Symbolic and Computational Analysis of Network Protocol Security

Symbolic and Computational Analysis of Network Protocol Security John Mitchell Stanford University Asian 2006

Outline Protocols n Some examples, some intuition Symbolic analysis of protocol security n Models, results, tools Computational analysis n Communicating Turing machines, composability Combining symbolic, computational analysis n n n Some alternate approaches Protocol Composition Logic (PCL) Symbolic and computational semantics

Many Protocols Authentication n Kerberos Key Exchange n SSL/TLS handshake, IKE, JFK, IKEv 2, Wireless and mobile computing n Mobile IP, WEP, 802. 11 i Electronic commerce n Contract signing, SET, electronic cash, See http: //www. lsv. ens-cachan. fr/spore/, http: //www. avispa-project. org/library

Mobile IPv 6 Architecture Mobile Node (MN) IPv 6 Direct connection via binding update Corresponding Node (CN) Home Agent (HA) Authentication is a requirement Early proposals weak

802. 11 i Wireless Authentication Supplicant Un. Auth/Un. Asso Auth/Assoc c 802. 1 X Blocked Un. Blocked No Key PTK/GTK 802. 11 Association EAP/802. 1 X/RADIUS Authentication 4 -Way Handshake Group Key Handshake Data Communication MS K

IKE subprotocol from IPSEC m 1 A, (ga mod p) A B, (gb mod p) , sign. B(m 1, m 2) m 2 sign. A(m 1, m 2) Result: A and B share secret gab mod p Analysis involves probability, modular exponentiation, complexity, digital signatures, communication networks B

Run of a protocol Initiate A Respond B Attacker C D Correct if no security violation in any run

Protocol analysis methods Cryptographic reductions n n n Bellare-Rogaway, Shoup, many others UC [Canetti et al], Simulatability [BPW] Prob poly-time process calculus [LMRST…] Symbolic methods n (see also http: //www. avispa-project. org/) Model checking w FDR [Lowe, Roscoe, …], Murphi [M, Shmatikov, …], n Symbolic search w NRL protocol analyzer [Meadows] n Theorem proving w Isabelle [Paulson …], Specialized logics [BAN, …]

“The” Symbolic Model Messages are algebraic expressions n Nonce, Encrypt(K, M), Sign(K, M), … Adversary n n Nondeterministic Observe, store, direct all communication w Break messages into parts w Encrypt, decrypt, sign only if it has the key n Example: K 1, Encrypt(K 1, “hi”) “hi” w Send messages derivable from stored parts

Many formulations Word problems [Dolev-Yao, Dolev-Even-Karp, …] n Each protocol step is symbolic function from input message to output message; cancellation law dkekx = x Rewrite systems [CDLMS, …] n Each protocol step is symbolic function from state and input message to state and output message Logic programming [Meadows NRL Analyzer] n n Each protocol step can be defined by logical clauses Resolution used to perform reachability search Constraint solving [Amadio-Lugiez, … ] n Write set constraints defining messages known at step i Strand space model [MITRE] n Partial order (Lamport causality), reasoning methods Process calculus [CSP, Spi-calculus, applied , …) n n Each protocol step is process that reads, writes on channel Spi-calculus: use for new values, private channels, simulate crypto

Complexity results (see [Cortier et al]) Bounded # of sessions Unbounded number of sessions Co-NP complete General: undecidable Without nonces With nonces Bounded msg length: DEXP-time complete undecidable Tagged: exptime Tagged: decidable One-copy: DEXP-time complete Ping-pong protocols: Ptime Additional results for variants of basic model (AC, xor, modular exp, …)

Many protocol case studies Murphi [Shmatikov, He, …] n SSL, Contract signing, 802. 11 i, … Meadows NRL tool n n Participation in IETF, IEEE standards Many important examples Paulson inductive method; Scedrov et al n Kerberos, SSL, SET, many more Protocol logic n n BAN logic and successors (GNY, Sv. O, …) DDMP … Automated tools based on the symbolic model detect important, nontrivial bugs in practical, deployed, and standardized protocols

Computational model I “Alice” oracle tape “Bob” oracle tape Adversary input tape work tape [Bellare-Rogaway, Shoup, …]

Computational model II Turing machine Adversary Turing machine [Canetti, …]

Computational model III Program In(c, x). Send(…) | In(d, y). new z. Send(…y z. . ) | In(c, encrypt(k, …)). … Adversary Program program Program [Micciancio-Warinschi, …]

Computational security: encryption Several standard conditions on encryption n Passive adversary w Semantic security n Chosen ciphertext attacks (CCA 1) w Adversary can ask for decryption before receiving a challenge ciphertext n Chosen ciphertext attacks (CCA 2) w Adversary can ask for decryption before and after receiving a challenge ciphertext Computational model offers more choices than the symbolic model

Passive Adversary m 0, m 1 Challenger E(mi) guess 0 or 1 Attacker

Chosen ciphertext CCA 1 c D(c) m 0, m 1 Challenger E(mi) guess 0 or 1 Attacker

Chosen ciphertext CCA 2 c D(c) m 0, m 1 Challenger E(mi) c E(mj) D(c) guess 0 or 1 Attacker

Slide: R Canetti Equivalence-based methods: UC, RSIM Protocol execution P 1 P 3 Z input P 2 P 1 P 2 S A P 4 attacker P 4 P 3 output Z simulator F Ideal functionality

Can we have best of both worlds? Symbolic model [NS 78, DY 84, …] Complexity-theoretic model [GM 84, …] Attacker actions – Fixed set of actions, nondeterminism (ABSTRACTION) + Any probabilistic polytime computation Security properties – Idealized, e. g. , secret message = not possessing atomic term representing message (ABSTRACTION) + Fine-grained, e. g. , secret message = no partial information about bitstring representation Analysis methods + Successful array of tools and techniques; – Hand-proofs are difficult, error-prone, unsystematic; no automation compositionality

Some relevant approaches Simulation framework n Backes, Pfitzmann, Waidner Correspondence theorems n Micciancio, Warinschi Kapron-Impagliazzo logics Abadi-Rogaway passive equivalence (K 2, {01}K 3) , {({101}K 2, K 5 )}K 2, {{K 6}K 4}K 5 … ) , {({101}K 2, K 5 )}K 2, { }K 5 (K 2, (K 1, … ) , {({101}K 1, K 5 )}K 1, { }K 5 (K 1, {K 1}K 7) , {({101}K 1, K 5 )}K 1, {{K 6}K 7}K 5 Proposed as start of larger plan for computational soundness [Abadi-Rogaway 00, …, Adao-Bana-Scedrov 05]

Symbolic methods comp’l results Pereira and Quisquater, CSFW 2001, 2004 n n n Studied authenticated group Diffie-Hellman protocols Found symbolic attack in Cliques SA-GDH. 2 protocol Proved no protocol of certain type is secure, for >3 participants Micciancio and Panjwani, EUROCRYPT 2004 n Lower bound for class of group key establishment protocols using purely Dolev-Yao reasoning w Model pseudo-random generators, encryption symbolically n Lower bounds is tight; matches a known protocol

Rest of talk: Protocol composition logic Protocol Private Data Honest Principals, Attacker nd e S c e R e v i e Alice’s information n Logic has symbolic and computational semantics n n Protocol Private data Sends and receives

Example { A, Noncea }Kb A { Noncea, … }Ka B Alice assumes that only Bob has Kb-1 Alice generated Noncea and knows that some X decrypted first message Since only X knows Kb-1, Alice knows X=Bob

More subtle example: Bob’s view { A, Noncea }Kb A { Noncea, B, Nonceb } Ka B { Nonceb} Kb Bob assumes that Alice follows protocol Since Alice responds to second message, Alice must have sent the first message

Execution model Protocol n “Program” for each protocol role Initial configuration n n Set of principals and key Assignment of 1 role to each principal Run A B C new x Position in run send{x}B recv{x}B decr new z recv{z}B send{z}B

Formulas true at a position in run Action formulas a : : = Send(P, m) | Receive (P, m) | New(P, t) | Decrypt (P, t) | Verify (P, t) Formulas : : = a | Has(P, t) | Fresh(P, t) | Honest(N) | Contains(t 1, t 2) | | 1 2 | x | | Example a < b = (b a) Notation in papers varies slightly …

Modal Formulas After actions, condition [ actions ] P where P = princ, role id Before/after assertions [ actions ] P Composition rule [S]P [T]P [ ST ] P Logic formulated: [DMP, DDMP] Related to: BAN, Floyd-Hoare, CSP/CCS, temporal logic, NPATRL

Example: Bob’s view of NSL Bob knows he’s talking to Alice [ receive encrypt( Key(B), A, m ); msg 1 new n; send encrypt( Key(A), m, B, n ); receive encrypt( Key(B), n ) ]B msg 3 Honest(A) Csent(A, msg 1) Csent(A, msg 3) where Csent(A, …) Created(A, …) Sent(A, …)

Proof System Sample Axioms: n Reasoning about possession: w [receive m ]A Has(A, m) w Has(A, {m, n}) Has(A, m) Has(A, n) n Reasoning about crypto primitives: w Honest(X) Decrypt(Y, enc(X, {m})) X=Y w Honest(X) Verify(Y, sig(X, {m})) m’ (Send(X, m’) Contains(m’, sig(X, {m})) Soundness Theorem: n Every provable formula is valid in symbolic model

Modal Formulas After actions, condition [ actions ] P where P = princ, role id Before/after assertions [ actions ] P Composition rule [S]P [T]P [ ST ] P

Composition example: Part 1 Diffie Hellman A B: ga B A: gb n n Shared secret (with someone) w A deduces: Knows(Y, gab) (Y = A) ۷ Knows(Y, b) Authenticated

Composition example: Part 2 Challenge-Response A B: m, A B A: n, sig. B {m, n, A} A B: sig. A {m, n, B} n n Shared secret Authenticated w A deduces: Received (B, msg 1) Λ Sent (B, msg 2)

Composition: Part 3 ISO-9798 -3 A B: ga, A B A: gb, sig. B {ga, gb, A} A B: sig. A {ga, gb, B} n n Shared secret: gab Authenticated m : = ga n : = gb

Additional issues Reasoning about honest principals n Invariance rule, called “honesty rule” Preserve invariants under composition n If we prove Honest(X) for protocol 1 and compose with protocol 2, is formula still true?

More about composing protocols DH Honest(X) … ’ CR Honest(X) … |- Secrecy ’ |- Authentication ’ |- Secrecy Authentication [additive] [nondestructive] = DH CR ’ ISO Secrecy Authentication

PCL Computational PCL • Syntax ± • Proof System ± Symbolic model • Semantics Complexity-theoretic model • Semantics

Some general issues Computational PCL n Symbolic logic for proving security properties of network protocols using public-key encryption Soundness Theorem: n If a property is provable in CPCL, then property holds in computational model with overwhelming asymptotic probability. Benefits n n Retain compositionality Symbolic proofs about computational model Computational reasoning in soundness proof (only!) Different axioms rely on different crypto assumptions w symbolic computational generally uses strong crypto assumptions

PCL Computational PCL Syntax, proof rules mostly the same n n Retain compositional approach But some issues with propositional connectives… Significant differences n Symbolic “knowledge” w Has(X, t) : X can produce t from msgs that have been observed, by symbolic algorithm n Computational “knowledge” w Possess(X, t) : can produce t by ppt algorithm w Indist(X, t) : cannot distinguish from rand value in ppt n More subtle system w Some axioms rely on CCA 2, some info-theoretically sound, etc.

Computational Traces Computational trace contains n n n Symbolic actions of honest parties Mapping of symbolic variables to bitstrings Send-receive actions (only) of the adversary Runs of the protocol n Set of all possible traces w Each tagged with random bits used to generate trace w Tagging set of equi-probable traces

Complexity-theoretic semantics Given protocol Q, adversary A, security parameter n, define n n T=T(Q, A, n), set of all possible traces [[ ]](T) a subset of T that respects in a specific way Intuition: valid when [[ ]](T) is an asymptotically overwhelming subset of T

Semantics of trace properties Defined in a straight forward way [[Send(X, m)]](T) All traces t such that n n t contains a Send(msg) action by X the bistring value of msg is the bitstring value of m

Inductive Semantics [[ 1 2]] (T) = [[ 1]] (T) [[ 2]] (T) [[ 1 2]] (T) = [[ 1]] (T) [[ 2]] (T) [[ ]] (T) = T - [[ ]] (T) Implication uses a form of conditional probability [[ 1 2]] (T) = [[ 1]] (T) [[ 2]] (T’) where T’ = [[ 1]] (T)

Semantics of Indistinguishable Not a trace property Intuition: Indist(X, m) holds if no algorithm can distinguish m from a random value, given X’s view of the run Attacker Protocol m View(X) C if b then m else rand D b’ [[Indist(X, m)]] (T, D, e) = T if | #(t: b=b’)-|T|/2 | < e

Validity of a formula Q |= if adversary A distinguisher D negligible function f n 0 s. t. n > n 0 |[[ ]](T, D, f(n))| / |T| > 1 – f(n) Fraction of traces where “ is true” T(Q, A, n) n n Fix protocol Q, PPT adversary A Choose value of security parameter n Vary random bits used by all programs Obtain set T=T(Q, A, n) of equi-probable traces [[ ]](T, D, f)

Advantages of Computational PCL High-level reasoning, sound for “real crypto” n Prove properties of protocols without explicit reasoning about probability, asymptotic complexity Composability n n PCL is designed for protocol composition Composition of individual steps w Not just coarser composition available with UC/RSIM Can identify crypto assumptions needed n n ISO-9798 -3 [DDMW 2006] Kerberos V 5 [unpublished] Thesis: existing deployed protocols have weak security properties, assuming weak security properties of primitives they use; UC/RSIM may be too strong

CPCL analysis of Kerberos V 5 Kerberos has a staged architecture n n n First stage generates a nonce and sends it encrypted Second stage uses nonce as key to encrypt another nonce Third stage uses second-stage nonce to encrypt other msgs Secrecy n Logic proves “Good. Key” property of both nonces Authentication n Proved assuming encryption provides ciphertext integrity Modular proofs using composition theorems

Challenges for computational reasoning More complicated adversary n Actions of computational adversary do not have a simple inductive characterization More complicated messages n Computational messages are arbitrary sequences of bits, without an inductively defined syntactic structure Different scheduler n Simpler “non-preemptive” scheduling is typically used in computational models (change symbolic model for equiv) Power of induction ? n n Indistinguishability, other non-trace-based properties appear unsuitable as inductive hypotheses Solution: prove trace property inductively and derive secrecy

Current and Future Work Investigate nature of propositional fragment n Non-classical implication related to conditional probability w complexity-theoretic reductions w connections with probabilistic logics (e. g. Nilsson 86) Generalize reasoning about secrecy n n Work in progress, thanks to Arnab Need to incorporate insight of “Rackoff’s attack” Extend logic n More primitives: signature, hash functions, … Complete case studies n Produce correctness proofs for all widely deployed standards Collaborate on n n Foundational work – please join us ! Implementation and case studies – please help us !

Conclusions Symbolic model supports useful analysis n Tools, case studies, high-level proofs Computational model more “correct” n n Captures accepted notions in cryptography Greater expressiveness for security properties Two approaches can be combined n n Several current projects and approaches One example: computational semantics for symbolic protocol logic

Credits Talk this afternoon Collaborators n M. Backes, A. Datta, A. Derek, N. Durgin, C. He, R. Kuesters, D. Pavlovic, A. Ramanathan, A. Roy, A. Scedrov, V. Shmatikov, M. Sundararajan, V. Teague, M. Turuani, B. Warinschi, … More information n Web page on Protocol Composition Logic w http: //www. stanford. edu/~danupam/logic-derivation. html Science is a social process

Needham-Schroeder Protocol { A, Nonce. A } Kb A { Nonce. A, Nonce. B } { Nonce. B} Ka B Kb Result: A and B share two private numbers not known to any observer without Ka-1, Kb-1

Anomaly in Needham-Schroeder [Lowe] { A, Na } Ke A E { Na, Nb } Ka { Nb } Ke Evil agent E tricks honest A into revealing private key Nb from B. Evil E can then fool B. { Na, Nb } { A, Na } Ka B Kb

Slide: Y Lindell Universal composability also “reactive simulatability” [BPW], … see [DKMRS] For every real adversary A Protocol interaction there exists an adversary S Trusted party REAL IDEAL

Proof system Information-theoretic reasoning [new n]X (Y X) Indist(Y, n) Complexity-theoretic reductions Verify(X, m, Y) Honest(X, Y) Y’ Sign(Y’, m) Asymptotic calculations

Example Axiom n Source(Y, u, {m}X) Decrypts(X, {m}X) Honest(X, Y) (Z X, Y) Indistinguishable(Z, u) Proof idea: crypto-style reduction n n Assume axiom not valid: A D negligible f n 0 n > n 0 s. t. [[ ]](T, D, f)|/|T| < 1 –f(n) Construct attacker A’ that uses A, D to break INDCCA 2 secure encryption scheme Conditional implication essential Parts of proof are similar to [Micciancio, Warinschi]

Applications of PCL IKE, JFK family key exchange n IKEv 2 in progress 802. 11 i wireless networking n SSL/TLS, 4 way handshake, group handshake Kerberos v 5 GDOI [Cervesato et al] [Meadows, Pavlovic] Current work n Use CPCL to understand computational security of these protocols, reliance on specific crypto properties