Using Unification For Opacity Properties

Transcription

1 Unité Mixte de Recherche 5104 CNRS - INPG - UJF Centre Equatin 2, avenue de VIGNATE F GIERES tel : fax : Using Unificatin Fr Opacity Prperties Reprt n 24 Octber 28, 2004 Reprts are dwnladable at the fllwing address

2 Using Unificatin Fr Opacity Prperties Octber 28, 2004 Abstract The mst studied prperty, secrecy, is nt always sufficient t prve the security f a prtcl. Other prperties such as annymity, privacy r pacity culd be useful. Here, we give a simple definitin f pacity by lking at the pssible traces f the prtcl. Our apprach draws n a new prperty ver messages called similarity. Then, using rewriting methds clse t thse used in unificatin, we demnstrate the decidability f ur pacity prperty. This is nly achieved in the case f atmic keys using a methd called Key Quantificatin. Keywrds: Opacity, Security, Frmal Verificatin, Dlev-Ya Cnstraints, Rewriting Systems, Decidability. Reviewers: Ntes: A cnference versin has been published in Prc. f the Wrkshp n Issues in the Thery f Security (WITS Hw t cite this { verimag-tr , title = { Using Unificatin Fr Opacity Prperties}, authrs = { }, institutin = { Verimag Technical Reprt }, number = {24}, year = { 2004}, nte = { } }

3 1 Intrductin During the last decade, verificatin f security prtcls has been widely investigated. The majrity f the studies fcussed n demnstrating secrecy prperties using frmal methds (see fr example [3], [5], [4] r [7]. These methds have lead t cncrete tls fr verifying secrecy such as these prpsed by the EVA prject [2]. Hwever, checking security prtcls requires studying ther prperties such as annymity r pacity : hiding a piece f infrmatin frm an intruder. Fr instance, in a vte prtcl, whereas the intruder is able t infer the pssible values f the vte (yes r n, it shuld be impssible fr him t guess which vte was expressed, nly by bserving a sessin f this prtcl. Checking a prtcl shuld include a way f frmalizing the infrmatin that were leaked and that the intruder culd guess. In the last few years, attempts have been made t prperly define pacity prperties, t prve their decidability in certain cases and t prpse sme verificatin algrithms. In this paper, we adpt a simple definitin fr pacity. The intruder C has a passive view f a prtcl sessin invlving tw agents A and B. He is able t read any exchanged messages but he cannt mdify, blck r create a message. A prperty will be called paque if there are tw pssible sessins f the prtcl such that : in ne f these, the prperty is true whereas it is nt in the ther, and it is impssible fr the intruder t differentiate the messages frm these tw sessins frm the messages exchanged in the riginal sessin. The starting pint is the ntin f similarity. This binary relatin nted is an equivalence relatin between messages. Tw messages are similar if it is nt feasible fr the intruder t differentiate them. A typical example is tw different messages encded by a key that the intruder culd nt infer. Frm the pint f view f the intruder, these messages will be said similar. This ntin is f curse dependent f the knwledge f the intruder given by Dlev-Ya thery [6] : if the intruder is able t infer any f the used keys, then similarity will be equivalent t syntactic equality. This ntin f similarity will allw us t express pacity prperties as cnstraints. We will then use rewriting techniques t find the set f slutins fr such cnstraints. The rewriting rules are mainly inspired by the rules used in the unificatin algrithm. The prblem is very similar t unificatin except that atmic cnstraints make use f similarity instead f syntactic equality. That is why, the rewriting rules are similar but nt exactly the same. This technique will give the same result as fr unificatin : we will be able t express the set f slutins fr any cnstraint. As the cnstraint satisfiability is exactly related t pacity, this gives the main result f this paper : decidability f the pacity prperty in ur case. With sme hypthesis (passive intruder, atmic keys, the pacity f a given prperty is decidable and there is an immediate algrithm t perfrm this checking. The remainder f this paper is rganized as fllws. In sectin 2, we recall usual definitin fr messages and prtcls. Similarity ver messages is intrduced in sectin 3 and sme useful prperties are given. Sectin 4 frmalizes the pacity hypthesis and translate the pacity prperty t a cnstraint. Then, it prvides the methd t check satisfiability fr such cnstraints. Eventually, sectin 5 shws the use f this technique n a simple example, and sectin 6 cncludes this paper. 2 Cryptgraphic Prtcls Let Atms and X be tw infinite cuntable disjint sets. Atms is the set f atmic messages a. X is a set f variables called prtcls variables x. Definitin 1 (Message Let Σ be the signature Atms {pair, encrypt} where pair and encrypt are tw binary functins. The atmic messages are suppsed cnstant functins. Then a message is a first rder term ver Σ and the set f variables X, namely an element f T(Σ, X. A message is said t be clsed if it is a clsed term f T(Σ, X, i.e. a term f T(Σ. In the rest f this paper, we will use the fllwing ntatins : m 1, m 2 = pair(m 1, m 2 {m 1 } m2 = encrypt(m 1, m 2

4 The substitutins σ frm X t T(Σ, X are defined as usual. Its applicatin t the message m will be nted mσ. If σ is defined by xσ = n and yσ = y fr any ther variables y, then we culd write m[x\n] instead f mσ. The set f variables used in a message m is called var(m. Definitin 2 (Prtcl Let Actrs be a finite set f participants called actrs. The set f prgrams P rg is given by the fllwing syntax where B is in Actrs, m 1, m 2 and m are messages. G ::= ɛ! B m.g?m.g if m 1 = m 2 then G else G fi A prtcl ver the set f actrs Actrs is a functin frm Actrs t Prgs assciating a prgram t each actr. Fr the fllwing, the set f actrs is fixed t Actrs. Let free(p be the set f free variables in the prtcl P. The functin free will easily be defined ver prgrams by inductin and culd be extended ver prtcls. An instance f the prtcl P is a prtcl P σ where σ instantiates exactly the variables in P with clsed messages. Fr that purpse, it is pssible t rename every bund variable with a fresh variable such that bund variables are distinct and nt in the free variables set. The substitutin σ is called a sessin f the prtcl P. Such prtcls are clsed, i.e. f ree(p σ =. Definitin 3 (Prtcl Semantic The semantic f a prtcl is the transitin system ver prtcls defined by the fllwing rules : If m is a clsed message and σ is the smallest unifier f m and m, Prg(A =! B m.p A Prg(B =?m.p B Prg m Prg[A P A ; B P B ]σ Nte that, if σ des nt exist, the prtcl culd be blcked. If m 1 and m 2 are the same clsed message, Prg(A = if m 1 = m 2 then P A else G fi Prg Prg[A P A ] If m 1 and m 2 are tw distinct clsed messages, Prg(A = if m 1 = m 2 then G else P A fi Prg Prg[A P A ] A prtcl terminates iff fr any Q such that P Q, it is pssible t reach the state ɛ : Q ɛ. Nte that nly clsed prtcls culd terminate. A run f a sessin σ fr a prtcl P is an rdered set f messages r = r 1.r 2...r n such that Pσ r1 r... n ɛ A prtcl sessin is deterministic if it has exactly nly ne pssible run. This run will be nted run(p σ. In the fllwing sectins, the prtcls will always be suppsed deterministic. This paper will make an extensive use f the Dlev-Ya thery. Let E be a set f messages and m be a message, then we will nte E m if m is deducible frm E using the Dlev-Ya s inferences.

5 3 Similarity The intuitive definitin f pacity is that an intruder is nt able t distinguish a run where the prperty is satisfied frm a run where it is nt. T distinguish tw messages, the intruder culd discmpse them, accrding t his knwledge but if he des nt knw the key k fr example, he wn t be able t make the difference between tw different messages encded by this key k. Tw such messages will be called similar messages. This definitin will be frmalized using inference rules. An envirnment is a finite set f clsed messages. Usually, it will dente the set f messages knwn by the intruder. Definitin 4 (Similar Messages Tw clsed messages m 1 and m 2 are said t be similar fr the envirnment env iff env m 1 m 2 where is the smallest binary relatin satisfying : a Atmes a a u 1 u 2 v 1 v 2 u 1, v 1 u 2, v 2 env k u v {u} k {v} k env k env k {u} k {v} k Intuitively, this means that an intruder with the knwledge env will nt be able t differentiate tw similar messages. The envirnment name will be mitted as sn as it is nt relevant fr the cmprehensin. The same thing will be dne fr Dlev-Ya thery, i.e. env m will be nted m. Mrever, the definitin f culd easily be extended t nn-clsed envirnments and messages by adding this inference : x X x x Prperty 1 The binary relatin is an equivalence relatin : fr every messages m 1, m 2 and m 3 : m 1 m 1 m 1 m 2 m 2 m 1 m 1 m 2 m 2 m 3 m 1 m 3 T prve that the relatin is cmpatible with the cntext peratin, we will have t suppse that nly atmic keys are allwed. This hypthesis will hld fr the rest f the dcument. Prperty 2 (Cntext Fr every messages m 1, m 2, m 3 and m 4, if m 3 and m 4 have nly ne free variable x, m 1 m 2 m 3 m 4 m 3 [x\m 1 ] m 4 [x\m 2 ] And in particular, m 1 m 2 m 3 [x\m 1 ] m 3 [x\m 2 ] Let m and n be tw messages and x a variable. Let σ be a substitutin such that xσ nσ. Then mσ m[x\n]σ An imprtant prblem with similarity is : knwing an envirnment env and a clsed message m, is it pssible t find a clsed message n such that env n and env m n Fr that purpse, the f resh functin will be intrduced. It is inductively defined ver messages by the fllwing lines where all the variables y have t be instantiated with different fresh variables (i.e. variables

6 that d nt ccur in env, m r n. We then call Keys + the set f keys such that env Keys + and Keys the set f keys such that env Keys. fresh(a = a fresh(x = x fresh( m, m = fresh(m, fresh(m fresh({m} k = {fresh(m} k if k Keys + fresh({m} k = {y} k if k Keys Prperty 3 Fr every substitutin σ, we have mσ fresh(mσ And the mst imprtant prperty is that if m is similar t n, then n is an instance f fresh(m, i.e. fresh(m where all free variables are instantiated by clsed messages. Prperty 4 If fr tw clsed messages m and n, m n, then there exists a substitutin σ that acts ver the free variables f f resh(m such that n = f resh(mσ. 4 Predicates Using Similarity and Dlev-Ya Thery We will use classical predicates ver messages using the binary relatins = (syntactic equality and (similarity, and the atmic frmulae E m where m is a message and E a set f messages. The set f these predicates will be called P red. Satisfiability ver P red is defined as usual. The set f mdels satisfying E m is the set f substitutins σ such that Eσ and mσ are clsed and Eσ mσ : mσ is deducible frm Eσ using Dlev-Ya thery. Mdels fr and = are defined in the same way. If a substitutin σ is a mdel fr a predicate P, we will write σ = P. If all the atmic frmulas in P use the same envirnment E, then E culd be mitted in the predicate P but we will nte σ = E P. 4.1 The Opacity Prblem Let us cnsider a prtcl P and a sessin σ. The pacity prblem cnsidered here needs sme hypthesis : The intruder C has a passive view f a prtcl sessin invlving tw agents A and B. Passive means that the intruder culd intercept and view any messages between A and B but is nt able t blck, mdify nr t send any message. The intruder knws the prtcl used. Only atmic keys are used fr encding. The intruder has an initial knwledge c 0, which is a predicate (fr example, c 0 = k 1 k 2 means that C knws that the keys that will instantiate k 1 and k 2 are the same. The sessin σ defines a witness run run(pσ = m 1.m 2...m n. A prperty ψ will be said paque fr this sessin σ if it is impssible t tell accrding t the knwledge f C if ψ is true r false. This means that there exist tw pssible sessins σ 1 and σ 2 f the prtcl giving messages similar t the witness messages where fr example, ψσ 1 is true and ψσ 2 is false. In this case, the intruder will nt be able t deduce any knwledge n ψ.

7 Definitin 5 (Opacity A prperty ψ is said t be paque fr a prtcl sessin σ f P iff there exist tw sessins f the prtcl σ 1 and σ 2 such that c 0 σ 1 p 1 m 1... p n m n ψσ 1 c 0 σ 2 q 1 m 1... q n m n ψσ 2 Where p 1.p 2...p n is the run f the prtcl P related t σ 1, q 1.q 2...q n is related t σ 2 and m 1.m 2...m n is related t σ. Nte that the three runs p, q and m must have the same length n. The envirnment used in the precedent cnjunctins is {m 1,..., m n, p 1,..., p n, q 1,..., q n } and culd be augmented with an initial knwledge f the intruder env 0. Our prperty f pacity culd als be used t check annymity. Fr example, if we take a definitin f annymity clsed t the ne given in [10], we just have t add a restricted view fr the intruder, i.e. the intruder nly intercepts sme f the exchanged messages. Then the pacity f the prperty identity f such actr will be similar t what is defined as annymity. 4.2 A Decidable Fragment : Glbal Key Quantificatin A similarity cnjunctin is a predicate f the frm : P = n m i n i i=1 Namely, it is a cnjunctin f similarities. The set f such predicates will be called Cnj. The purpse f this sectin is t shw that satisfiability ver Cnj is decidable. The decisin algrithm will be based n rewriting rules inspired by these used in unificatin (see fr example [9]. This will transfrm any cnjunctin t a slved frm, and we will shw that, fr such frms, the set f slutins is cmputable. The idea, as in unificatin, is t reverse the inferences giving. An intuitive rule fr decding message wuld be : {m 1 } k1 {m 2 } k2 ( k 1 k 2 m 1 m 2 k 1 ( k1 k 2 The messages {m 1 } k1 and {m 2 } k2 are similar in tw cases : if nne f the keys are cmprmised r if the keys are equals and the encded messages are similar. Hwever, using nly unificatin-like rules will nt wrk. The main difference is that a predicate like x {x} k has sme slutins if the key k is nt deducible by the intruder. Fr example, x = {a} k satisfies the frmer predicate. The usual ccur check rule culd nt apply directly, s we will have t use a methd called key quantificatin. The idea f key quantificatin lies upn the fact that the set Keys f keys ccuring in the prtcl is finite. That is why we will make tries fr every pssible partitin Keys + Keys f Keys with the fllwing hypthesis : if σ is a slutin, then fr every k + in Keys + and k in Keys, we have envσ k + σ and envσ k σ. S we quantify ver the set Keys + f cmprmised keys. Furthermre, if the intruder knws initially sme f the keys Keys + 0, we will nly quantify fr Keys+ Keys + 0. After chsing Keys +, the first step is t substitute the cnjunctin by : n fresh(m i fresh(n i i=1 Let us call freshv ar(m i the set f fresh variables used t cmpute fresh(m i. By extensin, let us define freshv ar(p by : freshv ar(p = n (freshv ar(m i freshv ar(n i The rewriting system R ver Cnj is defined by the fllwing rules. i=1

8 Variable Reslutin (Res : if the variable x ccurs in C and nt in m, x m C x m C[x\m] If m is the variable x, Else, if the variable x ccurs in m, x x C C x m C Pair Decmpsitin (Pair : m 1, m 2 n 1, n 2 C m 1 n 1 m 2 n 2 C Axim (Ax : fr a and b tw distinct atms a a C C a b C Type Mismatch (Type : m 1, m 2 {m} k C a m 1, m 2 C a {m} k C Cde Decmpsitin (Cde : if k 1 and k 2 are in Keys +, {m 1 } k1 {m 2 } k2 C C k 1 k 2 m 1 m 2 If k 1 and k 2 are in Keys, Else, {m 1 } k1 {m 2 } k2 C C {m 1 } k1 {m 2 } k2 C Definitin 6 (Slved Variable/Frm A variable x frm X is slved in a predicate P iff x appears exactly in ne similarity f P and this similarity has the frm x m where m is a message that des nt cntain x. A slved frm is an element P f the set Cnj f the frm Where fr every i, the variable x i is slved. P = n x i m i i=1 Nte that, in a slved frm, sme f the free variables culd be unslved. This will be the case, in particular, fr ur fresh variables. Therem 1 The rewriting system R terminates and the nrmal frms are slved frms and. Mrever, R is crrect and cmplete, i.e. the slutins f a predicate are exactly the slutins f its nrmal frms. Prf 1 T prve the terminatin f the rewriting system, we will use the lexicgraphic rder (sf, sp, sc, np lex where sf is the number f nn-slved variables, sp is the number f pair used in the predicate, sc is the number f encryptins and np is the number f atmic frmulas. Then the values decreases strictly during rewriting as shwn in the fllwing array. This prves the terminatin f the rewriting system.

9 Rule sf sp sc np Res 1 < Res 2 < Res 3 < Pair < Ax 1 2 < Type < Cde < Fr the cmpleteness and crrectin f rewriting, we have t prve fr each rule P 1 P 2 that P 1 and P 2 have exactly the same sets f slutins. The predicate is equivalent t a slved frm : n x i m i i=1 We culd nw describe the set Σ f pssible substitutins σ satisfying ur predicate P by : fr any variable x that is nt slved, xσ ranges ver all the pssible messages. These variables includes in particular sme f the fresh variables included in the sets freshv ar(m i. Fr the slved variables x i, x i σ = m i σ As m i culd nly cntain unslved variables, the frmer definitin is nt recursive. At last, we have t check that the hypthesis we made ver Keys + and Keys is crrect, i.e. there exists a σ amng Σ such that envσ Keys σ. We will nt cnsider the hypthesis ver Keys + as sn as the keys f Keys + σ culd be cnsidered as part f the initial knwledge f the intruder. T check that Keys is nt deducible, it is pssible t try with the wrst slutin (fr Dlev-Ya thery, i.e. use the same fresh atm a fr all the xσ where x is nt a key and use different fresh atms fr keys. Prperty 5 The σ defined abve is the wrst accrding t Dlev-Ya thery, frmally fr every cuple f messages m and n, ( η Σ, envη mη nη envσ mσ nσ ( η Σ, envη mη envσ mσ Prf 2 We suppse that there exists η Σ such that envη mη nη. By inductin n the prf s structure f envη mη nη, the prperty is easy t prve using the fllwing lemma : fr every key variable k : envη kη envσ kσ As kσ is atmic and keys are atmic, kσ culd be btained frm envσ using nly decmpsitin rules. Then, given the nature f σ, we have that env k which prves that envη kη. T finish ur check, we just have t prve envσ Keys fr ur wrst σ. This last check is f curse decidable. T cnclude this sectin, let us recall the main steps f ur decisin algrithm : Write the pacity prperty as tw cnstraints. Prcess these cnstraints ne after the ther. Chse a set Keys + included in K (finite number f pssibilities. Rewrite the cnstraints using the given rules. Check that the set Keys \ Keys + culd nt be inferred by the intruder using the wrst slutin. If fr the tw cnstraints, there exists a set Keys + such that the wrst slutin is valid, then the studied prperty is paque. Otherwise, the prperty is nt paque.

10 5 Example : The Limited Cryptgraphs Dinner T give a simple applicatin f pacity, the example f the cryptgraphs dinner will be taken. In this example, nly tw cryptgraphs will be present : Alice (A and Bb (B. They have dinner tgether in a restaurant. When cmes the time t pay, the waiter tells them that smene already paid the bill. A and B want t knw if the persn wh paid is ne f them r nt, but if this is the case, they als want that name t remain annymus. They suppse that an intruder Charlie (C culd listen t whatever they say. They decide t flip tw cins (C can t see the result, if bth are head r bth are tail, A have t tell 1 if he didn t pay, 0 else, same thing fr B. If the cins gives tw different results, then A and B act in the ppsite way. Obviusly A and B culd knw with that prtcl wh paid the dinner. C culd als knw if A r B paid. Nw we want t check that C cannt deduce wh paid. Let us frmalize this prtcl. They will tss tw cins p 1 and p 2 with result the bleans x 1 and x 2. The predicate x A is true iff A paid, the predicate x B is true iff B paid. The first step f the prtcl is the distributin f x 1 and x 2 by a third actr S using a key k nt deducible by C. S A : { x 1, x 2 } k S B : { x 1, x 2 } k The fllwing f the prtcl is detailed belw with respect t the pssible values fr the different variables. x A x B x x A B impssible B A impssible Let us suppse the trace f the prtcl is : S A, B : { 0, 1 } k A B : 1 B A : 0 S ne f A and B paid the dinner. Intuitively, we culd cnclude immediately. Let us cnsider the tw bld clumns, they prpse the right executin trace but in ne case A paid, in the ther ne, it is B. The identity f the payer remains annymus. The pacity prperty is the fllwing with the envirnment {0, 1}. σ 1, ( { x 1, x 2 } k { 0, 1 } k A B = 1 B A = 0 x A σ1 σ 2, ( x 1, x 2 } k { 0, 1 } k A B = 1 B A = 0 x A σ2 Let suppse that k is in Keys (therwise, the prperty is nt paque. By develping, we btain that the pssible sessins fr that trace are : [x A \0, x B \1, x 1 \0, x 2 \0], [x A \0, x B \1, x 1 \1, x 2 \1], [x A \1, x B \0, x 1 \0, x 2 \1] r [x A \1, x B \0, x 1 \1, x 2 \0]. And we culd take fr example : This prves the annymity f the payer fr this trace. σ 1 = [x A \0, x B \1, x 1 \0, x 2 \0] σ 2 = [x A \1, x B \0, x 1 \1, x 2 \0]

11 6 Cnclusin In this paper, we presented a new simple and intuitive definitin fr pacity. With that definitin, the pacity f a given prperty is decidable. The decisin algrithm has been implemented and tested in sme example cases. As far as we knw, ther versins f pacity ([1], [8] have been given in the literature but nne f these criterin were implemented. This wrk has sme limitatin, in particular, the hypthesis made ver the sessin between A and B : nly atmic keys are used and public key cryptgraphy is nt allwed. This gives sme natural extensin t this paper that will be explred later. Fr example, using tree autmata techniques shuld allw the use f nn-atmic keys. Anther interesting extensin wuld be t make the intruder active. If C culd intercept and mdify the messages, culd he find the right messages t alter such that the prperty is nt paque any mre? Anther interesting extensin wuld be t add syntactic equality t cnstraints : this equality means that the intruder has receive tw exactly identical messages. With that knwledge, the intruder culd make new deductins. References [1] A. Bisseau. Abstractins pur la vérificatin de prpriétés de sécurité de prtcles cryptgraphiques. PhD thesis, Labratire Spécificatin et Vérificatin (LSV, ENS de Cachan, [2] L. Bzga, Y. Lakhnech, and M. Périn. Abstract interpretatin fr secrecy using patterns. Technical reprt, EVA : [3] E.M. Clarke, S. Jha, and W. Marrer. Using state space explratin and a natural deductin style message derivatin engine t verify security prtcls. In IFIP Wrking Cnference n Prgramming Cncepts and Methds, [4] H. Cmn-Lundh. and V. Crtier. Security prperties: Tw agents are sufficient. Technical reprt, LSV, [5] H. Cmn-Lundh and V. Crtier. New decidability results fr fragments f first-rder lgic and applicatin t cryptgraphic prtcls. In 14th Int. Cnf. Rewriting Techniques and Applicatins (RTA 2003, vlume 2706 f LNCS, [6] D. Dlev and A. C. Ya. On the security f public key prtcls. IEEE Transactins n Infrmatin Thery, 29(2: , [7] Jean Gubault-Larrecq. A methd fr autmatic cryptgraphic prtcl verificatin. In Internatinal Wrkshp n Frmal Methds fr Parallel Prgramming: Thery and Applicatins, vlume 1800 f LNCS, [8] Dminic Hughes and Vitaly Shmatikv. Infrmatin hiding, annymity and privacy: A mdular apprach. Jurnal f Cmputer Security, 12(1:3 36, [9] Claude Kirchner and Hélène Kirchner. Rewriting, slving, prving. A preliminary versin f a bk available at ckirchne/rsp.ps.gz, [10] Steve Schneider and Abraham Sidirpuls. CSP and annymity. In ESORICS, pages ,