Automated verification of equivalence properties of cryptographic protocols

Rohit Chadha (1) , Stefan Ciobaca (1, 2) , Steve Kremer (2)

1 LSV - Laboratoire Spécification et Vérification [Cachan]
2 CASSIS - Combination of approaches to the security of infinite states systems

Indistinguishability properties are essential in formal verification of cryptographic protocols. They are needed to model anonymity properties, strong versions of confidentiality and resistance to offline guessing attacks, and can be conveniently modeled using process equivalences. We present a novel procedure to verify equivalence properties for bounded number of sessions. Our protocol specification language is parametrized by a first-order term signature and a rewrite system which allows formalization of algebraic properties of cryptographic primitives. Our procedure is able to verify observational equivalence for determinate cryptographic protocols. When protocols are not determinate our procedure can be used for both under- and over-approximations, which proved successive on examples. The procedure can handle a large set of cryptographic primitives, namely those which can be modeled by an optimally reducing convergent rewrite system. The procedure is based on a fully abstract modeling of traces in Horn clauses on which a dedicated resolution procedure is used to decide equivalence properties. Although, we were unable to prove termination of the resolution procedure, the procedure has been implemented in a prototype tool and has been effectively tested on examples some of which were outside the scope of existing tools, including checking anonymity of an electronic voting protocol.

Domaines: Cryptographie et sécurité [cs.CR]

Rohit Chadha, Stefan Ciobaca, Steve Kremer. Automated verification of equivalence properties of cryptographic protocols. [Research Report] 2011. ⟨inria-00632564v1⟩