Reasoning about Concrete Security in
Protocol Proofs
A. Datta, J.Y. Halpern, J.C. Mitchell, R. Pucella, A. Roy
1
Motivation
We want to answer questions like:


Given a cryptographic protocol and a security property


How frequently should we refresh the keys?
How does any advance in breaking the specific cryptographic primitives used
quantitatively affect security?
We base the analysis on the known security properties of the crypto
primitives used


A protocol may use a number of different crypto primitives


How do we translate the quantitative guarantees?
How do we handle composition?
Precursor:


Computational PCL [DDMST05,DDMW06,RDDM07,RDM07]

2
Used to reason about asymptotic security

Security of signatures
Cryptographic Security


Complexity Theoretic
Concrete
Existential Unforgeability under Chosen Message Attack
vk
Adversary
mi
sigk (mi)
Challenger
k
vk : public verification key
k : private signing key
m’, sigk (m’) : m’  mi
Advantage(Adversary,) = Prob[Adversary succeeds for sec. param. ]
A signature scheme is CMA secure if
Prob-Polytime A.
Advantage (A, ) is a negligible function of 
3

Cryptographic Security

Security of signatures

Complexity Theoretic
Concrete
Existential Unforgeability under Chosen Message Attack
vk
Adversary
mi
sigk (mi)
Challenger
k
vk : public verification key
k : private signing key
m’, sigk (m’) : m’  mi
Advantage(Adversary,) = Prob[Adversary succeeds for sec. param. ]
A signature scheme is (t, q, e) - CMA secure if
 t time bounded A making at most q sig queries.
Advantage (A, ) is less than e
4
A Challenge-Response Protocol
m, A
A
n, sigB {m, n, A}
sigA {m, n, B}

Alice reasons: if Bob is honest, then:



5
only Bob can generate his signature
if Bob generates a signature of the form sigB{m, n, A},

he sends it as part of msg2 of the protocol, and

he must have received msg1 from Alice
Alice deduces: Received (B, msg1) Λ Sent (B, msg2)
B

Computational PCL
Formal Proofs

Syntax, Semantics,
Proof System
Proof system for direct reasoning


Verify (X, sigY(m), Y)  Honest (Y)  Sign (Y, m)

No explicit use of probabilities and computational complexity
No explicit arguments about actions of attackers

Semantics capture idea that properties hold with high probability against
PPT attackers




Explicit use of probabilities and computational complexity
Probabilistic polynomial time attackers
Soundness proofs one time
Soundness implies result equivalent to security proof by cryptographic
reductions

6
Axiomatizing
Security of signatures

Formal Proofs

Syntax, Semantics,
Proof System
Existential Unforgeability under Chosen Message Attack
vk
Adversary
mi
sigk (mi)
Challenger
k
vk : public verification key
k : private signing key
m’, sigk (m’) : m’  mi
Computational PCL: Verify (X, sigY(m),Y)  Honest (Y)  Sign (Y, m)
Quantitative PCL: T esig(t,q,) (Verify (X, sigY(m),Y)  Honest (Y)  Sign (Y, m))
7
Axioms and Proof Rules
where,  = esig(t,q,)
where, ’ = l()(l()+1)/2
where, Bi are basic steps of the protocol
8
m, X
X
n, sigY {m, n, X}
sigX {m, n, Y}
9
Y
Previous CPCL Results

Core logic [ICALP05]

Key exchange [CSFW06]



Reasoning about computational secrecy [ESORICS07]


New security definition: key usability
Used by Blanchet et al in CryptoVerif Kerberos proof
Application to Kerberos
Reasoning about Diffie-Hellman [TGC07]

10
Applications to IKEv2 (standard model) and DH Kerberos (random oracle
model)
Logic and Cryptography: Big Picture
Protocol security proofs using proof system
Axiom in proof system
Semantics and soundness theorem
Complexity-theoretic crypto definitions
(e.g., IND-CCA2 secure encryption)
Crypto constructions satisfying definitions
(e.g., Cramer-Shoup encryption scheme)
11
Thanks !
Questions?
12
Example Property
13
PCL: Big Picture
High-level proof principles
PCL
•Syntax (Properties)
•Proof System (Proofs)
Computational PCL
•Syntax ± 
•Proof System± 
Soundness
Theorem
Soundness
Theorem
(Induction)
(Reduction)
Symbolic Model
•PCL Semantics
(Meaning of formulas)
[BPW,
MW,…]
14
Unbounded
# concurrent sessions
Cryptographic Model
•PCL Semantics
(Meaning of formulas)
Polynomial # concurrent sessions
Fundamental Question
PCL
CPCL
Axioms and rules for reasoning Axioms and rules for reasoning
about cryptographic protocols about cryptographic protocols
(Soundness)
(Computational soundness)
First-order logic (Soundness
and completeness)
15
Conditional first-order
logic (Soundness and
??? [?]
completeness)
Towards QPCL
16
PCL
QPCL
Axioms and rules for reasoning
about cryptographic protocols
(Soundness)
Axioms and rules for quantitative
reasoning about cryptographic
protocols (Computational
soundness)
First-order logic (Soundness and
completeness)
Conditional first-order logic
(Soundness and completeness)
Protocol language
17
Conditional implication (OLD)
Implication uses conditional probability

[[1 
18
2]] (T,D,) = [[1]] (T,D,)
 [[2]] (T’,D,)
where T’ = [[1]] (T,D,)