CAPSL Integrated Protocol Environment

CAPSLIntegrated Protocol Environment Jon Millen (PI) Grit Denker SRI International January, 2000

DARPA Project: TIPE • The Integrated Protocol Environment • Started August 1998 • Technology: cryptographic protocol security analysis/design • Approach: formal specification language usable with any analysis tool - CAPSL • Product: an integrated environment to use CAPSL with analysis tools, especially PVS and Maude

Cryptographic Protocols • For key distribution or authentication • Examples • SSL - in browsers • IKE - IPsec key exchange • SET - secure electronic transactions • Kerberos - remote unitary login • KEA - used with Clipper, Skipjack • New ones are continually proposed

Protocol Flaw Analysis • Concern: active attacks • masquerading, replay, man-in-middle, etc. • Actual and theoretical examples • IP spoofing, published protocols/attacks • Protocol flaws rather than cryptosystem weaknesses • Countermeasure: formal design analysis • Abstract encryption model, formal specification • Inductive proofs, state-space search, authentication logics • Analysis can find flaws, suggest improvements, prove conditional correctness

TIPE/CAPSL Concept Cryptographic Protocols Modern, precise, easy-to-use specification language CAPSL The basis for Internet Security Translation (CAPSL Intermediate Language: term rewriting) CIL Custom “connectors” Enables the coordinated application of multiple tools Others Trace models Strand spaces SRI SRI NRL PVS Inductive proofs Maude Model-checker Protocol Analyzer

CAPSL • Common Authentication Protocol Specification Language • High-level message-list based language with abstract encryption operators (article style: A -> B: {A}K) • Declarations: • strong typing and abstract data type extensions • initialization, named expressions • security goals • Actions between messages: tests, assignments

CAPSL Style Example PROTOCOL Short; IMPORTS ClientServer; VARIABLES A,S: PKUser; N: Nonce, FRESH, CRYPTO; ASSUMPTIONS HOLDS A: S; MESSAGES A -> S: A,{A,N}SK(A); S -> A: {S,N}PK(A); GOALS SECRET N: A, S; END; Variables have types and properties Key functions are imported Spec includes assumptions and security goals

CIL • Semantics: multiset term-rewriting (MSR) • Mitchell, CAV’98 and Durgin, et al CSFW-12 • Basic state-transition model for protocols • Pattern-matching style suits most analyzers • Example: • CIL output includes declarations, axioms, goals, and environmental assumptions • A -> B: A, N; • A0(A,B)  ( N) A1(A,B), M(A,B,A) • rule(facts(state(roleA,0,terms(A,B))), ids(N), • facts(state(roleA,1,terms(A,B)), msg(A,B,A))) CAPSL MSR CIL

CAPSL to CIL Translation • Parser/Type-checker: Java • Checks syntax and type consistency • Rule generator: Maude (Java soon) • Checks implementability • Optimizer: Java • Combines transitions of one agent, multiple messages/actions • Typically 50% reduction

Rule Optimization A -> B: A; B -> A: B; A1(A,B) -> A2(A,B),M(A,B,A) B1(B),M(X,B,A) -> B2(B,A) B2(B,A) -> B3(B,A),M(B,A,B) A2(B),M(X,A,B) -> A4(A,B) A1(A,B) -> A2(A,B),M(A,B,A) B1(B),M(X,B,A) -> B3(B,A),M(B,A,B) A2(B),M(X,A,B) -> A4(A,B) Optimizations must be attack-preserving

Our Protocol Analysis Tools • PVS for inductive verification • SRI verification environment • Supports abstract data types and fixpoint induction • Used with a modification of Paulson’s approach • Maude for model checking • Executable specifications based on Rewriting Logic • High performance rewrite engine (800K/sec) • Supports typed variables and reflection • Denker, et al paper at FMSP ‘98 • Related work under DARPA Active Nets program

Inductive Proofs with PVS • Paulson-style trace model, also new state-based model to match CIL • Security property is an invariant, proved inductively • Support structure • Standard axiomatic “theories” for messages, fields, and attacker operations • Each protocol is a recursive function • PVS “strategies” to automate proof • cil2pvs connector

CIL to PVS rule(facts(state(roleA,3,terms(A,B))), ids(N), facts(state(roleA,4,terms(A,B,N)), msg(A,B,terms(A,se(SK(B),N))))) cil2pvs rule(F,L,H): bool = EXISTS(A, B, N): unused(H, N) AND member(state(roleA,3,A++B),H) AND F = state(roleA,4,A++B++N) AND L = (: msg(A,B,A++Enc(SK(B),N)) :)

Model Checking with Maude • Support structure: data types, attacker model, nonce generation, search strategy, goal definition • Protocol is a set of term rewriting rules • Some examples (e.g., Needham-Schroeder Public-Key, Dolev-Yao ping-pong example) • cil2maude connector in process

CIL to Maude rule(facts(state(roleA,3,A,B)), ids(N), facts(state(roleA,4,A,B,N), msg(A,B,terms(A,se(SK(B),N))))) rule(facts(state(roleA,3,terms(A,B))), ids(N), facts(state(roleA,4,terms(A,B,N)), msg(A,B,terms(A,se(SK(B),N))))) cil2maude rl [msg3] : facts(state(roleA,3,terms(A,B)), H) => facts(state(roleA,4,terms(A,B, mkNonce(H))), msg(A,B,terms(A,se(SK(B), mkNonce(H))), H) .

Web Site

Web Site - What’s On It • HTML version of CAPSL specification report • Protocol examples in CAPSL • Grammar for CAPSL syntax • Downloadable preliminary translator • Parser applet • Papers, reports (postscript) • Design discussion notes • URL: http://www.csl.sri.com/~millen/capsl

Papers, Reports • DISCEX paper • SP ‘00 paper: Protocol-Independent Secrecy • FMSP’99 paper: CAPSL Intermediate Language • FMSP’99 paper: A Necessarily Parallel Attack • SRI-CSL-99-2: CAPSL and CIL Language Design • ASSET’99: CAPSL Interface for the NRL Protocol Analyzer

Future Research • Group management protocols and policies • Connectors to other tools, e.g., Athena • Integration with authentication logics • CAPSL support for other syntactic analysis • Special security policies (denial of service, etc.) • Significant examples; data abstraction • Prototype generation

CAPSL Integrated Protocol Environment