1. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 1 The Power of Simulation Relations Roberto Segala University of Verona

2. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 2 Hierarchical Verification I 11 I 12 I2I2 I3I3 S S1S1 S2S2 S3S3 Some properties verified here Modules verified separately

3. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 3 Implementation Some form of behavioral inclusion –Traces, Failures, Tests, … Features –Preserves properties of interest –Transitive –Compositional –Affine with logical implication … when properties are sets of behaviors Hard to check –Often Pspace-complete –But simulation relations help

4. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 4 Automata A = (Q, q 0, E, H, D) coffee q0q0 q2q2 q1q1 q4q4 q3q3 q5q5 d n n n choc ch Execution: q 0 n q 1 n q 2 ch q 3 coffee q 5 Trace: n n coffee

5. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 5 Forward Simulations Forward simulation from A 1 to A 2 (A 1  F  A 2 ) Relation R  Q 1 x Q 2 such that q q s s a a R R  q, s, a, q  s q0q0 q1q1 q3q3 q2q2 q4q4 s0s0 s1s1 s3s3 s4s4 aa cb a bc

6. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 6 Simulation Implies Trace Inclusion The step condition can be applied repeatedly q qq s ss a a qq ss b b qq ss c c qq ss d d … … Thus existence of simulation implies trace inclusion –Even more it implies a close correspondence between executions

7. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 7 Application of Simulation Relations Distributed Systems –Automata, I/O Automata Real-Time Systems –Add time component to states –Add time-passage actions or trajectories Time-passage modifies only time component Hybrid Systems –Time passage modifies entire state Randomized Systems –Transitions lead to probability measures

8. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 8 Example: Probabilistic Automata q0q0 qhqh qtqt qpqp flip 1/2 2/3 1/3 beep qzqz buzz

9. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 9 Example: Probabilistic Automata q0q0 q1q1 q2q2 q3q3 q4q4 q5q5 fair unfair flip 1/2 2/3 1/3 beep What is the probability of beeping?

10. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 10 Probabilistic Executions q0q0 q1q1 q3q3 q4q4 q5q5 1/2 q0q0 q2q2 q3q3 q4q4 q5q5 unfair flip 2/3 1/3 beep  (beep) = 2/3  (beep) = 1/2 fair beep flip 1/2 2/3

11. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 11 Example: Probabilistic Executions q0q0 q1q1 q2q2 q3q3 q4q4 q3q3 q4q4 q5q5 q5q5 fair unfair flip beep 1/2 2/3 1/3 1/2 1/4 2/6 7/12

12. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 12 Forward Simulations Forward simulation from A 1 to A 2 (A 1  F  A 2 ) Relation R  Q 1 x Q 2 such that q  s  a a R R  q, s, a,    q1q1 q2q2 s1s1 s2s2 s3s3 1/2 1/3 1/6 1/3 Lifting of R

13. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 13 Lifting and Transfer of Masses q1q1 q2q2 s1s1 s2s2 s3s3 q1q1 q2q2 s1s1 s2s2 s3s3 1/2 1/3 1/6 1/3

14. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 14 Simulation Implies Behavioral Inclusion The step condition can be applied repeatedly q  s        … … q    

15. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 15 A Potential Area of Application Security With simulations –Global properties validated via local properties –… almost as proving a property by induction Can we use simulations for security? –Properties are typically global –There is randomization Challenges –Specifications do not fail –Implementations fail with negligible probability –Some approximations appear to be necessary –Need for computational assumptions

16. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 16 Bellare and Rogaway MAP1 Protocol Nonces are generated randomly The key s is the secret for a Message Authentication Code –Specifically, MAC based on pseudo-random functions AB RARA [B.A.R A.R B ] s [A.R B ] s

17. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 17 Nonces Number ONCE –Typically drawn randomly Claim –For each constant c and polynomial p –There exists k such that for each k  k –If n 1,n 2,…,n p(k) are random nonces from {0,1} k –Then Pr[  i  j  n i  n j ]< k -c

18. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 18 Message Authentication Code Triple (G,A,V) –G on input 1 k generates s   {0,1} k –For each s and each a Pr[V( s,a, A( s,a ))=1]=1 Forger –On input 1 k obtains MAC of strings of its choice –Outputs a pair ( a,b ) –Successful if V( s,a,b )=1 and a different from previous queries Secure MAC –Every feasible forger succeeds with negligible probability

19. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 19 MAP1: Matching Conversations Matching conversation between A and B –Every message from A to B delivered unchanged Possibly last message lost Response from B returned to A –Every message received by A generated by B Messages generated by B delivered to A Possibly last message lost Correctness condition –Matching conversation implies acceptance –Negligible probability of acceptance without matching conversation

20. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 20 MAP1: Correctness Proof Let A be a PPT machine that interacts with the agents Show that A induces “no-match” with negligible probability –Argue that repeated nonces occur with negligible probability –Argue that A is an attack against a message authentication code Features –Relies on underlying pseudo-random functions –Proves correctness assuming truly random functions –Builds a distinguisher for PRFs if an attack exists Criticism –The arguments are semi-formal and not immediate –Three different concepts intermixed Nonces Message authentication codes Matching conversations

21. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 21 MAP1: Hierarchical Analysis Agents indexed by X, Y, t Adversary Keeps history (PPT function f) A1A1 A2A2 A3A3 A4A4 Key generator Nonce generator (coin flip) A5A5 Adversary Keeps history (PPT function f) A1A1 A2A2 A3A3 A4A4 Key generator Nonce generator (ideal) A5A5 Adversary Keep history (no forged signatures) A1A1 A2A2 A3A3 A4A4 Key generator Nonce generator (ideal) A5A5

22. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 22 Nonce Generators State –value X,Y,t initially  –FreshNonces initially {0,1} k Transitions –Input NonceRequest X,Y,t –Effect Let v  R {0,1} k value X,Y,t = v FreshNonces = FreshNonces -{ v } –Output NonceResponse X,Y,t ( n ) –Precondition n = value X,Y,t –Effect value X,Y,t =  Let v  R FreshNonces IdealCoin flip

23. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 23 Adversary Keeps a variable history –Holds all previous messages Real adversary –Runs a cycle where Computes the next message to send using a PPT function f Sends the message Waits for the answer if expected Ideal adversary –Highly nondeterministic –Stores all input –Sends messages that do not contain forged authentications

24. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 24 Problems with Simulations –Consider a transition of the real nonce generator –With some probability there is a repeated nonce –The ideal nonce generator does not repeat nonces –Thus, we cannot match the step Adversary Keeps history (PPT function f) A1A1 A2A2 A3A3 A4A4 Key generator Nonce generator (coin flip) A5A5 Adversary Keeps history (PPT function f) A1A1 A2A2 A3A3 A4A4 Key generator Nonce generator (ideal) A5A5 Adversary Keep history (no forged signatures) A1A1 A2A2 A3A3 A4A4 Key generator Nonce generator (ideal) A5A5

25. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 25 Approximated Simulations [ST07] Change lifting on measures –  1    2 iff  1 = (1-  )  1 ’ +  1 ’’  2 = (1-  )  2 ’ +  2 ’’  1 ’  2 ’ 1’1’  1 ’’ 2’2’  2 ’’ (1-  )   11 22 {2/3 q 1, 1/3 q 2 } = 2/3 {1/2 q 1, 1/2 q 2 } + 1/3{1 q 1 } {1/3 s 1, 1/3 s 2, 1/3 s 3 } = 2/3 {1/2 s 1, 1/2 s 2 } + 1/3{1 s 3 } ?  = 1/3

26. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 26 Approximated Simulations { A k } { R k } { B k } For each constant c and polynomial p There exists k such that for each k  k Whenever – 1 reached within p ( k ) steps in A k – 1 L ( R k,  ) 2 – 1  1 ’ There exists 2 ’ such that – 2  2 ’ – 1 ’ L ( R k,  + k -c ) 2 ’ 1 1 2 2 ’   +k -c

27. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 27 Approximated Simulations Step Condition (1-  )   1 2 (1-  -k -c )  2 ’  1 ’ (1-  -k -c ) k -c  (1-  )

28. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 28  p(k)  p(k) Simulation Implies Behavioral Inclusion The step condition can be applied repeatedly q  s      … … 0k -c 2k -c 3k -c p(k)k -c Observation –p  k  k -c can be smaller than any k -c’ by choosing c=c’+degree(p)

29. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 29 Example: Approximate Simulations Bellare-Rogaway MAP1 Protocol Negation of the step condition –1: Two random nonces are equal with high probability –2: Function f defines a forger for a signature scheme Adversary Keep history (no forged signatures) A1A1 A2A2 A3A3 A4A4 Key generator Nonce generator (ideal) A5A5 Adversary Keeps history (PPT function f) A1A1 A2A2 A3A3 A4A4 Key generator Nonce generator (ideal) A5A5 Adversary Keeps history (PPT function f) A1A1 A2A2 A3A3 A4A4 Key generator Nonce generator (coin flip) A5A5 12

30. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 30 Step Condition { A k } { R k } { B k } For each constant c and polynomial p There exists k for each k  k Whenever – 1 reached within p ( k ) steps in A k – 1 L ( R k,  ) 2 – 1  1 ’ There exists 2 ’ such that – 2  2 ’ – 1 ’ L ( R k,  + k -c ) 2 ’ 1 1 2 2 ’   +k -c

31. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 31 Negation of Step Condition { A k } { R k } { B k } There exists constant c and polynomial p For each k there exists k  k There exists – 1 reached within p ( k ) steps in A k – 1 L ( R k,  ) 2 – 1  1 ’ There is no 2 ’ such that – 2  2 ’ – 1 ’ L ( R k,  + k -c ) 2 ’ 1 1 2 2 ’   +k -c Signature forged in 1 ’ –Probability at least k -c Nonce replicated in 1 ’ –Probability at least k -c (1-  )   1 2 (1-  -k -c )  2 ’  1 ’ (1-  -k -c ) k -c  (1-  )

32. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 32 Nonces Number ONCE –Typically drawn randomly Claim –For each constant c and polynomial p –There exists k such that for each k  k –If n 1,n 2,…,n p(k) are random nonces from {0,1} k –Then Pr[  i  j  n i  n j ]< k -c

33. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 33 Example: Approximate Simulations Bellare-Rogaway MAP1 Protocol Proof Completed Adversary Keep history (no forged signatures) A1A1 A2A2 A3A3 A4A4 Key generator Nonce generator (ideal) A5A5 Adversary Keeps history (PPT function f) A1A1 A2A2 A3A3 A4A4 Key generator Nonce generator (ideal) A5A5 Adversary Keeps history (PPT function f) A1A1 A2A2 A3A3 A4A4 Key generator Nonce generator (coin flip) A5A5 12

34. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 34 Problems with Nondeterminism MAP1 Protocol [BR93] Potential problems –Let s be the shared key –Adversary queries k agents –Agent i replies if i th bit of s is 1 –The adversary knows the shared key Solution –One query at a time –Wait for the answer (agents as oracles) Adversary Keeps history (PPT function f) A1A1 A2A2 A3A3 A4A4 Key generator Nonce generator (coin flip) A5A5

35. We Are Not Alone Mitchell, Ramanathan, Scedrov, Teague –Probabilistic polynomial time calculus Canetti, Cheung, Kaynar, Liskov, Lynch, Pereira, Segala –Task Probabilistic I/O Automata Chatzikokolakis, Palamidessi –Syntactic restrictions for schedulers Canetti –UC framework Backes, Pfitzmann, Waidner –Reactive simulatability Framework Van Breugel, Worrel –Metrics and approximation Desharnais, Gupta, Jagadeesan, Panangaden –Metrics and approximation The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 35

36. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 36 Work in Progress Applications –Soundness of Dolev-Yao model –Analysis of the Crypto-Library Approximated simulations versus –Approximated language inclusion (Task PIOAs) –Restricted schedulers –Metrics Flexibility on restrictions –Many ways to restrict –Are we restricting too much?

37. The Power of Simulation Relations Sixty and Beyond Toronto, August 20, 2008 Roberto Segala - University of Verona 37 Summing Up Simulation relations are powerful –Interact well with hierarchical verification –Global properties verified via local arguments –Apply to several frameworks Security is a new interesting area –We have interesting case studies –We have still many open questions We are having a lot of fun