Computationally Complete Symbolic Attacker in Action
Abstract
We show that the recent technique of computationally complete symbolic attackers
proposed by Bana and Comon-Lundh [6] for computationally sound verification of security
protocols is powerful enough to verify actual protocols. In their work, Bana and Comon-Lundh
presented only the general framework, but they did not introduce sufficiently many axioms to
actually prove protocols.
We present a set of axioms—some generic axioms that are computationally sound for all PPT
algorithms, two specific axioms that are sound for CCA2 secure encryptions, and a further minimal
parsing assumption for pairing—and illustrate the power of this technique by giving the
first computationally sound verification (secrecy and authentication) via symbolic attackers of
the NSL Protocol that does not need any further restrictive assumptions about the computational
implementation.
In other words, all implementations for which the axioms are sound—namely, implementations
using CCA2 encryption, and satisfying the parsing requirement for pairing—exclude the possibility
of successful computational attacks. Furthermore, the axioms are entirely modular and
not particular to the NSL protocol (except for the parsing assumption without which there is an
attack).