A review of Proverif as an automatic security protocol verifier

The exact capabilities of the attacker are modelled according to the threat
model as proposed by Dolev and Yao, which is known as the Dolev-Yao threat
model [21]. In short, this amounts to the following three assumptions:
– Encryption schemes are perfect - no keys leak from the key infrastructure,
the encrypted messages are unretrievable without the key, everybody has
access to all public keys.
– The parties in the network can perform the encryption and decryption operations
themselves - they do not require an external party to perform these
tasks for them.
– The attacker assumes the role of an ‘active adversary’. More precisely, he
can intercept and read any message that is sent on the network and inject
any message that contains information he knows through previous actions.
When studying the accuracy of a tool for assessing security properties, it is
common to discuss the specificity and the sensitivity 5 of the tool. The specificity
is the extent to which the tool is able to declare that no attacks exist for a
protocol that indeed does not allow attacks, i.e. to prevent false positives. The
sensitivity is the ability of the tool to correctly recognize insecure protocols. In a
security context, it is clear that a high sensitivity is more important than a high
specificity. After all, we would rather have a hundred false positives reported
on our protocol than one potential attack that goes unnoticed. However, the
usability of the tool greatly depends on both the sensitivity and the specificity.
If a tool always reports that an attack exists, it would be prudent, yet not very
useful. In ProVerif, certain assumptions and abstractions are introduced. All of
these, however, only give more power to the attacker, thereby at most raising the
number of false positives, yet never missing an attack that is indeed legitimate.
For a discussion of approximations in ProVerif, see subsection 4.1.
The algorithm behind ProVerif always terminates. This is not guaranteed automatically,
but measures have been taken to assure its termination. The most
notable of these measures is the limitation to the depth of the nesting of terms
in protocol messages. If a message exceeds this limit, the message is replaced by
a new variable. Like the other approximations, this does lessen the sensitivity,
since any attack that exists in the non-limited case still exists in the depthlimited
case.
ProVerif is released under the GNU GPL 6 , which means that the source code
of the program is freely available on the web. Works derived from the source
of ProVerif must also be licensed under the GNU GPL. For such a program,
this can be a great incentive for potential new users, since they can check the
validity of the implementation. Second, it becomes possible to write additions
and extensions for ProVerif.
5
These terms are frequently used in the medical world. A further explanation in that
context can be found at [31].
6
GNU General Public License version 2, see for more details http://www.gnu.org/
licenses/gpl-2.0.html.