On the Security of Cryptographic Protocols Using the Little Theorem of Witness Functions

TL;DR

This paper demonstrates the effectiveness of the little theorem of witness functions in detecting security flaws in cryptographic protocols, specifically analyzing the Needham-Schroeder symmetric-key protocol to identify a vulnerability that enables replay attacks.

Contribution

It provides a formal analysis method using witness functions to identify security vulnerabilities in cryptographic protocols, illustrating its practical application on the Needham-Schroeder protocol.

Findings

Identified a security vulnerability in the Needham-Schroeder protocol.

Showed how witness functions can detect security flaws.

Highlighted a potential replay attack vulnerability.

Abstract

In this paper, we show how practical the little theorem of witness functions is in detecting security flaws in some category of cryptographic protocols. We convey a formal analysis of the Needham-Schroeder symmetric-key protocol in the theory of witness functions. We show how it helps to teach about a security vulnerability in a given step of this protocol where the value of security of a particular sensitive ticket in a sent message unexpectedly plummets compared with its value when received. This vulnerability may be exploited by an intruder to mount a replay attack as described by Denning and Sacco.

Tables

Table 1. TABLE I: The Needham-Schroeder symmetric-key protocol

$p$=	$⟨1,$	$A$	$⟶$	$S:$	$A.B.N_a⟩$
	$⟨2,$	$S$	$⟶$	$A:$	${\{N_a.k_{ab}.B.{\{k_{ab}.A\}}_{k_{bs}}\}}_{k_{as}}⟩$
	$⟨3,$	$A$	$⟶$	$B:$	${\{k_{ab}.A\}}_{k_{bs}}⟩$
	$⟨4,$	$B$	$⟶$	$A:$	${\left\{N_b\right\}}_{k_{ab}}⟩$
	$⟨5,$	$A$	$⟶$	$B:$	${\{N_b-1\}}_{k_{ab}}⟩$

Equations

$$F^{\prime }(\alpha ,r^{+})⊒┌\alpha ┐\sqcap F^{\prime }(\alpha ,R^{-})$$

$$S_A^1:\frac{\square }{A.B.N_a^i};S_A^2:\frac{\{N_a^i.X.B.Y{\}}_{k_{as}}}{Y};S_A^3:\frac{\{Z{\}}_X}{\{Z-1{\}}_X}$$

$$F^{\prime }(N_a^i,r_{S_A^2}^{+})⊒┌N_a^i┐\sqcap F^{\prime }(N_a^i,R_{S_A^2}^{-})\text{mbox}(2.7)$$

$$F^{\prime }(X,r_{S_A^2}^{+})⊒┌X┐\sqcap F^{\prime }(X,R_{S_A^2}^{-})\text{mbox}(2.8)$$

$$F^{\prime }(Y,r_{S_A^2}^{+})/⊒┌Y┐\sqcap F^{\prime }(Y,R_{S_A^2}^{-})\text{mbox}(2.9)$$

Full text

Notice

© 2019 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.

I Introduction

Cryptographic protocols are distributed programs that aim to secure communications in an unsecured network by means of cryptography. They are used wherever the security matters, for example, in electronic commerce, military communications, electronic voting, etc. A security breach in a protocol often causes significant and irreparable damage. Indeed, a flaw in an online sales protocol can cause huge losses for a remote seller. The victim, on the other hand, may end up with a bad credit record and a tarnished reputation. The use of cryptography, while necessary, cannot guarantee the security of a protocol. Indeed, the history of protocols [1, 2] teaches us that an intruder is capable of manipulating the rules of a given protocol to infer a secret, usurp an identity, alter the integrity of data or deny his participation in a given communication after committing an unhealthy act.

Formal methods have therefore emerged [3, 4, 5, 6, 7, 8, 9] as a preferred means of verifying whether a protocol meets the security properties for which it was intended. As a result, a number of methods have sprung up, and have demonstrated distinct performance. Others were withdrawn after a period of glory due to unfortunate deficiencies, several years after their release.

In recent years, a new generation of analytical functions, called witness functions [10, 11, 12, 13], has been proposed to analyze cryptographic protocols. These functions assign a security value to each message component exchanged in the protocol, then examine whether this value increases or not between two reception-sending steps. If throughout the protocol, all security values are observed increasing, then the protocol itself is said to be increasing and hence declared correct for the property of secrecy. If, on the other hand, a decreasing value is found, these functions refuse to certify the correctness of the protocol. This way of approaching and handling security in cryptographic protocols stems from the fact that increasing protocols are correct, proven in [11]. These functions have been a good way to demonstrate the correctness of several protocols. They were also able to teach about security vulnerabilities in other protocols. More recently, in [14], the author proposed a reduced form of the general theorem of protocol correctness by witness functions [13] for analyzing tagged protocols. The author adopts a very broad definition of tagged protocols and considers tagged any protocol whose messages are distinguishable, one by one by a receiving agent, either by inserting a particular syntactic element in a message, or thanks to the position of identities or nonces, or by any other means.

In this paper, we provide an analysis of the Needham-Schroeder symmetric-key protocol [15] using this reduced theorem that we refer to by the little theorem of witness functions as opposed to the general theorem. We show that this protocol does not respect this theorem and gets stuck in a critical step in the protocol where a value of security unexpectedly goes down which may be interpreted as a security vulnerability. We also show that this latter can be exploited by an intruder using a Denning and Sacco attack scenario [16].

II Paper organization

The paper is organized as follows:

• •

in Section III, we briefly present the role-based specification in which a protocol is specified;

• •

in Section IV, we shortly review the foundation of witness functions;

• •

in Section V, we present the little theorem of witness functions;

• •

in Section VI, we give a formal analysis of the Needham-Schroeder symmetric-key protocol using this theorem;

• •

in Section VII, we discuss the results of our analysis;

• •

in Section VIII, we compare our approach with other related approaches;

• •

in Section IX, we conclude.

III Role-based specification

A cryptographic protocol is a set of programs that can communicate over the network. Each program corresponds to a role of the protocol. Agents, who are actually servers or people who can implement the protocol, can play several roles simultaneously. When an honest agent takes on a role, an instance of the program corresponding to the role runs on the agent’s machine using its various personal data, for example its identity and secret keys. A session is an instance of a program executed by an agent. A dishonest agent, or intruder [17], is not required to follow a protocol role. It can execute any number of sessions. It has other capacities like intercepting messages, concatenating or de-concatenating messages, encrypting or decrypting messages with keys that it knows, etc.

A role-based specification [18, 19] is an abstraction of all these facts. It focuses on a single agent at a time and represents what, how, and to/from whom it sends and receives messages. If a component of a given message is not intelligible for that agent, it is replaced by a variable. In that case, we talk about generalized roles. An exponent is added to represent the session.

IV Witness Functions

IV-A Reliable Function

Let’s consider the following function $F$:

Definition 1

*(Reliable Function)

${F}(\alpha,\{\alpha\})$ $=$ $\bot$

${F}(\alpha,{M}_{1}\cup{M}_{2})$ $=$ ${F}(\alpha,{M}_{1})\sqcap{F}(\alpha,{M}_{2})$

${F}(\alpha,{M})$ $=$ $\top,\mbox{ if }\alpha\notin{\mathcal{A}}({M})$

${F}(\alpha,m_{1}.m_{2})$ $=$ $F(\alpha,\{m_{1},m_{2}\})$

${F}(\alpha,\{m\}_{k})$ $=$ $F(\alpha,\{m\}),$ if $\ulcorner k^{-1}\urcorner\not\sqsupseteq\ulcorner\alpha\urcorner$

${F}(\alpha,\{m\}_{k})$ $=$ $\ulcorner k^{-1}\urcorner\cup\mbox{ID}(m),$ if $\ulcorner k^{-1}\urcorner\sqsupseteq\ulcorner\alpha\urcorner$

A reliable function is a function that assigns to each atom in a message a reasonable value of security. In the point 1., it assigns to a plain (clear) atomic message $\alpha$ the bottom value of security (i.e. $\bot$). In the point 2., it assigns for an atomic message $\alpha$ that shows up in two sets of messages the minimum (i.e. $\sqcap$) of the two values calculated in each set separately. In the point 3., it assigns to an atomic message $\alpha$ that does not appear in a message (i.e. $\alpha\notin{\mathcal{A}}({M})$ where ${\mathcal{A}}({M})$ is the set of all atoms of $M$) the top value (i.e. $\top$). In the point 4., it assigns to an atomic message in a concatenated message the minimum of the values calculated in each message separately. In the point 5., $F$ disregards an encryption with an outer key of a lower level than the analyzed atom (i.e. $\ulcorner k^{-1}\urcorner\not\sqsupseteq\ulcorner\alpha\urcorner$) and seeks a deeper strong key. In the point 6., $F$ first ensures that $\alpha$ is encrypted with a key $k$ of a higher level (i.e. $\ulcorner k^{-1}\urcorner\sqsupseteq\ulcorner\alpha\urcorner$) and returns the set of identities of agents that detain the reverse key (i.e. $\ulcorner k^{-1}\urcorner$) in addition to the set of identities in the neighborhood of $\alpha$ under the same encryption in $m$ (i.e. $\mbox{ID}(m)$).

Example 1

Say that we have a context such that: $\ulcorner\alpha\urcorner=\{A,B,S\}$; ${k_{ac}^{-1}}={k_{ac}},{k_{ab}^{-1}}={k_{ab}},{k_{as}^{-1}}={k_{as}}$; $\ulcorner{k_{ac}}\urcorner=\{A,C\},\ulcorner{k_{as}}\urcorner=\{A,S\},\ulcorner{k_{ab}}\urcorner=\{A,B\}$. Say that $m=\{\{C.\{E.\alpha.D\}_{k_{as}}\}_{k_{ab}}\}_{k_{ac}}$.

[TABLE]

In [13, 11] we prove that $F$ is reliable and we define other reliable functions that we do not mention here.

IV-B Derivative Function

The function $F$ given in Definition 1 does not deal with variables. In order to do so, we rather use its derivative form $F^{\prime}$. This derivative function simply removes all variables around any evaluated atom before applying $F$. The following example explains how to use $F^{\prime}$ to assign values of security to atomic messages in messages containing variables.

Example 2

Let us have the same context as Example 1. Say that $m=\{\{C.\{X.\alpha.D\}_{k_{as}}\}_{k_{ab}}\}_{k_{ac}}$ where $X$ is a variable.

[TABLE]

The derivative function $F^{\prime}$ is good for analyzing generalized roles (involving messages with variables) in the case of tagged protocols. However, it may present some complexities in the general case, which is beyond the scope of this paper. In the context of tagged protocols, $F^{\prime}$ is called witness function. We recall that tagged protocols in our own definition are all protocols that generate messages such that they are one by one distinguishable from a receiver point of view, meaning, no regular message can be unified with a non regular one.

V Little Theorem of Witness Functions

Theorem 1

[Little Theorem of Witness Functions] Let $p$ be a tagged protocol. Let $F^{\prime}$ be a witness function. $p$ is correct for secrecy if: $\forall R.r\in R_{G}(p),\forall\alpha\in{\mathcal{A}}{(r^{+})}$ we have:

[TABLE]

Theorem 1, which we call the little theorem of the witness functions, uses the witness function $F^{\prime}$ to attribute a value of security to every component in every single exchanged message in the protocol, then, it examines if the value of security of that component is increasing in the sent message (i.e. in $r^{+}$) compared with its value in either the context or when it was received (i.e. in $R^{-}$). If this is the case in all the protocol steps, then the protocol is declared correct for secrecy. Otherwise, the theorem refuses to certify the protocol correctness and flags up a possible vulnerability that could be exploited by an intruder. We will refer to this theorem by LTWF in the following analysis of the Needham-Schroeder symmetric key protocol.

VI Formal analysis of the Needham-Schroeder symmetric-key protocol

In this section, we analyze the Needham-Schroeder symmetric-key protocol with Theorem 1 (LTWF) for secrecy. This protocol is described in Table I and we refer to by $p$.

VI-A Context setting

The generalized roles of the protocol are $\cal{R}_{\cal{G}}(\textit{p})=\{A_{\cal{G}},B_{\cal{G}},S_{\cal{G}}\}$ where:

[TABLE]

Context :

$\ulcorner A\urcorner=\bot$; $\ulcorner B\urcorner=\bot$; $\ulcorner S\urcorner=\bot$; (i.e. three public identities)

$\ulcorner N_{a}\urcorner=\bot$ (i.e. public nonce);

$\ulcorner N_{b}\urcorner=\{A,B\}$ (i.e. nonce shared between $A$ and $B$);

$\ulcorner k_{ab}\urcorner=\{A,B,S\}$; (i.e. session key shared between $A$ and $B$ and created by $S$)

$\ulcorner k_{as}\urcorner=\{A,S\}$; (i.e. shared key between $A$ and $S$)

$\ulcorner k_{bs}\urcorner=\{B,S\}$; (i.e. shared key between $B$ and $S$)

$({\cal{L}},\sqsupseteq,\sqcup,\sqcap,\bot,\top)=(2^{\cal{I}},\subseteq,\cap,\cup,\cal{I},\emptyset)$; (i.e. security lattice)

${\cal{I}}=\{I,A,B,S\}$; (i.e. intruder and regular agents participating in the protocol)

${\cal{X}}_{p}=\{X,Y,Z,T,Q\}$ is the set of variables. $F^{\prime}$ is the used witness function and the derivative function of $F$ given in Definition 1.

It is wise to notice that all the generated messages by the protocol cannot overlap one with another from a receiver point of view, which means that we can use Theorem LTWF to analyze the protocol.

VI-B Analyzing the generalized role of $A$

From the generalized role $\cal{A}_{\cal{G}}$, an agent $A$ may participate in three receiving/sending steps. In the first step, it receives nothing and sends the message $A.B.N_{a}^{i}$. In the second step, it receives the message $\{N_{a}^{i}.X.B.Y\}_{k_{as}}$ and sends the message $Y$. In the third step, it receives the message $\{Z\}_{X}$ and sends the message $\{Z-1\}_{X}$. This is represented by the following rules.

[TABLE]

VI-B1 Analyzing exchanged messages in $S_{A}^{1}$

1- For $N_{a}^{i}$:

a- On sending: $r_{S_{A}^{1}}^{+}=A.B.N_{a}^{i}$

[TABLE]

b- On receiving: $R_{S^{i}}^{-}=\emptyset$

$F^{\prime}(N_{a}^{i},R_{S_{A}^{1}}^{-})$ $=$ $F^{\prime}(N_{a}^{i},\emptyset)$

{No variable in the neighborhood of $N_{a}^{i}$ to be removed by derivation}

= $F(N_{a}^{i},\emptyset)$

{Definition 1}

= $\top$                                      (1.2)

2- Concordance with Theorem LTWF:

From 1.2 and since $\ulcorner N_{a}\urcorner=\{A,B\}$, we have:

$\ulcorner N_{a}^{i}\urcorner\sqcap F^{\prime}(N_{a}^{i},R_{S_{A}^{1}}^{-})=\bot\sqcap\top=\bot$                                      (1.3)

From 1.1 and 1.3, we have :

$F^{\prime}(N_{a}^{i},r_{S_{A}^{1}}^{+})\sqsupseteq\ulcorner N_{a}^{i}\urcorner\sqcap F^{\prime}(N_{a}^{i},R_{S_{A}^{1}}^{-})$                       (1.4)

From 1.4, $S_{A}^{1}$ respects Theorem LTWF.                      (I)

VI-B2 Analyzing exchanged messages in $S_{A}^{2}$

1- For $N_{a}^{i}$:

a- On sending: $r_{S_{A}^{2}}^{+}=Y$

$F^{\prime}(N_{a}^{i},r_{S_{A}^{2}}^{+})$ $=$ $F^{\prime}(N_{a}^{i},Y)$

{The variable $Y$ is removed by derivation}

= $F(N_{a}^{i},\emptyset)$

{Definition 1}

= $\top$                                      (2.1)

b- On receiving: $R_{S_{A}^{2}}^{-}=\{N_{a}^{i}.X.B.Y\}_{k_{as}}$

$F^{\prime}(N_{a}^{i},R_{S_{A}^{2}}^{-})$ $=$ $F^{\prime}(N_{a}^{i},\{N_{a}^{i}.X.B.Y\}_{k_{as}})$

{The variables $X$ and $Y$ are removed by derivation}

= $F(N_{a}^{i},\{N_{a}^{i}.B\}_{k_{as}})$

{Definition 1 and since $\ulcorner k_{as}^{-1}\urcorner$ = {A, S}}

= $\{A,S,B\}$                        (2.2)

2- For $X$:

c- On sending: $r_{S_{A}^{2}}^{+}=Y$

$F^{\prime}(X,r_{S_{A}^{2}}^{+})$ $=$ $F^{\prime}(X,Y)$

{The variable $Y$ is removed by derivation}

= $F(X,\emptyset)$

{Definition 1}

= $\top$                                   (2.3)

d- On receiving: $R_{S_{A}^{2}}^{-}=\{N_{a}^{i}.X.B.Y\}_{k_{as}}$

$F^{\prime}(X,R_{S_{A}^{2}}^{-})$ $=$ $F^{\prime}(X,\{N_{a}^{i}.X.B.Y\}_{k_{as}})$

{The variable $Y$ is removed by derivation}

= $F(X,\{N_{a}^{i}.X.B\}_{k_{as}})$

{Definition 1 and since $\ulcorner k_{as}^{-1}\urcorner$ = {A, S}}

= $\{A,S,B\}$                         (2.4)

3- For $Y$:

e- On sending: $r_{S_{A}^{2}}^{+}=Y$

$F^{\prime}(Y,r_{S_{A}^{2}}^{+})$ $=$ $F^{\prime}(Y,Y)$

{Definition 1}

= $\bot$                                   (2.5)

f- On receiving: $R_{S_{A}^{2}}^{-}=\{N_{a}^{i}.X.B.Y\}_{k_{as}}$

$F^{\prime}(Y,R_{S_{A}^{2}}^{-})$ $=$ $F^{\prime}(Y,\{N_{a}^{i}.X.B.Y\}_{k_{as}})$

{The variable $X$ is removed by derivation}

= $F(Y,\{N_{a}^{i}.B.Y\}_{k_{as}})$

{Definition 1 and since $\ulcorner k_{as}^{-1}\urcorner$ = {A, S}}

= $\{A,S,B\}$                        (2.6)

4- Concordance with Theorem LTWF:

From 2.1, 2.2, we have directly:

[TABLE]

From 2.3 and 2.4 we have directly:

[TABLE]

However, from 2.5 and 2.6, we declare that:

[TABLE]

since we have no idea about the variable $Y$, thus, we have no idea about its value of security in the context (i.e. $\ulcorner Y\urcorner$ ).

From 2.9, $S_{A}^{2}$ does not respect Theorem LTWF. (II)

We abort our analysis here and we declare that the whole protocol does not respect Theorem LTWF.

VII Discussion

In our analysis, we have clearly established in 2.9 that the value of security of the variable $Y$ (which is an abstraction of the ticket $\{k_{ab}.A\}_{k_{bs}}$) goes down between the step 2 and 3 of the protocol. At this point, our witness function refused to certify the security of the protocol and flagged up a possible attack. In other words, the witness function pointed out that the variable $Y$ could fall in an intruder hands who may exploit it illegally, which is in tandem with the replay attack presented by Denning and Sacco in [16]. In fact, suppose an employee executing the first two steps of the protocol several times as a regular agent $A$ and collecting all the tickets $\{k_{ab}.A\}_{k_{bs}}$, as well as the corresponding session keys $k_{ab}$. If he is fired, as an external intruder $I$, he could still log on any server $B$ by playing the remaining steps of the protocol as follows:

[TABLE]

To sum up, the Needham-Schroeder symmetric-key protocol neglected the fact that the tickets $\{k_{ab}.A\}_{k_{bs}}$ is an important component and allowed it to circulate in clear in the step 3, which caused the described flaw to take place. This behavior is strictly forbidden in an analysis using witness functions which never allows any message component to have a non increasing value of security even if it turns out that no actual flaw could be found. However, we can understand that back to the time when the protocol was designed, a few things were known about protocols, and protocol designers mostly thought that cryptography on its own was enough to ensure their security, which turned out to be incorrect over time.

VIII Comparison with related work

The analysis of cryptographic protocols remains a constraining task [20] despite all the progress made in the field due to the complexity and undecidability of the problem [21]. Witness functions, using the general theorem or the little one, are beginning to gain ground and are proven to be a powerful means of detecting security breaches or designing correct protocols. They have outperformed other analytical tools and methods such as interpretation functions [22, 23] in terms of efficiency and accuracy [12]. The fact that these functions allow a static analysis saves a lot of effort and time compared to other dynamic methods based on Model-Checking [24] or on program logics [25], for example. With that in mind, neither the witness functions nor any other verification method will deliver its optimal protocol protection if other dimensions are neglected, especially security issues akin to the protocol implementation and encryption primitive weaknesses of the selected cryptographic system.

IX Conclusion

In this paper, we have presented a detailed analysis of the Needham-Schroeder symmetric-key protocol using the little theorem of witness functions. We have proven its ability to help detecting security vulnerabilities and inform about possible flaws. In future work, we intend to address the problem of compose protocols [26, 27] as well as E-voting protocols [28, 29, 30] using these functions.

Notations

• $\ulcorner\alpha\urcorner$: initial value of security of an atomic message $\alpha$ in a context of verification.
• $\sqcap$: minimum operator (the union in the security Lattice)
• $\sqsupseteq$: greater than operator.
• $\top$: highest value in the security Lattice (top).
• $\bot$: lowest value in the security Lattice (bottom).
• $r^{+}$: sent message in a generalized role.
• $R^{-}$: received message in a generalized role.
• $I$: intruder; $S$: honest server; $A,B,...$: principals.
• $N_{a}$: nonce belonging to $A$.
• $k_{ab}$: key shared between $A$ and $B$ (and $k_{ab}^{-1}$ its reverse form).
• ${\mathcal{A}}{(m)}$: set of all atoms of a message $m$.
• $\cal{A}_{\cal{G}}$: generalized role of an agent $A$.
• $\cal{R}_{\cal{G}}(\textit{p})$: generalized roles of the protocol $p$.
• $A$ $\longrightarrow B$ : $m$: $A$ sending a message $m$ to $B$.
• $I(A)$: intruder impersonating (playing the role of) an agent $A$.