Affiliations: [a] Dipartimento di Informatica, Università di Pisa, Via Pontecorvo, I-56127 Pisa, Italia. E-mails: [email protected], [email protected] | [b] Dipartimento di Scienze dei Linguaggi, Università di Sassari, via Tempio, 9, I-07100 Sassari, Italia. E-mail: [email protected] | [c] Informatics and Mathematical Modelling, Technical University of Denmark, Richard Petersens Plads bldg 321, DK-2800 Kongens Lyngby, Denmark. E-mail: [email protected]
Correspondence:
[**]
Corresponding author.
Note: [*] A preliminary version of this paper appeared in [6]. Research partially supported by the EU within the FET-GC II Integrated Project IST-2005-016004 SENSORIA and by Italian PRIN Project “SOFT”.
Abstract: A type flaw attack on a security protocol is an attack where an honest principal is cheated on interpreting a field in a message as the one with a type other than the intended one. In this paper, we shall present an extension of the LYSA calculus to cope with types, by using tags to represent the intended types of terms. We develop a Control Flow Analysis for this calculus which soundly over-approximates all the possible behaviour of a protocol and, in particular, is able to capture any type confusion that may occur during the protocol execution. The analysis acts in a descriptive way: it describes which violations may occur. In the same setting, our approach also offers a prescriptive usage: we can impose a type discipline, by forcing some data to be of the expected types. At this point, the analysis may statically check that type violations are not possible any longer. In other words, we instrument the code with the only checks necessary to enforce type security. Finally, we apply our framework to a multi-protocol setting, where the risk of having type flaw attacks is higher. Our analysis has been implemented and successfully applied to a number of security protocols, showing it is able to capture type flaw attacks. The implementation complexity of the analysis is low polynomial.
Keywords: Security of cryptographic protocols, Control Flow Analysis, type flaw attacks
