Modelling & Analysis of Security Protocols

Peter Ryan has over 15 years experience in cryptography and mathematical modelling, computer security and formal methods, gained at GCHQ, CESG, DERA and SRI Cambridge. He is a DERA Fellow, an IMA Fellow and Chair of the Steering Committee of ESORICS. In 1999 he was awarded the title of DERA Fellow.  Steve Schneider is a Senior Lecturer in the Department of Computer Science, Royal Holloway, University of London, UK. He has published a large number of journal and conference papers in the areas of concurrency theory and security.  Michael Goldsmith is Managing Director of Formal Systems (Europe) Ltd, the company which developed the FDR tool and devised the techniques described in the book in collaboration with DERA and the University of Oxford. He is a Senior Research Fellow of Worcester College, Oxford.  Gavin Lowe is a Lecturer in Computer Science at the University of Oxford. He was responsible for discovering the attack on the Needham-Schroeder Public-Key protocol, which established the power of the current approach.   Bill Roscoe is Professor of Computing Science at the University of Oxford. He is one of the principal developers of CSP and of its application to cryptoprotocols and other aspects of computer security.

Table of Contents

0. Introduction.
Security protocols.
Security properties.
Cryptography.
Public-key certificates and infrastructures.
Encryption modes.
Cryptographic hash functions.
Digital signatures.
Security protocol vulnerabilities.
The CSP approach.
Casper: the user-friendly interface of FDR.
Limits of formal analysis.
Summary.

1. An introduction to CSP.
Basic building blocks.
Parallel operators.
Hiding and renaming.
Further operators.
Process behaviour.
Discrete time.

2. Modelling security protocols in CSP.
Trustworthy processes.
Data types for protocol models.
Modelling an intruder.
Putting the network together.

3. Expressing protocol goals.
The Yahalom protocol.
Secrecy.
Authentication.
Non-repudiation.
Anonymity.
Summary.

4. Overview of FDR.
Comparing processes.
Labelled Transition Systems.
Exploiting compositional structure.
Counterexamples.

5. Casper.
An example input file.
The %-notation.
Case study: the Wide-Mouthed-Frog protocol.
Protocol specifications.
Hash functions and Vernam encryption.
Summary.

6. Encoding protocols and intruders for FDR.
CSP from Casper.
Modelling the intruder: the perfect spy.
Wiring the network together.
Example deduction system.
Algebraic equivalences.
Specifying desired properties.

7. Theorem proving.
Rank functions.
Secrecy of the shared key: a rank function.
Secrecy on nB.
Authentication.
Machine assistance.
Summary.

8. Simplifying transformations.
Simplifying transformations for protocols.
Transformations on protocols.
Examples of safe simplifying transformations.
Structural transformations.
Case study: The CyberCash Main Sequence protocol.
Summary.

9. Other approaches.
Introduction.
The Dolev-Yao model.
BAN logic and derivatives.
FDM and InaJo.
NRL Analyser.
The B-method approach.
The non-interference approach.
Strand spaces.
The inductive approach.
Spi calculus.
Provable security.

10. Prospects and wider issues.
Introduction.
Abstraction of cryptographic primitives.
The refinement problem.
Combining formal and cryptographic styles of analysis.
Dependence on infrastructure assumptions.
Conference and group keying.
Quantum cryptography.
Data independence.

Appendix A. Background cryptography.
The RSA algorithm.
The ElGamal public key system.
Complexity theory.

Appendix B. The Yahalom protocol in Casper.
The Casper input file.
Casper output.

Appendix C. CyberCash rank function analysis.
Secrecy.
Authentication.

Bibliography.
Notation.
Index.