DY*: A Modular Symbolic Verification Framework for Executable Cryptographic Protocol Code

Bhargavan, Karthikeyan and Bichhawat, Abhishek and Do, Quoc Huy and Hosseyni, Pedram and Küsters, Ralf and Schmitz, Guido and Würtele, Tim (2021) DY*: A Modular Symbolic Verification Framework for Executable Cryptographic Protocol Code. In: 2021 IEEE European Symposium on Security and Privacy, (Euro S & P) 2021 :. IEEE, pp. 523-542. ISBN 9781665430487

Full text not available from this repository.

Abstract

We present DY∗, a new formal verification framework for the symbolic security analysis of cryptographic protocol code written in the F∗ programming language. Unlike automated symbolic provers, our framework accounts for advanced protocol features like unbounded loops and mutable recursive data structures, as well as low-level implementation details like protocol state machines and message formats, which are often at the root of real-world attacks. Our work extends a long line of research on using dependent type systems for this task, but takes a fundamentally new approach by explicitly modeling the global trace-based semantics within the framework, hence bridging the gap between trace-based and type-based protocol analyses. This approach enables us to uniformly, precisely, and soundly model, for the first time using dependent types, long-lived mutable protocol state, equational theories, fine-grained dynamic corruption, and trace-based security properties like forward secrecy and post-compromise security. DY∗ is built as a library of F∗ modules that includes a model of low-level protocol execution, a Dolev-Yao symbolic attacker, and generic security abstractions and lemmas, all verified using F∗. The library exposes a high-level API that facilitates succinct security proofs for protocol code. We demonstrate the effectiveness of this approach through a detailed symbolic security analysis of the Signal protocol that is based on an interoperable implementation of the protocol from prior work, and is the first mechanized proof of Signal to account for forward and post-compromise security over an unbounded number of protocol rounds.

Item Type:
Contribution in Book/Report/Proceedings
ID Code:
213511
Deposited By:
Deposited On:
09 Feb 2024 13:20
Refereed?:
Yes
Published?:
Published
Last Modified:
16 Jul 2024 05:24