Causality, partial orders, and lower bounds on ... - Semantic Scholar

Causality, partial orders, and lower bounds on rounds for a class of authentication protocols

Reihaneh Safavi-Naini Anish Mathuria Centre for Computer Security Research Centre for Computer Security Research Department of Computer Science Department of Computer Science University of Wollongong University of Wollongong NSW 2522 NSW 2522 [email protected] [email protected] Peter Nickolas Centre for Computer Security Research Department of Computer Science University of Wollongong NSW 2522 [email protected]

Abstract

An authentication protocol, as used in distributed systems, provides a mechanism for establishing secure channels to protect communications between nodes. Some notable recent works by Gong use the number of rounds as a communication complexity measure on authentication protocols|where a round consists of protocol messages that can be exchanged simultaneously. In this paper, we consider a more formal approach to de ning the round complexity of authentication protocols. We adopt Yahalom's notion of veri able causality between events as a means of specifying security requirements for asynchronous protocols. We formalise the notion of an abstract protocol class in terms of veri able causality. It is shown that such a class induces a partial order on an associated set of events; this partial order is a causal order in the sense of Lamport. A round then precisely consists of a set of causally unordered events. We give a theorem for proving lower bounds on the number of rounds. Our theorem leads to a simple graph-theoretic technique for nding bounds. We conclude by deriving lower bounds on rounds for some speci c classes of authenticated key exchange protocols informally analysed by Gong.

Keywords Distributed systems, speci cation

and veri cation, security protocols, partial orders, round complexity, lower bounds.

Proceedings of the 20th Australasian Computer Science Conference, Sydney, Australia, February 5{7 1997.

1 Introduction

A fundamental property of open distributed systems is that the communications network is tapped by malicious nodes, usually with the aim of subverting some security feature. The use of authentication protocols allows secure channels to be set up in order to protect communications between nodes. (Needham's tutorial [10] gives an excellent introduction to this subject.) Reasoning about the correctness of such protocols has been an area of active research in recent years, and has proved to be especially thorny [11, 9, 2, 1]. In a series of recent works, Gong [5, 6, 7] and Yahalom [13, 14, 15] independently consider some eciency metrics for authentication protocols. Gong [5] considers two eciency metrics, the number of messages and the number of rounds, and gives lower bounds on these metrics for some common protocol classes, in an informal manner. In contrast, Yahalom [13, 14] provides a more detailed model for analysing bounds on messages for a class of secure asynchronous protocols. The model provides constructs for the formulation of security requirements using the notion of veri able causality, which is related to Lamport's [8] happened before relation. Yahalom [13] employs the model to de ne a class of secure data exchange protocols, and derives a lower bound on the number of messages for this class. However, the metric of rounds is not addressed in his work. The purpose of this paper is to extend Yahalom's model to allow derivation of lower bounds on the number of rounds. The rest of the paper is organised as follows. In section 2, we set out the basic model mainly due to Yahalom [13], including the notion of veri able causality. In

section 3, we characterise an abstract protocol class de ned using this notion as a partially ordered set (poset) of events. We de ne the metric number of rounds, and establish a general relationship between the poset representation of a protocol class and lower bounds on rounds. We show that the problem of nding lower bounds on rounds reduces to path nding in the directed acyclic graph (DAG) representing a particular restriction of the poset. In section 4, we use the extended model to prove lower bounds on rounds for several classes of protocols for authenticated key exchange, verifying Gong's results [5]. Finally, section 5 presents our conclusions and suggests some directions for further work.

2 Basic model

We begin by recalling some of the notions described by Yahalom [13]. A system consists of a collection of nodes, also called principals, which communicate solely by asynchronous message passing. Each principal can generate a new pseudorandom value, called an upnonce, which is unpredictable by others. It is assumed that principals may act maliciously, that is, they can see, modify, or replay any message exchanged within the system. Further, any principal can inject fake messages into the system. An event is an action taken by a principal. The actions a principal can perform includes the following: (i) sending a message M, denoted send(M); (ii) receiving a message M, denoted receive(M). Although the system is asynchronous, each node maintains its own local abstract clock. However, the clocks at dierent nodes are assumed not to be synchronised. Each event E is associated with the local clock reading, c(E), at the principal where that event occurs. It is assumed that the local clock value at a principal is incremented at least once between two successive events at that principal. Following Lamport [8], we de ne a happened before relation, denoted !, as the smallest binary relation on the set of events of a system such that: 1. E ! E holds: (i) if E and E are events occurring at the same principal such that c(E) < c(E ), or (ii) if E = send(M) and E = receive(M) for any message M exchanged between two principals, or (iii) if E ! E and E ! E for some E . 2. E 6! E for all E. The above de nition essentially generalises the following two basic observations about the order of events in a distributed system (cf. [4]): (a) 0

0

0

0

00

00

0

00

A principal is a sequential process|the events occurring at the same principal are totally ordered; (b) Whenever a message exchange takes place, the event of sending the message occurs before the event of receiving the message. It is easy to see that ! is an irre exive, transitive, anti-symmetric relation; that is, a partial order on the events of a system. A basic property of ! is concerned with a notion of an information ow between events. If Ei ! Ej for events Ei and Ej at two dierent principals Pi and Pj , respectively, then the above de nition implies that there exists a send event, send(M), at Pi , and a receive event, receive(M ), at Pj , for some messages M and M , such that send(M) ! receive(M ). We then say that there is an information ow from Ei to Ej . The happened before relation eectively captures the notion of potential causality: E ! E means E may (but does not necessarily) causally aect E . The basic idea underlying Yahalom's notion of veri able causality is to capture strict causal dependence between events, in that the occurrence of one event is precluded without the occurrence of another event. This notion is relativised to principals, and causal dependence is further distinguished as precedence or succession between events, as follows. De nition 1 ([13]) An event Ei of one principal Pi veri ably-precedes an event Ej of another principal Pj if Pi can establish that Ej could not be generated without Pj receiving some information derived from the occurrence of Ei or from some event at Pi that occurred after Ei. De nition 2 ([13]) An event Ei of one principal Pi veri ably-succeeds an event Ej of another principal Pj if, at the time it generates Ei, Pi can establish that Ej has occurred. The notions of veri able precedence and veri able succession de ned above are strictly independent: \Ei veri ably-precedes Ej does not necessarily imply that Ej veri ably-succeeds Ei (and vice-versa)." ([13], p. 196) The following propositions relate veri able causality with potential causality. Proposition 1 ([13]) For any two events Ej and Ei that have occurred at dierent principals, if Ei veri ably-precedes Ej then Ei ! Ej . Proposition 2 ([13]) For any two events Ej and Ei that have occurred at dierent principals, if Ei veri ably-succeeds Ej then Ej ! Ei . As noted by Yahalom [13], the two notions represented by Ei veri ably-precedes Ej and Ej veri ably-succeeds Ei are strictly stronger 0

0

0

0

0

than Ei ! Ej . The converses of Propositions 1 and 2 do not hold. The following de nition is intended to capture the notion of an event at one principal occurring relatively recently with respect to an event at another principal. De nition 3 ([13]) An event Ej of one principal Pj 4-precedes an event Ei of another principal Pi if Pi can establish that Ej was generated at most 4 ticks (as measured by Pi on its local site clock) before the generation of Ei . The notion of 4-precedence de ned above is central to capturing the security requirement that principals be able to determine that certain messages are fresh and not replays of earlier ones. The following theorem (Theorem 1 of Yahalom [13]) gives necessary and sucient conditions for 4-precedence. Theorem 1 An event Ej of a principal Pj at one site 4-precedes an event Ei of principal Pi at another site if and only if the following conditions hold: 1. There exists another event Ei , generated by principal Pi, such that Ei veri ablyprecedes Ej . 2. Ei veri ably-succeeds Ej . 3. c(Ei ) ? c(Ei )  4. Note that the rst condition above asserts that for a principal Pi to establish that an event Ej at a dierent principal Pj 4-precedes an event Ei at Pi, there must exist another event Ei at Pi , from which there is an information ow to Ej . This information ow implicitly includes a receive event (respectively, send event) of some message at Pj (respectively, Pi). The received message at Pj is referred to as a 4-precedence establishing (4-pe) message by Yahalom [13]. Informally, a protocol de nes a sequence of events at various principals. An execution of a protocol consists of a realisation in which various protocol events take place at the principals involved. Each event is associated with the protocol execution where it occurs. Events that occur in dierent executions at the same principal are assumed to be unrelated, in that the clock values associated with such events are incomparable.

of base events at various principals, and (2) a set C of veri able causal relationships over Eb de ned using veri ably-precedes, veri ably-succeeds, or 4-precedes. Clearly, C induces a partial order, de ned by !, on the set E = Eb [ Ed , where Ed is a possibly empty set of additional events induced by Theorem 1. We thus represent a protocol class formally as a partially ordered set  = (E ; ), where  denotes the partial order associated with E. In view of the poset formulation for a protocol class, it appears natural to consider an individual protocol of class  as a totally ordered set (E ; Bound)). % % % %

path(A, Z, Digraph, Path, Cost): Digraph is represented as digraph(Nodes, Edges), where Nodes is a list of vertices and

% % % % % %

Edges is a list of edges in Digraph ; Path is an acyclic path with cost Cost from A to Z in Digraph p(X, Y) means there is an edge from X to Y in Digraph

path(A, Z, Digraph, Path, Cost) :path1(A, [Z], 1, Digraph, Path, Cost). path1(A, [A|Path1], Cost1, _, [A|Path1], Cost1). path1(A, [Y|Path1], Cost1, digraph(Nodes, Edges), Path, Cost) :member(p(X, Y), Edges), Cost2 is Cost1 + 1, path1(A, [X, Y|Path1], Cost2, digraph(Nodes, Edges), Path, Cost).

B Protocol classes NB + AO/AH + CO/CC B.1 Protocol class NB+AO+CO

Here we assume that the protocol responder chooses the session key. (The case where the protocol initiator chooses the session key can be similarly worked out.) To specify this class, we de ne the following events: eS;1 send of session key message for A at S eA;1 receive of session key message at A eB;1 send of session key message for S at B and capture the session key goal as follows: CR1 eS;1 4-precedes eA;1 CR2 eB;1 4-precedes eA;1 CR3 eB;1 veri ably-precedes eS;1 CR1 and CR2 respectively imply by Theorem 1, Proposition 1, and Proposition 2 that there exist send events eA;2 and eA;3 at A such that: CR4 eA;2 ! eS;1 CR5 eS;1 ! eA;1 CR6 eA;3 ! eB;1 CR7 eB;1 ! eA;1 CR3 implies by Proposition 1 that: CR8 eB;1 ! eS;1 To satisfy (H3), we stipulate the following constraints: CR9 eA;0 ! eS;1 CR10 eA;0 ! eB;1

(E 9 ; 9 ):

E 9 = feA;0 ;eA;1 ; eA;2; eA;3 ;eB;1; eS;1 g 9 = f(eA;2 ; eS;1 );(eS;1 ; eA;1); (eA;3 ;eB;1 );

(Es9 ; 9s ):

(eB;1 ;eA;1 ); (eB;1; eS;1 );(eA;0 ; eS;1 ); (eA;0 ; eB;1)g

Es9 = feA;0 ;eA;2 ; eA;3; eB;1; eS;1 g 9s = f(eA;2 ; eS;1 );(eA;3 ;eB;1 );(eB;1 ;eS;1 ); (eA;0 ; eS;1 );(eA;0 ; eB;1)g

MaxPath = [e(a,3),e(b,1),e(s,1)] Bound = 3; MaxPath = [e(a,0),e(b,1),e(s,1)] Bound = 3;

B.2 Protocol class NB+AH+CO

We introduce the following additional events: eA;4 send of handshake message for B at A eB;2 send of handshake message for A at B eA;5 receive of handshake message at A eB;3 receive of handshake message at B and capture the handshake goal as follows: CR11 eA;4 4-precedes eB;3 CR12 eB;2 4-precedes eA;5 We capture (H1) using the following constraint: CR13 eA;1 ! eA;4 CR11 and CR12 imply by Theorem 1, Proposition 1, and Proposition 2 that there exist send events eB;4 and eA;6 , respectively, at B and A such that: CR14 eB;4 ! eA;4 CR15 eA;4 ! eB;3 CR16 eA;6 ! eB;2 CR17 eB;2 ! eA;5 To satisfy (H3), we stipulate the following additional constraints: CR18 eA;0 ! eB;2 CR19 eA;0 ! eB;4 (E 10; 10): E 10 = E 9 [ feA;4; eA;5 ;eA;6 ;eB;2 ;eB;3; eB;4g 10 = 9 [ f(eA;1 ;eA;4 );(eB;4 ;eA;4 ); (eA;4 ;eB;3); (eA;6 ;eB;2 );(eB;2 ;eA;5 );(eA;0 ; eB;2); (eA;0 ;eB;4 )g

(Es10; 10 s ):

CR5 and CR6 imply by Proposition 1 respectively the following: Es10 = feA;0; eA;2; eA;3 ;eA;4 ;eA;6 ;eB;1 ; CR15 eB;1 ! eS;1 eB;2 ;eB;4 ;eS;1 g CR16 eA;1 ! eS;2 10 s = f(eA;2; eS;1 );(eS;1 ; eA;4 ); To satisfy (H3), we stipulate the following con(eA;3; eB;1); (eB;1; eA;4); straints: (eB;1;eS;1 ); (eA;0 ;eS;1 ); CR17 eA;0 ! eB;1 (eA;0; eB;1); (eB;4; eA;4); CR18 eA;0 ! eB;3 (eA;6; eB;2); (eA;0 ;eB;2); CR19 eA;0 ! eB;4 (eA;0; eB;4)g (E 11; 11): MaxPath = [e(a,3),e(b,1),e(s,1),e(a,4)] Bound = 4; E 11 = feA;0; eA;1 ;eA;2 ;eA;3 ; eA;4; eB;1; eB;2; eB;3;eB;4 ;eS;1 ; eS;2 g MaxPath = [e(a,0),e(b,1),e(s,1),e(a,4)] 11  = f(eA;3 ;eS;1 ); (eS;1 ;eA;2 ); Bound = 4; (eB;3; eS;2 );(eS;2 ;eB;2); B.3 Protocol class NB+AO+CC (eA;4 ;eB;1 );(eB;1 ;eA;2 ); To specify this class, we de ne the following events: (eB;4; eA;1 );(eA;1 ; eB;2 ); eS;1 send of partial session key message (e B;1; eS;1 );(eA;1 ; eS;2 ); for A at S (eA;0 ;eB;1 );(eA;0 ; eB;3 ); eS;2 send of partial session key message (eA;0 ;eB;4 )g for B at S eA;1 send of partial session key message (Es11; 11 s ): for S at A eA;2 receive of partial session key message Es11 = feA;0; eA;1 ;eA;3 ;eA;4 ; eB;1 ;eB;3 ; at A eB;4; eS;1 ;eS;2 g eB;1 send of partial session key message 11 = f(eA;3 ;eS;1 ); (eB;3; eS;2 );  s for S at B eB;2 receive of partial session key message (eA;4 ;eB;1 );(eB;4 ;eA;1 ); at B (eB;1; eS;1 );(eA;1 ; eS;2 ); (eA;0 ;eB;1 );(eA;0 ; eB;3 ); and capture the session key goal as follows: (e A;0 ;eB;4 )g CR1 eS;1 4-precedes eA;2 CR2 eS;2 4-precedes eB;2 MaxPath = [e(a,0),e(b,4),e(a,1),e(s,2)] CR3 eB;1 4-precedes eA;2 CR4 eA;1 4-precedes eB;2 CR5 eB;1 veri ably-precedes eS;1 CR6 eA;1 veri ably-precedes eS;2 CR1 and CR2 imply by Theorem 1, Proposition 1, and Proposition 2 that there exist send events eA;3 and eB;3, respectively, at A and B such that: CR7 eA;3 ! eS;1 CR8 eS;1 ! eA;2 CR9 eB;3 ! eS;2 CR10 eS;2 ! eB;2 CR3 and CR4 imply by Theorem 1, Proposition 1, and Proposition 2 that there exist send events eA;4 and eB;4, respectively, at A and B such that: CR11 eA;4 ! eB;1 CR12 eB;1 ! eA;2 CR13 eB;4 ! eA;1 CR14 eA;1 ! eB;2

Bound = 4;

B.4 Protocol class NB+AH+CC

We introduce the following additional events: eA;5 send of handshake message for B at A eB;5 send of handshake message for A at B eA;6 receive of handshake message at A eB;6 receive of handshake message at B and capture the handshake goal as follows: CR20 eA;5 4-precedes eB;6 CR21 eB;5 4-precedes eA;6 We capture (H1) using the following constraints: CR22 eA;2 ! eA;5 CR23 eB;2 ! eB;5 CR20 and CR21 imply by Theorem 1, Proposition 1, and Proposition 2 that there exist send events eB;7 and eA;7 , respectively, at B and A such

that:

CR24 eB;7 ! eA;5 CR25 eA;5 ! eB;6 CR26 eA;7 ! eB;5 CR27 eB;5 ! eA;6 To satisfy (H3), we stipulate the following additional constraints: CR28 eA;0 ! eB;5 CR29 eA;0 ! eB;7 (E 12; 12 ): E 12 = E 11 [ feA;5; eA;6; eA;7 ;eB;5; eB;6;eB;7 g 12  = 11 [ f(eA;2; eA;5); (eB;2; eB;5); (eB;7;eA;5 ); (eA;5 ;eB;6); (eA;7; eB;5); (eB;5; eA;6); (eA;0; eB;5); (eA;0 ;eB;7)g (Es12; 12 s ): Es12 = feA;0; eA;1; eA;3 ;eA;4 ;eA;5 ;eA;7 ; eB;1 ;eB;3 ;eB;4; eB;5; eB;7 ;eS;1 ; eS;2 g 12 = f (eA;3; eS;1 );(eS;1 ; eA;5 ); s (eB;3;eS;2 ); (eS;2 ; eB;5 ); (eA;4; eB;1); (eB;4; eA;1); (eB;1;eS;1 ); (eA;1 ;eS;2 ); (eA;0; eB;1); (eA;0 ;eB;3); (eA;0; eB;4); (eB;7; eA;5); (eA;7; eB;5); (eA;0 ;eB;5); (eA;0; eB;7)g MaxPath = [e(a,0),e(b,4),e(a,1),e(s,2),e(b,5)] Bound = 5;