Cryptographic protocol

A security protocol (cryptographic protocol or encryption protocol) is an abstract or concrete protocol that performs a security-related function and applies cryptographic methods, often as sequences of cryptographic primitives. A protocol describes how the algorithms should be used. A sufficiently detailed protocol includes details about data structures and representations, at which point it can be used to implement multiple, interoperable versions of a program.^[1]

Cryptographic protocols are widely used for secure application-level data transport. A cryptographic protocol usually incorporates at least some of these aspects:

Key agreement or establishment
Entity authentication
Symmetric encryption and message authentication material construction
Secured application-level data transport
Non-repudiation methods
Secret sharing methods
Secure multi-party computation

For example, Transport Layer Security (TLS) is a cryptographic protocol that is used to secure web (HTTP/HTTPS) connections. It has an entity authentication mechanism, based on the X.509 system; a key setup phase, where a symmetric encryption key is formed by employing public-key cryptography; and an application-level data transport function. These three aspects have important interconnections. Standard TLS does not have non-repudiation support.

There are other types of cryptographic protocols as well, and even the term itself has various readings; Cryptographic application protocols often use one or more underlying key agreement methods, which are also sometimes themselves referred to as "cryptographic protocols". For instance, TLS employs what is known as the Diffie-Hellman key exchange, which although it is only a part of TLS per se, Diffie-Hellman may be seen as a complete cryptographic protocol in itself for other applications.

Advanced cryptographic protocols

A wide variety of cryptographic protocols go beyond the traditional goals of data confidentiality, integrity, and authentication to also secure a variety of other desired characteristics of computer-mediated collaboration. Blind signatures can be used for digital cash and digital credentials to prove that a person holds an attribute or right without revealing that person's identity or the identities of parties that person transacted with. Secure digital timestamping can be used to prove that data (even if confidential) existed at a certain time. Secure multiparty computation can be used to compute answers (such as determining the highest bid in an auction) based on confidential data (such as private bids), so that when the protocol is complete the participants know only their own input and the answer. End-to-end auditable voting systems provide sets of desirable privacy and auditability properties for conducting e-voting. Undeniable signatures include interactive protocols that allow the signer to prove a forgery and limit who can verify the signature. Deniable encryption augments standard encryption by making it impossible for an attacker to mathematically prove the existence of a plain text message. Digital mixes create hard-to-trace communications.

Formal verification

Cryptographic protocols can sometimes be verified formally on an abstract level. When it is done, there is a necessity to formalize the environment in which the protocol operate in order to identify threats. This is frequently done through the Dolev-Yao model.

Logics, concepts and calculi used for formal reasoning of security protocols:

Research projects and tools used for formal verification of security protocols:

Automated Validation of Internet Security Protocols and Applications (AVISPA)^[3] and followup project AVANTSSAR^[4]
- Constraint Logic-based Attack Searcher (CL-AtSe)^[5]
- Open-Source Fixed-Point Model-Checker (OFMC)^[6]
- SAT-based Model-Checker (SATMC)^[7]
Casper^[8]
CryptoVerif
Cryptographic Protocol Shapes Analyzer (CPSA)^[9]
Knowledge In Security protocolS (KISS)^[10]
Maude-NRL Protocol Analyzer (Maude-NPA)^[11]
ProVerif
Scyther^[12]

Notion of abstract protocol

To formally verify a protocol it is often abstracted and modelled using Alice & Bob notation. A simple example is the following:

A\rightarrow B:\{X\}_{K_{A,B}}

This states that Alice $A$ intends a message for Bob $B$ consisting of a message $X$ encrypted under shared key $K_{A,B}$ .

Examples

References

^ "Cryptographic Protocol Overview" (pdf). 2015-10-23.
^ Fábrega, F. Javier Thayer, Jonathan C. Herzog, and Joshua D. Guttman., Strand Spaces: Why is a Security Protocol Correct?{{citation}}: CS1 maint: multiple names: authors list (link)
^ Automated Validation of Internet Security Protocols and Applications (AVISPA)
^ AVANTSSAR
^ Constraint Logic-based Attack Searcher (Cl-AtSe)
^ Open-Source Fixed-Point Model-Checker (OFMC)
^ SAT-based Model-Checker for Security Protocols and Security-sensitive Application (SATMC)
^ Casper: A Compiler for the Analysis of Security Protocols
^ cpsa: Symbolic cryptographic protocol analyzer
^ Knowledge In Security protocolS (KISS)
^ Maude-NRL Protocol Analyzer (Maude-NPA)
^ Scyther

External links

Secure protocols open repository

[1] "Cryptographic Protocol Overview" (pdf). 2015-10-23.

[2] Fábrega, F. Javier Thayer, Jonathan C. Herzog, and Joshua D. Guttman., Strand Spaces: Why is a Security Protocol Correct?{{citation}}: CS1 maint: multiple names: authors list (link)

[3] Automated Validation of Internet Security Protocols and Applications (AVISPA)

[4] AVANTSSAR

[5] Constraint Logic-based Attack Searcher (Cl-AtSe)

[6] Open-Source Fixed-Point Model-Checker (OFMC)

[7] SAT-based Model-Checker for Security Protocols and Security-sensitive Application (SATMC)

[8] Casper: A Compiler for the Analysis of Security Protocols

[9] sa: Symbolic cryptographic protocol analyzer

[10] Knowledge In Security protocolS (KISS)

[11] Maude-NRL Protocol Analyzer (Maude-NPA)

[12] Scyther

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[11]

[12]