We present the on-the-fly model checker OFMC, a tool that combines two ideas for analyzing security protocols based on lazy, demand-driven search. The first is the use of lazy data types as a simple way of building efficient on-the-fly model checkers for protocols with very large, or even infinite, state spaces. The second is the integration of symbolic techniques and optimizations for modeling a lazy Dolev---Yao intruder whose actions are generated in a demand-driven way. We present both techniques, along with optimizations and proofs of correctness and completeness.

Our tool is state of the art in terms of both coverage and performance. For example, it finds all known attacks and discovers a new one in a test suite of 38 protocols from the Clark/Jacob library in a few seconds of CPU time for the entire suite. We also give examples demonstrating how our tool scales to, and finds errors in, large industrial-strength protocols.

/pdf/ofmc-a-symbolic-model-checker-for-security-protocols-3elfoz10zb.pdf

OFMC: A symbolic model checker for security protocols

A light weight authentication protocol for IoT-enabled devices in distributed Cloud Computing environment

ProVerif is an automatic symbolic protocol verifier It supports a wide range of cryptographic primitives, defined by rewrite rules or by equations It can prove various security properties: secrecy, authentication, and process equivalences, for an unbounded message space and an unbounded number of sessions It takes as input a description of the protocol to verify in a dialect of the applied pi calculus, an extension of the pi calculus with cryptography It automatically translates this protocol description into Horn clauses and determines whether the desired security properties hold by resolution on these clauses This survey presents an overview of the research on ProVerif

/pdf/modeling-and-verifying-security-protocols-with-the-applied-1bkbdhelgp.pdf

Modeling and Verifying Security Protocols with the Applied Pi Calculus and ProVerif

In this tutorial, we give an overview of the Maude-NRL Protocol Analyzer (Maude-NPA), a tool for the analysis of cryptographic protocols using functions that obey different equational theories. We show the reader how to use Maude-NPA, and how it works, and also give some of the theoretical background behind the tool.

/pdf/maude-npa-cryptographic-protocol-analysis-modulo-equational-wt14nh7q68.pdf

Maude-NPA: Cryptographic Protocol Analysis Modulo Equational Properties

An elliptic curve cryptography based lightweight authentication scheme for smart grid communication

Many security properties are naturally expressed as indistinguishability between two versions of a protocol. In this paper, we show that computational proofs of indistinguishability can be considerably simplified, for a class of processes that covers most existing protocols. More precisely, we show a soundness theorem, following the line of research launched by Abadi and Rogaway in 2000: computational indistinguishability in presence of an active attacker is implied by the observational equivalence of the corresponding symbolic processes. We prove our result for symmetric encryption, but the same techniques can be applied to other security primitives such as signatures and public-key encryption. The proof requires the introduction of new concepts, which are general and can be reused in other settings.

/pdf/computational-soundness-of-observational-equivalence-227ct9sre8.pdf

Computational soundness of observational equivalence

This paper discusses progress in the verification of security protocols. Focusing on a small, classic example, it stresses the use of program-like representations of protocols, and their automatic analysis in symbolic and computational models.

/pdf/models-and-proofs-of-protocol-security-a-progress-report-3y1sloua09.pdf

Models and Proofs of Protocol Security: A Progress Report

We consider a new extension of the Skolem class for first-order logic and prove its decidability by resolution techniques. We then extend this class including the built-in equational theory of exclusive or. Again, we prove the decidability of the class by resolution techniques. Considering such fragments of first-order logic is motivated by the automatic verification of cryptographic protocols, for an arbitrary number of sessions; the first-order formalization is an approximation of the set of possible traces, for instance relaxing the nonce freshness assumption. As a consequence, we get some new decidability results for the verification of cryptographic protocols with exclusive or.

New decidability results for fragments of first-order logic and application to cryptographic protocols

We consider arbitrary cryptographic protocols and security properties. We show that it is always sufficient to consider a bounded number of agents b (actually b = 2 in most of the cases): if there is an attack involving n agents, then there is an attack involving at most b agents.

/pdf/security-properties-two-agents-are-sufficient-ohmvreo6n1.pdf

Security properties: two agents are sufficient

We consider security properties of cryptographic protocols that can be modeled using the notion of trace equivalence. The notion of equivalence is crucial when specifying privacy-type properties, like anonymity, vote-privacy, and unlinkability.In this paper, we give a calculus that is close to the applied pi calculus and that allows one to capture most existing protocols that rely on classical cryptographic primitives. First, we propose a symbolic semantics for our calculus relying on constraint systems to represent infinite sets of possible traces, and we reduce the decidability of trace equivalence to deciding a notion of symbolic equivalence between sets of constraint systems. Second, we develop an algorithm allowing us to decide whether two sets of constraint systems are in symbolic equivalence or not. Altogether, this yields the first decidability result of trace equivalence for a general class of processes that may involve else branches and/or private channels (for a bounded number of sessions).

/pdf/trace-equivalence-decision-negative-tests-and-non-4r4yret6me.pdf

Hubert Comon-Lundh

Papers

Computational soundness of observational equivalence

Models and Proofs of Protocol Security: A Progress Report

New decidability results for fragments of first-order logic and application to cryptographic protocols

Security properties: two agents are sufficient

Trace equivalence decision: negative tests and non-determinism