The inductive approach to verifying cryptographic protocols

  • Authors:
  • Lawrence C. Paulson

  • Affiliations:
  • -

  • Venue:
  • Journal of Computer Security
  • Year:
  • 1998

Quantified Score

Hi-index 0.00

Visualization

Abstract

Informal arguments that cryptographic protocols are secure canbe made rigorous using inductive definitions. The approach is basedon ordinary predicate calculus and copes with infinite-statesystems. Proofs are generated using Isabelle/HOL. The human effortrequired to analyze a protocol can be as little as a week or two,yielding a proof script that takes a few minutes to run.Protocols are inductively defined as sets of traces. A trace isa list of communication events, perhaps comprising many interleavedprotocol runs. Protocol descriptions incorporate attacks andaccidental losses. The model spy knows some private keys and canforge messages using components decrypted from previous traffic.Three protocols are analyzed below: Otway-Rees (which usesshared-key encryption), Needham-Schroeder (which uses public-keyencryption), and a recursive protocol (Bull and Otway, 1997) (whichis of variable length).One can prove that event ev always precedes event ev' or thatproperty P holds provided X remains secret. Properties can beproved from the viewpoint of the various principals: say, if Areceives a final message from B then the session key it conveys isgood.