Abstract-This paper presents a novel framework for proving specifications of security protocols in the computational model and generating runnable implementations from such proved specifications. We rely on the computationally-sound protocol verifier CryptoVerif for proving the specification, and we have implemented a compiler that translates a CryptoVerif specification into an implementation in OCaml. We have applied this compiler to the SSH Transport Layer protocol: we proved the authentication of the server and the secrecy of the session keys in this protocol and verified that the generated implementation successfully interacts with OpenSSH. The secrecy of messages sent over the SSH tunnel cannot be proved due to known weaknesses in SSH with CBC-mode encryption. The verification of security protocols is an important research area since the 1990s: the design of security protocols is notoriously error-prone, and errors can have serious consequences. In order to verify protocols, two main models have been considered: the symbolic model and the computational model. The symbolic model represents messages as terms in a term algebra. The attacker can only create terms in this algebra, and so it can only use the cryptographic primitives defined in it. The computational model is the model used by cryptographers, in which messages are bitstrings and attackers are polynomial-time probabilistic Turing machines. Proofs in the latter model are more difficult than in the former, but yield a much more precise analysis of the protocol. However, proving specifications of protocols in such models is not sufficient. Even if the specification is correct, an implementation of the protocol may be insecure, because of errors in implementation details left unspecified at the specification level, or because the specification has not been correctly implemented. It is therefore important to make sure that the implementation is secure, and not only the specification. Hence our goal is to obtain protocol implementations secure in the computational model. There are two ways of obtaining a secure implementation: write an implementation of a protocol, analyze it to extract a protocol specification and then prove this specification, or in the other way around, write a specification, prove it correct, and then generate an implementation from it. We chose the latter way for two reasons. First, we believe that starting by designing a protocol, formalizing it, proving it secure formally, and only after that implementing it, is a better methodology than starting from the implementation. Second,
In REF , protocol verification is performed in the computational model of cryptography, which is more precise than the symbolic model used by JavaSPI.
From Computationally-proved Protocol Specifications to Implementations
2012 Seventh International Conference on Availability, Reliability and Security
2012 Seventh International Conference on Availability, Reliability and Security
Computer Science