Spi Calculus

1. Spi Calculus Gokhan Gokoz Chad R. Meiners

2. What Spi Calculus Is • Spi calculus is a form of pi calculus extended to support cryptography. • Pi calculus is a language for describing and implementing concurrent processes over communication channels. • Pi calculus is designed to have a concise description when compared to CSP. • Spi calculus adds operators to perform symmetric cryptography.

3. How Pi and Spi Calculus is used to verify security properties of protocols. • Authenticity • Is the implementation equivalent to the specification? • Secrecy • Can an external process distinguish one instance from another?

4. Basic Facilities of Pi Calculus • Process: A system is constructed out of a set of concurrent processes. • Scope: Variables and channels may be restricted to certain processes or they may be global. • Channel: Processes communicate and synchronize with each other via channels.

5. Scope Extrusion • Channels may be placed as messages on channels. • Allows for scope restricted channel to be used outside of it original scope. • Allows dataflow analysis. • Spi calculus adds encryption operators.

6. Pi Grammar Pi calculus has four types of objects: • Names: channels. • represented as m, n, p, q, and r. • Variables: • represented as x, y, and z . • Terms: objects in Pi calculus. • represented as L, M, N. • Processes: • represented as P, Q, and R.

7. Terms A term can be one of the following five forms: • n: the name of a channel • (M, N) : a pair of terms. • 0 : the number zero. • suc(M) : the successor of M. • x: a variable.

8. Process Primitives • 0: Is the nil process. • P | Q: Is the process composition operator. • !P: Is the process replication operator Examples: A := 0 :A is the nil process B := !A | C :B is an infinite number of A in parallel with C.

9. Process communication • M<N>.P • communicate message N on channel M • becomes P. • M(x).P • block until it receives a message N from channel M • P where all occurrences of x in P are replaced by N • (We abbreviate such replacements with P[N/x]) Examples: A := c<0>.0 : A sends nil on c and becomes nil. B := c(x).0 : B received x on c and becomes nil.

10. Process Decisions • [M is N]P • P if M=N • else 0 • let (x,y) = MinP • P[N/x][L/y] when M=(N,L) • otherwise 0 • caseMis 0 : P suc(x) : Q • P when M=0 • Q[N/x] if M=suc(N) • 0 if M is not an integer.

11. Process Decisions Examples: • A(M,N) := [M,N]B • A is B if M=N; otherwise, A is 0. • B(M) := let (x,y) = M inA(x,y) • B is A(x,y) if M is a pair; otherwise, B is 0. • C(M) := caseMis 0 : 0 suc(x) : C(x) • C is 0 when M = 0 • C is C(M-1) when M > 0 • C is 0 if M N

12. Process Scope and Extrusion • (vn)P • P with the name n bound to P’s scope. Example: A(M) := (vcp)ca<cp>.cp <M>.0 • Send private channel cp on ca then become nil. B := ca(x).x(y).0 • Receive channel x on ca then receive y on x then become 0. C := (vca)(A(M) | B) • C is A in parallel with B. Channel ca is only in A’s and B’s scope.

13. Spi Calculus Extensions • {M}N: term representing the message “M encrypted with the key N”. • caseLof {x}N in P:P[M/x] provided that L= {M}N otherwise it is 0. Examples: A(M) := ca<{M}k>.0 • A sends M encrypted with k on ca and then becomes nil. B := ca(y).caseyof {x}k in F(x) • B receives y on ca and decrypts y into x using k. B then become F(x). C(M) := (vca)(vk)(A(M) | B) • C is A and B with channel ca and key k.

14. Process Equivalence • In Pi Calculus, we write P≡Q iff P and Q are indistinguishable to a separate process R. • In Spi Calculus we write P(M) ≡P(M’) iff given the two process instances a separate process R cannot tell which instance is the instance of M and which the instance of M’.

15. Pi Calculus Example Message 1 : A→B: M on cab A(M) :=cab<M> B := cab(x).F(x) Inst(M) := (vcab)(A(M) | B) • Principal A sends message M on channel cab to principal B. • cab is restricted, only A and B have access to cab. • Inst(M) isone instance of the protocol.

16. Pi Calculus Example (cont.) • Specification: A(M) :=cab<M> Bspec(M) := cab(x).F(M) Instspec(M) := (vcab)(A(M) | Bspec(M)) • Difference between protocol and specification: Bspec(M) is a variant, which receives input from A and acts like B when B receives M.

17. Security Properties • Authenticity property: Inst(M) ≡Instspec(M), for all M. The protocol with message M is indistinguishable from the specification with message M, for all messages M. • Secrecy property: Inst(M) ≡Inst(M’) if F(M) ≡F(M’), for all M,M’. If F(M) is indistinguishable from F(M’), then the protocol with message M is indistinguishable from the protocol with message M’. • These security properties hold because of the restriction on the channel cab.

18. Channel Establishment Example • Abstract and simplified version of the Wide Mouthed Frog protocol • proposed by Michael Burrows in 1989 • passes a restricted channel from A to B via restricted channels to S.

19. Channel Establishment Example (cont.) • channels instead of the keys • channel establishment and data communication happen only once Message 1: A→S: cab on cas Message 2 : S→B: cab on csb Message 3 : A→B: M on cab S 2. new channel 1. new channel A B 3. Data on new channel

20. Protocol Implementation • A(M) := (vcab)cas<cab>.cab<M> • A sends channel cab over cas then sends M over cab. • S := cas(x).csb<x> • S forwards x from cas to csb. • B := csb(x).x(y).F(y) • B receives channel x on csb and receives y on x. • Inst(M) := (vcas)(vcsb) )(A(M) | S | B) • Inst is the composition of A, S and B.

21. Specification In the specification A(M) and S are same as above, • Bspec(M) := csb(x).x(y).F(M) • Here Bspec is similar to B except it knows what M is already for authenticity checking. • Inst(M)spec:=(vcas)(vcsb) )(A(M) | S | Bspec(M)) The authenticity and secrecy properties hold.

22. Spi Calculus Example Same as the first Pi example except that a key is used to insure secrecy. • Message 1: A→B: {M}kabon cab • A(M) :=cab<{M}kab > • A send a shared key encrypted message M on cab. • B := cab(x).case x of {y}kabin F(y) • B decrypts x into y. • Inst(M) :=(vkab)(A(M) | B) • The key kab is restricted to only A and B.

23. Spi Example Specification Specification: • A(M) :=cab<{M}kab> • Bspec(M) := cab(x).case x of {y}kabin F(M) • Instspec(M) :=(vkab)( A(M) | Bspec(M)) Authenticity and secrecy properties are confirmed under a coarse-grained equivalence since an observer can definitely distinguish between P(M) and P(M´).

24. Key establishment in Spi Calculus • Same as the Pi frog protocol with key used instead of restricted channels. Message 1: A→S: {kab}kason cas Message 2: S→B: {kab}ksbon csb Message 3: A→B: {M}kabon cab S 1. new key kab under kas 2. new key kab under ksb A B 3. Data under new key kab

25. Protocol • A(M) :=(vkab)( cas<{kab}kas>.cab‹{M}kab>) • A sends a key kab to the server S and uses kabto encrypt M to send to B. • S := cas(x).case x of{y}kasincsb<{y}ksb> • S forwards the key contained in x via the shared key kas. • B := csb(x).case x of{y}ksbincab(z).case z of{w}yin F(w) • B receives and decrypts the key in x then uses that key to get the message w. • Inst(M) :=(vkas) (vksb)( A(M) | S | B)

26. Specification • Principals A(M) and S are the same as in the protocol; • Bspec(M) := csb(x).case x of{y}ksbin cab(z).case z of{w}yin F(M) • Instspec(M) :=(vkas) (vksb)( A(M) | S | Bspec(M)) • The specification is more complex than the protocol but Bspec(M) applies F only to the data from A and not to a message resulting from an attack or error.

27. Complete Authentication Example (with a flaw) • A server and n other principals • Each principal’s input channels are public and are named as c1, c2, …, cn and cs. • Server shares a pair of keys with each other principal, ksi and kis. • Message sequence: Message 1: A→S: A,{B,kab}kas on cs Message 2: S→B: {A, kab}ksbon cb Message 3: A→B: A,{M}kabon cb

28. Instance of the protocol • We have two principals (A and B) and the message sent after key establishment. • Instance I is a triple (i,j,M) where i: source address , j: destination address • Send(i,j,M):=(vk)(cs<(i,{j,k}kiS)>| cj<(i,{M}k)>) • Recv(j):= cj(ycipher).case ycipherof{xa,xkey}kSjincj(za,zcipher).[xa is za]case zcipherof{zplain}xkeyin F(xa,j, zplain)

29. Instance of the protocol (Sending) • Send(i,j,M) :=(vk)(cs<(i,{j,k}kiS )>|cj<(i,{M}k)>) • Creates a key k, sends to the server along with the names i and j of the principals of the instance. • Sends M under k with its name i.

30. Instance of the protocol (Receiving) • Recv(j) := cj(ycipher).case ycipherof{xa,xkey}kSjincj(za,zcipher).[xa is za] case zcipherof {zplain}xkeyin F(xa,j, zplain) • Waits for a message ycipher from server, extracts xkeyfrom this message • Then waits for a message zcipherunder this key • At the end applies F to the name xaof the presumed sender, j and to zplainof the message.

31. Server The server S is the same for all instances: S := cs(xa,xcipher). i1..n[xa is i] case xcipher of {xb,xkey}kisin j1..n[xb is j] cj<{xa,xkey}ksj> S receives a key that selects the correct branch to forward the key to the correct j. i1..k Pi is the k-way composition P1 |…|Pk

32. Whole System Sys(I1,…, Im) := (vkiS)(vkSj) (Send(I1) |…| Send(Im) | !S | !Recv(1) |…| !Recv(n) ) • Where (vkiS)(vkSj) stands for (vk1s)…(vkns) (vks1)…(vksn) and Sys(I1,…, Im) represents a system with m instances of the protocol.

33. The Flaw • The protocol is vulnerable to a replay attack. • System: Sys(I,I) where I=(i,j,M) ,I=(i,j,M) • An attacker can replay messages of one instance and get them mistaken for messages of the other instance. • So M will be passed to F twice and Sys(I,I) could execute two copies of F(i,j,M) although Sys(I,I) can run F for both instances F(i,j,M) and F(i,j,M) only once. • Therefore the authenticity equation doesn’t hold. Inst(M) ≡Instspec(M), for all M.

34. Complete Authentication Example (repaired) • To protect previous protocol against replay attacks, nonce handshakes (tag in the message to authenticate the sender) are added. • The new protocol, informally looks like: • Message 1: A→S: A on cs • Message 2: S→A: Ns on ca • Message 3: A→S: A,{A,A,B,kab,Ns}kason cs • Message 4: S→B: * on cb • Message 5: B→S: Nb on cs • Message 6: S→B: {S,A,B, kab, Nb}ksbon cb • Message 7: A→B: A,{M }kab on cb • See Appendix for implementation.

35. What we get with Spi Calculus? • Protocols in Spi Calculus are tedious. • Good for proofing authenticity and secrecy. • The scope of errors that it can find are limited though • Spi Calculus is not as general as other logics, but this lack of generality allows us more confidence in the properties we can prove.

36. Tool Support • Spi Calculus does not have any direct tool support. • Security proprieties must be proven by humans. • There is however a protocol language Cryptc that is based on Spi Calculus.

37. Cryptc • Redefines Spi calculus’s grammar • Adds protocol beginnings and endings • Protocols are considered secure if every protocol ending has a distinct beginning. • Cryptc performs an exhaustive search for paths that generate an end without a begin.

38. Online References • A Calculus for Cryptographic Protocols: The Spi CalculusMartin Abadi and Andrew D. GordonDigital SRC Research Report 149January 25, 1998http://gatekeeper.dec.com/pub/DEC/SRC/research-reports/abstracts/src-rr-149.Html

39. Online References •  Authenticity by Typing for Security ProtocolsA.D. Gordon and A.S.A. JeffreyMicrosoft Research Technical Report MSR-2001-49, 2001ftp://fpl.cs.depaul.edu/pub/ajeffrey/spi-types.ps.gz • The Cryptc webpage: http://cryptyc.cs.depaul.edu/intro.html

40. Appendix : Corrected Protocol Send(i,j,M) :=cs<i> | ci(xnonce). (vk)(cs<(i,{i,i,j,k,xnonce}kiS )>| cj<(i,{M}k)>) S := cs(xa).i1..n[xa is i](vNs)(ci<Ns> | cs(xa,xcipher).[xa is i] case xcipher of {ya,za,xb,xkey,xnonce}kis in j1..n[yais i][za is i][xb is j][xnonce is Ns] (cj<*> | cS(ynonce). cj<{S,i,j, xkey,ynonce}ksj>))

41. Recv(j) := cj(w). (vNb) (cs<Nb> | cj(ycipher). case ycipher of {xs, xa, xb, xkey,ynonce}ksj in j1..n[xsis S][xais i][xbis j][ynonce is Nb] cj(za,zcipher).[zais xa] case zcipher of {zplain}xkeyin F(i,j,zplain)) Sys(I1,…, Im) := (vkiS)(vkSj) (Send(I1) |…| Send(Im) | !S | !Recv(1) |…| !Recv(n) )

42. Authenticity: Sys(I1,…,Im) ≡Sysspec(I1,…,Im) for any instances I1,…,Im. This property holds because of the nonces. • Secrecy: Sys(I1,…,Im) ≡Sysspec(J1,…,Jm) if each pair (I1,J1),…,(Im,Jm) is indistinguishable.