A Rewriting-Based Inference System
for the NRL Protocol Analyzer
Santiago Escobar
Cathy Meadows
Jos ´e Meseguer
UIUC NRL UIUC
(UPV, Valencia, Spain)
NRL & UIUC
Outline
➀ Motivation
➁ Inference System through the NSPK Example
• Top Level
• Grammar Generation Level
• Reachability Analysis Level
MOTIVATION NRL & UIUC
Motivation
The NRL Protocol Analyzer (NPA) have been used with great effect on a number of complex real-life protocols
NPA successful because of its ability to use inductive techniques (formal languages) to drastically limit the infinite search space
However, lack of an independent formal specification and model of NPA. Basic techniques are closely intertwined with other features.
⇓ ⇓ Main Contribution ⇓ ⇓
Give a precise formal specification within the rewriting framework: 1. its backwards reachability analysis
MOTIVATION NRL & UIUC
Motivation
The NRL Protocol Analyzer (NPA) have been used with great effect on a number of complex real-life protocols
NPA successful because of its ability to use inductive techniques (formal languages) to drastically limit the infinite search space
However, lack of an independent formal specification and model of NPA. Basic techniques are closely intertwined with other features.
⇓ ⇓ Main Contribution ⇓ ⇓
Give a precise formal specification within the rewriting framework: 1. its backwards reachability analysis
MOTIVATION NRL & UIUC
Benefits
Formal specification in a system accessible to a large community of researchers
Inference system specified as a set of rewrite rules modulo an equational theory describing the behavior of the cryptographic al-gorithms involved
Extension of the equational theory with other algebraic properties of the underlying cryptographic functions
Allows us to make use of theorems from rewriting logic to prove open conjectures about properties of the NPA inference system.
INFERENCE SYSTEM NRL & UIUC
Inference System
Parametric on (Σ, RP, E)
• Σ is a protocol-specific signature (with type information)
• RP is the rewrite rules describing the protocol
• E is the equational theory describing the underlying algebraic prop-erties (encryption/decryption)
Two things:
1. Protocols (Notation, Semantics, Role in NPA) 2. Grammars (Notation, Semantics, Role in NPA)
INFERENCE SYSTEM NRL & UIUC
The NSPK Example
Signature Σ :
pk : N ame × M sg → Enc
sk : N ame × M sg → Enc
n : N ame × Integer → N once
r, r0 : → Integer ; : M sg × M sg → M sg Equational Theory E : pk(Y, sk(Y, Z)) = Z sk(Y, pk(Y, Z)) = Z Protocol rules RP : (p1) ∅ → pk(B, A;n(A, r)) (p2) pk(A, n(A, r);Z) → pk(B, Z), f inal(A, B;n(A, r)) (p3) pk(B, A;Z) → pk(A, Z;n(B, r)) (p4) pk(B, A;Z), pk(B, n(B, r0)) → f inal(B, A;n(B, r0)) (p5) M1, M2 → M1;M2 (p7) M → sk(Y, M) (p6a) M1;M2 → M1 (p8) M → pk(Y, M) (p6b) M1;M2 → M2
INFERENCE SYSTEM NRL & UIUC
Grammars
Used by the NPA to reduce the search space obtained by narrowing when performing backwards reachability analysis
Each grammar starts with a seed term and is generated by back-wards narrowing via the protocol rules
Grammars are described in terms of constraints:
1. Terms that the intruder is not expected to know (such as secret keys) (Y /∈I)
2. Instances of the seed term that the intruder may be able to learn
(Y t)
3. Recursive calls to know whether some subterm is in the lan-guage of the grammar (Y ∈L)
INFERENCE SYSTEM NRL & UIUC
The NSPK Example – Grammars
Seed term sd1 = Y /∈I 7→ X;Y ∈L
(g1.0) Y /∈I, Y A;n(A, r) 7→ X;Y ∈L
(g1.1) W∈L 7→ pk(A, n(A, r);sk(B, W))∈L
(g1.2) W∈L 7→ W;M2∈L (g1.4) W∈L 7→ pk(Y, W)∈L
(g1.3) W∈L 7→ M1;W∈L (g1.5) W∈L 7→ sk(Y, W)∈L
Seed term sd2 = Y /∈I 7→ pk(X, Y )∈L
(g2.0) Z /∈I, ZZ0;n(B, r) 7→ pk(R, Z)∈L (g2.1) Y /∈I, Y Z0;n(B, r) 7→ pk(A, n(A, r);Y )∈L (g2.2a) Y ∈L 7→ (Y ;M2)∈L (g2.3) Y ∈L 7→ pk(Y 0 , Y )∈L (g2.2b) Y ∈L 7→ (M1;Y )∈L (g2.4) Y ∈L 7→ sk(Y 0, Y )∈L
INFERENCE SYSTEM – TOP LEVEL NRL & UIUC
Top Level - NSPK
(1) Grammar Generation: where G0sd1 = {sd1} and G0sd2 = {sd2}
G0 = hG0sd1, G0sd2i VP,G0 G1 = hGsd1 1, G0sd2i VP,G1 G2 = hG!sd1, G0sd2i
VP,G2 G3 = hG!
sd1, G
!
sd2i
(2) Reachability Analysis: Useless backwards narrowing derivations are cut by grammars:
h pk(B, n(B, r)), . . . i
∗ P,G
h M1;pk(B, n(B, r)), . . . i
using protocol rule p6b ≡ (M1;M2) → M2, but
h G!sd1, (pk(B, n(B, r))∈I/ ) i ` (M1;pk(B, n(B, r)))∈L
INFERENCE SYSTEM – GRAMMAR GENERATION NRL & UIUC
Grammar Generation - NSPK
Consider G2 = hG!sd1, G0sd2i VP,G2 G3 = hG!sd1, G!sd2i with
G0sd2 = {sd2 = Y /∈I 7→ pk(X, Y )∈L}
For each backwards narrowing step sd2 σ,P,G2,G0
sd2 g
0, apply some
heuristics and generate a new grammar rule or constraint to be included in G!sd2. For example, Z /∈ I 7→ pk(R, Z)∈L σ,P,G2,G0 sd2 Z /∈ I 7→ pk(A, n(A, r);Z)∈L ≡ g 0 ⇓⇓ heuristicsG0 sd2,S1(sd2, id, g0) = h∅,{ Y /∈I 7→ pk(A, n(A, r);Y )∈L }i ⇓⇓
INFERENCE SYSTEM – GRAMMAR GENERATION NRL & UIUC
Dependencies in Grammar Generation
Gi VP,G i Gi+1 z z L%% L L L L L L L L L L L L L L s s ggggg newGrammars(G,C,H) t t hhhh h + + X X X X X X X X X α(G,C) β(G,C) Gb optimize(G) t t iiii iiii hC,H, Gi ⇒ P,Gi ,Gkj,s hC0,H0, G0 i removeContrainsts(G) removeRules(G) heuristics Gk j,s (g, σ, g0) s s gggg ggg hGi ,Di ` C t t jjjj jjjj j g σ,P,Gi ,Gk j g0 o o s s hhhh hhhh h c v c0 →R−G1 R −1 Gk j • σ,R−1 P ,EP
INFERENCE SYSTEM – GRAMMAR GENERATION NRL & UIUC
The relation
G
iV
P,G iG
i+1 Gi VP,Gi Gi+1 if Gi = hG!1, . . . , G!j−1, Gkj, . . . , Gknni, Gi+1 = hG!1, . . . , G!j−1, Gkj+1, . . . , Gknni, and Gkj+1 6≡ Gkj ; where h∅,∅, Gkj i ⇒!P,G i,Gkj,s hC,H,∅i and Gkj+1 = optimize(newGrammars(Gkj ,C,H))INFERENCE SYSTEM – GRAMMAR GENERATION NRL & UIUC
The Backwards Narrowing Relation
g
σ,P,Gi,Gkj
g
0 g σ,P,Gi,Gk j g 00 if g • σ,R−P1,EP g 0, g0 ! R−1 Gk j g00, and g00 is Gi-expandable g00 ≡ c1, . . . , ck 7→ (t1, . . . , tn)∈L is Gi-expandable iff(i) there is no ci and tj such that ci ≡ (tj 6∈ I),
(ii) for each ci of the form (ut), ∃θ : θ(u) ≡ θ(t), and (iii) for each tj, hGi,(c1, . . . , ck)i 6` (ti∈L).
INFERENCE SYSTEM – GRAMMAR GENERATION NRL & UIUC
The Operator
heuristics
Gkj,s
(
g, σ, g
0)
H1 ∃si, p ∈ Pos(si) : hG k j,Di ` (si|p ∈ L) heuristicsGk j,s(g, σ, g 0) = h∅,{Y ∈ L 7→ s i[Y ]p∈L}i H2a ∃di ∈ D : di ≡ (u /∈ I) ∧ u 6∈ X heuristicsGk j,s(g, σ, g 0) = h{Xu},∅i H2b σ(t) 6≡ t ∀ci ∈ C : ci 6≡ (X ∈ L) heuristicsGk j,s(g, σ, g 0) = h{t σ(t)},∅i H3 ∃di ∈ D, sj, p ∈ Pos(sj) : di ≡ (sj|p 6∈ I) heuristicsGk j,s(g, σ, g 0) = h∅,{Y 6∈ I 7→ s j[Y ]p∈L}iINFERENCE SYSTEM – GRAMMAR GENERATION NRL & UIUC
Grammar Generation (More Examples) - NSPK
For example, sd2 ≡ Z /∈ I 7→ pk(R, Z)∈L id,P,Gi,Gkj g 0 ≡ Z /∈ I 7→ pk(R, Z);M2∈L ⇓⇓ heuristicsG0,S1(g,id, g0) = h∅,{Y ∈L 7→ Y ;M2∈L}i ⇓⇓ G!sd2 = optimize(newGrammarS1(Gsd0 2, . . . , Y ∈L 7→ Y ;M2∈L, . . .})) For example, sd2 ≡ Z /∈ I 7→ pk(R, Z)∈L [Z/A;n(A,r)],P,Gi,Gk j g 0 ≡ A;n(A, r) ∈ I 7→ ∅/ ⇓⇓ heuristicsG0,S1(g,id, g 0 ) = h{ZA;n(A, r)},∅i ⇓⇓ G! = optimize(newGrammar (G0 , . . . , ZA;n(A, r), . . .}))
INFERENCE SYSTEM – REACHABILITY ANALYSIS NRL & UIUC
Reachability Analysis - NSPK
hf inal(B, A;n(B, r)), i ∗ P,Gh(pk(B, A;Z), pk(B, n(B, r))), w1i ∗ P,Ghpk(B, n(B, r))), w2i ∗ P,Ghn(B, r), w3i ∗ P,Ghpk(Y 0, n(B, r)), w4i ∗ P,Ghpk(A, n(A, r 0);n(B, r)), w5i ∗ P,Ghpk(B, A;n(A, r 0)), w 6i ∗ P,GhA;n(A, r 0 ), w7i ∗ P,Ghpk(Y 0, A;n(A, r0)), w8i ∗ P,Gh∅, w9i 1. A ,→ I : {NA, A}KI 2. IA ,→ B : {KA, A}KB 3. B ,→ A : {NA, NB}KA 4. A ,→ I : {NB}KI 5. I ,→ B : {NB}KBINFERENCE SYSTEM – REACHABILITY ANALYSIS NRL & UIUC
Reachability Analysis
ht, wi P,G ht0, σ(t|p.w)i if t p • σ,RP−1,EP t0 and for each s
i ∈ t0,
hG, ctr(w)i 6` (si∈I)/ and hG, ctr(w)i 6` (si∈L); where ctr(u1.· · · .un) = (u1∈I/ , . . . , un∈I/ ).
INFERENCE SYSTEM – REACHABILITY ANALYSIS NRL & UIUC
Conclusions & long-term goals
Precise rewriting-based formalization of the NPA inference system: grammar generation mechanisms and narrowing-based backwards reachability analysis.
1. Implementation of our rewrite-rule based inference system in Maude
2. Experimentation with such an implementation, and comparison with the original NPA tool.
3. Generalization of our inference system to handle equational theo-ries for the underlying cryptography
4. Development of a next-generation NPA-like tool based on such a generalized inference system
