Recently, a lot of results have shown how to relax the perfect cryptography assumption for security protocol verification in a number of particular situations. The aim of this work is to bring together these results and to provide general conditions on the equational theory and the intruder deduction system under which one gets a decision procedure for the verification of security protocols for a bounded number of sessions. Hubert Comon-Lundh has introduced this line of research in  .

The first part of this work consists of reducing the equational theory to a simpler one by using variants. Hubert Comon-Lundh and Stéphanie Delaune have formally defined the finite variant property allowing to reduce the equational theory. They have given equivalent (resp. sufficient) conditions on the equational theory to ensure that the finite variant property holds. They have investigated this property for some equational theories which are relevant to security protocols verification. For instance, they have proved that the finite variant property holds for the Dolev-Yao theory with explicit destructors, exclusive or, Abelian Groups, etc. They have also shown that the finite variant property does not hold for the theory ACUNh (Associativity, Commutativity, Unit, Nilpotence, homomorphism). This work has been published at RTA 2005  .

The perfect cryptography assumption widely adopted for the formal verification of security protocol is unrealistic for cryptographic primitives with visible algebraic properties. The classical Dolev-Yao model can be extended to deal with the fact that the intruder can exploit these properties. AC-like equational theories are those which involve an Associative and Commutative operator and are often used in cryptographic protocols.

Pascal Lafourcade, Ralf Treinen and Denis Lugiez (University of Marseille) have investigated the intruder deduction problem, that is the vulnerability to passive attacks, in presence of several variants of AC-like axioms (from AC to Abelian groups, including the theory of exclusive or) and homomorphism, which are the most frequent axioms arising in cryptographic protocols. Solutions to this problem have been known for the cases of exclusive or, of Abelian groups, and of homomorphism alone. In  , the authors address the combination of these AC-like theories with the law of homomorphism which leads to much more complex decision problems. They prove decidability of the intruder deduction problem in all cases considered. Their decision procedure is in EXPTIME, except for a restricted case in which they have been able to obtain a PTIME decision procedure using a property of one-counter and pushdown automata.

Pascal Lafourcade has also investigated this problem in presence of the equational theory of a commutative encryption operator which distributes over the exclusive or operator. These operators are frequently used in cryptographic protocols. For instance, the well-known RSA encryption is a commutative encryption, and the exclusive-or is used in several cryptographic protocols. The interaction between the commutative distributive law of the encryption and exclusive-or offers more possibilities to decrypt an encrypted message than in the non-commutative case. Pascal Lafourcade has shown that the intruder deduction problem is decidable and he has provided a 2-EXPTIME decision procedure. This work  has been submitted for publication.

Stéphanie Delaune has shown that the problem is actually in PTIME for the case of an exclusive or (resp. Abelian Groups) operator in combination with the homomorphism axiom. The problem is addressed by solving a system of linear equations over Z/2 Z[ h](resp. Z[ h]). This work improves the EXPTIME complexity results previously obtained. It has been accepted for publication at IPL  .

The works described above addressed the verification problem in presence of a passive attacker. Stéphanie Delaune, Pascal Lafourcade, Ralf Treinen and Denis Lugiez have also investigated the verification problem in presence of an active attacker who can not only listen to messages that pass over the network, but also intercept them and use them to fake messages. They have considered the theory of exclusive or in combination with the homomorphism axiom and they have shown that the problem is decidable. One main step of their proof consists in reducing the constraint system for deducibility into a constraint system for deducibility in one step and using one particular rule of the constraint system. This constraint system, in turn, can be expressed as a system of quadratic equations of a particular form over the ring of polynomials in one indeterminate over the finite field Z/2 Z[ h]. They show that satisfiability of these systems of equations is decidable in  .

Guessing attacks, also known as dictionary attacks, occurs when an attacker is able to recover the value of a secret data by searching the entire space of values. Passwords and, more generally, low-entropy secrets are especially vulnerable to guessing attacks, which gives a strong motivation for their study.

Fortunately, not all low-entropy secrets can be broken: the attacker must still be able to test whether one of his guesses is correct or not, typically by exploiting redundancy between messages. Among guessing attacks, off-lineguessing attacks are those for which the attacker does not need to participate in any communication during the guessing phase.In practice, off-line guessing attacks are considered more crucial for security, as non-off-line ones may generate an important flow of messages on the network, and thus are either inefficient or easily detected.

Amongst the numerous formal accounts of off-line guessing attacks that have been proposed in the litterature (for instance  , , , , , and ), the recent definition of Corin et al.  appears attractive in several respects. Notably, based on the standard notion of static equivalence in the applied pi calculus, this definition is arguably natural and applies to an arbitrary set of cryptographic primitives parametrized by an equational theory.

Unfortunately, it was not clear from the litterature before 2005 whether this definition could be addressed by an automatic procedure, nor whether some computational justification could be provided to it.

Our first contribution in this area has been to show that the security of protocols against off-line guessing attacks, according to Corin et al.'s definition, is decidable for a general class of equational theories, called subterm confluent, in the case of a bounded number of sessions. This work was presented at CCS'05  . Independently, Blanchet et al.presented at LICS'05 an approximate semi-procedure for an unbounded number of sessions.

Our second contribution, in collaboration with Martín Abadi (University of California at Santa Cruz) and Bogdan Warinschi (LORIA), has been to establish the computational soundness of Corin et al.'s criterion in the case of passive adversaries. In other words, we showed that in the case of passive adversaries, if the formal criterion holds, then the protocol is secure against guessing attacks in the computational model as well. This result has strong connexions with the one presented in Section  . This work was submitted for publication at FOSSACS'06.

Electronic voting promises the possibility of a convenient, efficient and secure facility for recording and tallying votes in an election. Recently highlighted inadequacies of implemented systems have demonstrated the importance of formally verifying the underlying voting protocols. The applied pi calculus is a formalism for modelling such protocols, and allows verifying properties by using automatic tools, and to rely on manual proof techniques for cases that automatic tools are unable to handle.

Steve Kremer and Mark Ryan (University of Birmingham) have used the applied pi calculus to model a known protocol for elections known as FOO 92, and three of its expected properties, namely fairness, eligibility, and privacy are formalized. Blanchet's tool ProVerif is used to prove that the first two properties are satisfied. In the case of the third property, ProVerif is unable to prove it directly, because its ability to prove observational equivalence between processes is not complete. A manual proof is provided for the required equivalence. Moreover, the proof emphasizes the need to divide the protocol into three phases in order for privacy to hold. Although the original description of the protocol describes three phases, no explanation for this choice is given and therefore the proof might increase the understanding of this property.

This result has been published at the European Symposium on Programming (ESOP '05).

In an extension of this work Stéphanie Delaune, Steve Kremer and Mark Ryan have extended and generalized the previous work: they give a general definition of what is an electronic voting protocol in the applied pi calculus in order to formalize and study two other properties, coercion-resistance and receipt-freeness. Intuitively, an election protocol is coercion-resistant if a voter Acannot prove to a potential coercer Cthat she voted in a particular way. One assumes that Acooperates with Cin an interactive way. Receipt-freeness is a weaker property, for which one assumes that Aand Ccannot interact during the protocol, but Alater provides evidence (the receipt) of how she voted. While receipt-freeness can be expressed using observational equivalence from the applied pi calculus, they need to introduce a new relation to capture coercion-resistance. The formalization of coercion-resistance and receipt-freeness are quite different. Nevertheless, they show in accordance with intuition that coercion-resistance implies receipt-freeness, which implies privacy, the basic anonymity property of voting protocols, as defined in the previous work. Finally the definitions are illustrated on a simplified version of the Lee et al.voting protocol.

An extended abstract of this work has been published at the Frontiers in Electronic Elections (FEE 2005) workshop. A more complete version has been submitted.

Since the 1980s, two approaches have been developed for analyzing security protocols. One of the approaches relies on a computational model that considers issues of complexity and probability. This approach captures a strong notion of security, guaranteed against all probabilistic polynomial-time attacks. However, proofs in this model are difficult and less successful for large, complex protocols. The other approach relies on a symbolic model of protocol executions in which cryptographic primitives are treated as black boxes. Since the seminal work of Dolev and Yao, it has been realized that this latter approach enables significantly simpler and often automated proofs of complex protocols. However, the guarantees that it offers with respect to a deployed protocol have been quite unclear.

Mathieu Baudet, Véronique Cortier (LORIA) and Steve Kremer have studied the link between formal and cryptographic models for security protocols in the presence of a passive adversary. In contrast to other works, they do not consider a fixed set of primitives but aim at results for an arbitrary equational theory. They define a framework for comparing a cryptographic implementation and its idealization with respect to various security notions. In particular, they concentrate on the computational soundness of static equivalence, a standard tool in cryptographic pi calculi. They present a soundness criterion, which for many theories is not only sufficient but also necessary. Finally, they establish new soundness results for the exclusive OR and a theory of ciphers and lists.

This work has been published at the 32nd International Colloquium on Automata, Languages and Programming (ICALP'05). A full version has been submitted for publication at Theoretical Computer Science.

This is joint work with Kumar Neeraj Verma, TU München, and former student of Goubault-Larrecq . In fact, this was a result obtained by Verma in 2003, while he was member of the SECSI project, in collaboration with Goubault-Larrecq.

In his PhD thesis, Verma proposed to study BVASS (Branching VASS) which extend VASS (Vector Addition Systems with States) by allowing addition transitions that merge two configurations. These objects were then rediscovered by de Groote et al. (LICS 2004) under the name of VATA (Vector Addition Tree Automata). The latter showed that provability in the multiplicative-exponential fragment of linear logic (MELL), a still unsolved problem, is equivalent to reachability in VATA, a.k.a., BVASS. BVASS were discovered in the SECSI project as a convenient tool to study two-way tree automata modulo AC (associativity, commutativity), and the latter are useful to verify cryptographic protocols in the presence of AC operators—a theme that is now flourishing, as the RNTL PROUVÉ project certainly demonstrates.

Runs in BVASS are tree-like structures instead of linear ones as for VASS. Verma showed in 2003 that the construction of Karp-Miller trees for VASS can be extended to BVASS, and this was published in 2005 . This entails that the coverability set for BVASS is computable. This allows one to obtain decidability results for certain classes of equational tree automata modulo AC. This is also a first towards answering the question of the decidability of MELL in the affirmative.

This is joint work with Kumar Neeraj Verma, TU München, and Muriel Roger, LIST, CEA, both former students of Goubault-Larrecq . In this paper, it is shown how one can approximate sets of clauses modulo an AC symbol using a sophisticated approximation scheme that supplements ordinary ordered resolution with selection. It is demonstrated that this applies to concrete cryptographic protocols such as those derived from the group Diffie-Hellman key generation protocols (GDH.2, IKA.1), and works efficiently in practice.

Florent Jacquemard, Michael Rusinowitch and Laurent Vigneron (from the project CASSIS at UR Lorraine) have worked at introducing and studing new classes of tree automata combining automata with equality test and automata modulo equational theories. The main application at aim for such a formalism is the automated verification of reachability properties of infinite state systems, where the states of the system are represented by ground terms (terms without variables) and the set of reachable states, or an (lower or upper) approximation, is a tree automaton language. The transitions of the system can be be represented either by tree automata transitions or by rewrite rules. This approach for verification, adopted in many works concerned with security, raises two important issues in tree automata theory: how can we augment the expressivity of tree automata languages, while preserving good decidability properties (in particular the ability of testing the emptiness of recognized languages), and which classes of rewrite systems preserve the recognizability (by tree automata) of term languages? These issues have been adresses separately since more than 15 years, a major improvement being in particular the addition of equality and disequality constraints in tree automata transitions (see e.g.  ), and this work is to our knowledge a first attempt of adressing both problems simultaneously.

It is shown in  that the emptiness problem is undecidable for former classes of non-deterministic tree automata with equality constraints, contradicting a long-term claim of  (see also  ). A decidable restriction is proposed for the application of constraints as well as an extension based the standard Horn clause representation for tree automata with equational conditions or rewrite systems or both. The generalized membership problem(whether there exists a ground instance of a given term in a given tree automata language, this embeds the classical emptiness problem) is shown decidable for the various tree automata classes studied in  , with a uniform theorem-proving technique used to prove that the saturation of tree automata presentations with suitable paramodulation strategies terminates. It has been shown that these results can be applied to the verification of the reachability problem for security protocols described in a fragment of the applied pi-calculus.

The main advantage of the choice of theorem-proving techniques for this works is that it permits a practical exploitation of the above results. Early experiments conducted on some examples of protocols with general purpose theorem provers like SPASS and DaTac have given encouraging results, and a specialized implementation is on course. It is the first known implementation of classes of tree automata with equality constraints.

Moreover, the participants are currently working on numerous extensions like the addition of disequality constraints or other constraints like ordering constraints, the extension of the decision techniques to the recognizability modulo axioms for associativity and commutativity, and the recognition of binary relations on terms by automata.

Adel Bouhoula (École supérieure des communications de Tunis) and Florent Jacquemard have continued to work on their development of an approach for mechanizing induction on complex data structures (like bags, sets, sorted lists, trees,...) based on tree automata with constraints. In this approach, which combines techniques of explicit induction and implicit induction (aka proof by consistency), a tree automata with constraints characterizing the initial model of a given algebraic specifications is used both as an induction schemefor the generation of subgoals and for checking consistency during the proof by induction (using classical tree automata algorithms).

During this year, the method has been generalized to deal with inductive proofs for partial constructor specifications, in particular for the definition of powerlists (lists stored in balanced binary trees) and for the inductive verification of some cryptographic protocols specified with explicit destructors.

Moreover, some extensions of this approch have been proposed to address the problem of the automatic verification of the properties sufficient completeness  and confluence of conditional and constrained specification.

In a paper presented at the CSL conference in 2002, Goubault-Larrecq, together with David Nowak (former member of SECSI, today at Tokyo University) and Slawek Lasota (Warsaw University), laid out the foundations of logical relations for Moggi's computational -calculus. This was then used as a basis in Zhang Yu's PhD thesis, defended in 2005, on cryptographic logical relations, with an application to the verification of properties such as strong secrecy.

The construction of logical relations above reduces to lifting strong monads to a so-called subscone category above the category where denotations take place. It can be applied to a hoist of monads, and one that was taken as an example in the above cited CSL paper was that of probabilistic choice. This is illustrated in the long version , awaiting publication in a journal

This prompted further studies of probabilities in the semantics of programming languages and with an eye towards security. The first result published in this line of research, which is admittedly a satellite of the main research themes of SECSI, is , is that simple valuations on a topological space X, i.e., least upper bounds of finite linear combinations of point-mass valuations, which play a prominent role in the theory of continuous valuations, are exactly those that extend to continuous valuations to the Alexandroff topology of the underlying specialization ordering. This complements the exhaustive apparatus of theorems that show under which conditions continuous valuations extend to measures on the Borel subsets of X.

The current line of research in this domain is now in finding reasonable notions of observational equivalence, bisimulation (and logical relations) for transition systems mixing probabilites and demonic non-determinism in a more general way than labelled Markov processes. This is required in subtle modern cryptographic protocols. The study of probabilistic models was started by Goubault-Larrecq in collaboration with Josée Desharnais and François Laviolette (U. Laval, Québec) and Vincent Danos (PPS, U. Paris 7), informally during the summer 2003. Then Goubault-Larrecq was invited at Québec in summer 2004 to work on with. Goubault-Larrecq filed an ARC proposal, together with Catuscia Palamidessi (Comète, INRIA Futurs) and Vincent Danos in Fall 2005. Goubault-Larrecq will talk about his results at the GeoCal residential session, February 2006, Luminy, France.

Yassine Lakhnech, Steve Kremer and Ralf Treinen describe in  the PROUVÉ specification language for cryptographic protocols. A main feature of the language is that it specifies protocols from the point of view of an agent executing the protocol, instead of describing correct protocol execution as seen by an outside observer. A protocol specification consists of five sections:

The manual defines the context-free syntax of protocol specifications and the static semantics conditions. The semantics of signatures and axioms is formally defined using concepts from algebraic specifications, and the semantics of roles, global variables and scenarios is given using a system of inference roles. The report gives syntax and semantics of a logics for safety assertions for traces. Finally, a sub-language of security assertions is given which allows to express usual security and authentication properties of protocols. The language of security assertions is designed with view to the proving capabilities of current verification tools.