Challenges in the Automated Verification of Security Protocols
IJCAR '08 Proceedings of the 4th international joint conference on Automated Reasoning
Computational soundness of observational equivalence
Proceedings of the 15th ACM conference on Computer and communications security
Safely composing security protocols
Formal Methods in System Design
Computational soundness for key exchange protocols with symmetric encryption
Proceedings of the 16th ACM conference on Computer and communications security
A Survey of Symbolic Methods in Computational Analysis of Cryptographic Systems
Journal of Automated Reasoning
Ideal key derivation and encryption in simulation-based security
CT-RSA'11 Proceedings of the 11th international conference on Topics in cryptology: CT-RSA 2011
Composition theorems without pre-established session identifiers
Proceedings of the 18th ACM conference on Computer and communications security
A simulation-based treatment of authenticated message exchange
ASIAN'09 Proceedings of the 13th Asian conference on Advances in Computer Science: information Security and Privacy
| Hi-index | 0.00 |
Composition theorems in simulation-based approaches allow to build complex protocols from sub-protocols in a modular way. However, as first pointed out and studied by Canetti and Rabin, this modular approach often leads to impractical implementations. For example, when using a functionality for digital signatures within a more complex protocol, parties have to generate new verification and signing keys for every session of the protocol. This motivates to generalize composition theorems to so-called joint state theorems, where different copies of a functionality may share some state, e.g., the same verification and signing keys. In this paper, we present a joint state theorem which is more general than the original theorem of Canetti and Rabin, for which several problems and limitations are pointed out. We apply our theorem to obtain joint state realizations for three functionalities: public-keyencryption, replayable public-key encryption, and digital signatures. Unlike most other formulations, our functionalities model that cipher texts and signatures are computed locally, rather than being provided by the adversary. To obtain the joint state realizations, the functionalities have to be designed carefully. Other formulations are shown to be unsuitable. Our work is based on a recently proposed, rigorous model for simulation-based security by K{\"u}sters, called the IITM model. Our definitions and results demonstrate the expressivity and simplicity of this model. For example, unlike Canetti's UC model, in the IITM model no explicit joint state operator needs to be defined and the joint state theorem follows immediately from the composition theorem in the IITM model.