ModelCheckingforSecurity.pptVIP

Model Checking for Security Anupam Datta CMU Fall 2007-08 Logistics Scribing Notes due a week after the lecture Sign-up! Blackboard access for people who are auditing, but are not officially enrolled: send email to Joe Homework 1 is out; due Sept 18 before class Project discussion: Sept 18, 20 (Tue-Th): 4:30-6PM in CIC 2118 Sign up for slots (15 min per group) This Lecture Model checking overview Model checking security protocols using Murphi Example: Needham-Schroeder public key protocol Note: More on Murphi this Friday HW1 will use Murphi; possibly projects Model Checking: Basics Model the system Set of states + Start state Transition relation between states Specify properties Special case: Invariants (properties that are true in all states) Model checking Check that every reachable state in the graph satisfies the invariants Graph search done using BFS or DFS Model Checking: Issue State space explosion The number of reachable states quickly blows up Techniques to combat problem Symmetry reduction Partial order reduction Symbolic representation of transition relation … Model checking security protocols Many tools (see “Tools” page on course web page) Murphi – Explicit state model-checker Authentication, key exchange protocols PRISM – Probabilistic model checker Protocols for anonymity MOCHA – Game properties specified in ATL and ATL* Contract signing protocols AVISPA – Specialized symbolic model checker for security protocols Authentication, key exchange Explicit intruder model Example: Needham-Schroeder Famous simple example Protocol published and known for 10 years Gavin Lowe discovered unintended property while preparing formal analysis using FDR system Subsequently rediscovered by every analysis method Needham-Schroeder Crypto Nonces Fresh, random numbers Public-key cryptography Every agent A has Public encryption key Ka Private decryption key Ka-1 Main properties Everyone can encrypt message to A Only A can decrypt these messages N