Protocol Security Goals and the Size of Skeletons

We express security goals for a cryptographic protocol in a language of classical first order logic. Its semantics uses realized skeletons, which represent the regular (non-penetrator) parts of possible executions. Security goals are preserved under some homomorphisms between realized skeletons, yielding an appealing proof of the Comon-Lundh/Cortier theorem that two agents are sufficient for testing security goals. One can reduce realized skeletons, when they contain redundant strands, obtaining realized skeletons with fewer strands. When protocols are formalized in a particular way, security goals are preserved under some reductions, and we argue that this way of formalizing protocols is usually more natural and informative than the alternative. Moreover, skeletons containing sufficiently many strands are necessarily reducible. Hence, security goals are decidable when protocols are formalized in this way. A skeleton [5] describes a set of possible cryptographic protocol executions, by summarizing regular (non-penetrator) behavior that appears in them. A skeleton is realized if it fully describes the regular behavior in some execution. Homomorphisms are information-preserving maps between skeletons. Each protocol determines a language in first order predicate logic capable of expressing the authentication and non-disclosure goals that the protocol may satisfy. Realized skeletons provide a semantics for these languages. The semantics using realized skeletons allows us to use homomorphisms to transform models. Some homomorphisms preserve satisfaction for classes of formula. In this paper, we illustrate the usefulness of this method in two cases. In both cases, we make the skeletons smaller. In the first, we show that we can decrease the number of values mentioned in the skeletons. From this, a result of Comon-Lundh and Cortier [3] follows. Its core assertion is that when a security goal is false, there is an attack involving at most two different principals. The second application considers decidability. The cryptographic protocol problem is undecidable [6]. Decidable subproblems arise if principals are permitted only finitely many runs, or are permitted only a finite budget of fresh random values (nonces) [6]. These limitations seem artificial and unmotivated. Alternatively, decidability holds for protocols that send syntactically distinct messages in different situations [1, 11]. Many protocols meet this condition; others can be adapted to it by adding tags to distinguish encrypted units. Supported by the MITRE-Sponsored Research program. However, the undecidability result seems too pessimistic to us. It applies when the freshness requirements of security goals are embedded in the definition of the protocol. It can be part of the definition of a role to generate a fresh nonce in a particular message, such that no participant will generate that value on any other occasion. Alternatively, we can express the freshness requirements explicitly within security goals themselves. A goal may assume that a particular nonce is generated freshly, and that no participant generates that nonce on any other occasion. If the assumption about this nonce suffices to establish some authentication result, the assumption is much weaker than the overall assumption that every instance of the role always generates fresh nonces. A goal relying on the weaker assumption is a stronger result. Because, in reality, it is difficult to generate cryptographically unpredictable values, it is practically important to know for which nonces freshness is needed. We show decidability for the stronger goals by showing how to eliminate strands from skeletons. When protocols are formalized so that the protocol itself does not impose the freshness requirements—instead, they are left to individual security goals to assume—then sufficiently large skeletons can always be reduced to smaller ones without changing whether the security goal is satisfied. In Section 1, we introduce the strand space vocabulary, including a notion of applying replacements to messages and compound objects. In Section 2, we define security goals and the language LΠ that expresses them for a protocol Π. Section 3 introduces skeletons and realization, and in Section 4 we show the two-agent theorem. Section 5 introduces reductions, which produce bundles with fewer strands. Section 6 shows that security goals are preserved under certain reductions, and thus satisfiability and validity are decidable. We have sketched proofs that seemed interesting. 1 Terms, Strands, and Bundles Terms form a free algebra A, built from atomic terms via constructors. The atoms are partitioned into the types principals, texts, keys, and nonces. An inverse operator is defined on keys. There may be additional operations on atoms, such as injective public key of or long term shared key of functions mapping principals to keys. For definiteness, we include a single function pubk(a) mapping principals to their public keys; pubk(a) is a’s private key. Atoms, written in italics (e.g. a,Na,K), serve as indeterminates (variables). We assume A contains infinitely many atoms of each type. Terms in A are freely built from atoms using tagged concatenation and encryption. The tags are chosen from a set of constants written in sans serif font (e.g. tag). The tagged concatenation using tag of t0 and t1 is written tag ˆ t0 ˆ t1. Tagged concatenation using the distinguished tag null of t0 and t1 is written t0 ˆ t1. Encryption takes a term t and an atomic key K, and yields a term as result written {|t|}K . Fix an A. Replacements have only atoms in their range: Definition 1 (Replacement, Application). A replacement is a function α mapping atoms to atoms, such that (1) for every atom a, α(a) is an atom of the