We demonstrate that for any well-defined cryptographic protocol, the symbolic trace reachability problem in the presence of an Abelian group operator (e.g., multiplication) can be reduced to solvability of a decidable system of quadratic Diophantine equations. This result enables complete, fully au tomated formal analysis of protocols that employ primitives such as Diffie–Hellman exponentiation, multiplication, and xor, with a bounded number of role instances, but without imposing any bounds on the size of terms created by the attacker.

We demonstrate that for any well-defined cryptographic protocol, the symbolic trace reachability problem in the presence of an Ahelian group operator (e.g., multiplication) can be reduced to solvab...

We demonstrate that for any well-defined cryptographic protocol, the symbolic trace reachability problem in the presence of an Abelian operator (e.g., multiplication) can be reduced to solvability of a particular system of quadratic Diophantine equations. This result enables formal analysis of protocols that employ primitives such as Diffie-Hellman exponentiation, products, and xor, with a bounded number of role instances, but without imposing any bounds on the size of terms created by the attacker. In the case of xor, the resulting system of Diophantine equations is decidable. In the case of a general Abelian group, decidability remains an open equation, but our reduction demonstrates that standard mathematical techniques for solving systems of Diophantine equations are sufficient for the discovery of protocol insecurities.

The reachability problem for cryptographic protocols with non-atomic keys can be solved via a simple constraint satisfaction procedure.

We develop a systematic proof procedure for establishing secrecy results for cryptographic protocols. Part of the procedure is to reduce messages to simplified constituents, and its core is a search procedure for establishing secrecy results. This procedure is sound but incomplete in that it may fail to establish secrecy for some secure protocols. However, it is amenable to mechanization, and it also has a convenient visual representation. We demonstrate the utility of our procedure with secrecy proofs for standard benchmarks such as the Yahalom protocol. 1

The concept of non-interference seeks to characterize the absence of information flows through a computer system. The intuition is startlingly simple. Suppose that we want to assert that no information may flow from user A to user B via the system S. We characterize this by asserting that B’s view of S is unchanged by any alteration in A’s behaviour. It is thus asserting that A can have no causal influence on B’s interactions with and observations of the system. Non-interference is such a simple and obvious characterization of MLS confidentiality that the security community is understandably reluctant to give it up. However, it has well known problems. First, in real systems high-level input interferes with low-level output all the time. High-level files can be encrypted, sanitized, or simply downgraded and sent on their way over low-level networks. Second, after fifteen years of trying, we still don’t have any consensus as to what is the “correct” nondeterministic formulation of it. Nondeterministic versions tend to be too weak (e.g., Nondeducibility), too strong (e.g., Noninference), too cumbersome (e.g., PNI and AFM), too limiting (e.g., the Roscoe, Woodcock, Wulf determinism approach) too Baroque (e.g., Restrictiveness), or some combination of the five. In [2] it is argued that, in a process algebraic setting, the characterization of non-interference reduces to characterizing the equivalence of certain processes. This in turn is a fundamental and difficult question of theoretical computer science and one to which there is no universally agreed answer. Thus it is not even clear whether a “correct”, Platonic notion of secrecy actually exists. Non-interference would seem to be a fundamental notion in information security. It could be argued that, if we cannot get the specification and verification of the absence of information flows right, we really don’t understand the foundations of our subject. On the other hand, it is such an abstract formulation that it seems remote from real concerns of security managers, policy makers and the developers of secure systems. Most “real” security policies are concerned with specifying who has access to what resources under what circumstances. Non-interference is never mentioned. Furthermore, non-interference is in practice impossible to realise in any real system: contention for resources etc render it infeasible. Even the so-called One-WayRegulators (e.g. the NRL Pump) allow some downward flow, albeit of low channel capacity. The study of non-interference arose from the need to understand why covert channels were possible, at a time when the only theoretical security models were access-control models, which were unable to explain them. The first wave of responses consisted of information flow models, which used the syntactic structure of statements to recognize possible flows, such as “indirect flow” from the condition of an if-then statement to variables that might be modified in its body. These models were found to overestimate flows. The second wave of models were the deterministic non-interference models, which were based on the notion of functional dependency. These models explained some covert channels, and found flows only where they really existed. Subsequent varieties of models found more channels by allowing for nondeterminacy in the computer system model, either “possibilistic” or probabilistic, and still other models addressed desirable features like composability. What’s wrong with these models? This question could be addressed at several levels. At the policy level, it has been suggested that no one cares about covert channels anymore, therefore models that purport to explain them are uninteresting. This does not really seem to be a valid response. There may be a shift in application areas, however. There is less emphasis in the design of multilevel operating systems, but more interest in something like the Bleichenbacher attack on the PKCS #1 cryptographic protocol standard [1], where a channel that is due partly to the algorithm and partly to the protocol design leads to compromise of encrypted data. Attacks that might expose a stored key are of great concern. The basic principles of information compromise still apply. There is also the practical question of how noninterference theory can be translated into efficient algorithms for detecting covert channels. Non-interference anal-

We consider scalable certificate revocation in a public-key infrastructure (PKI). We introduce depender graphs, a new class of graphs that support efficient and fault-tolerant revocation. Nodes of a depender graph are participants that agree to forward revocation information to other participants. Our depender graphs are k-redundant, so that revocations are provably guaranteed to be received by all non-failed participants even if up to k−1 participants have failed. We present a protocol for constructing k-redundant depender graphs that has two desirable properties. First, it is load-balanced, in that no participant need have too many dependers. Second, it is localized, in that it avoids the need for any participant to maintain the global state of the depender graph. We also give a localized protocol for restructuring the graph in the event of permanent failures.

We consider scalable certificate revocation in a public-key infrastructure (PKI). We introduce depender graphs, a new class of graphs that support efficient and fault-tolerant revocation. Nodes of a depender graph are participants that agree to forward revocation information to other participants. Our depender graphs are k-redundant, so that revocations are provably guaranteed to be received by all nonfailed participants even if up to k \\Gamma1 participants have failed. We present a protocol for constructing k-redundant depender graphs that has two desirable properties. First, it is load-balanced, in that no participant need have too many dependers. Second, it is localized, in that it avoids the need for any participant to maintain the global state of the depender graph. We also give a localized protocol for restructuring the graph in the event of permanent failures. 1. INTRODUCTION Public keys and their certificates eventually become invalid. Most certificates have an expiration dat...

For purposes of security analysis, cryptographic protocols can be translated from a high-level message-list language such as CAPSL into a multiset rewriting (MSR) rule language such as CIL. The natural translation creates two rules per message or computational action. We show how to optimize the natural rule set by about 50% into a form similar to the result of hand encoding, and prove that the transformation is sound because it is attack-preserving, and unique because it is terminating and confluent. The optimization has been implemented in Java.

In the real world, insurance is used to mitigate financial risk to individuals in many settings. Similarly, it has been suggested that insurance can be used in distributed systems, and in particular, in authentication procedures, to mitigate an individual's risks there. We further explore the use of insurance for public-key certificates and other kinds of statements. We also describe an application using threshold cryptography in which insured keys would also have an auditor involved in any transaction using the key, allowing the insurer better control over its liability. We provide a formal yet simple insurance logic that can be used to deduce the amount of insurance associated with statements based on the insurance associated with related statements. Using the logic, we show how trust relationships and insurance can work together to provide confidence.

Inductive proofs of secrecy invariants for cryptographic protocols can be facilitated by separating the protocol dependent part from the protocol-independent part. Our secrecy theorem encapsulates the use of induction so that the discharge of protocol-specific proof obligations is reduced to first-order reasoning. Also, the verification conditions are modularly associated with the protocol messages. Secrecy proofs for Otway-Rees (1987) and the corrected Needham-Schroeder protocol are given.

Survivable systems are modelled abstractly as collections of services supported by any of a set of configurations of components. Reconfiguration to restore services as a result of component failure is viewed as a kind of "flow" analogous to information flow. We apply C. Meadows' (1990) theorem on datset aggregates to characterize the maximum safe flow policy for distributed systems. For reconfiguration, safety means that services are preserved and that that reconfiguration rules may be stated and applied locally, with respect to just the failed components.

Covert channels emerged in mystery and departed in confusion. Covert channels are a means of communication between two processes that are not permitted to communicate, but do so anyway, a few bits at a time, by affecting shared resources. Information hiding is slightly different: the two communicating parties are allowed to talk, but the content is censored and restricted to certain subjects. The trick is to "piggyback" some contraband data invisibly on the legitimate content. The canonical example of this is to use the low-order two bits of each pixel in a picture for your secret message, since no one would notice if they were changed. When a similar idea was applied to smuggle information in network headers, we called it a network covert channel, mostly because the term "information hiding" hadn't been invented yet. The article traces the history of covert channel modeling from 1980 to the present (1999).

Many techniques for protocol analysis use term replacement rules to express the reduction properties of symbolic encryption operations. Some approaches must solve equations in those operators, using sequences of narrowing steps. It is shown that every infinite sequence of narrowing steps for popular abstract encryption operators has a loop, and hence there is a terminating algorithm to solve such equations by searching all sequences of narrowing steps.

CAPSL is a formal language for expressing authentication and key-exchange protocols. It is intended to capture enough of the abstract features of these protocols to perform an analysis for protocol failures. The impetus for such a language grew out of project work in protocol analysis. A common protocol specification language seems necessary to bridge the gap between the typical informal presentations of protocols given in papers and the precise characterizations required to conduct formal analysis. It is hoped that proponents of different analysis techniques will offer algorithms for compiling this language into whatever form they require. Doing so will go a long way toward ensuring that the assumptions made by different techniques, as well as the analysis results, are comparable. Since Denning and Sacco published a replay attack on the Needham-Schroeder protocol in 1981, it has been welI known that protocols for exchanging cryptographic keys over data networks can be vulnerable to message modification attacks. The abundance of flaws in published protocols led to the development of formal techniques for their security aualysis. The proposed techniques, as represented by some of the earlier papers on the subject, include the use of goal-directed state search tools implemented in Prolog, the application of general purpose specification and verification tools, a specially-designed logic of belief, and the application of a model-checking tool for CSP specifications. It has become evident that it was difficult for analysts other than the developers of the various techniques to apply them. One reason for this difficulty is the fact that the protocols had to be m-specified for each technique, and it was not easy to transform the published description of the protocol into the required formal system. Some tool developers began work on translators or compilers that would perform the transformation automatically. The input to any such translator still requires a formally-defined language, but it can be made similar to the message-oriented protocol descriptions that are typically published. Besides our initial work on CAPSL for the Interrogator at MITRE, there were independent efforts by Steve Brai and Gavin Lowe, with a similar language, CASPER, for the application of FDR using a CSP model-checking approach. The idea of having a single common protocol specification language that could be used as the input format for any formal analysis technique was first presented at the 1996 Isaac Newton Institute Programme on Computer Security, Cryptology, and Coding Theory. The design of CAPSL is still in progress. Current documentation for the language, and discussions on design alternatives and extensions, may be found at the CAPSL home page on the World-Wide Web, at the URL http:// www.mitre.org/research/capsI.

The Interrogator is a protocol security analysis tool implemented in Prolog and based on a communicating-machine message transformation model with message modification threats. It supports a large and extendible class of symbolic encryption and data transformation operators with a novel equation-solving approach in the context of equational theories. The operator representation and equation-solving capability has a simple interface to the protocol and threat model.>

A state-machine formulation is given for forward correct ability in event systems, to provide a type of unwinding result for this information flow security property. We show also how regular expression notation provides an easy mechanical tool for ve

A state-machine formulation is given for forward correctability in event systems, to provide a type of unwinding result for this information flow security property. We show also how regular-expression notation provides an easy mechanical tool for verifying forward correctability for small systems, which is necessary for the effective presentation of examples and exercises.>

A denial-of-service protection base is characterized as a resource monitor closely related to a TCB, supporting a waiting-time policy for benign processes. Resource monitor algorithms and policies can be stated in the context of a state-transition mo

A denial-of-service protection base (DPB) is characterized as a resource monitor closely related to a TCB, supporting a waiting-time policy for benign processes. Resource monitor algorithms and policies can be stated in the context of a state-transition model of a resource allocation system. Probabilistic waiting-time policies are suggested in addition to the finite- and maximum-waiting-time policies. The model supports concurrency, multiprocessing and networking. A simple example of a DPB is given, as a feasibility and consistency check on the definitions.>

A design approach for a secure multilevel object-oriented database system is proposed by which a multilevel object-oriented system can be implemented on a conventional mandatory security kernel. Each object is assigned a single security level that applies to all its contents (variables and methods). The informal security policy model includes properties such as compatibility of security level assignments with the class hierarchy. After discussing the essential features of a general object system model, and then extending the object model to incorporate mandatory label-based security, it is shown how typical database security and integrity policies can be supported by this model, with special attention to inference problems and integrity constraints. The representation of integrity constraints and classification constraints are illustrated.>

The author further delineates and improves the evidence that nondeducibility on strategies is a respectable candidate for a definition of security against information compromise, at least for the class of systems that can be modeled as synchronized state machines. First, the author confirms the thesis of J.T. Wittbold and D.M. Johnson (1990) that nondeducibility on strategies is stronger than the notion of nondeducibility on inputs, defined by D. Sutherland (1986), which is generally viewed as a minimum requirement for security. Second, it is shown that nondeducibility on strategies is preserved when two machines that are secure by this definition are hooked up arbitrarily, even when loops are created by the interconnection. In order to make these more general hookups possible, it is necessary to generalize the definition of a synchronized state machine.>

Covert channels in a multilevel secure computer system can be exploited by malicious software to compromise information. The maximum information rate of a known channel is determined by modeling the channel as a communications channel and calculating its capacity. The capacity of an important class of covert channels, finite-state noiseless channels with nonuniform transition times, is found by adapting a technique suggested by Shannon (1964).>

Techniques for detecting covert channels are based on information flow models. This paper establishes a connection between Shannon's theory of communication and information flow models, such as the Goguen-Meseguer model, that view a reference monitor as a state-transition automaton. The channel associated with a machine and a compromise policy is defined, and the capacity of that channel is taken as a measure of covert channel information rate.

The Interrogator is a Prolog program that searches for security vulnerabilities in network protocols for automatic cryptographic key distribution. Given a formal specification of the protocol, it looks for message modification attacks that defeat the protocol objective. It is still under developement, but is has been able to rediscover a known vulnerability in a published protocol. It is implemented in LM-Prolog on a Lisp Machine, with a graphical user interface.

Computer networks employ encryption several purposes, including private communication, message authentication, and digital signatures. The correctness and security of these applications depend not only on the strength the cryptographic algorithms, but also on the procedures for key management.

An optimization problem exists in the context of local area network security. The network provides a number of physical or logical "channels", each carrying a set of levels or compartments of information. A channel is accessible to users cleared for all the levels it carries. The problem is to assign the set of levels to be carried by each channel so as to minimize the total number of channels, under the constraint that each pair of users with a level in common can communicate over some channel. This problem was found to be equivalent to a known NP-complete problem, the set basis problem.The main result is an approximate algorithm that runs in polynomial time and finds one solution. It has succeeded in finding an optimal solution in all of the test cases small enough to confirm the optimality independently.

A security kernel is that part of operating system software responsible for controlling access to files and other resources. This report gives a paradigm for showing that a kernel can protect itself from destruction or tampering by user software, on the basis of the hardware and kernel software properties. An illustrative proof is carried out for DEC PDP-11 /70 hardware, with kernel properties that would be typical for this machine.

A method is given to enumerate the flows between variables in systems specified in a non-procedural language. It finds all flows that would exist according to a deductive theory of information flow. It is presented in the form of an attribute grammar for the specification language. The effect of system invariants is discussed.

The confinement problem is how to constrain untrusted software in such a way that information made available to it is not passed along to unauthorized indi viduals. One type of attack on this problem is to have the supervisor or operating system control all memory accesses according to a suitable policy. The security kernel is that part of an operating system or supervisor whose correctness is supposed to be sufficient for the desired protection.

The parallel derivative of a set of strings is introduced. Given a serial, repetition-free parallel program schema, its closure is constructed by taking parallel derivatives of its set of computations. The construction resembles the construction of a state diagram from a regular expression by means of derivatives.