1. Probabilistic Polynomial-Time Process Calculus for Security Protocol Analysis John Mitchell Stanford University P. Lincoln, M. Mitchell, A. Ramanathan, A. Scedrov, V. Teague

2. Computer Security uAccess control uOS security uNetwork security uCryptography u… Crypto Security Goal: protection of computer systems and digital information

3. Research challenge uInvent the logic of computer security Reasoning principles for systems that use cryptography and are subject to attack uAnalogy Effective topos, synthetic domain thy, … Recursion, recursive domains, collections of types, … form a model of intuitionistic set theory with additional axioms

4. LICS presence at CSFW Check out: Crypto, Oakland, CCS, … 2001200019991998 Abadi Blanchet Fiore Gordon Gunter Halpern Jeffrey Kirli Pierce Pavlovic Rusinowitch Scedrov Abadi Roscoe

5. Today: Protocols and Probability uSecurity protocols uGoals for process calculus uSpecific process calculus Probabilistic semantics Complexity: probabilistic poly time Asymptotic equivalence Pseudo-random number generators Equational properties and challenges

6. Protocol Security uCryptographic Protocol Program distributed over network Use cryptography to achieve goal uAttacker Intercept, replace, remember messages Guess random numbers, some computation uCorrectness Attacker cannot learn protected secret or cause incorrect conclusion

7. IKE subprotocol from IPSEC A, (g a mod p) B, (g b mod p) Result: A and B share secret g ab mod p Analysis involves probability, modular exponentiation, digital signatures, communication networks, … AB m1 m2, signB(m1,m2) signA(m1,m2)

8. Simpler: Challenge-Response uAlice wants to know Bob is listening Send “fresh” number n, Bob returns f(n) Use encryption to avoid forgery uProtocol Alice  Bob: { nonce } K Bob  Alice: { nonce * 5 } K uCan Alice be sure that –Message is from Bob? –Message is fresh response to Alice’s challenge?

9. Important Modeling Decisions uHow powerful is the adversary? Simple replay of previous messages Decompose, reassemble and resend Statistical analysis, timing attacks,... uHow much detail in model of crypto? Assume perfect cryptography Include algebraic properties –encr(x*y) = encr(x) * encr(y) for RSA encrypt(k,msg) = msg k mod N

10. Standard analysis methods uFinite-state analysis uLogic based models Symbolic search of protocol runs Proofs of correctness in formal logic uConsider probability and complexity More realistic intruder model Interaction between protocol and cryptography Hard Easy

11. Comparison LowHigh Low Sophistication of attacks Protocol complexity   BAN logic Future Poly-time calculus  Hand proofs  FDR  NRL  Athena  Paulson  Bolignano  Spi-calculus  Mur

12. Outline uSecurity protocols Goals for process calculus uSpecific process calculus Probabilistic semantics Complexity – probabilistic poly time Asymptotic equivalence Pseudo-random number generators Equational properties and challenges

13. Language Approach [Abadi, Gordon] uWrite protocol in process calculus uExpress security using observational equivalence Standard relation from programming language theory P  Q iff for all contexts C[ ], same observations about C[P] and C[Q] Context (environment) represents adversary uUse proof rules for  to prove security Protocol is secure if no adversary can distinguish it from some idealized version of the protocol Great general idea; application is complicated

14. Probabilistic Poly-time Analysis uAdd probability, complexity uProbabilistic polynomial-time process calc Protocols use probabilistic primitives –Key generation, nonce, probabilistic encryption,... Adversary may be probabilistic uExpress protocol and spec in calculus uSecurity using observational equivalence Use probabilistic form of process equivalence

15. Secrecy for Challenge-Response uProtocol P A  B: { i } K B  A: { f(i) } K u“Obviously’’ secret protocol Q A  B: { random_number } K B  A: { random_number } K uAnalysis: P  Q reduces to crypto condition related to non-malleability [Dolev, Dwork, Naor] –Fails for “plain old” RSA if f(i) = 2i

16. Specification with Authentication uProtocol P A  B: { random i } K B  A: { f(i) } K A  B: “OK” if f(i) received u“Obviously’’ authenticating protocol Q A  B: { random i } K B  A: { random j } K i, j A  B: “OK” if private i, j match public msgs public channel private channel public channel private channel

17. Nondeterminism vs encryption uAlice encrypts msg and sends to Bob A  B: { msg } K uAdversary uses nondeterminism Process E 0 c  0  | c  0  | … | c  0  Process E 1 c  1  | c  1  | … | c  1  Process E c(b 1 ).c(b 2 )...c(b n ).decrypt(b 1 b 2...b n, msg) In reality, at most 2 -n chance to guess n-bit key

18. Semantics Nondeterministic SemanticsProbabilistic Semantics 0.5 0.2 0.3 0.5 0.2 0.3 0.2 0.3 0.5 0.2 0.3 0.2 0.5 0.2 0.3 0.5 Prove initial results for arbitrary scheduler

19. Methodology uDefine general system Process calculus Probabilistic semantics Asymptotic observational equivalence uApply to protocols Protocols have specific form “Attacker” is context of specific form –Induces coarser observational equivalence This talk: general calculus and properties

20. Outline uSecurity protocols uGoals for process calculus Specific process calculus Probabilistic semantics Complexity – probabilistic poly time Asymptotic equivalence Pseudo-random number generators Equational properties and challenges

21. Technical Challenges uLanguage for prob. poly-time functions Extend work of Cobham, Cook, Hofmann uReplace nondeterminism with probability Otherwise adversary is too strong... uDefine probabilistic equivalence Related to poly-time statistical tests...

22. Syntax uBounded  -calculus with integer terms P :: = 0 | c q(|n|)  T  send up to q(|n|) bits | c q(|n|) (x). P receive |  c q(|n|). P private channel | [T=T] P test | P | P parallel composition | ! q(|n|). P bounded replication Terms may contain symbol n; channel width and replication bounded by poly in |n|

23. Probabilistic Semantics uBasic idea Alternate between terms and processes –Probabilistic evaluation of terms (incl. rand) –Probabilistic scheduling of parallel processes uTwo evaluation phases Outer term evaluation –Evaluate all exposed terms, evaluate tests Communication –Match send and receive –Probabilistic if multiple send-receive pairs

24. Scheduling uOuter term evaluation Evaluate all exposed terms in parallel Multiply probabilities uCommunication E(P) = set of eligible subprocesses S(P) = set of schedulable pairs Prioritize – private communication first Choose highest-priority communication with uniform (or other) probability

25. Example uProcess c  rand+1  | c(x).d  x+1  | d  2  | d(y). e  x+1  uOuter evaluation c  1  | c(x).d  x+1  | d  2  | d(y). e  x+1  c  2  | c(x).d  x+1  | d  2  | d(y). e  x+1  uCommunication c  1  | c(x).d  x+1  | d  2  | d(y). e  x+1  Each prob ½ Choose according to probabilistic scheduler

26. Example (again) Each with prob 0.5 Choose according to probabilistic scheduler c  rand+1  | c(x).d  x+1  | d  2  | d(y). e  x+1  c  2  | c(x).d  x+1  | d  2  | d(y). e  x+1  c  1  | c(x).d  x+1  | d  2  | d(y). e  x+1  Outer Eval Comm Step

27. Complexity results uPolynomial time For each process P, there is a poly q(x) such that –For all n –For all probabilistic schedulers –All minimal evaluation contexts C[ ] eval of C[P] halts in time q(|n|+|C[]|) Minimal evaluation context –C[ ] = c(x).d(y)…[ ] | c  20  | d  7  | e  492  | …

28. Complexity: Intuition uBound on number of communications Count total number of inputs, multiplying by q(|n|) to account for ! q(|n|). P uBound on term evaluation Closed T evaluated in time q T (|n|) uBound on time for each comm step Example: c  m  | c(x).P  [m/x]P Substitution bounded by orig length of P –Size of number m is bounded –Previous steps preserve # occurr of x in P

29. Outline uSecurity protocols uApplication of process calculus uSpecific process calculus Probabilistic semantics Complexity – probabilistic poly time Asymptotic equivalence Pseudo-random number generators Equational properties and challenges

30. How to define process equivalence? uIntuition | Prob{ C[ P ]  “yes” } - Prob{ C[ Q ]  “yes” } | <  uDifficulty How do we choose  ? –Less than 1/2, 1/4, … ? (not equiv relation) –Vanishingly small ? As a function of what? uSolution Use security parameter –Protocol is family { P n } n>0 indexed by key length Asymptotic form of process equivalence Problem:

31. Probabilistic Observational Equiv uAsymptotic equivalence within f Process, context families { P n } n>0 { Q n } n>0 { C n } n>0 P  f Q if  contexts C[ ].  obs v.  n 0.  n> n 0. | Prob[C n [ P n ]  v ] - Prob[C n [ Q n ]  v ] | < f(n) uAsymptotically polynomially indistinguishable P  Q if P  f Q for every polynomial f(n) = 1/p(n) Final def’n gives robust equivalence relation

32. Outline uSecurity protocols uApplication of process calculus uSpecific process calculus Probabilistic semantics Complexity – probabilistic poly time Asymptotic equivalence Pseudo-random number generators Equational properties and challenges

33. Compare with standard crypto uSequence generated from random seed P n : let b = n k -bit sequence generated from n random bits in PUBLIC  b  end uTruly random sequence Q n : let b = sequence of n k random bits in PUBLIC  b  end uP is crypto strong pseudo-random generator P  Q Equivalence is asymptotic in security parameter n

34. Desired equivalences u P | (Q | R)  (P | Q) | R u P | Q  Q | P u P | 0  P u P  Q  C[P]  C[Q] uP   c. ( c | c(x).P) x  FV(P) Warning: hard to get all of these…

35. One way to get equivalences uLabeled transition system Allow process to send any output, read any input Label with numbers “resembling probabilities” uSimulation relation Relation  on processes If P Q and P P’, then exists Q’ with Q Q’ and P’ Q’ uWeak form of prob equivalence But enough to get started … r  ~  ~  ~ r

36. Hold for uniform scheduler u P | (Q | R)  (P | Q) | R u P | Q  Q | P u P | 0  P u P  Q  C[P]  C[Q] Compositionality is important issue in computer security

37. Problem uWant this equivalence P   c. ( c | c(x).P) x  FV(P) uFails for general calculus, general  P = d(x).e C[ ] =  d.( d | d(y).e | [ ] )

38. Comparison  d.( d | d(y).e | d(x).e )  d.( d | d(y).e |  c. ( c | c(x).P) ) e leftc e P Even prioritizing private channels, equivalence fails c left right left

39. Paradox uTwo processors connect by network uEach does private actions uUnrealistic interaction Private coin flip in Beijing does not influence coin flip in Washington

40. Solutions uModify scheduler Process private channels left-to-right Each channel: random send-receive pair uRestrict syntax of protocol, attack C[ P ] = C[  c. ( c | c(x).P) ] for all contexts C[ ] that –do not share private channels –do not bind channel names used in [ ] Modification of scheduler more reasonable for protocols

41. Current State of Project uFramework for protocol analysis Determine crypto requirements of protocols Precise definition of crypto primitives uProbabilistic ptime language uProcess framework Replace nondeterminism with rand Equivalence based on ptime statistical tests uMethods for establishing equivalence Develop probabilistic simulation technique uExamples: Diffie-Hellman, Bellare-Rogaway, …

42. Connections with modern crypto uCryptosystem consist of three parts Key generation Encryption Decryptions uMany forms of security Semantic security, non-malleability, chosen-ciphertext security, … uCommon conditions use prob. games

43. Chosen-ciphertext security Probabilistic poly-time player A cannot win game (>1/2): 1)A gets public key 2)A submits ciphertexts and receives decryptions 3)A submits two messages m 0, m 1 and receives either  = Encr(m 0 ) or  = Encr(m 1 ) at random 4)A submits ciphertexts   and receives decryptions 5)A declares guess g = 0 or 1 6)Score win if  = Encr(m g ), else lose Deterministic encryption vulnerable to chosen-c attack

44. Simulation security of K,E,D Algorithms K, E, D indistinguishable from variant where encryption uses random messages and private table EKD sk pk mm  K D mm  plain cipher sk Q P [Canetti 00; Shoup; Pfitzmann-Waidner 00,01]

45. Goal: Chosen-c-secure iff sim-secure uP  P1  P2  …  Q Hope to prove using process calculus Derive protocol correctness by congruence uwhere P = Game on previous slide P1 = Same, but quit if some output  of E seen before as input to D or output of E P2 = If input  to D was output by E, use table instead of algorithm D Q = instead of encrypt, use Encr(0) and table

46. Conclusion uComputer security Exacting subject amenable to analysis Analysis useful since correctness critical uProtocols Short but complex uProbabilistic poly-time process calc Challenging semantics, proof theory Appropriate for game equivalence

49. Chosen-ciphertext security 1)A gets public key 2)A submits ciphertexts and receives decryptions 3)A submits two messages m 0, m 1 and receives either  = Encr(m i ) for i=1 or i=2 4)A submits ciphertexts   and gets decryptions 5)A guesses g = 0 or 1 6)Score win if  = Encr(m g ), else lose Encrypt Key Gen Decrypt ? choose i=0,1 mimi m 0, m 1 i pk sk Encrypt(m i ) =

50. Compositionality uProperty of observational equiv A  B C  D A|C  B|D similarly for other process forms

51. Zero-Knowledge Protocol u Witness protection program Q(x) iff  w. P(x,w) Prove  w. P(x,w) without revealing w PV I know a number x with Q(x) Answer these questions Here. Now you’ll believe me.

52. Identify Friend or Foe uSequential One conversation at a time uConcurrent Base station proves identity concurrently Base M A V S proververifiers Are concurrent sessions still zero-k ?