Deduction with XOR constraints in security API modelling

Authors:
Graham Steel
Affiliations:
School of Informatics, University of Edinburgh, Edinburgh, Scotland
Venue:
CADE' 20 Proceedings of the 20th international conference on Automated Deduction
Year:
2005

Citing 20
Cited 7

An automatic search for security flaws in key management schemes

Computers and Security
An attack on the Needham-Schroeder public-key authentication protocol

Information Processing Letters
The inductive approach to verifying cryptographic protocols

Journal of Computer Security
API-Level Attacks on Embedded Systems

Computer
Proceedings of the 12th International Conference on Automated Deduction

CADE-12 Proceedings of the 12th International Conference on Automated Deduction
Breaking and Fixing the Needham-Schroeder Public-Key Protocol Using FDR

TACAs '96 Proceedings of the Second International Workshop on Tools and Algorithms for Construction and Analysis of Systems
Automated Unbounded Verification of Security Protocols

CAV '02 Proceedings of the 14th International Conference on Computer Aided Verification
Basic Paramodulation and Superposition

CADE-11 Proceedings of the 11th International Conference on Automated Deduction: Automated Deduction
Theorem Proving with Ordering Constrained Clauses

CADE-11 Proceedings of the 11th International Conference on Automated Deduction: Automated Deduction
AC-Superposition with Constraints: No AC-Unifiers Needed

CADE-12 Proceedings of the 12th International Conference on Automated Deduction
Associative-Commutative Deduction with Constraints

CADE-12 Proceedings of the 12th International Conference on Automated Deduction
System Description: Spass Version 1.0.0

CADE-16 Proceedings of the 16th International Conference on Automated Deduction: Automated Deduction
Intruder Deductions, Constraint Solving and Insecurity Decision in Presence of Exclusive or

LICS '03 Proceedings of the 18th Annual IEEE Symposium on Logic in Computer Science
An NP Decision Procedure for Protocol Insecurity with XOR

LICS '03 Proceedings of the 18th Annual IEEE Symposium on Logic in Computer Science
On the freedom of decryption

Information Processing Letters
Superposition with completely built-in Abelian groups

Journal of Symbolic Computation
A decision procedure for the verification of security protocols with explicit destructors

Proceedings of the 11th ACM conference on Computer and communications security
Automatic discovery of API-level exploits

Proceedings of the 27th international conference on Software engineering
Terminator

IJCAI'83 Proceedings of the Eighth international joint conference on Artificial intelligence - Volume 2
Compiling and verifying security protocols

LPAR'00 Proceedings of the 7th international conference on Logic for programming and automated reasoning

Formal analysis of PIN block attacks

Theoretical Computer Science - Automated reasoning for security protocol analysis
Reducing protocol analysis with XOR to the XOR-free case in the horn theory based approach

Proceedings of the 15th ACM conference on Computer and communications security
Integrity of intention (a theory of types for security APIs)

Information Security Tech. Report
Automatic analysis of the security of XOR-based key management schemes

TACAS'07 Proceedings of the 13th international conference on Tools and algorithms for the construction and analysis of systems
Constraint differentiation: Search-space reduction for the constraint-based analysis of security protocols

Journal of Computer Security - Digital Identity Management (DIM 2007)
Formal security analysis of PKCS#11 and proprietary extensions

Journal of Computer Security - 7th International Workshop on Issues in the Theory of Security (WITS'07)
Reducing Protocol Analysis with XOR to the XOR-Free Case in the Horn Theory Based Approach

Journal of Automated Reasoning

Quantified Score

Hi-index	0.00

Visualization

Abstract

We introduce XOR constraints, and show how they enable a theorem prover to reason effectively about security critical subsystems which employ bitwise XOR. Our primary case study is the API of the IBM 4758 hardware security module. We also show how our technique can be applied to standard security protocols.