Abstract

A novel protocol has been formally analyzed using the prover Isabelle/HOL, following the inductive approach described in earlier work [11]. There is no limit on the length of a run, the nesting of messages or the number of agents involved. A single run of the protocol delivers session keys for all the agents, allowing neighbours to perform mutual authentication. The basic security theorem states that session keys are correctly delivered to adjacent pairs of honest agents, regardless of whether other agents in the chain are compromised. The protocol's complexity caused some difficulties in the specification and proofs, but its symmetry reduced the number of theorems to prove. CONTENTS i Contents 1 Introduction 1 2 The Recursive Authentication Protocol 2 3 Review of the Inductive Approach 4 4 A Formalization of Hashing 6 5 Modelling the Protocol 7 5.1 Modelling the Server . . . . . . . . . . . . . . . . . . . . . . . 8 5.2 A Coarser Model of the Server . . . . . . . . . . . . . . . . ....

Citations

1040	R.: A logic for authentication - Burrows, Abadi, et al. - 1989
548	Breaking and fixing the Needham-Schroeder public-key protocol using CSP and FDR - Lowe
386	Isabelle: A generic theorem prover - Paulson - 1994
332	Prudent engineering practice for cryptographic protocols - Abadi, Needham - 1990
183	A compiler for the analysis of security protocols - Casper - 1997
138	Proving properties of security protocols by induction - Paulson - 1997
112	E cient and Timely Mutual Authentication - Otway, Rees - 1987
61	Analyzing the needham-schroeder public-key protocol: A comparison of two approaches - Meadows - 1996
43	An approach to the formal verification of cryptographic protocols - Bolignano - 1996
22	The authentication protocol - Bull, Otway - 1997