1 / 26

Andrea Turrini University of Verona joint work with Roberto Segala

Andrea Turrini University of Verona joint work with Roberto Segala. Approximated Computationally Bounded Simulation Relations for Probabilistic Automata accepted paper at CSF’07. Verification of Security Protocols. Our Question Can we use Probabilistic Automata? Hierarchical verification

mick
Download Presentation

Andrea Turrini University of Verona joint work with Roberto Segala

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Andrea Turrini University of Verona joint work with Roberto Segala Approximated Computationally Bounded Simulation Relations for Probabilistic Automataaccepted paper at CSF’07 Andrea Turrini University of Verona

  2. Andrea Turrini University of Verona Verification of Security Protocols Our Question • Can we use Probabilistic Automata? • Hierarchical verification • Compositional analysis • Simulation method • Local arguments to derive global properties • Rigorous proofs • Potentials for automatic verification • Potentials to draw connections to other areas

  3. Andrea Turrini University of Verona Probabilistic Automata PA = (Q , q0 , E , H , D) Transition relation DQ (EH) Disc(Q) Internal (hidden) actions External actions:EH =  Initial state:q0Q States

  4. Andrea Turrini University of Verona Simulations (Automata) Forward simulation from A1 to A2 (A1FA2) Relation RQ1x Q2such that  q, s, a, q s a s s q0 s0 R R a a a s1 q1 q2 a q q b c b c s3 s4 q3 q4

  5. Andrea Turrini University of Verona Simulations on Probabilistic Automata Simulation from A1 to A2 (A1FA2) Relation RQ1x Q2such that  q, s, a,  s1 1/3 1/3 1/2 q1 a s  1/6 s2 1/6 1/3 R R q2 a 1/2 q  1/3 s3 1/3 Lifting of R

  6. Andrea Turrini University of Verona Bellare and Rogaway MAP1 Protocol • Nonces are generated randomly • The key s is the secret for a Message Authentication Code • Specifically, MAC based on pseudo-random functions RA A B [B.A.RA.RB]s [A.RB]s

  7. Andrea Turrini University of Verona Nonces • Number ONCE • Typically drawn randomly • Claim • For each constant c and polynomial p • There exists k such that for each k k • If n1,n2,…,np(k) are random nonces from {0,1}k • Then Pr[ijninj]<k-c

  8. Andrea Turrini University of Verona Message Authentication Code • Triple (G,A,V) • G on input 1k generates s {0,1}k • For each s and each a • Pr[V(s,a,A(s,a))=1]=1 • Forger • On input 1k obtains MAC of strings of its choice • Outputs a pair (a,b) • Successful if V(s,a,b)=1 and a different from previous queries • Secure MAC • Every feasible forger succeeds with negligible probability

  9. Andrea Turrini University of Verona MAP1: Matching Conversations • Matching conversation between A and B • Every message from A to B delivered unchanged • Possibly last message lost • Response from B returned to A • Every message received by A generated by B • Messages generated by B delivered to A • Possibly last message lost • Correctness condition • Matching conversation implies acceptance • Negligible probability of acceptance without matching conversation

  10. Andrea Turrini University of Verona MAP1: Correctness Proof • Let A be a PPT machine that interacts with the agents • Show that A induces “no-match” with negligible probability • Argue that repeated nonces occur with negligible probability • Argue that A is an attack against a message authentication code • Features • Relies on underlying pseudo-random functions • Proves correctness assuming truly random functions • Builds a distinguisher for PRFs if an attack exists • Criticism • The arguments are semi-formal and not immediate • Three different concepts intermixed • Nonces • Message authentication codes • Matching conversations

  11. Andrea Turrini University of Verona MAP1: Hierarchical Analysis Key generator Nonce generator (coin flip) Key generator Nonce generator (ideal) Key generator Nonce generator (ideal) • Agents indexed by X, Y, t • Need to find suitable simulations • Step conditions lead to local arguments • Yet transitions cannot be matched exactly A1 A2 A3 A4 A5 A1 A2 A3 A4 A5 A1 A2 A3 A4 A5 Adversary Keeps history (PPT function f) Adversary Keeps history (PPT function f) Adversary Keep history (no forged signatures)

  12. Andrea Turrini University of Verona Nonce Generators • State • valueX,Y,t initially  • FreshNonces initially {0,1}k • Transitions • Input NonceRequestX,Y,t • Effect • Let v R{0,1}k • valueX,Y,t = v • FreshNonces = FreshNonces-{v} • Output NonceResponseX,Y,t(n) • Precondition • n = valueX,Y,t • Effect • valueX,Y,t =  Coin flip Ideal • Let v RFreshNonces

  13. Andrea Turrini University of Verona Adversary • Keeps a variable history • Holds all previous messages • Real adversary • Runs a cycle where • Computes the next message to send using a PPT function f • Sends the message • Waits for the answer if expected • Ideal adversary • Highly nondeterministic • Stores all input • Sends messages that do not contain forged authentications

  14. Andrea Turrini University of Verona Problems with Simulations • Problem • Consider a transition of the real nonce generator • With some probability there is a repeated nonce • The ideal nonce generator does not repeat nonces • Thus, we cannot match the step • Solution • Match transitions up to some error

  15. Andrea Turrini University of Verona Approximate Simulations (1-)  • Change equivalence on measures • 12 iff • 1 = (1-)1’ + 1’’ • 2 = (1-)2’ + 2’’ • 1’ 2’ • Add parameterizations • Consider families of PIOA parameterized by k • Require  smaller than any polynomial in k • Absence of simulation becomes failure • Existence of a forger for a signature • Random nonces that are equal • Existence of a distinguisher 2 2’ 2’’  1 1’ 1’’

  16. Andrea Turrini University of Verona Approximate Simulations {Ak} {Rk} {Bk} • For each constant c and polynomial p • There exists k such that for each k k • Whenever • 1 reached within p(k) steps in Ak • 1L(Rk,) 2 • 11’ • There exists 2’ such that • 22’ • 1’ L(Rk,+k-c) 2’ 2 2’  +k-c 1 1

  17. Andrea Turrini University of Verona Approximate SimulationsStep Condition  2’ (1--k-c) k-c 2  (1-)   1 (1-)   1’ (1--k-c) k-c

  18. Andrea Turrini University of Verona Execution Correspondence under Approximated Simulations If {Ak} {Rk} {Bk} then • For each constant c and polynomial p • There exists k such that for each k k • For each scheduler 1 • 1 reached within p(k) steps in Ak with 1 • There exists 2 such that • 2 reached within p(k) steps in Bk with 2 • 1L(Rk , pkk-c) 2 • Observation • pkk-c can be smaller than any k-c’ by choosing c=c’+degree(p)

  19. Andrea Turrini University of Verona Example: Approximate SimulationsBellare-Rogaway MAP1 Protocol Key generator Nonce generator (coin flip) Key generator Nonce generator (ideal) Nonce generator (ideal) Key generator Nonce generator (ideal) • Negation of the step condition • 1: Two random nonces are equal with high probability • 2: Function f defines a forger for a signature scheme 1 2 A1 A2 A3 A4 A5 A1 A2 A3 A4 A5 A1 A2 A3 A4 A5 Adversary Keeps history (PPT function f) Adversary Keeps history (PPT function f) Adversary Keeps history (no forged signatures) Adversary Keeps history (no forged signatures)

  20. Andrea Turrini University of Verona  (1--k-c) k-c 2’  (1-) 2   (1-) 1  (1--k-c) k-c 1’ Negation of Step ConditionNonce Generation {Ak} {Rk} {Bk} • There exists constant c and polynomial p • For eachkthere existsk k • There exists • 1 reached within p(k) steps in Ak • 1L(Rk,) 2 • 11’ • There is no2’ such that • 22’ • 1’ L(Rk,+k-c) 2’ 2 2’  +k-c • Signature forged in 1’ • Probability at least k-c • Nonce replicated in 1’ • Probability at least k-c 1 1

  21. Andrea Turrini University of Verona Problems with NondeterminismMAP1 Protocol [BR93] Key generator Nonce generator (coin flip) • Authentication protocol • Symmetric key signature schema • Computational Dolev-Yao • Adversary queries agents • Potential problems • Let s be the shared key • Adversary queries k agents • Agent i replies if ith bit of s is 1 • The adversary knows the shared key • Solution • One query at a time • Wait for the answer (agents as oracles) A1 A2 A3 A4 A5 Adversary Keeps history (PPT function f)

  22. Andrea Turrini University of Verona Approaches to Nondeterminism • Reduce the power of the scheduler • Process Algebras • Scheduler sees only enabled action type • UC framework • ITMs have a token passing mechanism • No nondeterminism • Reactive simulatability • Again token passing mechanism • Nondeterminism based on local information only • Task PIOAs • Define equivalence classes of states and actions • Scheduler sees only equivalence classes, not elements • Careful specifications • Avoid dangerous nondeteminism in the specification • Is it always possible?

  23. Andrea Turrini University of Verona Applicability • Dolev-Yao Model • Soundness w.r.t. indistinguishability • How about correspondence of computations? • Cryptographic library • More rigorous/local proofs? • Alternative to error sets? • Game transformations • Proof method?

  24. Andrea Turrini University of Verona Concluding Remarks • Formal methods are useful • Semi-formal proofs may be wrong • Semi-formal proofs require attention • There are several approaches • Computational, symbolic, compositional • Suitable for crypto-primitives or protocols • We need proof techniques • Algebraic, symbolic, automata theoretic • Nondeterminism arises and gives problems • Restrict resolution of nondeterminism • Avoid dangerous nondeterminism

  25. Andrea Turrini University of Verona What Else? • A lot to understand on approximated simulations • Are they connected to metrics? • Can we define them incrementally • How far can we go without polynomial bounds? • How about approximated language inclusion? • Need more techniques • Can we have a uniform view? • Can we relate better computational and symbolic approaches? • How about cross migration of techniques? • Need more automation • … but we need to understand what we automate

  26. Andrea Turrini University of Verona Thanks

More Related