Abstract

Many security protocols have the aim of authenticating one agent to another. Yet there is no clear consensus in the academic literature about precisely what "authentication" means. In this paper we suggest that the appropriate authentication requirement will depend upon the use to which the protocol is put, and identify several possible definitions of "authentication". We formalize each definition using the process algebra CSP, use this formalism to study their relative strengths, and show how the model checker FDR can be used to test whether a system running the protocol meets such a specification. 1 Introduction Many security protocols have appeared in the academic literature; these protocols often have the aim of achieving authentication, i.e., one agent should become sure of the identity of the other. The protocols are designed to succeed even in the presence of a malicious agent, called an intruder, who has complete control over the communications network, and so can intercept ...

Citations

3118	Communicating Sequential Processes - Hoare - 1985
1040	R.: A logic for authentication - Burrows, Abadi, et al. - 1989
783	Using encryption for authentication in large networks of computers - Needham, Schroeder - 1978
548	Breaking and fixing the Needham-Schroeder public-key protocol using CSP and FDR - Lowe
231	Authentication and Authenticated Key Exchanges - Diffie, Oorschot, et al. - 1992
221	Timestamps in key distribution protocols - Denning, Sacco - 1981
187	An attack on the Needham-Schroeder public-key authentication protocol - Lowe - 1995
183	A compiler for the analysis of security protocols - Casper - 1997
138	Proving properties of security protocols by induction - Paulson - 1997
112	E cient and Timely Mutual Authentication - Otway, Rees - 1987
109	Limitations of the Kerberos authentication system - Bellovin, Merritt - 1991
103	Security properties and CSP - Schneider - 1996
89	Integrating security in a large distributed system - Satyanarayanan - 1989
89	Some new attacks upon security protocols - Lowe - 1996
82	Kerberos authentication and authorization system - Miller, Neuman, et al. - 1987
78	A taxonomy of replay attacks - Syverson - 1994
77	Programming Satan’s computer - Anderson, Needham - 1995
71	Model-checking CSP - Roscoe - 1994
55	What do we mean by entity authentication - Gollmann - 1996
48	A note on the use of timestamps as nonces - Neuman, Stubblebine - 1993
41	A lesson on authentication protocol design - Woo, Lam - 1994
40	Systematic Design of a Family of Attack-Resistant Authentication Protocols - Bird, Gobal, et al. - 1993
39	Intensional specification of security protocols - Roscoe - 1996
27	Mechanized proofs of security protocols: NeedhamSchroeder with public keys - Paulson - 1997
20	A Nonce-Based Protocol for Multiple Authentications - Kehne, Schonwalder, et al. - 1992
17	A family of attacks upon authentication protocols - Lowe - 1997
15	On the security of recent protocols - Clark, Jacob - 1995
13	Using CSP for protocol analysis: the Needham-Schroeder Public-Key Protocol - Schneider - 1996
12	The design and implementation of an authentication system for the wide area distributed environment - Yamaguchi, Okayama, et al. - 1991
10	A logic of authentication. Proceedings of the Royal Society of London A, 426:233–271 - Burrows, Abadi, et al. - 1989
8	On the security of SPLICE/AS--- the authentication system - Hwang, Chen - 1995
3	On the security of SPLICE/AS---the authentication system - Hwang, Chen - 1995
1	11770-2:1994 "Information technology---Security Techniques---Key management---Part 2: Mechanisms using symmetric techniques - DIS - 1994