One Year Later. Iliano Cervesato. ITT Industries, NRL Washington, DC. MSR 3.0:

Size: px
Start display at page:

Download "One Year Later. Iliano Cervesato. ITT Industries, NRL Washington, DC. MSR 3.0:"

Transcription

1 MSR 3.0: The Logical Meeting Point of Multiset Rewriting and Process Algebra MSR 3: Iliano Cervesato One Year Later ITT Industries, NRL Washington, DC CS Department, UMBC February 27-28, 2003 Iliano Cervesato iliano@itd.nrl.navy.mil ITT Industries, NRL Washington, DC Protocol exchange Seminar, UMBC May 27-28, 2004

2 A B: {n A, A} kb NSPK in MSR 3 B A: {n A, n B } ka A B: {n B } kb MSR 2 spec. A: princ. { L: princ B:princ.pubK B nonce mset. } B: princ. k B :pubkb. n A : nonce. net ({n A, A} kb ), L (A, B, k B, n A ) B: princ. k B : pubk B. k A :pubka. k A ': prvk k A. n A : nonce. n B : nonce. net ({n A, n B } ka ), L (A, B, k B, n A ) net ({n B } kb ) Interpretation of L Rule invocation Implementation detail Control flow Local state of role Explicit view Important for DOS MSR 3: One Year Later 1/28

3 A B: {n A, A} kb NSPK in MSR 3 B A: {n A, n B } ka A B: {n B } kb A:princ. B: princ. k B : pubk B. n A : nonce. net ({n A, A} kb ), Not an MSR 2 spec. ( k A :pubka. k A ': prvk k A. n B : nonce. net ({n A, n B } ka ) net ({n B } kb )) Succinct Continuation-passing style Rule asserts what to do next Lexical control flow State is implicit Abstract MSR 3: One Year Later 2/28

4 A B: {n A, A} kb Looks Familiar? B A: {n A, n B } ka A B: {n B } kb Process calculus Parametric strand A:princ. B: princ. k B : pubk B. k A :pubka. k A ': prvk k A. n B : nonce. νn A : nonce. net ({n A, A} kb ). net <{n A,n B } ka >. net ({n B } kb ). 0 Alice (A,B,N A,N B ) : N A Fresh, π A (A,B) {N A, A} KB {N A, N B } KA {N B } KB MSR 3: One Year Later 3/28

5 What is MSR 3? A new language for security protocols Supports State transition specs Conservative over MSR 2 Process algebraic specs Neutral paradigm Rewriting re-interpretation of logic Rich composable set of connectives Universal connector MSR 3: One Year Later 4/28

6 More than the Sum of its Parts Process- and transition-based specs. in the same language Choose the paradigm User s preference Highlight characteristics of interest Support various verification techniques (FW) Mix and match styles Within a spec. Within a protocol Within a role MSR 3: One Year Later 5/28

7 What is in MSR 3? Security-relevant signature Network Encryption, Typing infrastructure Dependent types Subsorting Data Access Specification (DAS) Module system Equations From MSR 1 From MSR 2 From MSR 2 implementation MSR 3: One Year Later 6/28

8 ω-multisets Specification language for concurrent systems Crossroad of State transition languages Petri nets, multiset rewriting, Process calculi CCS, π-calculus, (Linear) logic Benefits Analysis methods from logic and type theory Common ground for comparing Multiset rewriting Process algebra Allows multiple styles of specification Unified approach MSR 3: One Year Later 7/28

9 Syntax A ::= a atomic object 1 [ ] empty A B [A, B] formation A ο B [A B] rewrite T no-op A & B [A B] choice x. A instantiation x. A generation! A replication Generalizes FO multiset rewriting (MSR 1-2) x 1 x n. a(x) y 1 y k. b(x,y) MSR 3: One Year Later 8/28

10 State and Transitions States Σ ; Γ ; Δ Σ ; Δ Σ is a list Γ and Δ are Constructor:, commutative monoids Empty: Transitions Σ; Γ; Δ Σ ; Γ ; Δ Σ; Γ; Δ * Σ ; Δ * for reflexive and transitive closure MSR 3: One Year Later 9/28

11 Transition Semantics ο Σ ; Γ ; (Δ, A, A ο B) Σ ; Γ ; (Δ, B) T (no rule) & Σ ; Γ ; (Δ, A 1 &A 2 ) Σ ; Γ ; (Δ, A i ) Σ ; Γ ; (Δ, x. A) Σ ; Γ ; (Δ, [t/x]a) if Σ - t Σ ; Γ ; (Δ, x. A) (Σ, x) ; Γ ; (Δ, A)! Σ ; Γ ; (Δ,!A) Σ ; (Γ, A) ; Δ Σ ; (Γ, A) ; Δ Σ ; (Γ, A) ; (Δ, A) Σ ; Γ ; Δ * Σ ; Δ Σ ; Γ ; Δ * Σ ; Δ if Σ ; Γ ; Δ Σ ; Γ ; Δ and Σ ; Γ ; Δ * Σ ; Δ MSR 3: One Year Later 10/28

12 Linear Logic Formulas A, B ::= a 1 A B A ο B! A T A & B x. A x. A LV sequents Γ ; Δ --> Σ C Constructor:, Empty: Unrestricted context Linear context Signature Goal formula MSR 3: One Year Later 11/28

13 Logical Derivations Γ ; C --> Σ C Γ ; Δ --> Σ C Γ ; Δ --> Σ C Γ; Δ --> Σ C Proof of C from Δ and Γ Emphasis on C C is input Finite Closed Rules shown Major premise Preserves C Minor premise Starts subderivation MSR 3: One Year Later 12/28

14 A Rewriting Re-Interpretation Γ ; C --> Σ C Γ ; Δ --> Σ C Γ ; Δ --> Σ C Transition From conclusion To major premise Emphasis on Γ, Δ and Σ C is output, at best Does not change Possibly infinite Open Γ; Δ --> Σ C Minor premise Auxiliary rewrite chain Finite Topped with axiom MSR 3: One Year Later 13/28

15 Interpreting Unary Rules Γ; Δ, A, B --> Σ C Γ; Δ, A B --> Σ C Σ; Γ; (Δ, A B ) Σ; Γ; (Δ, A, B) Σ - t Γ; Δ, [t/x]a--> Σ C Γ; Δ, x.a --> Σ C Σ; Γ; (Δ, x. A) Σ; Γ; (Δ, [t/x]a) if Σ - t Γ; Δ, A --> Σ,x C Γ; Δ, x.a --> Σ C Σ; Γ; (Δ, x. A) (Σ, x); Γ; (Δ, A) Γ, A; Δ --> Σ C Γ; Δ,!A --> Σ C Σ; Γ; (Δ,!A) Σ; (Γ, A); Δ MSR 3: One Year Later 14/28

16 Binary Rules and Axiom Γ ; A --> Σ A Γ; Δ --> Σ A Γ; Δ, B --> Σ C Γ; Δ, Δ, A οb --> Σ C Minor premise Auxiliary rewrite chain Top of tree Focus shifts to RHS Axiom rule Observation MSR 3: One Year Later 15/28

17 Observations Γ,Γ ; A --> Σ,Σ A Observation states Σ ; Δ In Δ, we identify, with with 1 Categorical semantics Identified with For Σ = x 1,, x n De Bruijn s telescopes x 1. x n. Δ Γ; Δ --> Σ Σ. A A Δ = Δ Σ; Δ = Σ. Δ Observation transitions Σ; Γ; Δ * Σ ; Δ MSR 3: One Year Later 16/28

18 Interpreting Binary Rules Γ; A --> Σ A Σ; Γ; Δ * Σ; Δ Σ; Γ; Δ * Σ ; Δ if Σ; Γ; Δ Σ ; Γ ; Δ and Σ ; Γ ; Δ * Σ ; Δ Γ; Δ --> Σ A Γ; Δ, B --> Σ C Γ; Δ, Δ, A οb --> Σ C Σ; Γ; (Δ, Δ, A ο B) Σ; Γ; (Δ, B) if Σ; Γ; Δ * Σ; A Γ; Δ --> Σ A Γ; Δ, A --> Σ C Γ; Δ, Δ --> Σ C Σ; Γ; Δ, Δ Σ; Γ; (A, Δ) if Σ; Γ; Δ * Σ; A MSR 3: One Year Later 17/28

19 Formal Correspondence Soundness If Σ ; Γ ; Δ * Σ,Σ ; Δ then Γ ; Δ --> Σ Σ. Δ Completeness? No! We have only crippled right rules ; ; a ο b, b ο c * ; a ο c MSR 3: One Year Later 18/28

20 System ω With cut, rule for ο can be simplified to Σ; Γ; (Δ, A, A ο B) Σ; Γ; (Δ, B) Cut elimination holds = in-lining of auxiliary rewrite chains But Careful with extra signature symbols Careful with extra persistent objects No rule for needs a premise does not depend on * MSR 3: One Year Later 19/28

21 Multiset Rewriting Multiset: set with repetitions allowed a ::= a, a Commutative monoid Multiset rewriting (a.k.a. Petri nets) Rewriting within the monoid Fundamental model of distributed computing Alternative: Process Algebras Basis for security protocol spec. languages MSR family several others Many extensions, more or less ad hoc MSR 3: One Year Later 20/28

22 The Atomic Objects of MSR 3 Atomic terms Principals A Keys K Nonces N Other Raw data, timestamp, Fully definable Constructors Encryption {_} _ Pairing (_, _) Other Signature, hash, MAC, Predicates Network Memory Intruder net M A I MSR 3: One Year Later 21/28

23 Types Simple types A : princ n : nonce m : msg, Dependent types k : shk AB K : pubk A K : privk K, Fully definable Powerful abstraction mechanism At various user-definable level Finely tagged messages Untyped: msg only Simplify specification and reasoning Automated type checking MSR 3: One Year Later 22/28

24 Subsorting τ <: τ Allows atomic terms in messages Definable Non-transmittable terms Sub-hierarchies Discriminant for type-flaw attacks MSR 3: One Year Later 23/28

25 Data Access Specification Prevent illegitimate use of information Protocol specification divided in roles Owner = principal executing the role A signing/encrypting with B s key A accessing B s private data, Simple static check Central meta-theoretic notion Detailed specification of Dolev-Yao access model Gives meaning to Dolev-Yao intruder Current effort towards integration in type system Definable Possibility of going beyond Dolev-Yao model MSR 3: One Year Later 24/28

26 Modules and Equations Modules Bundle declarations with simple import/export interface Keep specifications tidy Reusable Equations (For free from underlying Maude engine) Specify useful algebraic properties Associativity of pairs Allow to go beyond free-algebra model Dec(k, Enc(k, M)) = M MSR 3: One Year Later 25/28

27 State-Based vs. Process-Based State-based languages Multiset Rewriting NRL Prot. Analyzer, CAPSL/CIL, Paulson s approach, State transition semantics Process-based languages Process Algebra Strand spaces, spi-calculus, Independent communicating threads MSR 3: One Year Later 26/28

28 MSR 3 Bridges the Gap Difficult to go from one to the other Different paradigms PB PB State vs. process distance SB SB Other distance MSR 3 State Process translation done once and for all in MSR 3 MSR 3: One Year Later 27/28

29 Summary MSR 3.0 Language for security protocol specification Succinct representations Simpl specifications Economy of reasoning Bridge between State-based representation Process-based representation ω-multisets Logical foundation of multiset rewriting Relationship with process algebras Unified logical view Better understanding of where we are Hint about where to go next MSR 3: One Year Later 28/28

MSR 3.0: The Logical Meeting Point of Multiset Rewriting and Process Algebra. Iliano Cervesato. ITT Industries, NRL Washington, DC

MSR 3.0: The Logical Meeting Point of Multiset Rewriting and Process Algebra. Iliano Cervesato. ITT Industries, NRL Washington, DC MSR 3.0: The Logical Meeting Point of Multiset Rewriting and Process Algebra Iliano Cervesato iliano@itd.nrl.navy.mil ITT Industries, inc @ NRL Washington, DC http://theory.stanford.edu/~iliano ISSS 2003,

More information

The Logical Meeting Point of Multiset Rewriting and Process Algebra

The Logical Meeting Point of Multiset Rewriting and Process Algebra MFPS 20 @ MU May 25, 2004 The Logical Meeting Point of Multiset Rewriting and Process Algebra Iliano ervesato iliano@itd.nrl.navy.mil ITT Industries, inc @ NRL Washington, D http://theory.stanford.edu/~iliano

More information

Relating State-Based and Process-Based Concurrency through Linear Logic

Relating State-Based and Process-Based Concurrency through Linear Logic École Polytechnique 17 September 2009 Relating State-Based and Process-Based oncurrency through Linear Logic Iliano ervesato arnegie Mellon University - Qatar iliano@cmu.edu Specifying oncurrent Systems

More information

MSR by Examples. Iliano Cervesato. ITT Industries, NRL Washington DC.

MSR by Examples. Iliano Cervesato. ITT Industries, NRL Washington DC. MSR by Examples Iliano Cervesato iliano@itd.nrl.navy.mil ITT Industries, Inc @ NRL Washington DC http://www.cs.stanford.edu/~iliano/ IITD, CSE Dept. Delhi, India April 24 th,2002 Outline Security Protocols

More information

Typed MSR: Syntax and Examples

Typed MSR: Syntax and Examples Typed MSR: Syntax and Examples Iliano Cervesato iliano@itd.nrl.navy.mil ITT Industries, Inc @ NRL Washington DC http://www.cs.stanford.edu/~iliano/ MMM 01 St. Petersburg, Russia May 22 nd, 2001 Outline

More information

Abstract Specification of Crypto- Protocols and their Attack Models in MSR

Abstract Specification of Crypto- Protocols and their Attack Models in MSR Abstract Specification of Crypto- Protocols and their Attack Models in MSR Iliano Cervesato iliano@itd.nrl.navy.mil ITT Industries, Inc @ NRL Washington DC http://www.cs.stanford.edu/~iliano/ Software

More information

MSR by Examples. Iliano Cervesato. ITT Industries, NRL Washington DC.

MSR by Examples. Iliano Cervesato. ITT Industries, NRL Washington DC. MSR by Examples Iliano Cervesato iliano@itd.nrl.navy.mil ITT Industries, Inc @ NRL Washington DC http://www.cs.stanford.edu/~iliano/ PPL 01 March 21 st, 2001 Outline I. Security Protocols II. MSR by Examples

More information

Lecture 7: Specification Languages

Lecture 7: Specification Languages Graduate Course on Computer Security Lecture 7: Specification Languages Iliano Cervesato iliano@itd.nrl.navy.mil ITT Industries, Inc @ NRL Washington DC http://www.cs.stanford.edu/~iliano/ DIMI, Universita

More information

Control Flow Analysis of Security Protocols (I)

Control Flow Analysis of Security Protocols (I) Control Flow Analysis of Security Protocols (I) Mikael Buchholtz 02913 F2005 Mikael Buchholtz p. 1 History of Protocol Analysis Needham-Schroeder 78 Dolev-Yao 81 Algebraic view of cryptography 02913 F2005

More information

Time-Bounding Needham-Schroeder Public Key Exchange Protocol

Time-Bounding Needham-Schroeder Public Key Exchange Protocol Time-Bounding Needham-Schroeder Public Key Exchange Protocol Max Kanovich, Queen Mary, University of London, UK University College London, UCL-CS, UK Tajana Ban Kirigin, University of Rijeka, HR Vivek

More information

Notes on BAN Logic CSG 399. March 7, 2006

Notes on BAN Logic CSG 399. March 7, 2006 Notes on BAN Logic CSG 399 March 7, 2006 The wide-mouthed frog protocol, in a slightly different form, with only the first two messages, and time stamps: A S : A, {T a, B, K ab } Kas S B : {T s, A, K ab

More information

CPSA and Formal Security Goals

CPSA and Formal Security Goals CPSA and Formal Security Goals John D. Ramsdell The MITRE Corporation CPSA Version 2.5.1 July 8, 2015 Contents 1 Introduction 3 2 Syntax 6 3 Semantics 8 4 Examples 10 4.1 Needham-Schroeder Responder.................

More information

Propositional Logic Language

Propositional Logic Language Propositional Logic Language A logic consists of: an alphabet A, a language L, i.e., a set of formulas, and a binary relation = between a set of formulas and a formula. An alphabet A consists of a finite

More information

Meta-Reasoning in a Concurrent Logical Framework

Meta-Reasoning in a Concurrent Logical Framework Meta-Reasoning in a Concurrent Logical Framework Iliano Cervesato and Jorge Luis Sacchini Carnegie Mellon University Chalmers University, 16 Oct 2013 Iliano Cervesato and Jorge Luis Sacchini Meta-Reasoning

More information

07 Equational Logic and Algebraic Reasoning

07 Equational Logic and Algebraic Reasoning CAS 701 Fall 2004 07 Equational Logic and Algebraic Reasoning Instructor: W. M. Farmer Revised: 17 November 2004 1 What is Equational Logic? Equational logic is first-order logic restricted to languages

More information

Term Rewriting applied to Cryptographic Protocol Analysis: the Maude-NPA tool

Term Rewriting applied to Cryptographic Protocol Analysis: the Maude-NPA tool Term Rewriting applied to Cryptographic Protocol Analysis: the Maude-NPA tool Santiago Escobar Departamento de Sistemas Informáticos y Computación Universitat Politècnica de València sescobar@dsic.upv.es

More information

First-Order Theorem Proving and Vampire

First-Order Theorem Proving and Vampire First-Order Theorem Proving and Vampire Laura Kovács 1,2 and Martin Suda 2 1 TU Wien 2 Chalmers Outline Introduction First-Order Logic and TPTP Inference Systems Saturation Algorithms Redundancy Elimination

More information

A Formalised Proof of Craig s Interpolation Theorem in Nominal Isabelle

A Formalised Proof of Craig s Interpolation Theorem in Nominal Isabelle A Formalised Proof of Craig s Interpolation Theorem in Nominal Isabelle Overview We intend to: give a reminder of Craig s theorem, and the salient points of the proof introduce the proof assistant Isabelle,

More information

Modular Multiset Rewriting in Focused Linear Logic

Modular Multiset Rewriting in Focused Linear Logic Modular Multiset Rewriting in Focused Linear Logic Iliano Cervesato and Edmund S. L. Lam July 2015 CMU-CS-15-117 CMU-CS-QTR-128 School of Computer Science Carnegie Mellon University Pittsburgh, PA 15213

More information

Meta-reasoning in the concurrent logical framework CLF

Meta-reasoning in the concurrent logical framework CLF Meta-reasoning in the concurrent logical framework CLF Jorge Luis Sacchini (joint work with Iliano Cervesato) Carnegie Mellon University Qatar campus Nagoya University, 27 June 2014 Jorge Luis Sacchini

More information

A Calculus for Control Flow Analysis of Security Protocols

A Calculus for Control Flow Analysis of Security Protocols International Journal of Information Security manuscript No. (will be inserted by the editor) A Calculus for Control Flow Analysis of Security Protocols Mikael Buchholtz, Hanne Riis Nielson, Flemming Nielson

More information

Extending Dolev-Yao with Assertions

Extending Dolev-Yao with Assertions Extending Dolev-Yao with Assertions Vaishnavi Sundararajan Chennai Mathematical Institute FOSAD 2015 August 31, 2015 (Joint work with R Ramanujam and S P Suresh) Vaishnavi S Extending Dolev-Yao with Assertions

More information

A Proof Theory for Generic Judgments

A Proof Theory for Generic Judgments A Proof Theory for Generic Judgments Dale Miller INRIA/Futurs/Saclay and École Polytechnique Alwen Tiu École Polytechnique and Penn State University LICS 2003, Ottawa, Canada, 23 June 2003 Outline 1. Motivations

More information

A Tableau Calculus for Minimal Modal Model Generation

A Tableau Calculus for Minimal Modal Model Generation M4M 2011 A Tableau Calculus for Minimal Modal Model Generation Fabio Papacchini 1 and Renate A. Schmidt 2 School of Computer Science, University of Manchester Abstract Model generation and minimal model

More information

Analysing privacy-type properties in cryptographic protocols

Analysing privacy-type properties in cryptographic protocols Analysing privacy-type properties in cryptographic protocols Stéphanie Delaune LSV, CNRS & ENS Cachan, France Wednesday, January 14th, 2015 S. Delaune (LSV) Verification of cryptographic protocols 14th

More information

A compositional logic for proving security properties of protocols

A compositional logic for proving security properties of protocols Journal of Computer Security 11 (2003) 677 721 677 IOS Press A compositional logic for proving security properties of protocols Nancy Durgin a, John Mitchell b and Dusko Pavlovic c a Sandia National Labs,

More information

Automatic Verification of Complex Security Protocols With an Unbounded Number of Sessions

Automatic Verification of Complex Security Protocols With an Unbounded Number of Sessions Automatic Verification of Complex Security Protocols With an Unbounded Number of Sessions Kaile Su, Weiya Yue and Qingliang Chen Department of Computer Science, Sun Yat-sen University Guangzhou, P.R. China

More information

185.A09 Advanced Mathematical Logic

185.A09 Advanced Mathematical Logic 185.A09 Advanced Mathematical Logic www.volny.cz/behounek/logic/teaching/mathlog13 Libor Běhounek, behounek@cs.cas.cz Lecture #1, October 15, 2013 Organizational matters Study materials will be posted

More information

Protocol Insecurity with a Finite Number of Sessions and Composed Keys is NP-complete

Protocol Insecurity with a Finite Number of Sessions and Composed Keys is NP-complete Protocol Insecurity with a Finite Number of Sessions and Composed Keys is NP-complete Michaël Rusinowitch and Mathieu Turuani LORIA-INRIA- Université Henri Poincaré, 54506 Vandoeuvre-les-Nancy cedex, France

More information

Logic for Computational Effects: work in progress

Logic for Computational Effects: work in progress 1 Logic for Computational Effects: work in progress Gordon Plotkin and John Power School of Informatics University of Edinburgh King s Buildings Mayfield Road Edinburgh EH9 3JZ Scotland gdp@inf.ed.ac.uk,

More information

Equational Tree Automata: Towards Automated Verification of Network Protocols

Equational Tree Automata: Towards Automated Verification of Network Protocols Equational Tree Automata: Towards Automated Verification of Network Protocols Hitoshi Ohsaki and Toshinori Takai National Institute of Advanced Industrial Science and Technology (AIST) Nakoji 3 11 46,

More information

07 Practical Application of The Axiomatic Method

07 Practical Application of The Axiomatic Method CAS 701 Fall 2002 07 Practical Application of The Axiomatic Method Instructor: W. M. Farmer Revised: 28 November 2002 1 What is the Axiomatic Method? 1. A mathematical model is expressed as a set of axioms

More information

3 Propositional Logic

3 Propositional Logic 3 Propositional Logic 3.1 Syntax 3.2 Semantics 3.3 Equivalence and Normal Forms 3.4 Proof Procedures 3.5 Properties Propositional Logic (25th October 2007) 1 3.1 Syntax Definition 3.0 An alphabet Σ consists

More information

A Logic of Authentication

A Logic of Authentication A Logic of Authentication by Burrows, Abadi, and Needham Presented by Adam Schuchart, Kathryn Watkins, Michael Brotzman, Steve Bono, and Sam Small Agenda The problem Some formalism The goals of authentication,

More information

First-Order Theorem Proving and Vampire. Laura Kovács (Chalmers University of Technology) Andrei Voronkov (The University of Manchester)

First-Order Theorem Proving and Vampire. Laura Kovács (Chalmers University of Technology) Andrei Voronkov (The University of Manchester) First-Order Theorem Proving and Vampire Laura Kovács (Chalmers University of Technology) Andrei Voronkov (The University of Manchester) Outline Introduction First-Order Logic and TPTP Inference Systems

More information

A process algebraic analysis of privacy-type properties in cryptographic protocols

A process algebraic analysis of privacy-type properties in cryptographic protocols A process algebraic analysis of privacy-type properties in cryptographic protocols Stéphanie Delaune LSV, CNRS & ENS Cachan, France Saturday, September 6th, 2014 S. Delaune (LSV) Verification of cryptographic

More information

The Maude-NRL Protocol Analyzer Lecture 3: Asymmetric Unification and Indistinguishability

The Maude-NRL Protocol Analyzer Lecture 3: Asymmetric Unification and Indistinguishability The Maude-NRL Protocol Analyzer Lecture 3: Asymmetric Unification and Catherine Meadows Naval Research Laboratory, Washington, DC 20375 catherine.meadows@nrl.navy.mil Formal Methods for the Science of

More information

Classical Program Logics: Hoare Logic, Weakest Liberal Preconditions

Classical Program Logics: Hoare Logic, Weakest Liberal Preconditions Chapter 1 Classical Program Logics: Hoare Logic, Weakest Liberal Preconditions 1.1 The IMP Language IMP is a programming language with an extensible syntax that was developed in the late 1960s. We will

More information

On the Automatic Analysis of Recursive Security Protocols with XOR

On the Automatic Analysis of Recursive Security Protocols with XOR On the Automatic Analysis of Recursive Security Protocols with XOR Ralf Küsters 1 and Tomasz Truderung 2 1 ETH Zurich ralf.kuesters@inf.ethz.ch 2 University of Kiel, Wrocław University tomasz.truderung@ii.uni.wroc.pl

More information

A Formal Analysis for Capturing Replay Attacks in Cryptographic Protocols

A Formal Analysis for Capturing Replay Attacks in Cryptographic Protocols ASIAN 07 A Formal Analysis for Capturing Replay Attacks in Cryptographic s Han Gao 1, Chiara Bodei 2, Pierpaolo Degano 2, Hanne Riis Nielson 1 Informatics and Mathematics Modelling, Technical University

More information

CS 395T. Probabilistic Polynomial-Time Calculus

CS 395T. Probabilistic Polynomial-Time Calculus CS 395T Probabilistic Polynomial-Time Calculus Security as Equivalence Intuition: encryption scheme is secure if ciphertext is indistinguishable from random noise Intuition: protocol is secure if it is

More information

The Consistency and Complexity of. Multiplicative Additive System Virtual

The Consistency and Complexity of. Multiplicative Additive System Virtual Scientific Annals of Computer Science vol. 25(2), 2015, pp. 1 70 The Consistency and Complexity of Multiplicative Additive System Virtual Ross HORNE 1 Abstract This paper investigates the proof theory

More information

Relations to first order logic

Relations to first order logic An Introduction to Description Logic IV Relations to first order logic Marco Cerami Palacký University in Olomouc Department of Computer Science Olomouc, Czech Republic Olomouc, November 6 th 2014 Marco

More information

A Cryptographic Decentralized Label Model

A Cryptographic Decentralized Label Model A Cryptographic Decentralized Label Model Jeffrey A. Vaughan and Steve Zdancewic Department of Computer and Information Science University of Pennsylvania IEEE Security and Privacy May 22, 2007 Information

More information

Relating Reasoning Methodologies in Linear Logic and Process Algebra

Relating Reasoning Methodologies in Linear Logic and Process Algebra Relating Reasoning Methodologies in Linear Logic and Process Algebra Yuxin Deng Robert J. Simmons Iliano Cervesato December 2011 CMU-CS-11-145 CMU-CS-QTR-111 School of Computer Science Carnegie Mellon

More information

Verification of the TLS Handshake protocol

Verification of the TLS Handshake protocol Verification of the TLS Handshake protocol Carst Tankink (0569954), Pim Vullers (0575766) 20th May 2008 1 Introduction In this text, we will analyse the Transport Layer Security (TLS) handshake protocol.

More information

Automated Validation of Internet Security Protocols. Luca Viganò

Automated Validation of Internet Security Protocols. Luca Viganò Automated Validation of Internet Security Protocols Luca Viganò The AVISPA Project Luca Viganò 1 Motivation The number and scale of new security protocols under development is out-pacing the human ability

More information

Verification of Security Protocols in presence of Equational Theories with Homomorphism

Verification of Security Protocols in presence of Equational Theories with Homomorphism Verification of Security Protocols in presence of Equational Theories with Homomorphism Stéphanie Delaune France Télécom, division R&D, LSV CNRS & ENS Cachan February, 13, 2006 Stéphanie Delaune (FT R&D,

More information

The TLA + proof system

The TLA + proof system The TLA + proof system Stephan Merz Kaustuv Chaudhuri, Damien Doligez, Leslie Lamport INRIA Nancy & INRIA-MSR Joint Centre, France Amir Pnueli Memorial Symposium New York University, May 8, 2010 Stephan

More information

CS522 - Programming Language Semantics

CS522 - Programming Language Semantics 1 CS522 - Programming Language Semantics Simply Typed Lambda Calculus Grigore Roşu Department of Computer Science University of Illinois at Urbana-Champaign 2 We now discuss a non-trivial extension of

More information

Uniform Schemata for Proof Rules

Uniform Schemata for Proof Rules Uniform Schemata for Proof Rules Ulrich Berger and Tie Hou Department of omputer Science, Swansea University, UK {u.berger,cshou}@swansea.ac.uk Abstract. Motivated by the desire to facilitate the implementation

More information

The Locally Nameless Representation

The Locally Nameless Representation Noname manuscript No. (will be inserted by the editor) The Locally Nameless Representation Arthur Charguéraud Received: date / Accepted: date Abstract This paper provides an introduction to the locally

More information

APPLICATIONS OF BAN-LOGIC JAN WESSELS CMG FINANCE B.V.

APPLICATIONS OF BAN-LOGIC JAN WESSELS CMG FINANCE B.V. APPLITIONS OF AN-LOGIC JAN WESSELS CMG FINANCE.V. APRIL 19, 2001 Chapter 1 Introduction This document is meant to give an overview of the AN-logic. The AN-logic is one of the methods for the analysis of

More information

Probabilistic Polynomial-Time Process Calculus for Security Protocol Analysis. Standard analysis methods. Compositionality

Probabilistic Polynomial-Time Process Calculus for Security Protocol Analysis. Standard analysis methods. Compositionality Probabilistic Polynomial-Time Process Calculus for Security Protocol Analysis J. Mitchell, A. Ramanathan, A. Scedrov, V. Teague P. Lincoln, P. Mateus, M. Mitchell Standard analysis methods Finite-state

More information

Fuzzy Description Logics

Fuzzy Description Logics Fuzzy Description Logics 1. Introduction to Description Logics Rafael Peñaloza Rende, January 2016 Literature Description Logics Baader, Calvanese, McGuinness, Nardi, Patel-Schneider (eds.) The Description

More information

Algebraic Trace Theory

Algebraic Trace Theory Algebraic Trace Theory EE249 Roberto Passerone Material from: Jerry R. Burch, Trace Theory for Automatic Verification of Real-Time Concurrent Systems, PhD thesis, CMU, August 1992 October 21, 2002 ee249

More information

Theoretical Computer Science. Representing model theory in a type-theoretical logical framework

Theoretical Computer Science. Representing model theory in a type-theoretical logical framework Theoretical Computer Science 412 (2011) 4919 4945 Contents lists available at ScienceDirect Theoretical Computer Science journal homepage: www.elsevier.com/locate/tcs Representing model theory in a type-theoretical

More information

A progress report on using Maude to verify protocol properties using the strand space model

A progress report on using Maude to verify protocol properties using the strand space model A progress report on using Maude to verify protocol properties using the strand space model Presented by Robert P. Graham, MAJ, USAF/AFIT Stephen W. Mancini, 1Lt, USAF/AFIT Presentation date: 01 Oct 03

More information

Hypersequent Calculi for some Intermediate Logics with Bounded Kripke Models

Hypersequent Calculi for some Intermediate Logics with Bounded Kripke Models Hypersequent Calculi for some Intermediate Logics with Bounded Kripke Models Agata Ciabattoni Mauro Ferrari Abstract In this paper we define cut-free hypersequent calculi for some intermediate logics semantically

More information

Dynamic Noninterference Analysis Using Context Sensitive Static Analyses. Gurvan Le Guernic July 14, 2007

Dynamic Noninterference Analysis Using Context Sensitive Static Analyses. Gurvan Le Guernic July 14, 2007 Dynamic Noninterference Analysis Using Context Sensitive Static Analyses Gurvan Le Guernic July 14, 2007 1 Abstract This report proposes a dynamic noninterference analysis for sequential programs. This

More information

Algebraic Trace Theory

Algebraic Trace Theory Algebraic Trace Theory EE249 Presented by Roberto Passerone Material from: Jerry R. Burch, Trace Theory for Automatic Verification of Real-Time Concurrent Systems, PhD thesis, CMU, August 1992 October

More information

Reasoning with Higher-Order Abstract Syntax and Contexts: A Comparison

Reasoning with Higher-Order Abstract Syntax and Contexts: A Comparison 1 Reasoning with Higher-Order Abstract Syntax and Contexts: A Comparison Amy Felty University of Ottawa July 13, 2010 Joint work with Brigitte Pientka, McGill University 2 Comparing Systems We focus on

More information

Automata-based analysis of recursive cryptographic protocols

Automata-based analysis of recursive cryptographic protocols 1 Automata-based analysis of recursive cryptographic protocols Thomas Wilke Joint work with Ralf Küsters Christian-Albrechts-Universität zu Kiel June 13, 2004 Un-/Decidability of security in the DY model

More information

Beyond First-Order Logic

Beyond First-Order Logic Beyond First-Order Logic Software Formal Verification Maria João Frade Departmento de Informática Universidade do Minho 2008/2009 Maria João Frade (DI-UM) Beyond First-Order Logic MFES 2008/09 1 / 37 FOL

More information

Causality Interfaces and Compositional Causality Analysis

Causality Interfaces and Compositional Causality Analysis Causality Interfaces and Compositional Causality Analysis Edward A. Lee Haiyang Zheng Ye Zhou {eal,hyzheng,zhouye}@eecs.berkeley.edu Center for Hybrid and Embedded Software Systems (CHESS) Department of

More information

Review of The π-calculus: A Theory of Mobile Processes

Review of The π-calculus: A Theory of Mobile Processes Review of The π-calculus: A Theory of Mobile Processes Riccardo Pucella Department of Computer Science Cornell University July 8, 2001 Introduction With the rise of computer networks in the past decades,

More information

02 The Axiomatic Method

02 The Axiomatic Method CAS 734 Winter 2005 02 The Axiomatic Method Instructor: W. M. Farmer Revised: 11 January 2005 1 What is Mathematics? The essence of mathematics is a process consisting of three intertwined activities:

More information

Introduction to lambda calculus Part 6

Introduction to lambda calculus Part 6 Introduction to lambda calculus Part 6 Antti-Juhani Kaijanaho 2017-02-16 1 Untyped lambda calculus 2 Typed lambda calculi 2.1 Dynamically typed lambda calculus with integers 2.2 A model of Lisp 2.3 Simply

More information

Axiomatic Semantics. Lecture 9 CS 565 2/12/08

Axiomatic Semantics. Lecture 9 CS 565 2/12/08 Axiomatic Semantics Lecture 9 CS 565 2/12/08 Axiomatic Semantics Operational semantics describes the meaning of programs in terms of the execution steps taken by an abstract machine Denotational semantics

More information

A simple proof that super-consistency implies cut elimination

A simple proof that super-consistency implies cut elimination A simple proof that super-consistency implies cut elimination Gilles Dowek 1 and Olivier Hermant 2 1 École polytechnique and INRIA, LIX, École polytechnique, 91128 Palaiseau Cedex, France gilles.dowek@polytechnique.edu

More information

Algebraic Abstract Data Types

Algebraic Abstract Data Types Introduction AADT Proofs Theories Hierarchies Rewriting in Algebraic Specifications Université de Genève 16 mars 2009 1/79 Introduction AADT Proofs Theories Hierarchies Rewriting in Algebraic Specifications

More information

Adjoint Logic and Its Concurrent Semantics

Adjoint Logic and Its Concurrent Semantics Adjoint Logic and Its Concurrent Semantics Frank Pfenning ABCD Meeting, Edinburgh, December 18-19, 2017 Joint work with Klaas Pruiksma and William Chargin Outline Proofs as programs Linear sequent proofs

More information

Negative applications of the ASM thesis

Negative applications of the ASM thesis Negative applications of the ASM thesis Dean Rosenzweig and Davor Runje University of Zagreb Berlin, February 26-27, 2007 Outline 1 Negative applications of the ASM thesis Motivation Non-interactive algorithms

More information

Encoding Graph Transformation in Linear Logic

Encoding Graph Transformation in Linear Logic Encoding Graph Transformation in Linear Logic Paolo Torrini joint work with Reiko Heckel pt95@mcs.le.ac.uk University of Leicester GTLL p. 1 Graph Transformation Graph Transformation Systems (GTS) high-level

More information

Propositional and Predicate Logic - V

Propositional and Predicate Logic - V Propositional and Predicate Logic - V Petr Gregor KTIML MFF UK WS 2016/2017 Petr Gregor (KTIML MFF UK) Propositional and Predicate Logic - V WS 2016/2017 1 / 21 Formal proof systems Hilbert s calculus

More information

AN ALTERNATIVE NATURAL DEDUCTION FOR THE INTUITIONISTIC PROPOSITIONAL LOGIC

AN ALTERNATIVE NATURAL DEDUCTION FOR THE INTUITIONISTIC PROPOSITIONAL LOGIC Bulletin of the Section of Logic Volume 45/1 (2016), pp 33 51 http://dxdoiorg/1018778/0138-068045103 Mirjana Ilić 1 AN ALTERNATIVE NATURAL DEDUCTION FOR THE INTUITIONISTIC PROPOSITIONAL LOGIC Abstract

More information

BiLog: Spatial Logics for Bigraphs 1

BiLog: Spatial Logics for Bigraphs 1 BiLog: Spatial Logics for Bigraphs 1 Giovanni Conforti a Damiano Macedonio b Vladimiro Sassone b a University of Dortmund b University of Sussex Abstract Bigraphs are emerging as a (meta-)model for concurrent

More information

Reasoning about the Consequences of Authorization Policies in a Linear Epistemic Logic

Reasoning about the Consequences of Authorization Policies in a Linear Epistemic Logic Reasoning about the Consequences of Authorization Policies in a Linear Epistemic Logic Henry DeYoung July 2009 CMU-CS-09-140 Frank Pfenning School of Computer Science Carnegie Mellon University Pittsburgh,

More information

Specifying Properties of Concurrent Computations in CLF

Specifying Properties of Concurrent Computations in CLF LFM 2004 Preliminary Version Specifying Properties of Concurrent Computations in CLF Kevin Watkins a,1 Iliano Cervesato b,2 Frank Pfenning a,3 David Walker c,4 a Department of Computer Science, Carnegie

More information

First-Order Logic. Chapter Overview Syntax

First-Order Logic. Chapter Overview Syntax Chapter 10 First-Order Logic 10.1 Overview First-Order Logic is the calculus one usually has in mind when using the word logic. It is expressive enough for all of mathematics, except for those concepts

More information

Proof Theoretical Studies on Semilattice Relevant Logics

Proof Theoretical Studies on Semilattice Relevant Logics Proof Theoretical Studies on Semilattice Relevant Logics Ryo Kashima Department of Mathematical and Computing Sciences Tokyo Institute of Technology Ookayama, Meguro, Tokyo 152-8552, Japan. e-mail: kashima@is.titech.ac.jp

More information

Formal Methods for Java

Formal Methods for Java Formal Methods for Java Lecture 20: Sequent Calculus Jochen Hoenicke Software Engineering Albert-Ludwigs-University Freiburg January 15, 2013 Jochen Hoenicke (Software Engineering) Formal Methods for Java

More information

FROM AXIOMS TO STRUCTURAL RULES, THEN ADD QUANTIFIERS.

FROM AXIOMS TO STRUCTURAL RULES, THEN ADD QUANTIFIERS. FROM AXIOMS TO STRUCTURAL RULES, THEN ADD QUANTIFIERS. REVANTHA RAMANAYAKE We survey recent developments in the program of generating proof calculi for large classes of axiomatic extensions of a non-classical

More information

Encoding security protocols in the cryptographic λ-calculus. Eijiro Sumii Joint work with Benjamin Pierce University of Pennsylvania

Encoding security protocols in the cryptographic λ-calculus. Eijiro Sumii Joint work with Benjamin Pierce University of Pennsylvania Encoding security protocols in the cryptographic λ-calculus Eijiro Sumii Joint work with Benjamin Pierce University of Pennsylvania An obvious fact Security is important Cryptography is a major way to

More information

Grammatical resources: logic, structure and control

Grammatical resources: logic, structure and control Grammatical resources: logic, structure and control Michael Moortgat & Dick Oehrle 1 Grammatical composition.................................. 5 1.1 Grammar logic: the vocabulary.......................

More information

03 Review of First-Order Logic

03 Review of First-Order Logic CAS 734 Winter 2014 03 Review of First-Order Logic William M. Farmer Department of Computing and Software McMaster University 18 January 2014 What is First-Order Logic? First-order logic is the study of

More information

Analysis of authentication protocols Intership report

Analysis of authentication protocols Intership report Analysis of authentication protocols Intership report Stéphane Glondu ENS de Cachan September 3, 2006 1 Introduction Many computers are interconnected through networks, the biggest of them being Internet.

More information

KLMLean 2.0: a Theorem Prover for KLM Logics of Nonmonotonic Reasoning

KLMLean 2.0: a Theorem Prover for KLM Logics of Nonmonotonic Reasoning KLMLean 2.0: a Theorem Prover for KLM Logics of Nonmonotonic Reasoning Laura Giordano*, Valentina Gliozzi, and Gian Luca Pozzato * Dip. di Informatica - Univ. del Piemonte Orientale A. Avogadro - Alessandria

More information

A few bridges between operational and denotational semantics of programming languages

A few bridges between operational and denotational semantics of programming languages A few bridges between operational and denotational semantics of programming languages Soutenance d habilitation à diriger les recherches Tom Hirschowitz November 17, 2017 Hirschowitz Bridges between operational

More information

distinct models, still insists on a function always returning a particular value, given a particular list of arguments. In the case of nondeterministi

distinct models, still insists on a function always returning a particular value, given a particular list of arguments. In the case of nondeterministi On Specialization of Derivations in Axiomatic Equality Theories A. Pliuskevicien_e, R. Pliuskevicius Institute of Mathematics and Informatics Akademijos 4, Vilnius 2600, LITHUANIA email: logica@sedcs.mii2.lt

More information

Foundations of Artificial Intelligence

Foundations of Artificial Intelligence Foundations of Artificial Intelligence 7. Propositional Logic Rational Thinking, Logic, Resolution Wolfram Burgard, Maren Bennewitz, and Marco Ragni Albert-Ludwigs-Universität Freiburg Contents 1 Agents

More information

The Curry-Howard Isomorphism

The Curry-Howard Isomorphism The Curry-Howard Isomorphism Software Formal Verification Maria João Frade Departmento de Informática Universidade do Minho 2008/2009 Maria João Frade (DI-UM) The Curry-Howard Isomorphism MFES 2008/09

More information

Foundations of Artificial Intelligence

Foundations of Artificial Intelligence Foundations of Artificial Intelligence 7. Propositional Logic Rational Thinking, Logic, Resolution Joschka Boedecker and Wolfram Burgard and Bernhard Nebel Albert-Ludwigs-Universität Freiburg May 17, 2016

More information

First Order Logic: Syntax and Semantics

First Order Logic: Syntax and Semantics CS1081 First Order Logic: Syntax and Semantics COMP30412 Sean Bechhofer sean.bechhofer@manchester.ac.uk Problems Propositional logic isn t very expressive As an example, consider p = Scotland won on Saturday

More information

Introduction to Kleene Algebras

Introduction to Kleene Algebras Introduction to Kleene Algebras Riccardo Pucella Basic Notions Seminar December 1, 2005 Introduction to Kleene Algebras p.1 Idempotent Semirings An idempotent semiring is a structure S = (S, +,, 1, 0)

More information

Cut-elimination for Provability Logic GL

Cut-elimination for Provability Logic GL Cut-elimination for Provability Logic GL Rajeev Goré and Revantha Ramanayake Computer Sciences Laboratory The Australian National University { Rajeev.Gore, revantha }@rsise.anu.edu.au Abstract. In 1983,

More information

A derivation system and compositional logic for security protocols

A derivation system and compositional logic for security protocols Journal of Computer Security 13 2005) 423 482 423 IOS Press A derivation system and compositional logic for security protocols Anupam Datta a,, Ante Derek a, John C. Mitchell a and Dusko Pavlovic b a Computer

More information

ACLT: Algebra, Categories, Logic in Topology - Grothendieck's generalized topological spaces (toposes)

ACLT: Algebra, Categories, Logic in Topology - Grothendieck's generalized topological spaces (toposes) ACLT: Algebra, Categories, Logic in Topology - Grothendieck's generalized topological spaces (toposes) Steve Vickers CS Theory Group Birmingham 2. Theories and models Categorical approach to many-sorted

More information

Outline. Overview. Syntax Semantics. Introduction Hilbert Calculus Natural Deduction. 1 Introduction. 2 Language: Syntax and Semantics

Outline. Overview. Syntax Semantics. Introduction Hilbert Calculus Natural Deduction. 1 Introduction. 2 Language: Syntax and Semantics Introduction Arnd Poetzsch-Heffter Software Technology Group Fachbereich Informatik Technische Universität Kaiserslautern Sommersemester 2010 Arnd Poetzsch-Heffter ( Software Technology Group Fachbereich

More information

7. Propositional Logic. Wolfram Burgard and Bernhard Nebel

7. Propositional Logic. Wolfram Burgard and Bernhard Nebel Foundations of AI 7. Propositional Logic Rational Thinking, Logic, Resolution Wolfram Burgard and Bernhard Nebel Contents Agents that think rationally The wumpus world Propositional logic: syntax and semantics

More information