Logical Analysis and Verification of Cryptographic Protocols - Loria

1.5. CONTRIBUTIONS AND PLAN OF THIS THESIS 15
1.5 Contributions and plan of this thesis
In this thesis, we relax the perfect cryptography hypothesis by taking into account
some algebraic properties of cryptographic primitives that we formulate
by equations. We follow the symbolic approach to analyse security protocols,
and in particular, the approach based on the resolution of constraint systems. To
this end, we formulate the capacity of the intruder by deduction rules, and the
verification task of the protocol by a reachability problem. The latter is the problem
of determining if a certain (finite) parallel program which models the protocol
and the specification can reach an erroneous state while interacting with
the environment. We provide decision procedures for the reachability problem
in presence of several algebraic operators.
In Chapter 2, we give the basic notions and definitions we use in the most
of this thesis. We define the constraint systems, and reachability problem. These
notions have been initially introduced by J. Millen and V. Shmatikov [156], but
as defined there, they are not adequate for the non empty equational theories.
We actually follow the definitions introduced by Y. Chevalier and M. Rusinowitch
[73] who generalised the initial definitions of [156] in order to capture non
empty equational theories. We show how protocols are modeled in a high specification
language, and we show how to reduce the insecurity problem of cryptographic
protocols to the satisfiability problem of constraint systems. Several
works follow this approach [156, 87, 73, 72].
1.5.1 Decidability results in presence of algebraic operators
Chapter 3: Analysis of protocols with collision vulnerable hash functions.
In Chapter 3, we consider the class of cryptographic protocols that use collision
vulnerable hash functions. The collision vulnerability property for a hash
function means that one can construct two different messages having the same
hash value. We remark that only a few years ago, it was intractable to compute
collisions on hash functions, so they were considered to be collision resistant
by cryptographers, and collision was considered to be a possible attack on hash
functions only from the nineties when collision attacks have been proved and
showed by several ressearchers [98, 103, 199, 201]. Examples of collision vulnerable
hash functions are “MD5” and “SHA-0”.
In this chapter, we symbolically represent how the intruder may compute
collisions on hash functions. We then reduce the insecurity problem of our class
of cryptographic protocols to the ordered satisfiability problem for the intruder
using the collision vulnerability property of hash functions when attacking a
protocol execution. The ordered satisfiability problem is a variant of the satisfiability
problem presented in Chapter 2. It was initially introduced by Y. Chevalier
et al. [72]. Roughly following the results obtained in [74], we conjecture that