[Paper Review] Automatic Methods for Analyzing Non-Repudiation Protocols with an Active Intruder

Francis Klay, Judson Santos Santiago+1 more|ArXiv.org|Oct 17, 2007

Advanced Authentication Protocols Security16 references4 citations

TL;DR

This paper proposes a novel, annotation-based method for automatically analyzing non-repudiation and fairness in cryptographic protocols using knowledge tracking of protocol participants. Implemented in the AVISPA tool, the method detects previously unknown attacks in the optimistic Cederquist-Corin-Dashti (CCD) protocol, proving it lacks fairness due to timing and intruder-induced race conditions, and demonstrates broad applicability without modifying the underlying analysis engine.

ABSTRACT

Non-repudiation protocols have an important role in many areas where secured transactions with proofs of participation are necessary. Formal methods are clever and without error, therefore using them for verifying such protocols is crucial. In this purpose, we show how to partially represent non-repudiation as a combination of authentications on the Fair Zhou-Gollmann protocol. After discussing its limits, we define a new method based on the handling of the knowledge of protocol participants. This method is very general and is of natural use, as it consists in adding simple annotations, like for authentication problems. The method is very easy to implement in tools able to handle participants knowledge. We have implemented it in the AVISPA Tool and analyzed the optimistic Cederquist-Corin- Dashti protocol, discovering two unknown attacks. This extension of the AVISPA Tool for handling non-repudiation opens a highway to the specification of many other properties, without any more change in the tool itself.

Motivation & Objective

• To address the lack of automated tools for verifying fairness and non-repudiation in cryptographic protocols.
• To overcome the limitations of modeling non-repudiation as a combination of authentication properties, which fails to capture fairness and evidence symmetry.
• To develop a general, extensible method for specifying non-repudiation and fairness properties using simple annotations in formal verification tools.
• To enable the detection of subtle protocol flaws, such as timing-based attacks and intruder exploitation, in real-world non-repudiation protocols.
• To extend the AVISPA tool with support for non-repudiation analysis without requiring changes to its core verification engine.

Proposed method

• The method models protocol participants' knowledge using logical assertions, such as \texttt{aknows}(A,s,M), to represent what each agent knows at a given state.
• It introduces simple annotations—similar to those used for authentication—to express non-repudiation and fairness requirements.
• The approach uses a state invariant mechanism to encode that a participant must possess both the message and receipt evidence to prove participation.
• The AVISPA tool is extended to handle these knowledge assertions and verify them across protocol execution traces.
• The method is applied to the CCD protocol by specifying invariants that require both parties to obtain full evidence, and checking for violations.
• The analysis leverages AVISPA’s existing model-checking and symbolic execution capabilities to detect traces where fairness fails.

Experimental results

Research questions

• RQ1 Can non-repudiation and fairness be formally verified in cryptographic protocols using only knowledge assertions, without modifying the underlying verification engine?
• RQ2 Why does modeling non-repudiation as a combination of authentications fail to capture fairness in protocols like Fair Zhou-Gollmann?
• RQ3 Can an active intruder exploit timing or message delays to break fairness in optimistic non-repudiation protocols?
• RQ4 Are there previously undetected flaws in the Cederquist-Corin-Dashti (CCD) protocol that violate its fairness guarantee?
• RQ5 Can the proposed annotation-based method be reused across different non-repudiation protocols without tool reimplementation?

Key findings

• The method successfully detected two previously unknown attacks in the Cederquist-Corin-Dashti (CCD) protocol, proving it does not provide fairness.
• The first attack occurs when a network delay causes one party to abort and the other to resolve, leading to asymmetric evidence possession despite both being honest.
• The second attack involves a malicious intruder who intercepts the first message and triggers a TTP resolve before the honest party can abort, allowing the intruder to obtain full evidence while the honest party cannot.
• The protocol was corrected, and all subsequent verification scenarios on the revised version showed no attacks, confirming the flaw was in the original design.
• The method is general and reusable: it enables specification of non-repudiation and fairness in any protocol using only annotations, without modifying AVISPA’s core engine.
• The approach is efficient for bounded verification and opens the door to specifying other security properties in the same framework.