Expressing Security Properties in CSP

	Security properties: the goals that a protocol is meant to satisfy, relatively to specific kinds and levels of threat ñ the intruders and their capabilities
	We will consider the following security properties:
		Secrecy
			No information leakage
		Authentication
			No falsification of identity
		Non-repudiation
			Evidence of the involvement of the other party
		Anonymity
			Protecting the identity of agents wrt particular events

Secrecy and authentication

	They are both safety properties: a certain bad thing should not happen
	Explicit annotations: In the CSP approach, these properties are defined by ìenhancingî the code of the processes with explicit signal claiming the success of the protocol wrt theÝ intended property
	Secrecy:ÝÝÝ Claim_secret. m
		Information m has not become known to the intruder
	Authentication:ÝÝ Run with A ,Ý Commit with B
		The matching of these two events guarrantees the identities of A and B

Secrecy and authentication

Example: The Yahalom Protocol

	The protocol
		Message 1ÝÝ a -> b : a.na
		Message 2ÝÝ b -> s : b.{a.na.nb}ServerKey(b)
		Message 3ÝÝ s -> a : {b.kab.na.nb}ServerKey(a) {a.kab}ServerKey(b)
		Message 4ÝÝ a -> b : {a.kab}ServerKey(b) .{nb}kab
	Authentication of the participants
	Kab should remain secret
	We may require secrecy also on nb

Exm: Secrecy in the Yahalom protocol

	CSP description of the two parties - Original
		Initiator(a,na ) =
		ÝÝÝ env?b: Agent
		ÝÝÝÝÝÝÝÝ g send.a.b.a.na
		ÝÝÝÝÝÝÝÝ g []Ý (receive.J.a{b. kab.na.nb}ServerKey(a) .m
		ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ kab e KeyÝÝÝÝÝÝÝÝ g send.a.b.m.{nb}kab
		ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ nb e NonceÝÝÝÝÝÝ g Session(a,b,kab,na,nb) )
		ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ m e T
		Responder(b,nb ) =
		ÝÝÝ []Ý (receive.a.b.a.na g send.b.J.b .{a.na.nb}ServerKey(b)
		Ý kab e KeyÝÝÝÝÝÝÝÝÝ g receive.a.b.{a. kab}ServerKey(b) .{nb}kab
		nb e NonceÝ g Session(b,a,kab,na,nb) )
		ÝÝÝ m e T

Exm: Secrecy in the Yahalom protocol

	CSP description of the two parties - Enhanced
	ÝÝÝ Initiatorí(a,na ) =
		ÝÝÝ env?b: Agent
		ÝÝÝÝÝÝÝÝ g send.a.b.a.na
		ÝÝÝÝÝÝÝÝ g []Ý (receive.J.a{b. kab.na.nb}ServerKey(a) .m
		ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ kab e KeyÝÝÝÝÝÝÝÝ g send.a.b.m.{nb}kab
		ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ nb e NonceÝÝÝÝÝÝ g signal.Claim_Secret.a.b. kab
		ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ m e TÝÝÝÝÝÝÝÝÝÝÝÝ g Session(a,b,kab,na,nb) )
		Responderí(b,nb ) =
		ÝÝÝ []Ý (receive.a.b.a.na g send.b.J.b .{a.na.nb}ServerKey(b)
		Ý kab e KeyÝÝÝÝÝÝÝÝÝ g receive.a.b.{a. kab}ServerKey(b) .{nb}kab
		nb e NonceÝ g signal.Claim_Secret.a.b. kab
		ÝÝ m e TÝÝÝÝÝÝÝÝÝÝÝÝÝÝ g Session(b,a,kab,na,nb) )

Exm: Secrecy in the Yahalom protocol

	CSP description of the server
		Server(J,kab ) =
		ÝÝÝ []Ý (receive.b.J.b .{a.na.nb}ServerKey(b)
		Ý A,B e AgentÝÝÝÝÝÝÝÝÝ g send.J.a. {b. kab.na.nb}ServerKey(a) .{a.kab}ServerKey(b)
		Nb ,nb e NonceÝ g Server(J,ks ) )
		ÝServer(J)ÝÝ =Ý ||| Server(J,kab )
		ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ kab e KeysServer

Exm: Secrecy in the Yahalom protocol

	CSP description of the intruder
	ÝÝÝÝ Intruder(X) = learn?m: messages gIntruder(close(X U {m})
	ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ []
	ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ say!m: X /\ messages gIntruder(X)
	Close(X) represents all the possible information that the attacker can infer from X. Typically we assume
		Ý{k,m}Ý |-Ý encript(k,m)
		{encript(k,m), k-1}Ý |-Ý m
		{Sq<x1,Ö,xn>} |- xi
		{x1,Ö,xn}Ý |-Ý Sq<x1,Ö,xn>}

Exm: Secrecy in the Yahalom protocol

	Initiatorí(Anne,nA)SÝ |||Ý Responder(Bob,nB)SÝ |||Ý Server(Jeeves)SÝ |||Ý Intruderí(f)Sí
	S = [fake,take/receive,send]
	Sí = [take.x.y/learn][fake.x.y, leak/say]

Exm: Secrecy in the Yahalom protocol

	ÝThe property to be verified:
		Signal.Claim_Secret.a.b.m e Traces(System)
		a
		not(leak.m e Traces(System) )
	As usual, this property can be verified automatically by checking the traces

Authentication

	The CSP approach is based on inserting signals:
		Running.a.bÝ (in aís protocol)
			Agent a is executing a protocol run apparently with b
		Commit.b.aÝ (in bís protocol)
			Agent b has completed a protocol run apparently with a
	Authentication is achieved if Running.a.b always precedes Commit.b.a in the traces of the system
		Weaker or stronger forms of authentication can be achieved by variations of the parameters of these signals and the constraints on them

Authentication in the Yahalom Pr.

	The Yahalom Protocol aims at providing authentication of both parties : authentication of the initiator to the responder, and viceversa
	We will analyze the two authentication properties separately
	This requires two separateÝ enhancements of the protocol

Yahalom: authentication of initiator

	CSP description of the two parties - Enhanced
	ÝÝÝ Initiatorí(a,na ) =
		ÝÝÝ env?b: Agent
		ÝÝÝÝÝÝÝÝ g send.a.b.a.na
		ÝÝÝÝÝÝÝÝ g []Ý (receive.J.a{b. kab.na.nb}ServerKey(a) .m
		ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ kab e KeyÝÝÝÝÝÝÝÝÝ g signal.Running_Initiator.a.b.na.nb.kab
		ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ nb e NonceÝÝÝÝÝÝÝÝÝ g send.a.b.m.{nb}kab
		ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ m e TÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ g Session(a,b,kab,na,nb) )
		Responderí(b,nb ) =
		ÝÝÝ []Ý (receive.a.b.a.na g send.b.J.b .{a.na.nb}ServerKey(b)
		Ý kab e KeyÝÝÝÝÝÝÝÝÝ g receive.a.b.{a. kab}ServerKey(b) .{nb}kab
		nb e NonceÝ g signal. Commit_Responder.b.a.na.nb.kab
		ÝÝ m e TÝÝÝÝÝÝÝÝÝÝÝÝÝÝ g Session(b,a,kab,na,nb) )

Yahalom: authentication of initiator

Yahalom: authentication of initiator

	The property to be verified:
	signal. Running_Initiator.a.b.na.nb.kab
	precedes
	signal.Commit_Responder.b.a.na.nb.kab
	in all the Traces(System)
	Again, this property can be verified automatically by checking the traces

Yahalom: authentication of responder

	CSP description of the two parties - Enhanced
	ÝÝÝ Initiatorí(a,na ) =
		ÝÝÝ env?b: Agent
		ÝÝÝÝÝÝÝÝ g send.a.b.a.na
		ÝÝÝÝÝÝÝÝ g []Ý (receive.J.a{b. kab.na.nb}ServerKey(a) .m
		ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ kab e KeyÝÝÝÝÝÝÝ g send.a.b.m.{nb}kab
		ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ nb e NonceÝÝÝÝÝÝÝ gÝÝÝ signal.Commit_Initiator.a.b.na.nb.kab
		ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ m e TÝÝÝÝÝÝÝÝÝÝÝÝÝ g Session(a,b,kab,na,nb) )
		Responderí(b,nb ) =
		ÝÝÝ []Ý (receive.a.b.a.na g send.b.J.b .{a.na.nb}ServerKey(b)
		Ý kab e KeyÝÝÝÝÝÝÝÝÝ g signal. Running_Responder.b.a.na.nb
		nb e NonceÝ g receive.a.b.{a. kab}ServerKey(b) .{nb}kab
		ÝÝÝ m e TÝÝÝÝÝÝÝÝÝÝÝÝÝÝ g Session(b,a,kab,na,nb) )

Yahalom: authentication of responder

Yahalom: authentication of responder

	The property to be verified:
	signal. Running_Responder.b.a.na.nb
	precedes
	signal.Commit_Initiator.a.b.na.nb.kab
	in all the Traces(System)
	Again, this property can be verified automatically by checking the traces

Non-repudiation

	Goal: provide the parties of an interaction with evidence so that later they cannot deny having participated
	Example: The Zhou-Gollmann protocol
		Message 1ÝÝ a -> b :Ý {fNRO .b.l.c}Ska
		Message 2ÝÝ b -> a :Ý {fNRR .a.l.c}Skb
		Message 3ÝÝ a -> j :Ý {fSUB .b.l.k}Ska
		Message 4ÝÝ b <-> j :Ý {fCON .a.b.l.k}Skj
		Message 5ÝÝ a <-> j :Ý {fCON .a.b.l.k}Skj
		c = k(m) where m is the message to be transmitted
		a and b are the parties, j is the trusted server
		fNRO , fNRR, etc. are flags identifying the steps. l is a nonce
		Ska, Skb, etc. are signature keys known only to their owners
	a can prove that b has got the message by presenting
	{fNRR .a.l.c}SkbÝ andÝ Ý{fCON .a.b.l.k}Skj

The Zhou-Gollmann protocol

	Non-Repudiation of Recipient: a can prove that b has got the message by presenting
	{fNRR .a.l.c}SkbÝ andÝ Ý{fCON .a.b.l.k}Skj
	Non-Repudiation of Origin: b can prove that a has sent the message by presenting
	{fNRO .b.l.c}SkaÝ andÝ Ý{fCON .a.b.l.k}Skj

CSP analysis of Non-Repudiation

	Specification of the Zhou-Gollmann protocol in CSP
	Agenta(S) =
	ÝÝ [] b e Agent, m e SÝ send.a.b.m -> Agenti(S)
	ÝÝ []Ý receive.a.b?m -> Agenta(close(S U {m}))
	ÝÝ [] ftp.a.Jeeves?m -> Agenta(close(S U {m}))
	ÝÝ [] m e S evidence.a.m -> Agenti(S)
	Close(S) represent the capability of inferring new information
	Server(S) =
	ÝÝ receive.a.Jeeves?. {fSUB .b.l.k}Ska
	ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ -> Server(S U {fCON .a.b.l.k}Skj)
	ÝÝÝ [] b e Agent, m e S ftp.a.Jeeves.m -> Server(S)

The Zhou-Gollmann protocol in CSP

Analysis of the Zhou-Gollmann protocol

	Non-Repudiation of Recipient:
	evidence.a.{fNRR .a.l.c}SkbÝ in TrÝ a b sent (fNRR .a.l.c)
	evidence.a.{fCON.a.b.l.k}Skj in TrÝ a receive.a.j. {fCON .a.b.l.k}Skj in Tr
	Non-Repudiation of Origin:
	evidence.b.{fNRO .b.l.c}Ska in TrÝ a a sent (fNRO.b.l.c)
	evidence.b.{fCON.a.b.l.k}Skj in TrÝ a a sent (fSUB.b.l.k)
	Again, these properties on traces can be proven automatically