Communication security: Formal models and proofs

(1)

Communication security: Formal models and proofs

Hubert Comon

September 14, 2016

(2)

The context (I)

I credit cards

I contactless cards

I telephones

I online transactions

I cars, fridges,... Internet of Things

I Big Brother: NSA

I Biomedical applications

I ...

(3)

The context (II)

(4)

The context (III)

I Security protocols

I Testing is not very useful

I Hiding the code is not a good idea

I The scope of formal methods

(5)

A simple handshake protocol

A→B: νn,r.aenc(hA,ni,pk(skB),r) B →A: νr⁰.aenc(n,pk(sk_A),r⁰)

(6)

The formal verification problem

∀A. A k P |= φ

∀A. A k P1 ∼ A k P2

Universal quantification onA: we cannot apply directly model-checking techniques.

One important issue: range ofA?

(7)

The formal verification problem

∀A. A k P |= φ

∀A. A k P1 ∼ A k P2

(8)

The formal verification problem

∀A. A k P |= φ

∀A. A k P1 ∼ A k P2

(9)

The formal verification problem

∀A. A k P |= φ

∀A. A k P1 ∼ A k P2

(10)

Attacker models

The DY-attacker

Messages are terms, the attacker is defined through an equation theory or an inference system

The computational attacker

Messages are bitstrings, the attacker is a probabilistic polynomial time Turing machine

Other attackers

(11)

Attacker models

The DY-attacker

Other attackers

(12)

Attacker models

The DY-attacker

Other attackers

(13)

Attacker models

The DY-attacker

Other attackers

(14)

Goals of the lecture

Verification inputs

I Cryptographic libraries

I Protocol programs

I Attacker model

I Security property

Goals of the lecture

Show how to derive the proof obligations in a parametric way, abstracting from crypto libraries, attacker models.

Focus on the semantics of protocols, for arbitrary libraries and attacker models.

(15)

Goals of the lecture

Verification inputs

I Cryptographic libraries

I Protocol programs

I Attacker model

I Security property Goals of the lecture

Show how to derive the proof obligations in a parametric way, abstracting from crypto libraries, attacker models.

Focus on the semantics of protocols, for arbitrary libraries and attacker models.

(16)

Roadmap

4 successive versions of the calculus, by increasing expressiveness (we could have considered the last case only...)

1. Simple case

2. Adding events: required for agreement properties 3. Adding replication

4. Adding channel generation: required for computational semantics

Then indistinguishability properties (privacy).

(17)

Cryptographic libraries

Syntax

I An arbitrary set of cryptographic primitivesF : hash, public-key encryption(s), symmetric encryption(s), zkp,...

represented by (typed) function symbols

I At least one random generation algorithm. Random numbers are represented by namesn,n₁,r, ... out of a set N

Termsare built over variables, function symbols and names.

(18)

Cryptographic libraries

Semantics

Mis an interpretation domain. Typically ground or constructor terms (the DY semantics) or bitstrings (the computational semantics).

Mincludes error messages (exceptions)Err.

Ifσ is an environment (mapping from variables to M), u is a term, [[u]]^M_σ

is the interpretation ofu in Mw.r.t. σ: M is a (partial) F-algebra.

The interpretation is strict:

ui ∈Err ⇒ [[f(u1, . . . ,un)]]^M_σ ∈Err

(19)

Cryptographic libraries

A possible set of function symbols

I aenc(u,pk,r) is (supposed to be) the asymmetric encryption of u with the public key pk and random input r.

I dec(u,sk) is (supposed to be) the decryption of u with the secret key sk

I pk(sk) is (supposed to be) the public key associated with the secret key sk

I hu,vi

I π1(u), π2(u)

(20)

Cryptographic libraries

A DY model

M_DY (messages) is the least set of ground terms such that:

I N ⊆M_DY

I if u,v ∈M_DY thenhu,vi ∈M_DY

I if k ∈ N then pk(k)∈M_DY

I if u∈M_DY,k,r ∈ N, then aenc(u,pk(k),r)∈M_DY. M_DY also includes special error termsErr (not messages).

dec(aenc(u,pk(k),r),k) → u For k,r ∈ N,u a message π₁(hu,vi) → u u,v are messages

π2(hu,vi) → v u,v are messages [[u]]^M_σ ^DY =uσ ↓

Any irreducible ground term, which is not a message, is an error.

(21)

Cryptographic libraries

Computational models

I η ∈Nis a security parameter

I τ mapsN to {0,1}^η

I M_c(τ,η)⊆ {0,1}^∗

I [[n]]^M^c^(τ,η)=τ(n)

I aenc( , , ),dec( , ),pk( ) are interpreted as a public-key encryption scheme.

I with an interpretation of pairing/projections, M_c(τ,η)is an F-algebra

(22)

A simple process calculus

Syntax

P ::= 0 null process (stalled)

| in(x).P input ofx (binds x)

| out(t).P output oft

| ifEQ(u,v) thenP elseP conditional branching

| lety =u inP evaluation (bindsy)

| νn.P random generation

| PkP parallel composition

All variable occurrences are bound.

(23)

Example

The simple handshake protocol

A→B: νn,r.aenc(hA,ni,pk(skB),r) B→A: νr⁰.aenc(n,pk(skA),r⁰)

A(sk_a,pk(sk_b)) =

νn,r.out(aenc(hpk(sk_a),ni,pk(sk_b),r)). in(z).letz1= dec(z,ska) in

ifEQ(z₁,n) then0(Success) else0(Fail)

B(sk_b) =

νr⁰.in(x).lety= dec(x,sk_b) in lety₁ =π₁(y) in lety₂ =π₂(y) in

out(aenc(y2,y1,r⁰)).0.

νska,sk_b. out(hpk(sk_a),pk(sk_b)i). (A(ska,pk(sk_b))kB(sk_b))

(24)

Example

A(sk_a,pk(sk_b)) =

νn,r.out(aenc(hpk(sk_a),ni,pk(sk_b),r)).

in(z).letz1= dec(z,ska) in

B(sk_b) =

(25)

Example

A(sk_a,pk(sk_b)) =

B(sk_b) =

νr⁰.in(x).lety= dec(x,sk_b) in

lety₁ =π₁(y) in lety₂ =π₂(y) in out(aenc(y2,y1,r⁰)).0.

(26)

Example

A(sk_a,pk(sk_b)) =

B(sk_b) =

(27)

Example

A(sk_a,pk(sk_b)) =

B(sk_b) =

(28)

Example

A(sk_a,pk(sk_b)) =

ifEQ(z₁,n) then0(Success) else0(Fail) B(sk_b) =

(29)

Example

A(sk_a,pk(sk_b)) =

ifEQ(z₁,n) then0(Success) else0(Fail) B(sk_b) =

(30)

Structural equivalence

0kP ≡ P P kQ ≡ QkP P k(Q kR) ≡ (P kQ)kR

νn.P ≡ νn⁰.P{n7→n⁰} in(x).P ≡ in(x⁰).P{x 7→x⁰} letx=u inP ≡ letx⁰ =u inP{x7→x⁰}

(νn.P)kQ ≡ νn⁰.(PkQ) ifn∈/ freenames(Q)

(31)

Operational semantics

States of the network are tuples (φ, σ,P), where

I φis a frame of the formνn.m1, . . . ,mk, wheren is a set of names (used so far) and m1, . . . ,m_k is a sequence of values in M(that have been sent out so far)

I σ is an environment: an assignment of the free variables to values in M

I P is a process

The semantics is a labeled transition system, whose labels are the inputs provided by the attacker (sometimes, an empty input)

(32)

Operational semantics

The transition system (I)

(φ, σ,in(x).P) −→^u (φ, σ] {x7→u},P)

(φ, σ,P) −→^u (φ⁰, σ⁰,P⁰)

(φ, σ,ifEQ(s,t) thenP elseQ) −→^u (φ⁰, σ⁰,P⁰) if[[s]]^M_σ = [[t]]^M_σ ∈/ Err

(φ, σ,Q) −→^u (φ⁰, σ⁰,P⁰)

(φ, σ,ifEQ(s,t) thenP elseQ) −→^u (φ⁰, σ⁰,P⁰) if[[s]]^M_σ 6= [[t]]^M_σ or [[s]]^M_σ ∈Error [[t]]^M_σ ∈Err

(33)

Operational semantics

(φ, σ,in(x).P) −→^u (φ, σ] {x7→u},P)

(φ, σ,P) −→^u (φ⁰, σ⁰,P⁰)

(φ, σ,Q) −→^u (φ⁰, σ⁰,P⁰)

(34)

Operational semantics

(φ, σ,in(x).P) −→^u (φ, σ] {x7→u},P)

(φ, σ,P) −→^u (φ⁰, σ⁰,P⁰)

(φ, σ,Q) −→^u (φ⁰, σ⁰,P⁰)

(35)

Operational semantics

The transition system (II)

if[[u]]^M_σ =w ∈/ Err (φ, σ,letx=uinP) −→ (φ, σ] {x7→w},P)

(νn.θ, σ,out(s).P) −→ (νn.θ·[[s]]^M_σ , σ,P) (φ, σ,P) −→^u (φ⁰, σ⁰,P⁰)

(φ, σ,PkQ) −→^u (φ⁰, σ⁰,P⁰kQ)

ifn∈/n∪freename(θ) (νn.θ, σ, νn.P) −→ νn]n.θ, σ,P)

(36)

Operational semantics

(νn.θ, σ,out(s).P) −→ (νn.θ·[[s]]^M_σ , σ,P)

(φ, σ,P) −→^u (φ⁰, σ⁰,P⁰) (φ, σ,PkQ) −→^u (φ⁰, σ⁰,P⁰kQ)

(37)

Operational semantics

(φ, σ,PkQ) −→^u (φ⁰, σ⁰,P⁰kQ)

(38)

Operational semantics

(φ, σ,PkQ) −→^u (φ⁰, σ⁰,P⁰kQ)

(39)

Example

On the black board.

(40)

Restricting the feasible transitions

(φ1, σ1,P1) −→ · · ·^u¹ −−−→^u^k−1 (φ_k, σ_k,P_k)

is possible w.r.t. modelMand an attacker Aif , for every i, A([[φ_i]]^M_σ_i ,Pi) = [[ui]]^M_σ_i

Note: could include a state inA.

(41)

Example DY

There is a DY attackerA such thatA(φ) = [[u]]^M_σ ^DY iff φ`_I uσ↓

whereI is defined by:

φ`u1· · ·φ`un

φ`f(u1, . . . ,un)↓ For everyf ∈ F

νn.u1, . . . ,un`u_i

νn.θ`n⁰ ifn⁰∈ N \n.

(42)

Exercise

In the simple handshake example, describe all feasible transition sequences in the DY model (assume the name extrusion, let, conditionals and outputs are always performed before inputs).

Is the noncen secret ?

(43)

Example computational

Ais a Probabilistic Polynomial Time Turing machine (PPT).

Some inputs that were not possible in the DY model might now be possible.

A typical example

Amight be able to compute (with a significant probability) [[aenc(u,pk(k₁),r₁)]]^M^c^(τ,η) from [[aenc(v,pk(k₁),r₁)]]^M^c^(τ,η)

∃A, Prob{τ, ρ: A([[aenc(v,pk(k₁),r₁)]]^M^c^(τ,η)) =

[[aenc(u,pk(k₁),r₁)]]^M^c^(τ,η)} > (η) isnon-negligible: there is a polynomial Pol such that

lim inf

η→+∞(η)×Pol(η)>1

(44)

Example computational

Ais a Probabilistic Polynomial Time Turing machine (PPT).

Some inputs that were not possible in the DY model might now be possible.

A typical example

Amight be able to compute (with a significant probability) [[aenc(u,pk(k₁),r₁)]]^M^c^(τ,η) from [[aenc(v,pk(k₁),r₁)]]^M^c^(τ,η)

∃A, Prob{τ, ρ: A([[aenc(v,pk(k₁),r₁)]]^M^c^(τ,η)) =

[[aenc(u,pk(k₁),r₁)]]^M^c^(τ,η)} > (η) isnon-negligible: there is a polynomial Pol such that

lim inf

η→+∞(η)×Pol(η)>1

(45)

Confidentiality

In the DY case

Is there a DY attackerA and a feasible transition sequence (∅,∅,P) −→^∗ (φ, σ,Q)

such thatA(φ,Q) =s ?

This problem is in NP

In the computational case

Is there a PPTAsuch that, for every computational model M_c(τ,η), the probability that there is a feasible sequence

(∅,∅,P) −→^∗ (φ, σ,Q) such thatA(φ,Q) =s is negligible inη ?

This requires in general assumptions on the libraries

(46)

Confidentiality

In the DY case

such thatA(φ,Q) =s ? This problem is in NP

In the computational case

(47)

Confidentiality

In the DY case

such thatA(φ,Q) =s ? This problem is in NP In the computational case

(48)

Exercises

In the following cases, give reasonable processesA,B and either give an attack on the confidentiality ofs or prove that there is no such attack in the DY model.

1.

A→B: νs, νr. hpk(sk_A),aenc(s,pk(sk_B),r)i B→A νr⁰.hpk(sk_B),aenc(s,pk(sk_A),r⁰)i

P =νsk_a, νsk_b.out(hpk(sk_A),pk(sk_B)i)·(A(sk_a,pk(sk_B))kB(sk_b))

2.

A→B: νs,r₁,r₂.aenc(hpk(sk_A),aenc(s,pk(sk_B),r₁)i,pk(sk_B),r₂) B→A: νr₃,r₄.aenc(hpk(sk_B),aenc(s,pk(sk_A),r₃)i,pk(sk_A),r₄)

P =νsk_a, νsk_b.out(hpk(sk_A),pk(sk_B)i)·(A(sk_a,pk(sk_B))kB(sk_b)kB(sk_b))

(49)

Gathering feasability conditions

States of the network are tuples (φ, σ,P, θ), where

I φ, σ,P as before

I θ is a constraint: equalities, disequalities and computational constraints of the formφ.u.

(φ, σ,in(x).P, θ) −→ (φ, σ,P, θ∧φ.x)

(φ, σ,ifEQ(s,t) thenP elseQ, θ) −→ (φ, σ,P, θ∧EQ(s,t))

(φ, σ,ifEQ(s,t) thenP elseQ, θ) −→ (φ, σ,P, θ∧ ¬EQ(s,t))

(50)

Gathering feasability conditions

(φ, σ,in(x).P, θ) −→ (φ, σ,P, θ∧φ.x)

(51)

Gathering feasability conditions

(φ, σ,in(x).P, θ) −→ (φ, σ,P, θ∧φ.x)

(52)

Gathering feasability conditions

(φ, σ,in(x).P, θ) −→ (φ, σ,P, θ∧φ.x)

(53)

Consequences

Advantages

I A finite transition system (regardless of the model)

I Confidentiality reduces to constraint satisfaction θ∧φ_f .s

in NP in the DY model

(54)

Consequences

Computational case

Specify the assumptions on the libraries: impossibility conditions.

6.n

S,aenc(n,pk(k),r).n ⇒ S.n S₁.x∧S₂,x.y ⇒ S₁,S₂.y

S₁.x₁∧. . .∧S_n.x_n ⇒ S₁, . . . ,S_n.f(x₁, . . . ,x_n) S,S1,S2 are finite sets of terms.

Check the constraint satisfiability, together withφ.s and the above axioms (in PTIME !!)

(55)

Consequences

Computational case

Specify the assumptions on the libraries: impossibility conditions.

6.n

S,aenc(n,pk(k),r).n ⇒ S.n S₁.x∧S₂,x.y ⇒ S₁,S₂.y

S₁.x₁∧. . .∧S_n.x_n ⇒ S₁, . . . ,S_n.f(x₁, . . . ,x_n) S,S1,S2 are finite sets of terms.

Check the constraint satisfiability, together withφ.s and the above axioms (in PTIME !!)

(56)

Exercise

Back to the simple handshake protocol. Study its security in the computational model, assuming the properties of the cryptographic libraries that are described in the lecture.

(57)

Adding events to the process calculus

syntax

Eva,Evb, ... is a set of event symbols.

| in(x).P input of x (bindsx)

| out(t).P output of t

| lety=uinP evaluation

| Eve(u)·P the eventEve is raised with a sequence of values u

(58)

Adding events to the process calculus

semantics

The states have now an event componentE, a sequence of event symbols together with values.

E is only modified when an event occurs in the process:

(φ, σ,Eve(u)·P,E) −→ (φ, σ,P,E·Eve([[u]]^M_σ )

(59)

Example

A(sk_a,pk(sk_b)) =

νn,r.out(aenc(hpk(sk_a),ni,pk(sk_b),r).

in(z).letz1 = dec(z,ska) in

ifEQ(z₁,n) thenEva(n,pk(sk_b),pk(sk_a)) else0 B(sk_b) =

νr⁰.in(x).lety = dec(x,skb) in lety₁ =π₁(y) in lety₂ =π₂(y) in

out(aenc(y₂,y₁,r⁰)).Evb(y₂,pk(sk_b),y₁)0.

∀x,y,z. Eva(x,y,z)⇒Evb(x,y,z)

(60)

Example

A(sk_a,pk(sk_b)) =

νn,r.out(aenc(hpk(sk_a),ni,pk(sk_b),r).

in(z).letz1 = dec(z,ska) in

ifEQ(z₁,n) thenEva(n,pk(sk_b),pk(sk_a)) else0 B(sk_b) =

νr⁰.in(x).lety = dec(x,skb) in lety₁ =π₁(y) in lety₂ =π₂(y) in

out(aenc(y₂,y₁,r⁰)).Evb(y₂,pk(sk_b),y₁)0.

∀x,y,z. Eva(x,y,z)⇒Evb(x,y,z)

(61)

Agreement property

∀x,y,z. Eva(x,y,z)⇒Evb(x,y,z) More generally

∀~x. Eva₁(u₁), . . . ,Eva_k(u_k)⇒Eva(u) For every feasible trace, ending with an event setE, for any assignmentσ, ifEva1(u1σ), . . . ,Eva_k(u_kσ)∈E, then Eva(uσ)∈E

(62)

Exercise

In the DY-mode, does the simple handshake protocol satisfy the agreement property ?

What happens if

1. we move forward theEva

2. B replies withy₂ (instead of the encrypted version) ?

(63)

Adding replication in the calculus

P ::= 0 null process

| !P

Operational semantics:

!P ≡ P k!P

(64)

Adding replication in the calculus

P ::= 0 null process

| !P

Operational semantics:

!P ≡ P k!P

(65)

Example

The handshake protocol

!(νsk_a,sk_b. out(hpk(sk_a),pk(sk_b)i). (!A(sk_a,pk(sk_b))k!B(sk_b))

(66)

Verification in the DY-model

I This is undecidable

I Most popular: approximation and translation into Horn clauses

(67)

Translation into Horn clauses

Attacker clauses

Att(a) ⇐

Att(hx₁,x₂i) ⇐ Att(x₁), Att(x₂) Att(pk(x)) ⇐ Att(x)

Att(aenc(x1,x2,x3)) ⇐ Att(x1)Att(x2), Att(x3)

Att(x₁) ⇐ Att(aenc(x₁,pk(x₂),x₃)), Att(x₂) Att(x₁) ⇐ Att(hx₁,x₂i)

Att(x2) ⇐ Att(hx₁,x2i) ais a free name.

(68)

Translation into Horn clauses

Protocol clauses

T(P) = [[P]]_∅,∅ where [[P]]_ρ,H is defined as follows [[0]] = ∅

[[PkQ]]_ρ,H = [[P]]_ρ,H∪[[Q]]_ρ,H [[!P]]ρ,H = [[P]]ρ,H

[[νn.P]]_ρ,H = [[P]]ρ]{n7→n(H)},H

[[in(x).P]]_ρ,H = [[P]]_ρ,H]{x}

[[out(s).P]]_ρ,H = [[P]]_ρ,H ∪ {Att(sρ)⇐Att(s1ρ), . . .Att(snρ)} IfH={s₁, . . . ,sn} [[ifEQ(s,t) thenP elseQ]]_ρ,H = [[P]]_ρσ,Hσ∪[[Q]]_ρ,H Ifσ =mgu(s,t)

[[letx=sinP]]ρ,H = [[P]]ρσx,s,Hσx,s Ifσx,s is defined

[[letx=sinP]]_ρ,H = ∅ Ifσx,s is undefined

(69)

Examples

B=νr.in(x).lety = dec(x,skb) in lety1=π1(y) in lety2= π2(y) in out(aenc(y2,y1,r))

x= aenc(hy₁,y₂i,pk(sk_B),z):

B=νr.in(aenc(hy₁,y2i,pk(sk_B),z)).out(aenc(y2,y1,r))

Att(aenc(y₂,y₁,r(· · ·))) ⇐ Att(aenc(hy₁,y₂i,pk(sk_B),z)))

Att(aenc(hpk(sk_A),ni,pk(sk_B),r⁰)) ⇐

(70)

Examples

B=νr.in(aenc(hy₁,y₂i,pk(sk_B),z)).out(aenc(y₂,y₁,r))

(71)

Examples

(72)

Examples

(73)

ProVerif

A tool available online, whose main developer isBruno Blanchet.

I Translate the specification of primitives into rewriting system + Attacker clauses

I Translate the protocol into clauses

I Negate the security goal

I Check for satisfiability (Ordered resolution strategy).

Three possible outputs:

1. Unsatisfiable: the protocol is secure

2. Satisfiable: there might be an attack (but might also be secure)

3. Non termination

Very successful tool : works well in practice.

(74)

False attacks

Using twice the same protocol clause (rigid variables !)

A→B : νn1,n2,r1,r2. haenc(n₁,pk(sk_B),r1),aenc(n2,pk(sk_B),r2)i B →A: νn,r₃. aenc(n,pk(sk_A),r₃)

A→B : νs. hn,senc(s,hn₁,n2i)i

Approximating names

A→B : νn.aenc(n,pk(sk_B),r) B →A: νn⁰.aenc(n⁰,pk(sk_A),r⁰)

A→B : νs.in(aenc(x,pk(sk_A),y).ifx=nthen out(s) else out(n)

(75)

False attacks

Using twice the same protocol clause (rigid variables !)

A→B : νn1,n2,r1,r2. haenc(n₁,pk(sk_B),r1),aenc(n2,pk(sk_B),r2)i B →A: νn,r₃. aenc(n,pk(sk_A),r₃)

A→B : νs. hn,senc(s,hn₁,n2i)i

Approximating names

A→B : νn.aenc(n,pk(skB),r) B →A: νn⁰.aenc(n⁰,pk(sk_A),r⁰)

A→B : νs.in(aenc(x,pk(sk_A),y).ifx=nthen out(s) else out(n)

(76)

The determinacy issue

Currently the calculus is non-deterministic, while the computational security is probabilistic.

As security is an asymptotic propery, it is harmless when the (symbolic) transition sytem is finite (for a fixed attacker).

Instead of non-determinism, we let the attacker choose the transition.

Communications are using differentcommunication channels, that solve the non-determinism and are chosen by the attacker.

(77)

The determinacy issue

(78)

The determinacy issue

(79)

Extending the calculus with channels

c,c₁, . . . are channel names

| in(c,x).P input of x (bindsx)

| out(c,t).P output of t

| !P

| νc.P

(80)

Operational semantics

Only known channels can be observed

(φ, σ,out(c,u)·P,E, θ) −→ (φ·[[u]]^M_σ , σ,P,E, θ∧φ.c)

Inputs are only possible on the designated channels

(φ, σ,in(c,x)·P,E, θ) −→ (φ, σ] {x 7→[[u]]^M_σ },P,E, θ) IfA(φ, γ) = [[c]]^M (γ is the global control state).

(81)

Operational semantics

Only known channels can be observed

(φ, σ,out(c,u)·P,E, θ) −→ (φ·[[u]]^M_σ , σ,P,E, θ∧φ.c)

Inputs are only possible on the designated channels

(φ, σ,in(c,x)·P,E, θ) −→ (φ, σ] {x7→[[u]]^M_σ },P,E, θ) IfA(φ, γ) = [[c]]^M (γ is the global control state).

(82)

Internal synchronizations

(φ, σ,in(c,x)·Pkout(c,u)·Q,E, θ) −→ (φ, σ] {x 7→[[u]]^M_σ },PkQ,E, θ)

(83)

Restrictions on the processes

We assume that, for any reachable process

in(c₁,x₁).P₁ k · · · kin(c_k,x_k).P_k kQ c1, . . . ,c_k are pairwise distinct.

Lemma

Any processP without channel can be translated into a processP⁰ such thatP⁰ satisfies the above restriction and anyP has the same (DY) operational semantics as forgetting the channels in the semantics ofP⁰.

(84)

Restrictions on the processes

We assume that, for any reachable process

in(c₁,x₁).P₁ k · · · kin(c_k,x_k).P_k kQ c1, . . . ,c_k are pairwise distinct.

Lemma

Any processP without channel can be translated into a processP⁰ such thatP⁰ satisfies the above restriction and anyP has the same (DY) operational semantics as forgetting the channels in the semantics ofP⁰.

(85)

Example

P = in(x).out(t) Q = in(y).out(u)

Trans(PkQ) = in(c_P,x).out(cP,t)kin(cQ,y).out(cQ,u)

Trans(!(PkQ)) = ! in(c_!(PkQ),?).νc_P,c_Q.out(c_!(PkQ),hc_P,c_Qi). Trans(PkQ)

(86)

Example

P = in(x).out(t) Q = in(y).out(u)

Trans(PkQ) = in(c_P,x).out(cP,t)kin(cQ,y).out(cQ,u)

Trans(!(PkQ)) = ! in(c_!(PkQ),?).νc_P,c_Q.out(c_!(P_kQ),hc_P,c_Qi).

Trans(PkQ)

(87)

Indistinguishability

Tr(M,A,P) =m₁,· · ·,m_k,· · ·

the (unique) sequence of outputs ofP, with attacker Ain model M.

Informally: P1 is indistinguishablefromP2, for a (familly of) model(s)M, if, for everyA₁,A₂,A₃,

A₂(Tr(M,A₁,P1)) = A₃(Tr(M,A₁,P1)) iff

A₂(Tr(M,A₁,P₂)) = A₃(Tr(M,A₁,P₂))

(88)

Indistinguishability

Tr(M,A,P) =m₁,· · ·,m_k,· · ·

the (unique) sequence of outputs ofP, with attacker Ain model M.

Informally: P1 is indistinguishablefromP2, for a (familly of) model(s)M, if, for everyA₁,A₂,A₃,

A₂(Tr(M,A₁,P1)) = A₃(Tr(M,A₁,P1)) iff

A₂(Tr(M,A₁,P₂)) = A₃(Tr(M,A₁,P₂))

(89)

Examples in the DY case (I)

A₁ gives (deducible) inputs to the process and A₂,A₃ observe some identities on the output.

Example 1

P₁ =νn.out(c,n) P₂=νn⁰.out(c,n⁰) P₁ ∼P₂

A₁ can’t input anything and A₂(n) =A₃(n) iff A₂ =A₃ Example 2

P₁= out(c,ok) P₂ =νn.out(c,n) P₁ 6∼P₂

A₂ is the identity,A₃ computesok.

(90)

Examples in the DY case (I)

Example 1

P₁ =νn.out(c,n) P₂=νn⁰.out(c,n⁰)

P₁ ∼P₂

(91)

Examples in the DY case (I)

Example 1

A₁ can’t input anything and A₂(n) =A₃(n) iff A₂ =A₃

Example 2

(92)

Examples in the DY case (I)

Example 1

P₁ = out(c,ok) P₂ =νn.out(c,n)

P₁ 6∼P₂

(93)

Examples in the DY case (I)

Example 1

P₁ = out(c,ok) P₂ =νn.out(c,n) P₁ 6∼P₂

(94)

Examples in the DY case (II)

Example 3

P₁=νk.out(pk(k)).out(c,aenc(n₁,pk(k),r)) P₂=νk.out(pk(k)).out(c,aenc(n₂,pk(k),r))

P₁ 6∼P₂ Example 4

P1= in(c,x)·out(c,hx,ni) P2= in(c,x)·out(c,hn,xi) P₁ 6∼P₂

(95)

Examples in the DY case (II)

Example 3

P₁=νk.out(pk(k)).out(c,aenc(n₁,pk(k),r)) P₂=νk.out(pk(k)).out(c,aenc(n₂,pk(k),r)) P₁ 6∼P₂

Example 4

P1= in(c,x)·out(c,hx,ni) P2= in(c,x)·out(c,hn,xi) P₁ 6∼P₂

(96)

Examples in the DY case (II)

Example 3

Example 4

P1 = in(c,x)·out(c,hx,ni) P2 = in(c,x)·out(c,hn,xi)

P₁ 6∼P₂

(97)

Examples in the DY case (II)

Example 3

Example 4

P1 = in(c,x)·out(c,hx,ni) P2 = in(c,x)·out(c,hn,xi) P₁ 6∼P₂

(98)

Results in the DY case

Indistinguishability is decidable in the DY case (for processes without replication). The complexity is unknown.

Verification tool: Apte.

An approximated equivalence is considered inProVerif(works with replication)

(99)

Computational indistinguishability (I)

For any PPTA₁,A₂,A₃,

Prob{τ, ρ:A₂(Tr(M_c(τ,η),A₁,P1)) =A₃(Tr(M_c(τ,η),A₁,P1))}

−Prob{τ, ρ:A₂(Tr(M_c(τ,η),A₁,P₂)) =A₃(Tr(M_c(τ,η),A₁,P₂))}

is negligible.

Example 1

P1 =νn.out(c,n) P2=νn⁰.out(c,n⁰) P1 ∼P2

The difference of probabilities is 0 !!

(100)

Computational indistinguishability (I)

is negligible.

Example 1

P1 =νn.out(c,n) P2=νn⁰.out(c,n⁰)

P1 ∼P2

(101)

Computational indistinguishability (I)

is negligible.

Example 1

P1 =νn.out(c,n) P2=νn⁰.out(c,n⁰) P1 ∼P2

(102)

Computational indistinguishability (II)

Example 2

P1 =νk1,r1,r2.out(c,aenc(ok,pk(k1),r1)).out(c,aenc(ok,pk(k1),r2)) P₂ =νk₁,k₂,r₁,r₂.out(c,aenc(ok,pk(k₁),r₁)).out(c,aenc(ok,pk(k₂),r₂))

P₁ ∼P₂ depends on assumptions on the crypto libraries Example 3

P1 = in(c,x).ifx = 0 then out(c,0) else out(c,x) P₂= in(c,x).out(c,x)

P₁ ∼P₂

(103)

Computational indistinguishability (II)

Example 2

P1 =νk1,r1,r2.out(c,aenc(ok,pk(k1),r1)).out(c,aenc(ok,pk(k1),r2)) P₂ =νk₁,k₂,r₁,r₂.out(c,aenc(ok,pk(k₁),r₁)).out(c,aenc(ok,pk(k₂),r₂)) P₁ ∼P₂ depends on assumptions on the crypto libraries

Example 3

P1 = in(c,x).ifx = 0 then out(c,0) else out(c,x) P₂= in(c,x).out(c,x)

P₁ ∼P₂