《安全协议形式化验证》课程报告

中山大学信息科学与技术学院

《安全协议形式化验证》课程报告报告名称：

班级：_ ___ 分数：_______ ___

姓名：___ _ _ _ _ 学号：______________________

教师评语：

报告正文

Yahalom协议描述

协议如下：

A,B,S : 协议主体

N a, N b : 新鲜的随机数

K AS, K BS, K AB : 协议主体间共享的对称密钥

A知道: A, B, S, K AS

B知道: B, S, K BS

S知道: S, A, B, K AS, K BS

1. A－> B : A, N a

2. B－> S : B, {A, N a, N b}KBS

3. S－> A : {B, K AB, N a, N b}KAS, {A, K AB}KBS

4. A－> B : {A, K AB}KBS, {N b}KAB

协议的目的：S为协议主体A，B产生并发送共享会话密钥K AB，并确保K AB 的机密性；同时B能有效鉴别A。

现在我们逐条分析下该协议：

1 . A －> B : A, Na

主体A 将他的名字与新鲜随机数Na 一起发送给主体B 。

2 . B －> S : B, {A, Na, Nb}Kbs

B连同A 的名字、A 的新鲜随机数Na、还有他自己产生的新鲜随机数Nb一起用他和S的共享密钥Kbs加密,再将加密的结果和B 的名字一起发送给S。

3 . S －> A : {B, Kab, Na, Nb}Kas, {A, Kab}Kbs

S用与B共享的密钥解密后得到Na和Nb，S产生两个消息,第一个消息由B 的名字、随机会话密钥Kab、A 的新鲜随机数Na 、B 的新鲜随机数Nb 组成,用他和A 共享密钥Kas 对所有第一个消息加密;第二个消息由A 的名字和随机会话密钥Kab组成,用他和B 共享密钥Kbs加密;然后将两个消息发送给A 。

4 . A －> B : {A, KAB}Kbs , { Nb}Kab

A收到消息后用与S之间的共享密钥解密，然后发送两个消息给B ,第一个消

息是从S那里接收到的用S与B 的共享密钥Kbs加密的消息;第二个是会话密钥Kab加密Nb。

之后B 用他的密钥解密消息, 提出Kab，然后解密出来之前B产生的新鲜随机数Nb，之后就可以确认A的身份了。

Yahalom的HLPSL语言描述

role alice(A, B, S :agent,

Kas :symmetric_key,

SND_BA,RCV_BA,SND_SA,RCV_SA :channel(dy))

played_by A

def=

local State :nat,

Na,Nb :text,

Kab :symmetric_key,

X :{agent.symmetric_key}_symmetric_key

init State:=0

transition

1.State =0 /\ RCV_BA(start)=|>

State':=2 /\ Na':=new()

/\ SND_BA(A.Na')

2.State =2 /\ RCV_SA({B.Kab'.Na.Nb'}_Kas.X')=|>

State':=4 /\ SND_BA(X'.{Nb'}_Kab')

/\ witness(A,B,bob_alice_kab,Kab')

/\ request(A,S,alice_server_kab,Kab')

/\ request(A,B,alice_bob_nb,Nb')

end role

%----------------------------------------------------

% Bob

role bob (A, B, S : agent,

Kbs : symmetric_key,

SND_AB, RCV_AB,SND_SB,RCV_SB: channel(dy))

played_by B

def=

local State : nat,

Na,Nb : text,

Kab: symmetric_key

init State:=1

transition

1.State =1 /\ RCV_AB(A.Na')=|>

State':=3 /\ Nb':=new()

/\ SND_SB(B.{A.Na'.Nb'}_Kbs)

/\ witness(B,S,server_bob_nb,Nb')

/\ witness(B,A,alice_bob_nb,Nb')

2.State =3 /\ RCV_AB({A.Kab'}_Kbs.{Nb}_Kab')=|>

State':=5 /\ request(B,A,bob_alice_kab,Kab')

end role

%----------------------------------------------------

% Server

role server(A, B, S : agent,

Kas, Kbs : symmetric_key, SND_AS,RCV_AS,SND_BS,RCV_BS: channel(dy))

played_by S

def=

local State :nat,

Na,Nb:text,

Kab:symmetric_key

init State :=7

transition

1.State = 7 /\ RCV_BS(B.{A.Na'.Nb'}_Kbs)=|>

State':= 9 /\ Kab' := new()

/\ SND_AS({B.Kab'.Na'.Nb'}_Kas.{A.Kab'}_Kbs)

/\ witness(S,A,alice_server_kab,Kab')

/\ secret(Kab',kab,{A,B,S})

/\ request(S,B,server_bob_nb,Nb')

end role

%----------------------------------------------------

%组合角色

role session(A, S, B : agent,

Kas, Kbs : symmetric_key)

def=

local

SSA, RSA,

SBA, RBA,

SAS, RAS,

SBS, RBS,

SAB, RAB,

SSB, RSB : channel (dy)

composition

alice (A, B, S, Kas, SBA, RBA, SSA, RSA)

/\ server (A, B, S, Kas, Kbs, SAS, RAS, SBS,RBS)

/\ bob (A, B, S, Kbs, SAB, RAB, SSB, RSB)

end role

%-------------------------------------------------------

role environment()

def=

const a, b, s : agent,

kas, kbs, kis : symmetric_key,

alice_bob_nb,bob_alice_kab,kab,server_bob_nb,

alice_server_kab : protocol_id

intruder_knowledge = {a, b, s, kis}

composition

session(a,s,b,kas,kbs)

/\ session(a,s,b,kas,kbs)

/\ session(a,s,i,kas,kis)

/\ session(i,s,b,kis,kbs)

/\ session(a,i,b,kas,kbs)

end role

%--------------------------------------------------------

goal

%kab的机密性

secrecy_of kab

%alice用nb鉴别bob

authentication_on alice_bob_nb

%alice用kab鉴别server

authentication_on alice_server_kab

%server用nb鉴别bob

authentication_on server_bob_nb

%bob用kab鉴别alice

authentication_on bob_alice_kab

end goal

%-------------------------------------------------------- environment()

%-------------------------------------------------------- Yahalom的HLPSL的运行结果

% OFMC

% Version of 2006/02/13

SUMMARY

UNSAFE

DETAILS

A TTACK_FOUND

PROTOCOL

C:\Program Files\SPAN\testsuite\results\2.cas.if GOAL

replay_protection_on_server_bob_nb

BACKEND

OFMC

COMMENTS

STA TISTICS

parseTime: 0.00s

searchTime: 0.10s

visitedNodes: 42 nodes

depth: 2 plies

ATTACK TRACE

i -> (b,3): a.x253

(b,3) -> i: b.{a.x253.Nb(1)}_kbs

i -> (s,3): b.{a.x253.Nb(1)}_kbs

(s,3) -> i: {b.Kab(2).x253.Nb(1)}_kas.{a.Kab(2)}_kbs i -> (s,7): b.{a.x253.Nb(1)}_kbs

(s,7) -> i: {b.Kab(3).x253.Nb(1)}_kas.{a.Kab(3)}_kbs

% Reached State:

%

% request(s,b,server_bob_nb,Nb(1),3)

% request(s,b,server_bob_nb,Nb(1),7)

% contains(a,set_105)

% contains(b,set_105)

% contains(s,set_105)

% witness(b,s,server_bob_nb,Nb(1))

% witness(b,a,alice_bob_nb,Nb(1))

% state_server(s,i,b,kis,kbs,7,dummy_nonce,dummy_nonce,dummy_sk,set_118,16)

% state_bob(b,i,s,kbs,1,dummy_nonce,dummy_nonce,dummy_sk,16)

% state_server(s,a,i,kas,kis,7,dummy_nonce,dummy_nonce,dummy_sk,set_116,11)

%

state_alice(a,i,s,kas,0,dummy_nonce,dummy_nonce,dummy_sk,{dummy_agent.dummy_sk}_dum my_sk,11)

% state_server(s,a,b,kas,kbs,9,x253,Nb(1),Kab(3),set_112,7)

% state_bob(b,a,s,kbs,1,dummy_nonce,dummy_nonce,dummy_sk,7)

%

state_alice(a,b,s,kas,0,dummy_nonce,dummy_nonce,dummy_sk,{dummy_agent.dummy_sk}_du mmy_sk,7)

% state_server(s,a,b,kas,kbs,9,x253,Nb(1),Kab(2),set_105,3)

% state_bob(b,a,s,kbs,3,x253,Nb(1),dummy_sk,3)

%

state_alice(a,b,s,kas,0,dummy_nonce,dummy_nonce,dummy_sk,{dummy_agent.dummy_sk}_du mmy_sk,3)

% secret(Kab(3),kab,set_112)

% witness(s,a,alice_server_kab,Kab(3))

% state_bob(b,a,i,kbs,1,dummy_nonce,dummy_nonce,dummy_sk,21)

%

state_alice(a,b,i,kas,0,dummy_nonce,dummy_nonce,dummy_sk,{dummy_agent.dummy_sk}_du mmy_sk,19)

% secret(Kab(2),kab,set_105)

% witness(s,a,alice_server_kab,Kab(2))

% contains(s,set_112)

% contains(b,set_112)

% contains(a,set_112)

攻击分析

i -> (b,3): a.x253

入侵者I冒充A向B发送A的标识，以及随机数x253

(b,3) -> i: b.{a.x253.Nb(1)}_kbs

入侵者I截获B向S发送的消息

i -> (s,3): b.{a.x253.Nb(1)}_kbs

入侵者I将截获到的消息转发给S

(s,3) -> i: {b.Kab(2).x253.Nb(1)}_kas.{a.Kab(2)}_kbs

入侵者I截获S向A发送的消息

i -> (s,7): b.{a.x253.Nb(1)}_kbs

入侵者I冒充B将第2步截获到的消息在下一回合重发给S (s,7) -> i: {b.Kab(3).x253.Nb(1)}_kas.{a.Kab(3)}_kbs

入侵者I截获S向A发送的消息

Yahalom协议的改进

role alice(A, B, S :agent,

Kas :symmetric_key,

SND_BA,RCV_BA,SND_SA,RCV_SA :channel(dy)) played_by A

def=

local State :nat,

Na,Nb :text,

Kab :symmetric_key,

Succ : hash_func

init State:=0

transition

1.State =0 /\ RCV_BA(start)=|>

State':=2 /\ Na':=new()

/\ SND_BA(A.Na')

2.State =2 /\ RCV_SA({B.Kab'.Na.Nb'}_Kas.X')=|>

State':=4 /\ SND_BA(X'.{A.Nb'}_Kab')

/\ witness(A,B,bob_alice_kab,Kab')

3.State =4 /\ RCV_BA({B.Succ(Na)_Kab})=|>

State':=6 /\ request(A,S,alice_server_kab,Kab')

/\ request(A,B,alice_bob_nb,Nb')

end role

%----------------------------------------------------

% Bob

role bob (A, B, S : agent,

Kbs : symmetric_key, SND_AB, RCV_AB,SND_SB,RCV_SB: channel(dy))

played_by B

def=

local State : nat,

Na,Nb : text,

Kab: symmetric_key

Succ : hash_func

init State:=1

transition

1.State =1 /\ RCV_AB(A.Na')=|>

State':=3 /\ Nb':=new()

/\ SND_SB(B.{A.Na'.Nb'}_Kbs)

/\ witness(B,S,server_bob_nb,Nb')

/\ witness(B,A,alice_bob_nb,Nb')

2.State =3 /\ RCV_AB({A.Nb.Kab'}_Kbs.{A.Nb}_Kab')=|>

State':=5 /\ SND_AB({B.Succ(Na)}_Kab)

/\ request(B,A,bob_alice_kab,Kab')

end role

%----------------------------------------------------

% Server

role server(A, B, S : agent,

Kas, Kbs : symmetric_key, SND_AS,RCV_AS,SND_BS,RCV_BS: channel(dy))

played_by S

def=

local State :nat,

Na,Nb:text,

Kab:symmetric_key

init State :=7

transition

1.State = 7 /\ RCV_BS(B.{A.Na'.Nb'}_Kbs)=|>

State':= 9 /\ Kab' := new()

/\ SND_AS({B.Kab'.Na'.Nb'}_Kas.{A.Nb'.Kab'}_Kbs)

/\ witness(S,A,alice_server_kab,Kab')

/\ secret(Kab',kab,{A,B,S})

/\ request(S,B,server_bob_nb,Nb')

end role

%----------------------------------------------------

%组合角色

role session(A, S, B : agent,

Kas, Kbs : symmetric_key)

def=

local

SSA, RSA,

SBA, RBA,

SAS, RAS,

SBS, RBS,

SAB, RAB,

SSB, RSB : channel (dy)

composition

alice (A, B, S, Kas, SBA, RBA, SSA, RSA)

/\ server (A, B, S, Kas, Kbs, SAS, RAS, SBS,RBS)

/\ bob (A, B, S, Kbs, SAB, RAB, SSB, RSB)

end role

%-------------------------------------------------------

role environment()

def=

const a, b, s : agent,

kas, kbs, kis : symmetric_key,

alice_bob_nb,bob_alice_kab,kab,server_bob_nb,

succ : hash_func

alice_server_kab : protocol_id

intruder_knowledge = {a, b, s, kis}

composition

session(a,s,b,kas,kbs)

/\ session(a,s,b,kas,kbs)

/\ session(a,s,i,kas,kis)

/\ session(i,s,b,kis,kbs)

/\ session(a,i,b,kas,kbs)

end role

%--------------------------------------------------------

goal

%kab的机密性

secrecy_of kab

%alice用nb鉴别bob

authentication_on alice_bob_nb

%alice用kab鉴别server

authentication_on alice_server_kab

%server用nb鉴别bob

authentication_on server_bob_nb

%bob用kab鉴别alice

authentication_on bob_alice_kab

end goal

%-------------------------------------------------------- environment()

%--------------------------------------------------------