hash hmac
name sk : index -> message
name msgA : index * index -> message
name msgB : index * index -> message
abstract SIGN : message
abstract myZero : message
abstract ok : message
mutable cellA(i:index) : message = myZero
mutable cellB(i:index) : message = myZero
channel cR
channel cS
(* mySucc function for counter *)
abstract mySucc : message -> message
(* order relation for counter *)
abstract (~<) : message -> message -> bool
(* PROCESSES *)
process ReceiverA(i,j:index) =
in(cR,x);
if fst(snd(fst(x))) = SIGN
&& cellA(i) ~< snd(snd(fst(x)))
&& snd(x) = hmac(<snd(snd(fst(x))),fst(fst(x))>,sk(i))
then
cellA(i) := mySucc(cellA(i));
out(cS,ok)
process ReceiverB(i,j:index) =
in(cR,x);
if fst(snd(fst(x))) = SIGN
&& cellB(i) ~< snd(snd(fst(x)))
&& snd(x) = hmac(<snd(snd(fst(x))),fst(fst(x))>,sk(i))
then
cellB(i) := mySucc(cellB(i));
out(cS,ok)
process SenderA(i,j:index) =
cellA(i) := mySucc(cellA(i));
out(cR,<<msgA(i,j),<SIGN,cellA(i)>>,hmac(<cellA(i),msgA(i,j)>,sk(i))>)
process SenderB(i,j:index) =
cellB(i) := mySucc(cellB(i));
out(cR,<<msgB(i,j),<SIGN,cellB(i)>>,hmac(<cellB(i),msgB(i,j)>,sk(i))>)
system ((!_i !_j ReceiverA(i,j)) | (!_i !_j SenderA(i,j)) |
(!_i !_j ReceiverB(i,j)) | (!_i !_j SenderB(i,j))).
Typed-check process:
null
Added action dependencies lemmas:
System after processing:
null
System Empty registered with actions (init).
[warning>Loaded "Prelude.sp".
<]global axiom namelength_sk {'P:system} @system:(set:'P; equiv:None) :
[forall (i:index), len (sk i) = namelength_message]
global axiom namelength_msgA {'P:system} @system:(set:'P; equiv:None) :
[forall (i:index * index), len (msgA i) = namelength_message]
global axiom namelength_msgB {'P:system} @system:(set:'P; equiv:None) :
[forall (i:index * index), len (msgB i) = namelength_message]
process ReceiverA (i,j:index) =
in(cR,x);
if fst (snd (fst x)) = SIGN &&
cellA i@τ ~< snd (snd (fst x)) &&
snd x = hmac (<snd (snd (fst x)),fst (fst x)>, sk i) then
cellA(i) := mySucc (cellA i@τ); out(cS,ok); null
process ReceiverB (i,j:index) =
in(cR,x);
if fst (snd (fst x)) = SIGN &&
cellB i@τ ~< snd (snd (fst x)) &&
snd x = hmac (<snd (snd (fst x)),fst (fst x)>, sk i) then
cellB(i) := mySucc (cellB i@τ); out(cS,ok); null
process SenderA (i,j:index) =
cellA(i) := mySucc (cellA i@τ);
out(cR,
<<msgA (i, j),<SIGN,cellA i@τ>>,hmac (<cellA i@τ,msgA (i, j)>, sk i)>);
null
process SenderB (i,j:index) =
cellB(i) := mySucc (cellB i@τ);
out(cR,
<<msgB (i, j),<SIGN,cellB i@τ>>,hmac (<cellB i@τ,msgB (i, j)>, sk i)>);
null
Typed-check process:
( !_i( !_j( ReceiverA i j)) ) |
( !_i( !_j( SenderA i j)) ) |
( !_i( !_j( ReceiverB i j)) ) |
!_i( !_j( SenderB i j))
Added action dependencies lemmas:
axiom mutex_ReceiverB1_ReceiverB {'P:system[like default]}
@system:(set:'P; equiv:None) :
forall (i,j:index),
not happens(ReceiverB1(i, j)) || not happens(ReceiverB(i, j))
axiom mutex_ReceiverB_ReceiverB1 {'P:system[like default]}
@system:(set:'P; equiv:None) :
forall (i,j:index),
not happens(ReceiverB(i, j)) || not happens(ReceiverB1(i, j))
axiom mutex_ReceiverA1_ReceiverA {'P:system[like default]}
@system:(set:'P; equiv:None) :
forall (i,j:index),
not happens(ReceiverA1(i, j)) || not happens(ReceiverA(i, j))
axiom mutex_ReceiverA_ReceiverA1 {'P:system[like default]}
@system:(set:'P; equiv:None) :
forall (i,j:index),
not happens(ReceiverA(i, j)) || not happens(ReceiverA1(i, j))
axiom depends_init_SenderB {'P:system[like default]}
@system:(set:'P; equiv:None) :
forall (i,j:index), happens(SenderB(i, j)) => init < SenderB(i, j)
axiom depends_init_ReceiverB1 {'P:system[like default]}
@system:(set:'P; equiv:None) :
forall (i,j:index), happens(ReceiverB1(i, j)) => init < ReceiverB1(i, j)
axiom depends_init_ReceiverB {'P:system[like default]}
@system:(set:'P; equiv:None) :
forall (i,j:index), happens(ReceiverB(i, j)) => init < ReceiverB(i, j)
axiom depends_init_SenderA {'P:system[like default]}
@system:(set:'P; equiv:None) :
forall (i,j:index), happens(SenderA(i, j)) => init < SenderA(i, j)
axiom depends_init_ReceiverA1 {'P:system[like default]}
@system:(set:'P; equiv:None) :
forall (i,j:index), happens(ReceiverA1(i, j)) => init < ReceiverA1(i, j)
axiom depends_init_ReceiverA {'P:system[like default]}
@system:(set:'P; equiv:None) :
forall (i,j:index), happens(ReceiverA(i, j)) => init < ReceiverA(i, j)
System after processing:
( !_i(
!_j(
in(cR,x);
if fst (snd (fst x)) = SIGN &&
cellA i@τ ~< snd (snd (fst x)) &&
snd x = hmac (<snd (snd (fst x)),fst (fst x)>, sk i) then
cellA(i) := mySucc (cellA i@τ); ReceiverA: out(cS,ok); null
else
ReceiverA1: null)) ) |
( !_i(
!_j(
cellA(i) := mySucc (cellA i@τ);
SenderA: out(cR,
<<msgA (i, j),<SIGN,cellA i@τ>>,
hmac (<cellA i@τ,msgA (i, j)>, sk i)>);
null)) ) |
( !_i(
!_j(
in(cR,x);
if fst (snd (fst x)) = SIGN &&
cellB i@τ ~< snd (snd (fst x)) &&
snd x = hmac (<snd (snd (fst x)),fst (fst x)>, sk i) then
cellB(i) := mySucc (cellB i@τ); ReceiverB: out(cS,ok); null
else
ReceiverB1: null)) ) |
!_i(
!_j(
cellB(i) := mySucc (cellB i@τ);
SenderB: out(cR,
<<msgB (i, j),<SIGN,cellB i@τ>>,
hmac (<cellB i@τ,msgB (i, j)>, sk i)>);
null))
System Empty registered with actions (init).
System default registered with actions
(init,ReceiverA,ReceiverA1,SenderA,ReceiverB,ReceiverB1,SenderB).
CANAUTH
Vincent Cheval, Véronique Cortier, and Mathieu Turuani. “A Little
More Conversation, a Little Less Action, a Lot More Satisfaction: Global
States in ProVerif”. CSF 2018.
Sender -> Receiver :
<<msg,<SIGN,ctr>>,hmac(<ctr,msg>,sk)> ctr :=
ctr+1 Receiver -> Sender : input x, check x ctr := ctr+1
An agent has a cell which is used to store a counter. This counter is
incremented at each action (receive or send).
HELPING LEMMAS - counter increase
SECURITY PROPERTIES - authentication - injectivity
******************************************************************************