of Extensions BAN
by Heather Goldsby Michelle Pirtle
CSE 914 - Michigan State University
Overview
BAN Logic Burrows, Abadi, and Needham GNY Gong, Needham, Yahalom RV AT Abadi and Tuttle VO van Oorschot SVO Syverson and van Oorschot Wenbo Mao Mao Comparison Conclusion
CSE 914 - Michigan State University
BAN Logic 1989
Goal: Offer a formalization of the description and analysis of authentication protocols over distributed computer systems
State what is accomplished by the protocol Allow reasoning about, and comparisons of, protocol assumptions Draw attention to unnecessary actions that can be removed from a protocol Highlight any encrypted messages that could be sent in clear text
Tool: SPEAR
Model analyzer for BAN Logic and GNY Developed for security protocols
CSE 914 - Michigan State University
1
BAN (cont.)
Advantages
Introduced a simple and powerful notation Logic postulates (ie. Nonce-verification rule) are straight forward to apply for deriving BAN beliefs
Disadvantages
Idealization step can cause analysis problems No formal syntax or semantics Does not account for improper encryption A principals beliefs cannot be changed at later stages of the protocol Logic limited to analyze authentication protocols Honesty and trust in other principals is not addressed
CSE 914 - Michigan State University
Foundation of Each Logic
BAN GNY BAN GNY GS AT VO SVO Mao RV X X X X X X X GS AT VO SVO Mao RV
X X X
X X X
X X X
X X
X
Read across - States which logic(s) were used to design the new logic Read down - States which logic(s) extended from the logic Logics listed in increasing year of publication
GNY - 1990
Goal: Gain ability to analyze more protocols in a more consistent manner Extends and reformulates BAN
Notions are expanded New rules and constructs Eliminate some of BANs universal assumptions
Tools:
SPEAR
Model analyzer for BAN Logic and GNY Developed for security protocols
Pattern scanner used as a parser for not-originated-here notion
CSE 914 - Michigan State University
2
GNY (cont.)
Advantages
Multiple levels of trust can be used in reasoning More protocols can be analyzed Making some BAN assumptions explicit allows for generality
Disadvantages
R6 is unsound Combining rules can result in unsound conclusions The set of rules is incomplete Some rules have redundant premises
E.g. I2
CSE 914 - Michigan State University
RV 1996
Goal: Provide a logic of belief, based on BAN for use with a theory generator Extension of BAN
Explicit interpretation
Idealization step
Fails to consider other interpretations Hidden assumptions about safety of message
Responsibility
Account for principals irresponsible behavior
Tool: RVChecker
Theory Generator
CSE 914 - Michigan State University
RV (cont.)
Advantages
Maintains the original simplicity of BAN Has tool support Addresses principal responsibility and the idealization step
Disadvantages
No formal syntax or semantics Unable to specify full range of protocols
CSE 914 - Michigan State University
3
AT 1991
Goal: Find a natural semantic model for BAN Extensions:
Provides formal syntax and semantics Simplifies existing BAN inference rules Reformulates inference rules as axioms Removes need for honesty
CSE 914 - Michigan State University
AT (cont.)
Advantages
Formal syntax and semantics Addresses question of principal honesty More elegant proof system owing to rules of BAN being rewritten as axioms
Disadvantages
No tool support Assumes perfect encryption Does not address idealization step
CSE 914 - Michigan State University
VO 1993
Goal: Extend BAN family of logics in a manner that allows authenticated key agreement protocols to be analyzed, and to better goals examine and beliefs in the protocols. Extensions
Refine the BAN construct shares the good crypto key Define new key confirmation primitive Define new postulates for use with reasoning about jointly established keys
CSE 914 - Michigan State University
4
VO (cont.)
Advantages
Accomplishes analysis of a new set of protocols Allows for a closer analysis of the goals and beliefs of the new set of protocols
Disadvantages
Time is ignored Message ordering is not addressed
CSE 914 - Michigan State University
SVO 1994
Goal: Unification of BAN, GNY, AT, & VO Extensions:
Include public keys New functions Message comprehensibility
CSE 914 - Michigan State University
SVO (cont.)
Advantages
Proved to be sound
Disadvantages
Not suited for tool support
SVD revamped SVO: developed to be compatible with Isabelle theorem prover
CSE 914 - Michigan State University
5
Mao 1995
Goal: Formalize the idealization step Extension:
Rule-based idealization technique Remove need for perfect encryption assumption
CSE 914 - Michigan State University
Mao (cont.)
Advantages
Formalization of idealization technique Eliminates assumption of perfect cryptography
Disadvantages
No tool support No proof of soundness for idealization rules
CSE 914 - Michigan State University
Comparison Table Part 1
Syntax BAN Logical Formal Semantics NO Separation of Semantics and Syntax NO Minimize Increases Number Universal of Protocols Assumptions Analyzed YES Cryptographic Adversary NO
GNY
Logical
NO
NO
YES
NO
RV AT VO SVO Mao
Logical Formal Logical Formal Formal
NO YES NO YES YES
NO YES NO YES YES
NO NO YES YES NO
NO NO Yes NO NO
NO NO
NO
CSE 914 - Michigan State University
6
Comparison Table Part 2
Assumes Perfect Address Cryptography Idealization Honesty BAN YES YES N O YES - notoriginatedGNY YES here YES YES - comes up with YES - done interpretation with legit RV YES rules rules AT YES NO YES VO YES NO N O SVO YES NO N O Mao NO YES N O Differ Levels of Trust NO Tool Support SPEAR SPEAR, pattern scanner
YES
NO NO YES YES YES
RVChecker NO NO NO NO
CSE 914 - Michigan State University
Conclusions
BAN gave a very good foundation to expand upon BAN-like logics do not need to be limited to authen...