reasoning about concrete security in protocol proofs
Post on 16-Jan-2016
38 Views
Preview:
DESCRIPTION
TRANSCRIPT
1
Reasoning about Concrete Security in Protocol Proofs
A. Datta, J.Y. Halpern, J.C. Mitchell, R. Pucella, A. Roy
2
Motivation We want to answer questions like:
Given a cryptographic protocol and a security property How frequently should we refresh the keys? How does any advance in breaking the specific cryptographic
primitives used quantitatively affect security?
We base the analysis on the known security properties of the crypto primitives used A protocol may use a number of different crypto primitives
How do we translate the quantitative guarantees? How do we handle composition?
Precursor: Computational PCL [DDMST05,DDMW06,RDDM07,RDM07]
Used to reason about asymptotic security
3
Security of signatures
AdversaryChallenger
kmi
sigk (mi)
m’, sigk (m’) : m’ mi
Existential Unforgeability under Chosen Message Attack
Advantage(Adversary,) = Prob[Adversary succeeds for sec. param. ]
A signature scheme is CMA secure if Prob-Polytime A.
Advantage (A, ) is a negligible function of
Cryptographic Security Complexity
Theoretic Concrete
vk
vk : public verification keyk : private signing key
4
Security of signatures
AdversaryChallenger
kmi
sigk (mi)
m’, sigk (m’) : m’ mi
Existential Unforgeability under Chosen Message Attack
Advantage(Adversary,) = Prob[Adversary succeeds for sec. param. ]
A signature scheme is (t, q, e) - CMA secure if t time bounded A making at most q sig queries.
Advantage (A, ) is less than e
Cryptographic Security Complexity
Theoretic Concrete
vk
vk : public verification keyk : private signing key
5
A Challenge-Response Protocol
A B
m, A
n, sigB {m, n, A}
sigA {m, n, B}
Alice reasons: if Bob is honest, then: only Bob can generate his signature if Bob generates a signature of the form sigB{m, n, A},
he sends it as part of msg2 of the protocol, and he must have received msg1 from Alice
Alice deduces: Received (B, msg1) Λ Sent (B, msg2)
6
Computational PCL
Proof system for direct reasoning Verify (X, sigY(m), Y) Honest (Y) Sign (Y, m) No explicit use of probabilities and computational complexity No explicit arguments about actions of attackers
Semantics capture idea that properties hold with high probability against PPT attackers Explicit use of probabilities and computational complexity Probabilistic polynomial time attackers Soundness proofs one time
Soundness implies result equivalent to security proof by cryptographic reductions
Formal Proofs Syntax, Semantics,
Proof System
7
Axiomatizing Security of signatures
AdversaryChallenger
kmi
sigk (mi)
m’, sigk (m’) : m’ mi
Existential Unforgeability under Chosen Message Attack
vk
vk : public verification keyk : private signing key
Formal Proofs Syntax, Semantics,
Proof System
Computational PCL: Verify (X, sigY(m), Y) Honest (Y) Sign (Y, m)
Quantitative PCL: T esig(t,q,) (Verify (X, sigY(m), Y) Honest (Y) Sign (Y, m))
8
Axioms and Proof Rules
where, = esig(t,q,)
where, ’ = l()(l()+1)/2
where, Bi are basic steps of the protocol
9
X Y
m, X
n, sigY {m, n, X}
sigX {m, n, Y}
10
Previous CPCL Results Core logic [ICALP05]
Key exchange [CSFW06] New security definition: key usability Used by Blanchet et al in CryptoVerif Kerberos proof
Reasoning about computational secrecy [ESORICS07] Application to Kerberos
Reasoning about Diffie-Hellman [TGC07] Applications to IKEv2 (standard model) and DH Kerberos
(random oracle model)
11
Logic and Cryptography: Big Picture
Complexity-theoretic crypto definitions (e.g., IND-CCA2 secure
encryption)
Crypto constructions satisfying definitions (e.g., Cramer-Shoup
encryption scheme)
Axiom in proof system
Protocol security proofs using proof system
Semantics and soundness theorem
12
Thanks !
Questions?
13
Example Property
14
PCL: Big Picture
Symbolic Model•PCL Semantics (Meaning of formulas)
Unbounded # concurrent sessions
PCL •Syntax (Properties)•Proof System (Proofs)
Soundness Theorem
(Induction)
High-level proof principles
Cryptographic Model•PCL Semantics (Meaning of formulas)
Polynomial # concurrent sessions
Computational PCL •Syntax ± •Proof System±
Soundness Theorem
(Reduction)
[BPW, MW,…]
15
Fundamental Question
PCL CPCL
Axioms and rules for reasoning about cryptographic protocols (Soundness)
Axioms and rules for reasoning about cryptographic protocols (Computational soundness)
First-order logic (Soundness and completeness) ???
Conditional first-order logic (Soundness and completeness) [?]
16
Towards QPCL
PCL QPCL
Axioms and rules for reasoning about cryptographic protocols (Soundness)
Axioms and rules for quantitative reasoning about cryptographic protocols (Computational soundness)
First-order logic (Soundness and completeness)
Conditional first-order logic (Soundness and completeness)
17
Protocol language
18
Conditional implication (OLD)
Implication uses conditional probability
[[1 2]] (T,D,) = [[1]] (T,D,)
[[2]] (T’,D,)
where T’ = [[1]] (T,D,)
top related