i613 Algebraic Formal Methods - Japan Advanced Institute ...kokichi/class/i613-1312/lectureNote10.pdf · Authentication protocol (5) 9 Cathy is never able to obtain nAlice nor nBob

i613 Algebraic Formal Methods10. Model checking of

trans‐based system specifications

Kazuhiro Ogata (JAIST)

Outline of lecture

• Invariant model checking

• Authentication protocol

• Specification of NSPK, an authentication protocol

• Model checking that NSPK enjoys the nonce secrecy property

2

Invariant model checking (1)

3

State machine M is <S,I,T> s.t. S is a set of states, I ⊆ S (the set of initial states), and T ⊆ S × S (transition relations).

Let p be a predicate over S.

p is invariant w.r.t. M iff p holds in all reachable states R from I.

Invariant model checking is to verify or falsify that p is invariant w.r.t. M by exhaustively traversing R.

S

I

R

Invariant model checking (2)

4

Let SPEC be a trans‐based specification of M in which Config is the sort corresponding to S, c be a term of Config corresponding to a state in I, and C be a variable of Config.

open SPEC .… red search c =(1,*)=>* C suchThat ￢p(C) .

close

Invariant model checking (especially for falsification) can be performed by the following search:

Invariant boundedmodel checking can also be conducted if a natural number k is used instead of * in (1,*).

Authentication protocol (1)

5

Whom am I communicating with?

Alice Bob?

… Bob ?

!?

I am communicating with Bob.

!


6

Public‐key cryptography

(closed)

(opened)

encrypted

decryptedplaintext ciphertext (cipher)

public key private key

Nonce

Principals Main players in a protocol such as Alice & Bob.

Each nonce is used at most once.

Cryptographically secure (pseudo‐)random numbers can be used as nonces.


7

{nAlice,Alice}pubkey(Bob)

challenge

{nAlice,nBob}pubkey(Alice)

responce

{nBob}pubkey(Bob)

confirmation

Roger M. Needham, Michael D. Schroeder: Using Encryption for Authentication in Large Networks of Computers. Commun. ACM 21(12): 993‐999 (1978)

Needham‐Schroeder Public‐Key (NSPK) authentication protocol

Alice (initiator) Bob (responder)


8

Cathy {… n …}k

If k is the Cathy’s public key, she can also obtain n.

Cathy can obtain any message {… n …}k flowing in the open network.

Intruder

Cathy may not be distinguished from other principals.

She can counterfeit messages based on those messages and nonces.

{n,Alice}pubkey(Bob)


9

Cathy is never able to obtain nAlice nor nBob.

The principals who know nAlice and/or nBob are only Alice and Bob.

Nonce secrecy proeprty One property NSPK should enjoy

Specification of NSPK (1)

10

mod! SET(X :: TRIV) {[Elt.X < Set]op emp : -> Set {constr}op _ _ : Set Set -> Set {constr assoc comm id: emp}op _\in_ : Elt.X Set -> Boolop _=<_ : Set Set -> Boolvars E E' : Elt.Xvars S S' : Seteq E E = E .…

}


11

eq E \in emp = false .eq E \in E S' = true .ceq E \in E' S' = E \in S' if not(E = E') .eq emp =< S' = true .eq (E S =< S') = (E \in S') and (S =< S') .ceq (S = S') = (S =< S') and (S' =< S)

if not((S :is Elt.X) and (S' :is Elt.X)) .

The condition is needed to prevent a circular definition of _\in_ and _=_ that may lead to infinite rewrite steps.


12

mod* RANDOM-NUMBER {pr(PNAT)op seed : -> PNatop next : PNat -> PNatvars R R' : PNateq (next(R) = seed) = false .eq (next(R) = next(R')) = (R = R') . }

Each model is a permutation of natural numbers:

seed, next(seed), next(next(seed)), …

From a security point of view, however, predictable permutations are not acceptable: 0, 1, 2, … 99, …, 0, 199, …, 100, …

Unpredictableness is implicitly described in the specification of NSPK, which works for model checking and theorem proving.


13

mod! INTRUDER { [Intruder]op intrdr : -> Intruder {constr} }

mod* PRINCIPAL { [Prin] }

mod! PRIN&INTRDR { pr(INTRUDER) pr(PRINCIPAL)[Intruder Prin < Prin&Intrdr]var I : Intruder var P : Prin var PI : Prin&Intrdreq (I = P) = false .eq (I = PI) and (PI = P) = false . }

mod! PRIN-SET {pr(SET(PRINCIPAL) * {sort Set -> PrinSet,

op emp -> noPrin } ) }


14

mod! NONCE principal-sort Nonce { pr(RANDOM-NUMBER) pr(PRIN&INTRDR)[Nonce]op n : Prin&Intrdr Prin&Intrdr PNat -> Nonce {constr}op gen : Nonce -> Prin&Intrdrop forWhom : Nonce -> Prin&Intrdrvars PI1 PI2 PI1' PI2' : Prin&Intrdr vars R R' : PNateq (n(PI1,PI2,R) = n(PI1',PI2',R')) = (PI1 = PI1') and (PI2 = PI2') and (R = R') .eq gen(n(PI1,PI2,R)) = PI1 .eq forWhom(n(PI1,PI2,R)) = PI2 . }

nAlice and nBob is denoted by n(Alice,Bob,r1) and n(Bob,Alice,r2).

mod! NONCE-SET {pr(SET(NONCE) * {sort Set -> NonceSet, op emp -> noNonce } ) }

nBobnAlice


15

mod! CIPHER1 { pr(NONCE)[Cipher1]op c1 : Prin&Intrdr Nonce Prin&Intrdr -> Cipher1 {constr}op non : Cipher1 -> Nonceop gen : Cipher1 -> Prin&Intrdrvars PI QI PI' QI' : Prin&Intrdrvars N N' : Nonceeq non(c1(QI,N,PI)) = N . eq gen(c1(QI,N,PI)) = PI . … }

The ciphertext in the message is denoted by c1(Bob,n(Alice,Bob,r1),Alice).


challenge


16

mod! MESSAGE1 { pr(CIPHER1)[Msg1]op m1 : Prin&Intrdr Prin&Intrdr Prin&Intrdr Cipher1 -> Msg1 {constr}… }


challenge

The message is denoted by m1(Alice,Alice,Bob,c1(Bob,n(Alice,Bob,r1),Alice)).

mod! MESSAGE principal-sort Msg {pr(MESSAGE1) pr(MESSAGE2) pr(MESSAGE3)[Msg1 Msg2 Msg3 < Msg]eq (M1:Msg1 = M2:Msg2) = false .eq (M1:Msg1 = M3:Msg3) = false .eq (M2:Msg2 = M3:Msg3) = false . }


17

mod! NETWORK {pr(SET(MESSAGE) * {sort Set -> Network, op emp -> noMsg } )op _\in_ : Cipher1 Network -> Boolop _\in_ : Cipher2 Network -> Bool…eq CIPH1 \in noMsg = false .eq CIPH1 \in m1(C,S,D,CIPH1') NW

= if CIPH1 = CIPH1' then true else CIPH1 \in NW fi .eq CIPH1 \in M2 NW = CIPH1 \in NW .eq CIPH1 \in M3 NW = CIPH1 \in NW . … }

m1(Alice,Alice,Bob,c1(Bob,n(Alice,Bob,r1),Alice))


18

mod! OBSERVABLE-VALUE principal-sort OVal {pr(NETWORK) …[OVal]op (nw:_) : Network -> OVal {constr}op (rand:_) : PNat -> OVal {constr}op (nonces:_) : NonceSet -> OVal {constr}op (prins:_) : PrinSet -> OVal {constr} … }

nw: all messages sent (put into the network)

rand: the random number used (generated) next

nonces: all nonces gleaned by the intruder (Cathy)

prins: all non‐intruder principals such as Alice and Bob


19

mod! CONFIG { pr(PNAT)pr(SET(OBSERVABLE-VALUE)

* {sort Set -> Config, op emp -> void } )op #nw : Config -> Pnatop #nonces : Config -> PNat…op nonces : Config -> NonceSetop msgs : Config -> Network…ceq nonces((nonces: NS) C) = NS if #nonces(C) = z .ceq nonces((nonces: NS) C) = noNonce if not(#nonces(C) = z) .ceq nonces(C) = noNonce if #nonces(C) = z . ... }

mod! PNAT { [PZero PNzNat < Pnat]op z : -> PZero {constr}op s : PNat -> PNzNat {constr}… }


20

mod! NSPK-INIT { inc(CONFIG)op init : PrinSet -> Configvar PS : PrinSeteq init(PS)

= (nw: noMsg) (rand: seed) (nonces: noNonce) (prins: PS) . }

init(Alice Bob) = (nw: noMsg) (rand: next(seed)) (nonces: noNonce) (prins: (Alice Bob))


21

mod! NSPK-CHALLENGE1 { inc(CONFIG) …ctrans [challenge1] : (nw: NW) (rand: R) (nonces: NS) (prins: (P Q PS))=> (nw: (m1(P,P,Q,c1(Q,n(P,Q,R),P)) NW))

(rand: next(R)) (nonces: NS) (prins: (P Q PS)) if not(P = Q) . }

m1(P,P,Q,c1(Q,n(P,Q,R),P))Challenge1


22

mod! NSPK-CHALLENGE2 { inc(CONFIG) …trans [challenge2] : (nw: NW) (rand: R) (nonces: NS) (prins: (P PS))=> (nw: (m1(P,P,intrdr,c1(intrdr,n(P,intrdr,R),P)) NW))

(rand: next(R)) (nonces: (n(P,intrdr,R) NS)) (prins: (P PS)) . }

m1(P,P,intrdr,c1(intrdr,n(P,intrdr,R),P))Challenge2

Challenge2n(P,intrdr,R)


23

mod! NSPK-CHALLENGE3 { inc(CONFIG) …trans [challenge3] : (nw: NW) (rand: R) (nonces: NS) (prins: (Q PS))=> (nw: (m1(intrdr,intrdr,Q,c1(Q,n(intrdr,Q,R),intrdr)) NW))

(rand: next(R)) (nonces: NS) (prins: (Q PS)) . }

m1(intrdr,intrdr,Q,c1(Q,n(intrdr,Q,R),intrdr))Challenge3


24

mod! NSPK-RESPONSE { inc(CONFIG) …trans [Response] : (nw: (m1(PI',PI,QI,c1(QI,N,PI)) NW))(rand: R) (nonces: NS) (prins: PS)=> (nw: (m2(QI,QI,PI,c2(PI,N,n(QI,PI,R)))

m1(PI',PI,QI,c1(QI,N,PI)) NW))(nonces: (if PI = intrdr then n(QI,PI,R) N NS else NS fi))(rand: next(R)) (prins: PS) . }

m1(PI',PI,QI,c1(QI,N,PI)) m2(QI,QI,PI,c2(PI,N,n(QI,PI,R)))m1(PI',PI,QI,c1(QI,N,PI))

Response

elseif PI = intrdrthen

Responsen(QI,PI,R)

N


25

mod! NSPK-CONFIRMATION { inc(CONFIG) …trans [Confirmation] : (rand: R) (nonces: NS) (prins: PS)(nw: (m2(QI',QI,PI,c2(PI,N,N')) m1(PI,PI,QI,c1(QI,N,PI)) NW))=> (nw: (m3(PI,PI,QI,c3(QI,N')) m2(QI',QI,PI,c2(PI,N,N'))

m1(PI,PI,QI,c1(QI,N,PI)) NW))(nonces: (if QI = intrdr then N' NS else NS fi))(rand: R) (prins: PS) . }

m1(PI,PI,QI,c1(QI,N,PI))

m2(QI',QI,PI,c2(PI,N,N'))m3(PI,PI,QI,c3(QI,N'))

Confirmation

elseif QI = intrdrthen N'

m1(PI,PI,QI,c1(QI,N,PI))m2(QI',QI,PI,c2(PI,N,N'))

Confirmation


26

mod! NSPK-FAKE21 { inc(CONFIG) …ctrans [fake21] : (nw: NW) (rand: R) (nonces: (N N' NS)) (prins: (P Q PS))=> (nw: (m2(intrdr,Q,P,c2(P,N,N')) NW))(rand: R) (nonces: (N N' NS)) (prins: (P Q PS))

if not(N = N') and not(P = Q) . }

m2(intrdr,Q,P,c2(P,N,N'))Fake21

Fake21

N N'N N'


27

mod! NSPK-FAKE21a { inc(CONFIG) …ctrans [fake21a] : (nw: NW) (rand: R) (nonces: (N N' NS)) (prins: (P PS))=> (nw: (m2(intrdr,intrdr,P,c2(P,N,N')) NW))

(rand: R) (nonces: (N N' NS)) (prins: (P PS))if not(N = N') . }

mod! NSPK-FAKE21b { inc(CONFIG) …ctrans [fake21b] : (nw: NW) (rand: R) (nonces: (N N' NS)) (prins: (Q PS))=> (nw: (m2(intrdr,Q,intrdr,c2(intrdr,N,N')) NW))

(rand: R) (nonces: (N N' NS)) (prins: (Q PS))if not(N = N') . }


28

mod! NSPK-FAKE22 { inc(CONFIG) …ctrans [fake22] : (nw: (m2(QI',QI,PI,C2) NW))(rand: R) (nonces: NS) (prins: (P Q PS))=> (nw: (m2(intrdr,Q,P,C2) m2(QI',QI,PI,C2) NW))

(rand: R) (nonces: NS) (prins: (P Q PS))if not(P = Q) . }

m2(intrdr,Q,P,C2)Fake22

m2(QI',QI,PI,C2)m2(QI',QI,PI,C2)


29

mod! NSPK-FAKE22a { inc(CONFIG) …trans [fake22a] : (nw: (m2(QI',QI,PI,C2) NW))(rand: R) (nonces: NS) (prins: (P PS))=> (nw: (m2(intrdr,intrdr,P,C2) m2(QI',QI,PI,C2) NW))

(rand: R) (nonces: NS) (prins: (P PS)) . }

mod! NSPK-FAKE22b { inc(CONFIG) …trans [fake22b] : (nw: (m2(QI',QI,PI,C2) NW))(rand: R) (nonces: NS) (prins: (Q PS))=> (nw: (m2(intrdr,Q,intrdr,C2) m2(QI',QI,PI,C2) NW))

(rand: R) (nonces: NS) (prins: (Q PS)) . }


30

mod! INV { inc(CONFIG)op nonSec : Config Nonce -> Boolvar C : Config var N : Nonceeq nonSec(C,N) = N \in nonces(C)

implies( gen(N) = intrdr or forWhom(N) = intrdr ) . }

Nonce secrecy property (NSP) can be rephrased as follows: any nonce gleaned by the intruder has been generated by the intruder or a non‐intruder principal that wanted to authenticate the intruder.

generated by the intrudergenerated by a non‐intruder principal that wanted to authenticate the intruder

Model checking NSP for NSPK (1)

31

open NSPK + INV .ops p q : -> Prin . eq (p = q) = false .var N : Nonce var NS : NonceSet var C : Configred init(p q) =(1,*)=>* ((nonces: (N NS)) C)

suchThat (not nonSec((nonces: (N NS)) C,N)) .close

A counterexample is found.

Note that this search was not feasible with CafeOBJ, and then was done with Maude, a language sibling of CafeOBJ.

mod! NSPK { inc(NSPK-INIT)inc(NSPK-CHALLENGE1)…inc(NSPK-FAKE22) … }

Model checking NSP for NSPK (2)

32

m1(Alice,Alice,Cathy,c1(Cathy,n(Alice,Cathy,seed),Alice))

m1(Cathy,Alice,Bob,c1(Bob,n(Alice,Cathy,seed),Alice))

m2(Bob,Bob,Alice,c2(Alice,n(Alice,Cathy,seed),

n(Bob,Alice,next(seed)))

m2(Cathy,Cathy,Alice,c2(Alice,n(Alice,Cathy,seed),

n(Bob,Alice,next(seed)))

m3(Alice,Alice,Cathy,c3(Cathy,n(Bob,Alice,next(seed)))

Challenge2

Fake11b

ResponceFake22a

Confirmation

Gavin Lowe: An Attack on the Needham‐Schroeder Public‐Key Authentication Protocol. Inf. Process. Lett. 56(3): 131‐133 (1995)

Summary

• Invariant model checking

• Authentication protocol

• Specification of NSPK, an authentication protocol

• Model checking that NSPK enjoys the nonce secrecy property

33

Documents

i613 Algebraic Formal Methods - Japan Advanced Institute ...kokichi/class/i613-1312/lectureNote10.pdf · Authentication protocol (5) 9 Cathy is never able to obtain nAlice nor nBob