%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\documentstyle[12pt,twoside,alltt,psfig]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of=20
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1997}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{16}{October 28, 1997}{Ron Rivest}{Chris Sepulveda}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem}=20
% \begin{definition} ... \end{definition}=20
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following:=20
% 1) Prepare your figures using your favourite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following
convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you=20
% 	are scribing and mm is the sequential number of the picture in the=20
% 	notes
% 3) Insert the following block in your LaTeX code in the place you=20
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena:=20
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and=20
% 	print your notes, but don't worry the TA will take care of it.=20
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well=20
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Handouts}
\begin{itemize}
\item Midterm Quiz
\item {\sl A Logic for Authentification} by Burrows, Abadi, and Needham
\end{itemize}

\section{Today's Topics}
\begin{itemize}
\item Kerberos
\item BAN Logic -- for proving the security of protocols
\item BAN Logic proof of Kerberos
\end{itemize}

\section{Kerberos}
\subsection{The Kerberos protocol}

\begin{figure}[h]
\begin{center}
\mbox{\psfig{figure=notes-16-fig-1.ps}}
\caption{The Kerberos Protocol.}
\label{fig:kerberos}
\end{center}
\end{figure}

Assumptions
\begin{itemize}
\item A and B have no prior knowledge of each other (i.e., no public
keys)
\item A and B trust S
\item A and B have established secret keys with S ($k_{as}$, $k_{bs}$)
\end{itemize}

The protocol is defined as follows:
\begin{enumerate}
\item  $A$ sends a request for an authenticator for $B$ to $S$.
\item $S$ replies with a message only decodable by $A$ which contains a
timestamp and an authenticator $A$ can send to $B$ to demonstate he is
real.
\item sends an initial message to $B$ telling him he is there, has a
valid authenticator, and wants to know if he knows how to decode it
and reply.
\item Finally, B demonstrates that he can parse the
authenticator and sends back a reply to A's challenge.
\end {enumerate}

\section{BAN Logic}
In the Kerberos protocol, for example, how can we be sure that it is
secure? We ideally would like some formal method for asserting that we
trust or don't trust the Kerberos protocol. BAN logic is an attempt to
provide a formal method for analyzing protocols.

The basic problems that BAN logic tries to address is:
\begin{itemize}
\item there is some goal we want to achieve
\item we have some idea of what we want, need
\item we want to satisfy ourselves that our solution to the the above
goal works
\item we don't want to depend on trial by fire
\end{itemize}

There are a lot of problems involved when trying to prove security. As
we go over BAN logic, we want to scrutinize it, considering how much do
we trust its validity? Are the rules of BAN logic sound and reasonable?
When are assumptions being made and what are they?.

Even if we prove something like Kerberos works theoretically, we still
can have problems. Using somthing like BAN logic, we are proving the
ideal. Unfortunately, implementations aren't always(ever?) ideal.  This
is just another concern we need to be aware of.

\subsection{The BAN terms (principals)}
The following terms are described in the BAN paper.
\begin {description}
\item [Principals] are those agents involved in the protocol (usually
people or programs). $P$, $Q$, $R$ are all possible symbols for the
principals. ($S$,$A$,$B$ are principals in Kerberos).
\item [Keys] are used to encrypt messages
symmetrically. $K_{ab}$ and $K_{as}$ are possible keys.
\item [Public Keys] are similar to Keys except that they are used in
pairs,
one of which is known to all. $(K_{b}, K_{b}^{-1})$ is a possible
pair.
\item [Nonces] are message parts that are not meant to be
repeated. $N_{a}$, $N_{b}$ are nonces.
\item [Timestamps] are similar to nonces in that they are unlikely to
be repeated. However, they reflect the current time of the person
creating them. $T_{a}$, $T_{b}$ are timestamps.
\end {description}



\subsection {The {\sl BAN} Statements}
Once we have a formal definition of terms, we need a formal definition
of the statements we may make (the constructs)
\begin {description}
\item [$P$ believes $X$]: $P$ {\it believes } $X$, or $P$ would be
entitled to believe $X$. In particular, $P$ can take $X$ as true.
\item [$P$ sees $X$]: $P$ {\it sees} $X$. $P$ has received some message
$X$ and is capable of reading and repating it.
\item [$P$ said $X$]: $P$ {\it once said} $X$. $P$ at some time sent a
message including the statement $X$. It is not knownwhether this is a
replay, though it is known that $P$ believed $X$
when he sent it.
\item [$P$ controls $X$]: $P$ has {\it jurisdiction over} $X$. The
principal $P$ is an authority on $X$ and should be trusted on this
matter. (In Kerberos, $S$ controls $K_{ab}$)
\item [fresh($X$)]: The message $X$ is {\it fresh}; that is, $X$ has
not been sent in a message at any time before the current run of the
protocol. This is usually true for {\it nonces}.
\item [$P \stackrel{K}{\leftrightarrow} Q$]: $P$ and $Q$ may use the
{\it shared key} $K$ to communicate. The key $K$ is good in that it
will be known only by  $P$ and $Q$.
\item [$\stackrel{K}{\mapsto} P$]: $P$ has $K$ as a {\it public
key}. The matching {\it secret key} (denoted $K^{-1}$) will never be
discovered by any principal excpet $P$ or a principal trusted by $P$.
\item [$P \stackrel{X}{\rightleftharpoons} Q$]: The formula $X$ is a
{\it secret} known only to $P$ and to $Q$, and possibly to principals
trusted by them. Only $P$ and $Q$ may use $X$ to prove their
identities to one another. An example is a secret password.
\item [{$\{X\}_K \mbox{ or } [X]_K$}]: This represents the formula $X$
encrypted under the key $K$. This is short for $[X]_K {\it from} P$.
\item [$\langle X \rangle _Y$]: This represents $X$ {\it combined
with} the formula $Y$. $Y$ is intended to be secret and that its
presence proves the identity of whoever utters $\langle X
\rangle_Y$. In implementations, $X$ can simply be concatenated with
the password $Y$. We assume that this is encrypted so that replay
cannot be used.
\end {description}

\subsection{Ban Rules of Inference}
\begin {enumerate}
\item {\it Message meaning rules} concern the interpretation of
messages. They all derive beliefs about the origin of messages.

For shared keys, we postulate \[\frac{ P \mbox{ believes } Q
\stackrel{K}{\leftrightarrow} P, P \mbox{ sees } [X]_K}{P \mbox {
believes } Q \mbox{ said } X} \] That is, if $P$ believes that the key
$K$ is shared with $Q$ and sees $X$ encrypted under $K$, then $P$
believes that $Q$ once said $X$.

For public keys, we postulate \[ \frac{P \mbox{ believes }
\stackrel{K}{\mapsto} Q \mbox{, } P \mbox{ sees } [X]_{K^{-1}}}{ P
\mbox{ believes } Q \mbox{ said } X} \]
That is, if P believes that $K$ is $Q$'s public key, and $P$ receives
a message encoded with $Q$'s secret key, then $P$ believes $Q$ once
said $X$.

For shared secrets, we postulate \[ \frac{P \mbox{ believes } Q
\stackrel{Y}
{\rightleftharpoons} P \mbox{, } P \mbox{ sees } \langle X \rangle _Y}
{P \mbox{ believes } Q \mbox{ said } X} \]
That is, if $P$ believes that the secret $Y$ is shared with $Q$ and
sees $\langle X \rangle _Y$, then $P$ believes that $Q$ once said $X$.
\item The {\it nonce-verification} rule expresses the check that a
message is recent, and hence, that the sender still believes in it:
\[ \frac {P \mbox{ believes fresh } (X) \mbox{, } P \mbox{ believes }
Q \mbox{ said } X} { P \mbox{ believes } Q \mbox{ believes } X} \]
That is, if $P$ believes that $X$ could have been uttered only
recently and that $Q$ once said $X$, then $P$ believes that $Q$
believes $X$. For simplicity, $X$ should be ``cleartext''.
\item The {\it jurisdiction} rule states that if $P$ believes that $Q$
has jurisdiction over $X$, then $P$ trusts $Q$ on the trueth of $X$:
\[ \frac { P \mbox{ believes } Q \mbox{ controls } X \mbox{, } P
\mbox{ believes } Q \mbox{ believes } X} { P \mbox{ believes } X} \]
\item If a principal sees a formula, the he also sees its components,
provided he knows the necessary keys:
\begin{center}
\begin{tabular}{clr}
$\frac{P \mbox{ sees } (X, Y)}{P \mbox{ sees } X}$, & $\frac{P \mbox{
sees } \langle X \rangle _Y}{P \mbox{ sees } X}$, & $\frac{ P \mbox{
believes } Q \stackrel{K}{\leftrightarrow} P \mbox(, ) P \mbox{ sees }
[X]_K}{P \mbox{ sees } X}$, \\
\end{tabular}

\begin{tabular}{clr}
$\frac{P \mbox{ believes } \stackrel{K}{\mapsto} P \mbox{, } P \mbox{
sees } [X]_K}{P \mbox{ sees } X}$, & $\frac{P \mbox{ believes }
\stackrel{K}{\mapsto} P \mbox{, } P \mbox{ sees } [X]_{K^{-1}}}{P
\mbox{ sees } X}$. \\
\end{tabular}
\end{center}
Note that if $P$ sees $X$ and $P$ sees $Y$ it does NOT follow that $P$
sees $(X, Y)$ since that means that $X$ and $Y$ were uttered at the
same time.
\item If one part of the formula is fresh, then the entire formula must
be fresh:
\[ \frac { P \mbox{ believes fresh}(X)}{P \mbox{ believes fresh}(X,
Y)} . \]

\end {enumerate}

\section{Proof of Kerberos}
Now that we have a system for proving a protocol works, lets test the
Kerberos protocol.

\subsection{Kerberos, in BAN logic}
Let's re write the protocol in the language of BAN logic.
\begin{enumerate}
\item $A \rightarrow S: (A,B)$
\item $S \rightarrow A:[T_s, A \stackrel{K_{ab}}{\leftrightarrow} B,
[T_s, A \stackrel{K_{ab}}{\leftrightarrow} B]_{K_{bs}}]_{K_{as}}$
\item $A \rightarrow B: [T_s, A \stackrel{K_{ab}}{\leftrightarrow}
B]_{K_{bs}}, [T_s, A \stackrel{K_{ab}}{\leftrightarrow} B]_{K_{ab}}$
\item $B \rightarrow A: [T_s, A \stackrel{K_{ab}}{\leftrightarrow}
B]_{K_{ab}}$
\end {enumerate}

\subsection{Goals}
We want to prove the following:
\begin{center}
$A  \mbox{ believes } A \stackrel {K_{ab}}{\leftrightarrow} B$ \&
$B \mbox{ believes } A \stackrel {K_{ab}} \leftrightarrow B$

and ideally

$A \mbox{ believes } B \mbox{ believes } A \stackrel {K_{ab}} \leftrightarrow B$ \&
$B \mbox{ believes } A \mbox{ believes } A \stackrel {K_{ab}} \leftrightarrow B$
\end{center}

Basically, we want A and B to establish their key, $K_{ab}$ and believe
that each has the key and that is is valid. Also, we would like each to
believe that the other believes that they have established the same,
valid key.

\subsection{Assumptions}
\begin{center}
\begin{tabular}{clr}
$A \mbox{ believes } A \stackrel{K_{as}}\leftrightarrow S$, &
$B \mbox{ believes } B \stackrel{K_{bs}}\leftrightarrow S$,\\
$S \mbox{ believes } A \stackrel{K_{as}}\leftrightarrow S$, &
$S \mbox{ believes } B \stackrel{K_{bs}}\leftrightarrow S$, \\
$S \mbox{ believes } A \stackrel{K_{ab}}\leftrightarrow B$, &
$B \mbox{ believes } (S \mbox { controls } A \stackrel K \leftrightarrow
B)$, \\
$A \mbox{ believes } (S \mbox { controls } A \stackrel K \leftrightarrow
B)$, &
$B \mbox{ believes fresh} (T_s) $, \\
$A \mbox{ believes fresh} (T_s) $, &
$B \mbox{ believes fresh} (T_a) $, \\
\end{tabular}
\end{center}

\subsection{the proof}

Starting with message 2 (see protocol),
\[ A \mbox{ sees } [ T_s \mbox{, }
( A \stackrel{K_{ab}} \leftrightarrow B) \mbox{, } [T_s \mbox{, } A
\stackrel {K_{ab}} \leftrightarrow B]_{K_{bs}}]_{K_{as}} \]
and using the assumption
\[ A \mbox{ believes } A \stackrel {K_as}\leftrightarrow S \]
apply a {\it message meaning rule} for shared keys we get
\[A \mbox{ believes } S \mbox{ said } (T_s \mbox{, } (A
\stackrel{K_{ab}} \leftrightarrow B) \mbox{, }[T_s\mbox{, }
A \stackrel{K_{ab}}\leftrightarrow B]_{K_{bs}}) \]
which can be broken up into
\[A \mbox{ believes } S \mbox{ said } (T_s \mbox{, } ( A
\stackrel{K_{ab}} \leftrightarrow B)) \]
Using the assumption
\[ A \mbox{ believes fresh}(T_s) \]
and the {\it nonce verification rule}, we get
\[ A \mbox{ believes } S \mbox{ believes } (T_s, A \stackrel {K_{ab}}
\leftrightarrow B) \]
Breaking this up into
\[ A \mbox{ believes } S \mbox{ believes } A
\stackrel{K_{ab}}\leftrightarrow B \]
Now use the assumption
\[ A \mbox{ believes } S \mbox{ controls } A \stackrel {K_{ab}}
\leftrightarrow B \]
with the {\it juristiction rule} we get
\[ A \mbox{ believes } A \stackrel {K_{ab}} \leftrightarrow B \]

This completes the analysis of messaage 2.

You can repeat the same analysis to get
\[ B \mbox{ believes } A \stackrel {K_{ab}} \leftrightarrow B \]
Now message 3 can be decrypted and the following can be proved
\[ B \mbox{ believes } A \mbox{ believes } A
\stackrel{K_{ab}}\leftrightarrow B \]
The last message assures A that B believes the key.  We can use the {\it
nonve verification} and {\it message meaning} rules to prove
\begin{center}
\begin{tabular}{clr}
$A \mbox{ believes } A \stackrel {K_{ab}} \leftrightarrow B$ &
$B \mbox{ believes } A \stackrel {K_{ab}} \leftrightarrow B$ \\
$A \mbox{ believes } B \mbox{ believes } A \stackrel {K_{ab}}
\leftrightarrow B$ &
$B \mbox{ believes } A \mbox{ believes } A \stackrel {K_{ab}}
\leftrightarrow B$ \\
\end{tabular}
\end{center}

We have proved our goals, and can verify that the idealization of
Kerberos works, given our assumptions.



%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}
