Sound Approximations to Diffie-Hellman using Rewrite Rules

1. Sound Approximations to Diffie-Hellman using Rewrite Rules Christopher Lynch Catherine Meadows Naval Research Lab

2. Example: DH Protocol • A ! B: xnA • B ! A: xnB • A ! B: e(h(exp(x,nB¢ nA)),m) • B ! A: e(h(exp(x,nA¢ nB)),m’)

3. Cryptographic Protocol Analysis • Formal Methods Approach usually ignores properties of algorithm • But Algebraic Properties of Algorithm can be modeled as Equational Theory (by using Equational Unification)

4. DH uses Commutativity (C) • exp(x,nB nA) = exp(x,nA¢ nB) • This can lead to attacks • Analysis using C-unification finds these attacks

5. C-Unification • exp(b,X ¢ Y) = exp(b,nA,nB) has two solutions • Solution 1: [X  nA, Y  nB] • Solution 2: [X  nB, Y  nA]

6. C-unification is Exponential • exp(b,X1 Xn) = exp(b,c1 cn) has 2n solutions • Let d1,,dn be a permutation of c1,,cn (2n permutations exist) • Then [X1 d1,,Xn dn] is a solution

7. Goal of Paper • Find an efficient theory H to approximate C soundly • i.e., an attack modulo H is an attack modulo C • But what about vice versa (that’s the hard part)

8. Our Results • We found an efficient theory H which approximates C soundly • We gave simple properties for a DH protocol to satisfy • We showed that if a protocol has these properties then a C-attack can be converted to an H-attack

9. Basic Properties • hashed symmetric keys are of the form h(exp(x,nA¢ nB)) • An honest principal can send exp(x,nA) • h-terms appear nowhere else, exponent nonces appear nowhere else, exp-terms appear nowhere else

10. Properties preventing Role Confusion Attacks • Messages encrypted with DH-key from Initiator and Responder must be of different form • Messages encrypted with DH-key must contain a unique strand id

11. Intruder • As usual, the intruder can see all messages, and modify, delete and create messages • Of course, the intruder does not have to obey any of these rules

12. About the Properties • Most DH-protocols for two principals satisfy these properties • They are syntactic, so it is easy to check if a protocol meets them

13. Who Cares? • A Protocol Developer: A protocol with these properties will have no attack based on commutativity • A Protocol Analyzer: If a protocol has these properties, analyze it using efficient H-theory. Only if it does not, then use C.

14. Contents of Talk • Representation of Protocol • Derivation Rules • Properties and Proof Techniques

15. Example of DH Protocol • A ! B: [exp(x,nA), nonce] • B ! A: [exp(x,nB), e(h(exp(x,nB¢ nA)),exp(x,nA))] • A ! B: e(h(exp(x,nA¢ nB)),ok)

16. Specification of Protocol Rules • A: ! [exp(x,nA), nonce] • B: [Y, nonce] ! [exp(x,nB), e(h(Y,nB),Y)] • A: [Z, e(h(exp(Z,nA),exp(x,nA))] ! e(h(exp(Z,nA),ok)

17. Instantiation of Specification • A: ! [exp(x,nA), nonce] • B: [exp(x,nA), nonce] ! [exp(x,nB), e(h(exp(x,nA¢ nB)),exp(x,nA))] • A:[exp(x,nB), e(h(exp(x,nB¢ nA)),exp(x,nA))] ! e(h(exp(x,nB¢ nA),ok)

18. Equation needed in Protocol • Need to know that: h(exp(x,nA¢ nB)) = h(exp(x,nB¢ nA)) • That’s where C is needed, but is there a more efficient H • h(exp(X,Y ¢ Z)) = h(exp(X,Z ¢ Y)) will work, but we can be more efficient

19. Mofification of DH Protocol • Assume inititiator uses has function h1 and responder uses h2 • A ! B: [exp(x,nA), nonce] • B ! A: [exp(x,nB), e(h2(exp(x,nB¢ nA)),exp(x,nA))] • A ! B: e(h1(exp(x,nA¢ nB)),ok)

20. New Specification • A: ! [exp(x,nA), nonce] • B: [Y, nonce] ! • [exp(x,nB), e(h2(Y,nB),Y)] • A: [Z, e(h2(exp(Z,nA),exp(x,nA))] ! e(h1(exp(Z,nA),ok)

21. New Instantiation • A: ! [exp(x,nA), nonce] • B: [exp(x,nA), nonce] ! [exp(x,nB), e(h2(exp(x,nA¢ nB)),exp(x,nA))] • A:[exp(x,nB), e(h2(exp(x,nB¢ nA)),exp(x,nA))] ! e(h1(exp(x,nB¢ nA),ok)

22. Equation we now need • h1(exp(x,nA¢ nB)) = h2(exp(x,nB¢ nA)) • So theory H will be h1(exp(X,Y ¢ Z)) = h2(exp(X,Z ¢ Y))

23. How Efficient is H Using results from [LM01], we see that: • In H, all unifiable terms have a most general unifier • Complexity of H-unification is quadratic (usually linear in practice)

24. Completeness Theorem • Start with attack modulo C on h-protocol • Convert to attack modulo CH on (h1,h2)-protocol • Convert to attack modulo H on (h1,h2)-protocol

25. Differences between H and CH • h1(exp(x, n1¢ n2)) equals h2(exp(x,n1¢ n2)) modulo CH but not modulo C • h1(exp(x, n1¢ n2)) equals h1(exp(x, n2¢ n1)) modulo CH but not modulo C • h1(exp(x, n1¢ n2¢ n3)) equals h2(exp(x, n3¢ n2¢ n1)) modulo CH but not modulo C

26. Protocol Instance A Protocol Instance has 2 parts • Protocol Rules • Derivation Rules to represent Intruder

27. Derivation Rules • [X,Y] ` X • [X,Y] ` Y • X, Y ` [X,Y] • privkey(A), enc(pubkey(A), X) ` X • Pubkey(A), enc(privkey(A), X) ` X

28. More Derivation Rules • X, Y ` enc(X,Y) • X, Y ` e(X,Y) • X ` hi(X) • X, e(X,Y) ` Y • X,Y ` exp(X,Y)

29. Derivation modulo CH • Recall rule X, e(X,Y) ` Y • Derivation modulo CH: • X1 e(X2,Y) `CH Y if X1 =CH X2

30. Example • h1(exp(x,nB¢ nI¢ nA)), e(h2(exp(x,nA¢ nI¢ nB)),m) `CH m • But not h1(exp(x,nB¢ nI¢ nA)), e(h2(exp(x,nA¢ nI¢ nB)),m) `H m

31. How to convert from `CH to `H • Requires Certain Properties • Use Rewrite System RN so that S `CH m implies S+RN`H m+RN • RN: exp(X,Y) ! X if Y is not an honest principal nonce

32. How to convert from `C to `CH • Again Certain Properties • Conversion function TWO so that S `C m implies TWO(S) `CH TWO(m) • TWO converts some occurrences of h to h1 and others to h2

33. What We Show Under Certain Properties • S `C m implies TWO(S) `CH TWO(m) implies TWO(S)+RN`H TWO(m)+RN

34. Properties of Protocol • hashed symmetric keys are of the form h(exp(X ¢ n)), where X eventually unifies with a term exp(b,n’) • h-terms appear nowhere else, exponent nonces appear nowhere else, exp-terms appear nowhere else

35. More Interesting Properties • A message encrypted with h1-term on RHS of protocol cannot unify with message encrypted with h2-term on LHS • Avoids role confusion attacks • Messages encrypted with hashed term must include a strand id in message • Avoids attacks involving different instances of same protocol or different protocols

36. Properties of Derivable Terms • Honest Principals follow Protocol Rules • But Intruder can use derivation rules to create terms which disobey properties • Nevertheless, we show that there are certain properties that are preserved by derivation and protocol rules

37. Example Properties of Derivable Terms • There is a set N (honest principal nonces) • Elements of N only appear as exponent • If a term exp(x,t1 tn) is derivable • t1 and tn are in N or are derivable • t2,,tn-1 are derivable • if term is not a key, then tn derivable

38. More Properties • There are many more properties • Some quite complicated • And may lemmas and theorems to prove them

39. Properties Imply • Every term will reduce by RN to a term with at most two exponents (all exponents not in N are removed by rewrite rules) • This and other properties imply that if s and t CH-unify then s+RN and t+RN} H-unify

40. Summary • Suppose a DH-protocol obeys simple (easy to check) properties • Then it’s possible to discover attacks based on commutativity, using an efficient equational theory

41. Related Work • Properties so that attacks modeling cancellation of encryption/decryption rules are found with free algebra • Symmetric Key [Millen 03] • Public Key [LM 04]

42. Future Work • Other DH work • Don’t assume base is known • What about inverses? • Group DH-protocols • Hierarchy of Protocol Models [Meadows 03]