusion

47. New Technique for Authenticity verification in Cryptographic Protocol Fully automatic Precise sematic foundation Unbounded number of sessions Support general cryptographic primitive