The objective of this paper is to give a comprehensive introduction to applied cryptography with an engineer or computer scientist in mind. The emphasis is on the knowledge needed to create practical systems which supports integrity, confidentiality, or authenticity. Topics covered includes an introduction to the concepts in cryptography, attacks against cryptographic systems, key use and handling, random bit generation, encryption modes, and message authentication codes. Recommendations on algorithms and further reading is given in the end of the paper. This paper should make the reader able to build, understand and evaluate system descriptions and designs based on the cryptographic components described in the paper.

[서평]「Applied Cryptography」

Recent technologies have cleared the way for large scale application of electronic communication. The open and distributed nature of these communications implies that the communication medium is no longer completely controlled by the communicating parties. As a result, there has been an increasing demand for research in establishing secure communications over insecure networks, by means of security protocols. In this thesis, a formal model for the description and analysis of security protocols at the process level is developed. At this level, under the assumption of perfect cryptography, the analysis focusses on detecting aws and vulnerabilities of the security protocol. Starting from ??rst principles, operational semantics are developed to describe security protocols and their behaviour. The resulting model is parameterized, and can e.g. capture various intruder models, ranging from a secure network with no intruder, to the strongest intruder model known in literature. Within the security protocol model various security properties are de??ned, such as secrecy and various forms of authentication. A number of new results about these properties are formulated and proven correct. Based on the model, an automated veri??cation procedure is developed, which signi ??cantly improves over existing methods. The procedure is implemented in a prototype, which outperforms other tools. Both the theory and tool are applied in two novel case studies. Using the tool prototype, new results are established in the area of protocol composition, leading to the discovery of a class of previously undetected attacks. Furthermore, a new protocol in the area of multiparty authentication is developed. The resulting protocol is proven correct within the framework.

/pdf/scyther-semantics-and-verification-of-security-protocols-3r7jj418mt.pdf

Scyther : semantics and verification of security protocols

We present a new automatic technique for proving strong secrecy for security protocols. Strong secrecy means that an adversary cannot see any difference when the value of the secret changes. Our technique relies on an automatic translation of the protocol into Horn clauses, and a resolution algorithm on the clauses. It requires important extensions with respect to previous work for the proof of (standard) secrecy and authenticity. This technique can handle a wide range of cryptographic primitives, and yields proofs valid for an unbounded number of sessions and an unbounded message space; it is also flexible and efficient. We have proved its correctness, implemented it, and tested it on several examples of protocols including JFK by W. Aiello et al. (2002).

/pdf/automatic-proof-of-strong-secrecy-for-security-protocols-yylsplf15v.pdf

Automatic proof of strong secrecy for security protocols

In the recent years, many formalizations of security properties have been proposed, most of which are based on different underlying models and are consequently difficult to compare. A classification of security properties is thus of interest for understanding the relationships among different definitions and for evaluating the relative merits. In this paper, many non-interference-like properties proposed for computer security are classified and compared in a unifying framework. The resulting taxonomy is evaluated through some case studies of access control in computer systems. The approach has been mechanized, resulting in the tool CoSeC. Various extensions (e.g., the application to cryptographic protocol analysis) and open problems are discussed.

/pdf/classification-of-security-properties-part-i-information-4x83f2jz17.pdf

Classification of Security Properties (Part I: Information Flow)

Process Mining and Security: Detecting Anomalous Process Executions and Checking Process Conformance

Many security properties of cryptographic protocols can be all seen as specific instances of a general property, we called Non Deducibility on Composition (NDC), that we proposed a few years ago for studying information flow properties in computer systems The advantage of our unifying theory is that formal comparison among these properties is now easier and that the full generality of NDC has helped us in finding a few new attacks on cryptographic protocols

Non Interference for the Analysis of Cryptographic Protocols

We present a uniform approach for the definition and the analysis of various security properties. It is based on the general idea that a security property should be satisfied even in the presence of an hostile environment. This principle determines a family of strong properties which are resistant to every external attack, but are quite impractical to check. For this reason, we find some general conditions that permit to check a property only against a "most powerful" intruder. We show that the results of our theory can be easily applied to a number of existing security properties that can be rephrased in our setting. This shows the generality of the approach and permits to find some interesting relations among properties which have been proposed for different security issues.

/pdf/a-uniform-approach-for-the-definition-of-security-properties-43ssdo1oqq.pdf

A Uniform Approach for the Definition of Security Properties

http://wwwold.iit.cnr.it/staff/fabio.martinelli/j-pmc.pdf

Analysis of security protocols as open systems

The author presents a methodology based on known techniques in concurrency and process logics theory for ensuring information flow security properties, similar to the ones proposed by Focardi and Gorrieri (1995, 1997). Recently, they have shown that concepts from information flow theory can be used in the analysis of authentication protocols. This kind of problem may be tackled by his methodology. This has been implemented over mudiv, a tool for partial model checking.

Partial model checking and theorem proving for ensuring security properties

We present a tool for checking automatically the correctness of cryptographic protocols with finite behaviour. The underlying theory has been proposed in [13] and borrows some compositional analysis concepts for process algebras (see [3,8]). Here we extend the theory by showing an interesting relation among security properties.

/pdf/automatic-verification-of-cryptographic-protocols-through-2wjjfzimgp.pdf

Fabio Martinelli

Papers

Non Interference for the Analysis of Cryptographic Protocols

A Uniform Approach for the Definition of Security Properties

Analysis of security protocols as open systems

Partial model checking and theorem proving for ensuring security properties

Automatic Verification of Cryptographic Protocols through Compositional Analysis Techniques