Decision and Complexity of Dolev-Yao Hyperproperties

The formal analysis of cryptographic protocols traditionally focuses on trace and equivalence properties, for which decision procedures in the symbolic (or Dolev-Yao, or DY) model are known. However, many relevant security properties are expressed as DY hyperproperties that involve quantifications o...

Full description

Saved in:
Bibliographic Details
Published in:Proceedings of ACM on programming languages Vol. 8; no. POPL; pp. 1913 - 1944
Main Authors: Rakotonirina, Itsaka, Barthe, Gilles, Schneidewind, Clara
Format: Journal Article
Language:English
Published: New York, NY, USA ACM 02.01.2024
Subjects:
Cryptographic protocols
Formal security models
Logic and verification
Security and privacy
Theory of computation
security protocols
hyperproperties
computational complexity
ISSN:2475-1421, 2475-1421
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:The formal analysis of cryptographic protocols traditionally focuses on trace and equivalence properties, for which decision procedures in the symbolic (or Dolev-Yao, or DY) model are known. However, many relevant security properties are expressed as DY hyperproperties that involve quantifications over both execution paths and attacker computations (which are constrained by the attacker’s knowledge in the underlying model of computation). DY hyperproperties generalise hyperproperties, for which many decision procedures exist, to the setting of DY models. Unfortunately, the subtle interactions between both forms of quantifications have been an obstacle to lifting decision procedures from hyperproperties to DY hyperproperties. The central contribution of the paper is the first procedure for deciding DY hyperproperties, in the usual setting where the number of protocol sessions is bounded and where the equational theory modelling cryptography is subterm-convergent. We prove that our decision procedure can decide the validity of any hyperproperty in which quantifications over messages are guarded and quantifications over attacker computations are limited to expressing the attacker’s knowledge. We also establish the complexity of the decision problem for several important fragments of the hyperlogic. Further, we illustrate the techniques and scope of our contributions through examples of related hyperproperties.
ISSN:2475-1421
2475-1421
DOI:10.1145/3632906