Trust a Few: The Weakest Assumptions a Protocol Needs
A verifier loop computes the weakest key, value, and channel assumptions a protocol needs to meet a goal.
The paper characterizes the weakest key, value, and channel assumptions a protocol needs to meet a security goal. Minimal stopping sets of attacks define that trust; the answer is unique once either/or assumptions are allowed, and deciding whether at most k assumptions suffice is NP-hard. A loop using a bounded analyser and CPSA finds the weakest trust for 18 goals across ten protocols and agrees with exhaustive verification. It shows a Kerberos PKINIT model states an assumption the client's server authentication does not need, and identifies channel assumptions under which Needham-Schroeder meets its goal in a bounded model.
- Weakest trust equals the minimal ways to stop all minimal attacks.
- Deciding whether at most k assumptions suffice is NP-hard.
- The loop matches exhaustive checks on 18 goals over ten protocols.
- Kerberos PKINIT client authentication does not need one stated assumption.
- Bounded Needham-Schroeder meets its goal under identified channel assumptions.
- Products
- KerberosNeedham-SchroederCPSA
From the original article
1 min read at arxiv.orgProtocol verifiers check whether a protocol meets a security goal under stated trust assumptions, such as that a key is never leaked, a value is fresh, or a channel is authentic. They do not say which of those assumptions the goal needs. Rowe, Guttman and Liskov asked for the weakest assumptions under which a protocol achieves a goal and left the question open.
By Bhumika Mittal · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.