[Paper Review] Proving Security Goals With Shape Analysis Sentences

John D. Ramsdell|arXiv (Cornell University)|Mar 14, 2014

User Authentication and Security Systems12 references3 citations

TL;DR

This paper presents a method to import shape analysis sentences from the Cryptographic Protocol Shapes Analyzer (cpsa) into the PVS proof assistant, enabling formal verification of security goals using a semantically rich, shallow-embedded theory of strand spaces. By leveraging PVS's higher-order logic and built-in reasoning support, the approach allows for rigorous proof of authentication and secrecy goals, including counterexample generation when goals fail, while avoiding explicit handling of homomorphisms and substitutions.

ABSTRACT

The paper that introduced shape analysis sentences presented a method for extracting a sentence in first-order logic that completely characterizes a run of CPSA. Logical deduction can then be used to determine if a security goal is satisfied. This paper presents a method for importing shape analysis sentences into a proof assistant on top of a detailed theory of strand spaces. The result is a semantically rich environment in which the validity of a security goal can be determined using shape analysis sentences and the foundation on which they are based.

Motivation & Objective

• To enable formal, machine-checked verification of security goals in cryptographic protocols using a proof assistant.
• To overcome limitations of prior tools like Prover9, which cannot reason about structural properties such as transitivity of message precedences.
• To provide a semantically accurate environment where security goals can be proven or refuted with counterexamples.
• To eliminate the need to manually encode homomorphisms, substitutions, and skeletons within the proof assistant by using shape analysis sentences as transport mechanisms.
• To formally capture role semantics using height-instance predicates, improving on prior approaches that ignored role origination assumptions.

Proposed method

• Import shape analysis sentences—generated by cpsa—into the PVS proof assistant using a shallow embedding of strand space theory.
• Represent protocol executions as bundles over an initial algebra, replacing free algebras used in earlier models to simplify reasoning.
• Define the height-instance predicate (htin) to capture role-specific message occurrences and their ordering in execution traces.
• Use PVS's higher-order logic to express shape analysis sentences, enabling access to foundational lemmas such as transitivity of the precedes relation.
• Leverage PVS's type system and formal logic to verify security goals without explicitly modeling homomorphisms or substitutions.
• Construct counterexamples in PVS when a security goal fails, using adversarial stands to model man-in-the-middle attacks.

Experimental results

Research questions

• RQ1 Can shape analysis sentences from cpsa be effectively imported into a proof assistant to support formal verification of security goals?
• RQ2 Does using a shallow embedding of strand space theory in PVS improve the expressiveness and reliability of security proofs compared to first-order tools like Prover9?
• RQ3 Can the resulting framework detect flaws such as man-in-the-middle attacks by generating counterexamples when security goals are not provable?
• RQ4 How does the use of bundles over initial algebras compare to skeletons over free algebras in terms of supporting formal reasoning in PVS?
• RQ5 To what extent does capturing role semantics via height-instance predicates improve the accuracy of security goal verification?

Key findings

• The method successfully enables formal proof of security goals in PVS using shape analysis sentences, with full access to underlying strand space theory.
• The framework supports counterexample generation when a security goal is false, as demonstrated by constructing a man-in-the-middle attack that violates the authentication goal.
• The use of higher-order logic in PVS allows reasoning about structural properties such as transitivity of the precedes relation, which are not available in first-order tools like Prover9.
• The shallow embedding via bundles over initial algebras eliminates the need to explicitly represent homomorphisms and substitutions within PVS.
• The height-instance predicate (htin) correctly models role-specific message occurrences and enables precise reasoning about protocol execution traces.
• The approach improves on prior work by formally capturing role origination and eliminating assumptions that previously obscured semantic correctness.