On the Reachability Problem in Cryptographic Protocols

On the Reachability Problem in Cryptographic Protocols (2000)

Cached

Download Links

[ftp.inria.fr]
[protis.univ-mrs.fr]

Other Repositories/Bibliography

DBLP

by Roberto M. Amadio , Roberto M. Amadio , Denis Lugiez , Denis Lugiez , Thème Réseaux Et Systèmes , Unité Inria , Sophia Antipolis

Citations:

79 - 0 self

BibTeX

@INPROCEEDINGS{Amadio00onthe,
    author = {Roberto M. Amadio and Roberto M. Amadio and Denis Lugiez and Denis Lugiez and Thème Réseaux Et Systèmes and Unité Inria and Sophia Antipolis},
    title = {On the Reachability Problem in Cryptographic Protocols},
    booktitle = {},
    year = {2000},
    pages = {380--394},
    publisher = {Springer-Verlag}
}

Years of Citing Articles

Bookmark

OpenURL

Abstract

We study the verification of secrecy and authenticity properties for cryptographic protocols which rely on symmetric shared keys. The verification can be reduced to check whether a certain parallel program which models the protocol and the specification can reach an erroneous state while interacting with the environment. Assuming finite principals, we present a simple decision procedure for the reachability problem which is based on a `symbolic' reduction system.

Citations

872	A.C.-C.: On the security of public key protocols - Dolev, Yao - 1983
699	A.D.: A calculus for cryptographic protocols: The Spi calculus - Abadi, Gordon - 1997
245	Automated Analysis of Cryptographic Protocols using Mur - Mitchell, Mitchell, et al. - 1997
207	A survey of authentication protocol literature. http://www.cs.york.ac.uk/˜jac/ papers/drareviewps.ps - Clark, Jacob - 1997
138	Proving properties of security protocols by induction - Paulson - 1997
103	Security properties and CSP - Schneider - 1996
59	Proof techniques for cryptographic processes - Boreale, Nicola, et al. - 1999
53	Using state space exploration and a natural deduction style message derivation engine to verify security protocols - Clarke, Jha, et al. - 1998
48	Abstracting Cryptographic Protocols with Tree Automata - Monniaux - 1999
40	A model of computation for the NRL Protocol Analyzer - Meadows - 1994
28	Proving Security Protocols Correct - Paulson - 1999
12	The game of the name in cryptographic tables - Amadio, Prasad - 1999
5	Symbolic analysis of cryptographic protocols in the spi-calculus - BOREALE - 2001
3	Formal verication of cryptographic protocols - Bolignano - 1996
3	EOEcient innite-state analysis of security protocols - Huima - 1999
1	2 1[hx 0 ;x 00 i=xi]. ifx 0 2 Dom( 1);x 00 2 Dom( 2), rk (x 0 ) = rk (x 00 ) = rk (xi), and i decreasing fori=1 - Let
1	P;T [ftg;E) by (! s ). By inductive hypothesis, 9 j= E ( (P;T [ftg) # err ) and we note that (!t:P;T ) ! (P;T [ftg) sincet 2M - Then
1	P;T;E;x :T ) by (? s ). By inductive hypothesis, 9 j= E;x :T - Then
1	letx =t inP;T;E) ! ([t=x]P;T;E), by (l s ). By inductive hypothesis, 9 j=E ( ([t=x]P;T) # err ). We observe that - Then
1	by (c s 2 ). By inductive hypothesis - Then
1	xi]P;T;E) ! (P;T;E) by (m s 2 ) and by inductive hypothesis - Then
1	xj]P;T;E) ! [xi=xj](P;T;E), by (m s 3 ). By inductive hypothesis, 9 j= [xi=xj]E ( [xi=xj](P;T) # err ). We de ne 0 = [ (xi)=xj] and note that 0 j=E. This follows, by the usual case analysis where we note in particular that 0 (xj )= (xi) 2S(A(Ti))S(A(Tj )) - Then
1	xi =C]P;T;E) ! [C=xi](P;T;E) by (m s 4 ). By inductive hypothesis, 9 j=E ( [C=xi](P;T) # err ). We de ne 0 = [C=xi] and observe that 0 j=E by the usual case analysis, where we note in particular that 0 (xi) =C 2 K(Ti)S(A( 0Ti)). We observe that 0 ([xi =C] - Then
1	t)) Then ([xi =E(t;C)]P;T;E) ! (caseE(x;C) = xi in [x =t]P;T;E), by (m s 6 ). By inductive hypothesis - P
1	t:P;T ) ! (P;T [ftg), by (!). By inductive hypothesis, (P;T [ ftg;E) # err and we observe that (!t:P;T;E) ! (P;T [ftg;E) by (! s ). INRIA the reachability problem in cryptographic protocols 31 - Then
1	x:P;T ) ! ([t=x]P;T ) [t=x](P;T) # err by (?) wheret2 S(A(T )). We de ne 0 = [t=x] and observe that 0 j=E;x :T and (?x:P;T;E - Then
1	letx =t inP;T) ! ([t=x]P;T ) by (l). We observe that (letx =t inP;T;E) ! ([t=x]P;T;E), [t=x]P [t=x]P, and that by inductive hypothesis ([t=x]P;T;E) # err - Then
1	it must be thatt = ht 0 - Then