Abstract. Security protocol verification has been a very active research area since the 1990s. This paper surveys various approaches in this area, considering the verification in the symbolic model, as well as the more recent approaches that rely on the computational model or that verify protocol implementations rather than specifications. Additionally, we briefly describe our symbolic security protocol verifier ProVerif and situate it among these approaches. Security protocols are programs that aim at securing communications on insecure networks, such as Internet, by relying on cryptographic primitives. Security protocols are ubiquitous: they are used, for instance, for e-commerce (e.g., the protocol TLS [109], used for https:// URLs), bank transactions, mobile phone and WiFi networks, RFID tags, and e-voting. However, the design of security protocols is particularly error-prone. This can be illustrated for instance by the very famous Needham-Schroeder public-key protocol [160] , in which a flaw was found by Lowe [147] 17 years after its publication. Even though much progress has been made since then, many flaws are still found in current security protocols (see, e.g., http://www.openssl.org/news/ and http://www.openssh.org/security.html). Security errors can have serious consequences, resulting in loss of money or loss of confidence of users in the system. Moreover, security errors cannot be detected by functional software testing because they appear only in the presence of a malicious adversary. Automatic tools can therefore be very helpful in order to obtain actual guarantees that security protocols are correct. This is a reason why the verification of security protocols has been a very active research area since the 1990s, and is still very active. This survey aims at summarizing the results obtained in this area. Due to the large number of papers on security protocol verification and the limited space, we had to omit many of them; we believe that we still present representatives of the main approaches. Additionally, Sect. 2.2 briefly describes our symbolic verification tool ProVerif. We illustrate the notion of security protocol with the following example, a simplified version of the Denning-Sacco public-key key distribution protocol [108] .
There has been extensive work on the formal verification of key exchange protocols, see for instance the recent survey REF .
Security protocol verification: Symbolic and computational models
PRINCIPLES OF SECURITY AND TRUST - FIRST INTERNATIONAL CONFERENCE, POST 2012, VOLUME 7215 OF LECTURE NOTES IN COMPUTER SCIENCE
Computer Science