钟姑矣坌邑栽傩僮.PDFVIP

Zero-Knowledge in the Applied Pi-calculus and Automated Verication of the Direct Anonymous Attestation Proto col Michael Backes, Matteo Maei, and Dominique Unruh Saarland University, Saarbrücken, Germany {b ack es ,maffe i ,unruh }@c s .uni- s b .de Abstract We devise an abstraction of zero-knowledge proto cols that is accessible to a fully mechanized analysis. The abstraction is formalized within the applied pi-calculus using a novel equational theory that abstractly characterizes the cryptographic se- mantics of zero-knowledge pro ofs. We present an enco ding from the equational theory into a convergent rewriting system that is suitable for the automated proto- col verier ProVerif. The enco ding is sound and fully automated. We successfully used ProVerif to obtain the rst mechanized analysis of the Direct Anonymous At- testation (DAA) proto col. The analysis in particular required us to devise novel abstractions of sophisticated cryptographic security denitions based on interactive games. 1 Intro duction Pro ofs of security proto cols are known to b e error-prone and, owing to the distributed- system asp ects of multiple interleaved proto col runs, awkward to make for humans. In fact, vulnerabilities have accompanied the design of such proto cols ever since early au- thentication proto cols like Needham-Schro eder [11 , 24 ], over carefully designed de-facto standards like SSL and PKCS [28, 8 ], up to current widely deployed pro ducts like Mi- crosoft Passp ort [13 ] and Kerb eros [10]. Hence work towards the automation of such pro ofs has started so on after the rst proto cols were develop ed; some imp ortant exam- ples of automate