Solving the insecurity problem for assertions

Symbolic analysis of security protocols is a long-standing field of study, with the Dolev-Yao model [22] being the standard. In this model, cryptographic operations are abstracted as operators in a term algebra, and the ability to build new messages from old ones is specified by rewrite rules or a proof system. The model includes an intruder who controls the network, and can see, block, inject, redirect, as well as derive terms, but cannot break cryptography. Informally, protocols are specified as a finite sequence of communications between principals/agents. We now illustrate this model using an example.

Is there any execution of this protocol at the end of which the intruder can derive $m$? This property is called confidentiality. In fact, the intruder can effect the following man-in-the-middle attack, at the end of which $A$ thinks $m$ is secret between her and $B$, while $B$ thinks $m$ is secret between him and $I$. $B$ receives a message where $x$ can be matched with $\mathit{pk}(k_{I})$ and $y$ with $m$, and thus sends out $\{m\}_{\mathit{pk}(k_{I})}$.

The Dolev-Yao model and its extensions have been studied extensively over the last forty years. People have studied extensions that express richer classes of protocols and security properties [1, 10, 7, 17], and associated decidability and complexity results [12, 8, 16, 15, 30, 18, 36, 37, 23, 9, 14, 2, 20]. Various verification tools have also been built based on these formal models [21, 10, 11, 33, 13].

In this paper, we consider an extension introduced in [35], which gives agents the power to communicate terms as well as logical formulas about them. These formulas, called assertions, involve equality of terms, existential quantification, conjunction, and disjunction. For instance, we can reveal partial information about some encrypted term $\{m\}_{k}$ to a recipient who does not know the key $k$ (for instance, that the value of $m$ is either $0$ or $1$, without revealing which) by sending the assertion $\exists{x}{y}\bigl{[}\{x\}_{y}=\{m\}_{k}\ \wedge\ x\in\{0,1\}\bigr{]}$. So we see that assertions allow us to model protocols that involve some kinds of certification. Traditionally, such certification is often modelled using zero-knowledge proofs.

The Dolev-Yao model can also be extended with a special class of zero-knowledge terms [7, 6]. But in these extensions, one important component is missing: logical reasoning over certificates. This is especially important in situations where certificates communicate partial information. For example, two partial-information certificates of the form $x\in\{0,1\}$ and $x\in\{0,2\}$ can lead to the inference of strictly greater information, namely $x=0$, potentially violating some security guarantees. This is one of the main features of the model in [35]. Making “assertions”, as that paper refers to such logical statements, first-class citizens provides a threefold advantage: a more transparent specification of protocols which captures design intent better, the ability to explicitly reason about certificates and thus analyze protocols more precisely, and the ability to state some security properties more easily. In [35], the authors express examples (the FOO [24] and Helios [3] e-voting protocols) and specify security properties using assertions. We describe the modelling of the FOO protocol in detail in Section 2.3.

In [35], any communicated assertion is “believed” by the recipients. One way to implement this feature is to communicate a zero knowledge proof of the assertion. But formally, we send the assertion itself rather than a term standing for a zero-knowledge proof, which also allows us the possibility of choosing other implementations for the assertion. Another way in which [35] differs from other modelling using ZKP terms is that these proofs need not be built ab initio every time. One can compose a new proof by combining existing proofs. These can be implemented using composable ZKPs [26]. These issues have been discussed in [31], which considers a logical language with conjunction and existential quantification and modular construction of ZKPs for these formulas. However, unlike [31], assertions also allow “destructive reasoning” from existing knowledge via elimination rules.

The main focus in this paper is to solve an interesting technical problem in our model with assertions – the insecurity problem for finitely many sessions.

The attack on Example 1 indicates that even for simple protocols, one needs to consider non-trivial scenarios to detect security violations. A canonical problem of interest is the insecurity problem, which asks if a given protocol admits a run that leaks a secret to the intruder. A run is characterized by an interleaving of protocol roles ($A$ and $B$ in Example 1), with a substitution for the variables in messages received by agents during these roles. There can be infinitely many such substitutions, i.e. a potentially infinite number of executions, and thus, the insecurity problem is undecidable in general [4, 23, 27]. In [38], the authors consider a restricted set of runs, and show that the insecurity problem is in NP when one considers at most $K$ sessions, for some fixed $K$.

Even with only a finite number of sessions, the intruder can inject arbitrarily large terms in place of variables. Thus, there is no bound on the size of terms encountered in a run. The work in [38] gets around this complication by showing that if there is any attack at all given by an interleaving of roles and a substitution, there is an attack given by the same interleaving and a ‘small’ substitution. This “new” attack is such that the intruder can derive the same terms at the end, and the size of all messages transmitted is bounded by a polynomial in the size of the protocol specification. Hence the insecurity problem with boundedly many sessions can be solved in NP.

As with terms, one can formulate the insecurity problem for assertions as well. The general problem continues to be undecidable, so we consider the case of finitely many sessions. With existential quantification, we now have two types of variables – those used to identify parts of received messages (instantiated at runtime by the actual message sent by the intruder), and quantified variables that occur in assertions. As earlier, there is no a priori bound on the size of terms assigned to the first kind of variables. But there is another source of unboundedness: to derive a quantified assertion $\exists{x}.~{}\alpha$, one must derive $\alpha(t)$ for some “witness” $t$. There is no a priori bound on the size of $t$ either, and proof search is further complicated by any potential interaction between these two sources of unboundedness. When we simulate a substitution for the “intruder” variables with a small one, the witnesses for quantifiers might change too, but we still need to preserve some derivations under these new witnesses.

We extend the techniques of [38], while considering interactions between multiple substitutions and having to preserve more complex derivations, to obtain a somewhat surprising result. In this paper, we show that the insecurity problem for assertions for finitely many sessions remains in NP.

There are many extensions of the basic Dolev-Yao model that aim to capture various cryptographic operators and their properties [2, 8, 15, 16, 17, 20, 30]. Algebraic properties of operators like xor, blinding, distributive encryption etc. are studied by means of equation theories, which are also referred to as intruder theories in the security literature. Equations in these theories are implicitly universally quantified, and the intention is that any term matching one side of the equation may be replaced by the other side. For example, if the theory contains a rule of the form $\textit{unblind}(\textit{sign}(\textit{blind}(x,y),k),y)=\textit{sign}(x,k)$, it means that any instance of the LHS can be replaced by the corresponding instance of the RHS. Such equations correspond to proof rules in the system for deriving terms in this paper (examples of such systems are given in Section 2.1).

Equality assertions, on the other hand, are to be treated literally, and not as rewrite rules. For instance, given an assertion of the form $\{x\}_{k}=\{t\}_{k}$, we cannot replace all terms of the form $\{u\}_{k}$ by $\{t\}_{k}$. In fact, these equality assertions are objects that are manipulated by proof rules, rather than being another style of expressing derivations between terms.

Along with studying the derivability problem for such extensions, several of these papers also extend the results of [38] by addressing the active intruder problem for finitely many sessions. For instance, [15, 16] obtain NP decision procedures in the case of extending Dolev-Yao with rules for xor. The current paper, however, extends [38] along a different dimension, to solve both the passive and active intruder problems for assertions, and is thus not subsumed by any of these works on equation theories.

In Section 2, we first introduce the syntax for terms and assertions. We present an example of modelling with assertions via the FOO e-voting protocol, and then present the proof system for assertions. Then we define protocols and runs for this new system. In Section 3, we first present a high-level overview of the various steps involved in solving the insecurity problem, and then we move on to Section 4, where we present the technical results in detail and prove that insecurity for the assertion system is in NP. We present some ideas for future research in Section 5.

In this model, each communicated message is modelled as a term in an algebra, which has operators for pairing, encryption, hashing etc. New terms can be derived from old ones using proof rules, which specify the behaviour of these operators. We begin with a set $\mathscr{N}$ of names (atomic terms, with no further structure), and a set of variables $\mathscr{V}$. We denote by $\mathscr{A}\subseteq\mathscr{N}$ the set of agents, with $I\in\mathscr{A}$ being the malicious intruder. We denote by $\mathscr{V}_{q}\subset\mathscr{V}$ the variables used for quantification, and by $\mathscr{V}_{i}$ the set $\mathscr{V}\setminus\mathscr{V}_{q}$. The set of terms, denoted by $\mathscr{T}$, is given by

where $x\in\mathscr{V}$, $m\in\mathscr{N}$, $t_{1},\ldots t_{n}\in\mathscr{T}$, and ${\sf f}$ is an $n$-ary operator. The set of ground terms are those without variables. A substitution $\sigma$ is a partial function with finite support from $\mathscr{V}_{i}$ to $\mathscr{T}$. Its domain is denoted by ${\sf dom}(\sigma)$. We assume that $\sigma(x)=x$ for $x\not\in{\sf dom}(\sigma)$. The set of subterms of $t$ is denoted by ${\sf st}(t)$, and defined as usual. The set of variables appearing in $t$ is denoted by ${\sf vars}(t)$.

Each ${\sf f}$ has constructor rules and destructor rules, expressed in terms of sequents of the form $X\vdash t$ (to be read as “$t$ is derived from $X$”), where $X\cup\{t\}$ is a finite set of terms. Figure 1 gives the general form of a constructor rule (on the left) and a destructor rule (on the right). In a destructor rule, the conclusion $t_{i}$ is an immediate subterm of the leftmost premise, which is designated as the major premise of the rule. The ${\sf ax}$ rule (which derives $X\vdash t$ when $t\in X$) is also considered a destructor rule for technical purposes. We say $X\vdash_{\mathit{dy}}t$ if there is a proof of $X\vdash t$ using these constructor and destructor rules, and $X\vdash_{\mathit{dy}}S$ to mean that $X\vdash_{\mathit{dy}}t$ for every $t\in S$.

For any proof $\pi$ of $X\vdash t$, we denote by ${\sf axioms}(\pi)$ the set $X$, by ${\sf conc}(\pi)$ the term $t$, and by ${\sf terms}(\pi)$ all terms occurring in $\pi$. $\pi$ is said to be normal if a constructor rule does not yield the major premise of a destructor rule. We only consider proof systems which enjoy the following three properties:

• •

  Normalization: Every proof $\pi$ of $X\vdash t$ can be converted into a normal proof $\varpi$ of the same.

• •

  Subterm property: For any normal proof $\varpi$ of $X\vdash t$, ${\sf terms}(\varpi)\subseteq{\sf st}(X\cup\{t\})$, and if $\varpi$ ends in a destructor rule, ${\sf terms}(\varpi)\subseteq{\sf st}(X)$.

• •

  Efficient derivability checks: There is a PTIME algorithm for checking derivability.

The normalization and subterm properties combined are referred to as locality in the security literature. This is a notion identified in [32], and is crucially used in solving the derivability problem for many classes of inference systems, including many intruder theories.

We consider an assertion syntax which includes equality over terms (to avoid overloading the $=$ operator, we denote equality between $t$ and $u$ by ${{t}\bowtie{u}}$), predicates, conjunction, existentially quantified assertions, list membership, and a$\ \mathit{says}\$connective. Existential quantification allows us to make statements that convey partial information about terms, in particular, allowing us to hide terms or parts thereof. The$\ \mathit{says}\$connective works like a signature over assertions, indicating who endorses the fact conveyed by the assertion. List membership, which we denote by $\twoheadleftarrow$, acts as a restricted form of disjunction. Predicates allow us to express some protocol-specific facts. As we will see over the later sections, this fragment allows us to express example protocols of interest, as well as yields a decidable active intruder problem for boundedly many sessions.

In the following, $t,u\in\mathscr{T}$, $P$ is an $m$-ary predicate, $u_{1},\ldots,u_{m},t_{0}\in\mathscr{N}\cup\mathscr{V}$, and $t_{1},\ldots,t_{n}\in\mathscr{N}$,¹¹1We could consider arbitrary terms in list membership, but this simple syntax suffices for most examples. Similarly for $P(u_{1},\ldots.u_{m})$. $x\in\mathscr{V}_{q}$, and $\mathit{pk}(k)$ is the public key corresponding to a secret key $k$.

By atomic assertions, we mean assertions that are not of the form $\alpha\wedge\beta$ or $\exists{x}\alpha$.

We denote the free (resp. bound) variables occurring in an assertion $\alpha$ by ${\sf fv}(\alpha)$ and ${\sf bv}(\alpha)$. ${\sf vars}(\alpha)={\sf fv}(\alpha)\cup{\sf bv}(\alpha)$. The set of subterms (resp. subformulas) of $\alpha$ is given by ${\sf st}(\alpha)$ (resp. ${\sf sf}(\alpha)$). We can lift these notions to sets of assertions as usual. For a substitution $\lambda$, we obtain $\lambda(\alpha)$ by replacing $x$ in $\alpha$ by $\lambda(x)$ for all $x\in{\sf fv}(\alpha)$.

We now define the public terms of an assertion $\alpha$. These are essentially the terms that $\alpha$ is “about”, which are always communicated along with $\alpha$. Quantified variables in an assertion stand for “private” terms, so if a term $t$ occurring in $\alpha$ has quantified variables, it cannot itself be public. But it is not reasonable to declare all other subterms to be public terms either. For instance, if an assertion talks about ${\sf senc}(v,k)$, the term ${\sf senc}(v,k)$ should be public, but probably not $v$ or $k$ itself. Hence we define the public terms of $\alpha$, denoted ${\sf pubs}(\alpha)$, as the set of all maximal subterms of $\alpha$ which contain no quantified variables. In other words, $t\in{\sf pubs}(\alpha)$ iff $t\in{\sf st}(\alpha)$, ${\sf vars}(t)\cap\mathscr{V}_{q}=\emptyset$, and $\forall u\in{\sf st}(\alpha):\ t\in{\sf st}(u)\implies{\sf vars}(u)\cap\mathscr{V}_{q}\neq\emptyset$.

Assertions, like terms, can be involved in sends and receives. However, since assertions are logical formulas, we can also have agents check them for derivability and take some action based on the result of this check, without any send/receive. We call such an action an ${\sf assert}$. As part of an ${\sf assert}~{}{\alpha}$ action, an agent $A$ checks to see if $\alpha$ is derivable from their current knowledge. If it is, $A$ continues with their role, otherwise $A$ aborts. An ${\sf assert}$ action allows us to model some minimal branching based on the derivability of assertions from agents’ local states.

Note that this does not involve any absolute notion of the “truth” (or lack thereof) of an assertion. An agent can only locally check if an assertion can be “verified”, i.e. obtained from what they know about the system at that point in the execution. It might well be the case that while an ${\sf assert}~{}\alpha$ check passes for an agent $A$, a different agent $B$ might not have enough information to be able to derive $\alpha$, and abort. Conversely, if some agent’s internal state has been compromised somehow and made inconsistent, they might even be able to ${\sf assert}$ something like $0=1$, which is patently false. We are only concerned with the verifiability of assertions, and not their absolute truth values.

Having introduced this system, we now present the modelling of the well-known FOO e-voting protocol [24]. This is a minor modification of the presentation in [35].

The FOO e-voting protocol was proposed in 1992 and closely mirrors the way one votes offline. There is a voter $V$, an authority $A$ who verifies voter identities, and a collector $C$ who computes the final tally.

To model this using only terms [24, 29], blinding is used. One can use $t$ and $b$ to make a blind pair ${\sf blind}(t,b)$, and get ${\sf sign}(t,k)$ from ${\sf sign}({\sf blind}(t,b),k)$ and $b$. The voter authenticates themselves to the authority using their signing key $\mathit{sk}_{V}$, and uses the blinding operation to have the authority certify it without knowing the actual vote. The authority’s signature ${\sf sign}(\cdot,\mathit{sk}_{A})$ percolates through to the vote when the voter removes the blind, and the voter can then anonymously send (denoted by $\looparrowright$) this signed vote to the collector for inclusion into the final tally. This specification is shown below.

We model the voting phase of FOO as below, following [35]. We use $\{\alpha\}^{A}$ as shorthand for $A\ \mathit{says}\ \alpha$. In fact, the use of assertions allows one to also specify an eligibility check for voters via an ${\sf assert}$. If the user is not eligible, the protocol aborts. Further, voters can also state that their vote is for an allowable candidate from the list $\ell$. These are left implicit in the terms-only modelling.

$V$ first sends to $A$ their encrypted vote along with an assertion claiming that it is for a candidate from the list $\ell$. The authority checks the voter’s eligibility via the ${\sf assert}$ action on the ${\sf el}$ predicate. If the check passes, the authority issues a certificate stating that the voter is allowed to vote, crucially, without modifying the term containing the vote. $V$ then existentially quantifies out their name from this certificate, and anonymously sends to $C$ a re-encryption of the vote authorized by $A$ along with a certificate to that effect. Here, $p$ and $q$ are freshly-generated ephemeral keys. Thus, the intent behind the various communications is made more transparent than in the model with blind signatures. One can show that this satisfies anonymity [35].

One can also specify security properties in a more natural manner (as compared to the terms-only model). For instance, one can say that vote secrecy is ensured in the above protocol if there is no run where the intruder can derive the assertion $\exists{xy}:[\{v\}_{p}=\{x\}_{y}\wedge x=v]$. Note that this means that while anyone can derive the value of $v$, which is public, they should not be able to identify the value inside the encrypted vote $\{v\}_{p}$ as being a particular public name. To express this in the terms-only formulation, one has to check whether two runs that only differ in the vote $v$ can be distinguished by the intruder [19]. It can be seen from [35] that proving such properties might involve considering multiple runs simultaneously, but their specification itself does not refer to a notion of equivalence.

Before we present the proof system, we need to fix under what conditions one can derive a new assertion from existing ones. In a security context, it becomes important to distinguish when a term is accessible inside an assertion versus when it is not. To substitute a term $u$ (with, say, $v$) inside a term $t$, an agent $A$ essentially needs to break the term down to that position, replace $u$ with $v$, and construct the whole term back. This depends on other terms $A$ has access to. We formalize this notion as “abstractability”, which requires us to first define the set of term positions of an assertion.

We will view terms as trees, with $\mathbb{P}(t)\subseteq\mathbb{N}^{*}$ denoting the set of positions of the term $t$, and $\varepsilon$ the empty word in $\mathbb{N}^{*}$. We will also view assertions as trees, with any operator forming the root of its subtree, and its operands standing for its children. We will only be interested in the position where terms occur in assertions, not those of the various operators. We define these as follows.

For $t,r\in\mathscr{T}$, and $p\in\mathbb{P}(t)$, ${t}|_{p}$ is the subterm of $t$ rooted at $p$. The set of positions of $r$ in $t$ is $\mathbb{P}_{r}({t})\coloneqq\{p\in\mathbb{P}(t)\mid{t}|_{p}=r\}$. For $P\subseteq\mathbb{P}(t)$, ${t}[{r}]_{P}$ is obtained by replacing the subterm of $t$ occurring at each $p\in P$ with $r$. We will use analogous notation for assertions.

For example, let $t=(\{\{m\}_{k}\}_{k^{\prime}},(n_{1},n_{2}))$. Then, $\mathbb{P}(t)=\{\varepsilon,0,1,00,01,10,11,000,001\}$. Consider the set $S=\{\{m\}_{k}\}_{k^{\prime}},(n_{1},n_{2})$. Then, $\mathbb{A}(S,t)=\{\varepsilon,0,1,10,11\}$. The abstractable positions are shown in bold in Figure 2.

Now, an inductive definition seems like it might suffice to lift the notion of abstractable positions for assertions. However, a problem arises when we consider an assertion of the form $\exists x.\alpha$. Let $\alpha=\exists b.\{{{\{m\}_{b}}\bowtie{\{m\}_{k}}}\}$. Suppose we want to get $\exists ab.\{{{\{a\}_{b}}\bowtie{\{m\}_{k}}}\}$ from $\alpha$ in the presence of the set $S=\{m,k\}$. That position of $m$ in $\alpha$ must be abstractable w.r.t $S$, i.e. we require that $S\vdash_{\mathit{dy}}\{m\}_{b}$, but $S$ does not even contain the quantified variable $b$. We must therefore consider derivability from $S\cup\{b\}$ in this case, not $S$.

We now state a fundamental property of abstractability, which will be used in some of the more technical proofs later.

The assertion proof system is shown in Table 2. We say $S;A\vdash_{\mathit{a}}\alpha$ if $\alpha$ can be derived from $S;A$ using these rules. We say $S;A\vdash_{\mathit{a}}\Gamma$ if $S;A\vdash_{\mathit{a}}\gamma$ for every $\gamma\in\Gamma$.

We say that $S;A\vdash_{\mathit{eq}}\alpha$ if $\alpha$ can be derived from $S;A$ by a proof which does not use any of the rules from $\{\wedge\sf i,\wedge\sf e,\exists\sf i,\exists\sf e,{\sf say}\}$. Recall that an atomic assertion is one that is not of the form $\alpha\wedge\beta$ or $\exists{x}.\alpha$. The $\vdash_{\mathit{eq}}$ system is used typically when $A\cup\{\alpha\}$ consists only of atomic assertions, and we want to ensure that there is no use of the rules for $\wedge$ and $\exists$ in these proofs. To ensure this, we also need to avoid the ${\sf say}$ rule. Otherwise, we might allow a derivation of $\mathit{pk}(k)\ \mathit{says}\ (\alpha\wedge\beta)$ using $\alpha\wedge\beta$, which itself can be derived only using $\wedge\sf i$ (since the LHS contains only atomic assertions).

The proofs in Section 4 crucially appeal to some properties of $\vdash_{\mathit{eq}}$ proofs, which we detail below.

We now state the normalization theorem and subterm property for $\vdash_{\mathit{eq}}$ proofs. First, we define the following notions.

• •

  ${\sf terms}(\pi)\coloneqq\{t\mid$ a subproof of $\pi$ derives $\alpha$ and $t$ is a maximal subterm of $\alpha\}$.

• •

  ${\sf lists}(E)\coloneqq\{\ell\mid\exists{t}:t\twoheadleftarrow{\ell}$ is in $E\}$.

• •

  ${\sf lists}(\pi)\coloneqq\{\ell\mid$ a subproof of $\pi$ derives $t\twoheadleftarrow{\ell}\}$.

Armed with these notions, we present a saturation-based procedure in Algorithm 1 for deciding whether $T;E\vdash_{\mathit{eq}}\alpha$, where $E\cup\{\alpha\}$ consists only of atomic assertions. The procedure computes the set

where $Z$ is as defined in Algorithm 1, and checks if $\alpha\in\mathscr{E}^{{\alpha}}_{{T},{E}}$.

Letting $M=|{\sf st}(T)\cup{\sf st}(E\cup\{\alpha\})|$ and $N=|{\sf lists}(E)|$, it can be seen that the algorithm runs in time polynomial in $M+N$. There are at most $(M+N)^{2}$ atomic formulas that can be added in $C$, and hence the while loop runs for at most $(M+N)^{2}$ iterations. In each iteration, the amount of work to be done is polynomial in $M+N$. (Recall that $\vdash_{\mathit{dy}}$ can be decided in PTIME.) Thus the algorithm works in time polynomial in $M+N$, and hence polynomial in the size of $(T;E\cup\{\alpha\})$.

Following [10, 38], a protocol is given by a finite set of roles, each role consisting of a finite sequence of alternating receives and sends (each send triggered by a receive).​²²2This model considers actions of the form ${\sf assert}~{}\alpha$ to model rudimentary branching in protocols, which we used for specifying the FOO protocol. But we omit these in the formal model, for ease of presentation. We discuss handling such branching in Section 5.4. These are the actions of honest agents. Every sent message is added to the Dolev-Yao intruder’s knowledge base. Each received message is assumed to have come from the intruder, so it must be derivable by the intruder. We assume that only assertions are communicated – a term $t$ can be modelled via the assertion ${{t}\bowtie{t}}$, whose only public term is $t$.

A protocol $\mathit{Pr}$ is a finite set of roles, each of the form $({\beta_{1}},{\alpha_{1}})\ldots({\beta_{m}},{\alpha_{m}})$, where the $\alpha_{i}$s and $\beta_{i}$s are assertions. An $x\in{\sf fv}(\mathit{Pr})$ is said to be an agent variable if it occurs first in an $\alpha_{i}$; otherwise it is an intruder variable. Each role is a sequence of actions by an agent, receiving the $\beta_{i}$s and sending the $\alpha_{i}$s in response. The $\alpha_{i}$s and $\beta_{i}$s can have bound variables from $\mathscr{V}_{q}$ as well as free variables from $\mathscr{V}_{i}$. Instantiating the free variables with appropriately-typed ground terms yields a session. A run is obtained by interleaving a finite number of sessions that satisfy the required derivability conditions. It is convenient to instantiate the free variables of a role in two stages. Agent variables are instantiated with names before starting a session, but intruder variables can be mapped to terms only at runtime.