Sebery J.Cryptography.An introduction to computer security.1989

11.6 BAN Logic of Authentication

Burrows, Abadi and Needham [71] have developed a formalism for analysing authentication protocols. The formalism is referred to as the BAN logic. It investigates the evolution of principal beliefs throughout the execution of the protocol. The BAN logic operates on

{principals,

{cryptographic keys, and

{statements (or formulas).

Typically, the symbols P; Q range over principals; X; Y range over statements; and K ranges over keys. The BAN logic uses the following constructs:

1.P believes X { P is persuaded of the truth of X. This construct is central to the logic.

2.P sees X { P receives a message containing X. P can read and repeat X.

3.P said X { some time ago, P sent a message X.

4.P controls X { P has jurisdiction over X; that is P is an authority on X. Typically, a server is assumed to have jurisdiction over the generation of fresh session keys.

5.fresh(X) { X has never been sent in any message in the past (nonces are

11.6.1 BAN Logical Postulates

The BAN logic is based on logical postulates (or deduction rules) that allow us to derive conclusions from the assumptions and statements of the current run

402 11 KEY ESTABLISHMENT PROTOCOLS

of a protocol. The notation reads: given that X and Y hold, Z holds as well. The conjunction operator is denoted by `,'. Although the list given below do not exhaust the collection of rules provided by the creators of the BAN logic, it conveys most of the avor of the logic.

1.The message meaning rule. There are three versions of the rule depending on the secret involved.

{ For shared key, the rule takes the following form:

P believes Q $K P; P sees fXgK

P believes Q said X

If P believes that the key K is shared with Q and P sees a statement encrypted under the key K, then P believes that Q once said X.

{ For public key, the rule can be represented by the following expression:

P believes !7K Q; P sees fXgK 1

P believes Q said X

If P believes that the public key K belongs to Q and P sees a statement encrypted under the secret key K 1, then P believes that Q once said X.

{ For shared secrets, the rule can be expressed by the following form:

Y

P believes Q * P; P sees hXi

) Y

P believes Q said X

If P believes that the statement Y is shared with Q and P sees a statement hXiY , then P believes that Q once said X.

2. The nonce veri cation rule:

P believes fresh(X); P believes Q said X P believes Q believes X

If P believes that X is fresh and P believes that Q once said X, then P believes that Q believes X.

3. The jurisdiction rule:

P believes Q controls X; P believes Q believes X P believes X

If P believes that Q has jurisdiction over X and P believes that Q believes that X is true, then P believes that X is true.

4. Other rules. These rules allow to infer about components of a statement. (4.1) If P sees a compound statement (X; Y ), then P also sees its component

X, that is:

P sees (X; Y )

P sees X

believes that the whole statement (X; Y ) if fresh. This rule is expressed

as: P believes fresh(X)

P believes fresh(X; Y )

(4.7) If P believes that Q believes in (X; Y ), then P believes that Q believes

in X and

P believes (Q believes (X; Y )):

P believes (Q believes X)

If P believes that Q believes in (X; Y ), then P believes that Q believes

in Y and

P believes (Q believes (X; Y )): P believes (Q believes Y )

11.6.2 Analysis of the Needham-Schroeder Protocol

The BAN logic can be used to investigate the evolution of beliefs during the execution of a protocol. We show how the Needham-Schroeder protocol can be analysed using the logic. First the protocol description (Section 11.1) needs to be rewritten in the BAN logic language [112].

Idealized Needham-Schroeder protocol

404 11 KEY ESTABLISHMENT PROTOCOLS

Goals: 1. Beliefs for A:

$B KAB

(b)B believes (A $ B).

2.Beliefs for B:(a) A KAB

(a) A K$AB B

(b) A believes (A K$AB B). Assumptions: 1. Principal A believes:

(d)fresh(rA) { rA is fresh.

2.Principal B believes:

The aim of the analysis is to determine whether the statements formulated as the goals of the protocol can be derived from the assumptions and passes of the protocol by applying the BAN rules (postulates). We start from pass (2) of the protocol. Let

406 11 KEY ESTABLISHMENT PROTOCOLS

A believes B said A K$AB B:

A believes that KAB is fresh, so by the nonce veri cation rule

If we make the additional assumption that B believes fresh(A K$AB B), we can repeat the same deduction process and derive that

B believes A believes A K$AB B:

To conclude the above protocol analysis, it is worth noting that the BAN logic provides a useful tool to detect some security aws in key distribution protocols. The analysis presented above allows us to detect a aw in the NeedhamSchroeder protocol that was rst pointed out by Denning and Sacco [138]. There are some drawbacks of the BAN logic. An obvious one is the lack of a precise formalism for converting a concrete protocol into its idealized form. For instance, the Message (4) in the idealized Needham-Schroeder protocol is open to dif-

KAB

ferent interpretations. If we correct the Message (4) from frB; (A $ B)gKAB

to frBgKAB , then the deduction process shown above collapses and A is not

able to derive the conclusion A believes B believes A K$AB B. Additionally, B selects at random a nonce rB so A after decryption sees a meaningless number. Some other properties of the BAN logic that may be seen as drawbacks relate to the lack of an independently motivated semantics and are discussed in [335].

11.7 Problems and Exercises

1.Generalize the Needham-Schroeder protocol for multidomain environment. Assume that there are two domains D1 and D2 with two trusted servers S1 and S2, respectively. There

$S2)) to establish a secret channel (A $ B).

2.Modify the Needham-Schroeder protocol with timestamps so it can be used to establish a secret key among more than two principals.

3.Consider the Needham-Schroeder protocol with timestamps for public key distribution. Make necessary modi cations so the protocol is applicable for multidomain environments (domains are arranged in a hierarchical structure).

4.Show how the common secret key can be agreed upon between two principals A and B

using the DiÆe-Hellman protocol. Select a prime p 10000. Exemplify the intruder-in- the-middle attack.

5.Two principals A and B wish to use the DiÆe-Hellman protocol to agree on a commonAB2

key. At the same time A and B share with their trusted server S their secret channels

and the modulus p and sent the pair (g; p) secretly to A and B using the Otway-Rees protocol. Present the overall protocol that allows A and B to establish their secret key, which applies the Otway-Rees protocol (to distributed parameters g and N) and the DiÆe-Hellman protocol to agree on the secret key.

6.Take the Otway-Rees and Boyd-Mao protocols. Discuss their properties and emphasize their di erences.

7.Consider the following key agreement protocols: DiÆe-Hellman, ElGamal, MTI, and STS. Compare the protocols and contrast them taking their security as the base for discussion.

8.Demonstrate on simple numerical examples how two principals can agree on a secret key using

{key predistribution with self-certi ed keys,

{two-pass protocol with self-certi ed keys.

Construct a suitable instance of the RSA cryptosystem.

9.Show how three principals P1, P2 and P3 execute the star, based protocol to establish a common secret key. Assume that the modulus p = 1879 and g = 1054.

10.The star based protocol can be seen as a variant of the DiÆe-Hellman protocol. Show that the protocol is subject to the intruder-in-the-middle attack. In particular, demonstrate how the intruder who sits between P2 and P1 (P1 plays the role of a trusted authority) can obtain the common secret key and then control the traÆc coming to and going from

P2.

11.Use the broadcast protocol to establish a common secret key among three principals P1, P2 and P3. Accept the modulus p = 1879 and the primitive element g = 1054.

12.Rewrite the DiÆe-Hellman key agreement protocol into its idealized form and analyze it using the BAN logic.

12 ZERO KNOWLEDGE PROOF SYSTEMS

Zero knowledge (also called minimum disclosure) proof systems are indispensable wherever there is a necessity to prove the truth of a statment without revealing anything more about it. Zero knowledge proofs involve two parties: the prover who claims that a statement is true and the veri er who would like to be convinced that the statement is indeed true. The proof is conducted via an interaction between the parties. At the end of the protocol, the veri er is convinced only when the statment is true. If, however, the prover lies about the statement, the veri er will discover the lie with an overwhelming probability. The idea sprang out of interactive proof systems. Interactive proofs have gained a quite independent status as a part of Computational Complexity Theory.

Most books on cryptography contain some discussion of the topic. Schneier's book [452] discusses the idea of zero knowledge proofs and describes some zero knowledge protocols. An encyclopedic treatment of the subject can be found in [338]. Stinson's book [497] contains a comprehensive introduction to zero knowledge proofs. An entertaining exposure of the idea of zero knowledge was presented by Quisquater and Guillou at Crypto `89 [419]. Most of the presented results in this chapter can be found in the papers [61, 209, 211].

12.1 Interactive Proof Systems

The class NP can be seen as a class of problems for which there is a polynomial time proof of membership. An interactive proof system is a protocol which involves two parties: the prover P and veri er V . Sometimes P and V are called mnemonically Peggy and Vic, respectively. The veri er is assumed to be a polynomial time probabilistic algorithm. The prover, however, is a probabilistic algorithm with an unlimited computational power. Their interactions consist of a (polynomial) number of rounds. In each round, the veri er sends a challenge to the prover via a communication channel. The prover replies to the veri er.

410 12 ZERO KNOWLEDGE PROOF SYSTEMS

At the end of the interaction, the veri er is either convinced and stops in an accept state or is not convinced and halts in an reject state.

Given a decision problem Q (not necessarily in NP). Q has an interactive proof system if there is a protocol which satis es

{Completeness { for each yes-instance x of Q, V accepts x with probability

no smaller than 1 n c for every constant c > 0 (n means the size of the instance x),

{Soundness { for each no-instance, V rejects x with probability no smaller than 1 n c for any prover (honest or otherwise)

whenever V follows the protocol. It turns out [208], that the error probability in the completeness condition can be reduced to zero with no consequences for the protocol. In other words, V always accepts any yes-instance.

Consider an interactive proof based on the quadratic residue problem. Recall that ZNQ is the set of all integers in ZN whose Jacobi symbol with respect to N is equal to 1. The set ZNQ = ZNQ+ [ ZNQ . An integer x 2 ZNQ is a quadratic

residue modulo N if there is an integer y 2 Z such that y2 x mod N. We

N

simply say that x 2 ZNQ+. Otherwise, the integer x is a quadratic nonresidue or simply x 2 ZNQ . To decide whether x 2 ZNQ is a quadratic residue modulo N or not, one would need to nd the factorization of N and compute Jacobi symbols of x in respect to all (nontrivial) factors of N.

Name: Quadratic residue (QR) problem

Instance: Given a composite integer N. The integer x 2 ZNQ. Question: Does x belong to ZNQ+ (or is x a quadratic residue)?

An interactive proof for the QR problem proceeds as follows [211]. Both the prover and veri er know an instance (x; N) where x is an integer which may or may not be a quadratic residue modulo N. The interaction takes t(n) rounds. A round is started by P who picks up at random a quadratic residue u and sends it to V . V selects a random bit b and forwards it to P. If b = 0, the prover shows a random square root w of u to V . Otherwise, P shows a random square root w of (x u). As P is assumed to be of unlimited power, the computations of square roots can be done instantly. The veri er checks whether w2 is either u mod N if b = 0 or u x mod N if b = 1.

QR interactive proof { QR$