Abstract

In this paper we analyse the well known Needham-Schroeder Public-Key Protocol using FDR, a refinement checker for CSP. We use FDR to discover an attack upon the protocol, which allows an intruder to impersonate another agent. We adapt the protocol, and then use FDR to show that the new protocol is secure, at least for a small system. Finally we prove a result which tells us that if this small system is secure, then so is a system of arbitrary size. 1 Introduction In a distributed computer system, it is necessary to have some mechanism whereby a pair of agents can be assured of each other's identity---they should become sure that they really are talking to each other, rather than to an intruder impersonating the other agent. This is the role of an authentication protocol. In this paper we use the Failures Divergences Refinement Checker (FDR) [11, 5], a model checker for CSP, to analyse the Needham-Schroeder PublicKey Authentication Protocol [8]. FDR takes as input two CSP processes, ...

Citations

3118	Communicating sequential processes - Hoare - 1978
2507	A method for obtaining digital signatures and public-key cryptosystems - Rivest, Shamir, et al.
2292	New Directions in Cryptography - Diffie, Hellman - 1976
1040	R.: A logic for authentication - Burrows, Abadi, et al. - 1989
900	Applied Cryptography - Schneier - 1996
783	Using encryption for authentication in large networks of computers - Needham, Schroeder - 1978
221	Timestamps in key distribution protocols - Denning, Sacco - 1981
187	An attack on the Needham-Schroeder public-key authentication protocol - Lowe - 1995
103	Security properties and CSP - Schneider - 1996
71	Model-checking CSP - Roscoe - 1994
20	Hidden assumptions in cryptographic protocols - Boyd - 1990
6	Verifying a replicated database: A case study in model-checking CSP - Roscoe, MacCarthy - 1994
2	Developing and verifying protocols in CSP - Roscoe - 1993