Logical Analysis and Verification of Cryptographic Protocols - Loria

Chapter 4
Analysis of protocols with
vulnerable digital signature schemes
The idea of digital signature schemes first appeared in W. Diffie and
M.E. Hellman’s seminal paper [101]. Digital signatures have many
applications in information security, including authentication, data
integrity, and non-repudiation. In [117], the authors showed the
different flaws of digital signature schemes. Furthermore, the authors
defined what is a secure digital signature scheme: a digital signature
scheme is considered to be secure if it is existential unforgeable
against adaptative chosen message attacks. Unfortunately, while this
security notion is adequate to the single-user setting, it is not adequate
for the multi-user setting [152]. In this chapter, we are interested
by the security of signature schemes in the multi-user setting, and
to this end, we consider two properties of digital signature schemes:
the constructive exclusive ownership vulnerability property and the destructive
exclusive ownership vulnerability property. We show the decidability
of the insecurity problem for two classes of cryptographic
protocols where the signature schemes employed have respectively
these two properties. This result has been published in the proceedings
of FSTTCS 2007 conference [66].
Outline. In Section 4.1 we present the signature schemes, in Section
4.2 we define the constructive exclusive ownership vulnerability property
(also called duplicate-signature key selection property), and the destructive
exclusive ownership vulnerability property is defined in Section 4.3.
In Section 4.4, we define the symbolic model of these two perperties
(Section 4.4.1 and Section 4.4.2), we prove the decidability of HDSKS
and HDEO unifiability problems (Section 4.4.3), and we prove the decidability
of IDSKS and IDEO reachability problems (Section 4.4.5).
81