hash H
hash G
name k : message
name k' : message
name s0 : index -> message
mutable sT(i:index) : message = s0(i)
mutable sR(i:index) : message = s0(i)
abstract ok : message
channel cT
channel cR
process tag(i:index) =
sT(i):=H(sT(i),k);
out(cT,G(sT(i),k'))
process reader =
in(cT,x);
try find ii such that x = G(H(sR(ii),k),k') in
sR(ii):=H(sR(ii),k);
out(cR,ok)
system (!_i !_j T: tag(i) | !_jj R: reader).
Typed-check process:
null
Added action dependencies lemmas:
System after processing:
null
System Empty registered with actions (init).
[warning>Loaded "Prelude.sp".
<]global axiom namelength_k {'P:system} @system:(set:'P; equiv:None) :
[len k = namelength_message]
global axiom namelength_k' {'P:system} @system:(set:'P; equiv:None) :
[len k' = namelength_message]
global axiom namelength_s0 {'P:system} @system:(set:'P; equiv:None) :
[forall (i:index), len (s0 i) = namelength_message]
process tag (i:index) =
sT(i) := H (sT i@τ, k); out(cT,G (sT i@τ, k')); null
process reader =
in(cT,x);
find (ii) such that x = G (H (sR ii@τ, k), k') in
sR(ii) := H (sR ii@τ, k); out(cR,ok); null
Typed-check process:
( !_i( !_j( T: tag i)) ) | !_jj( R: reader )
Added action dependencies lemmas:
axiom mutex_R1_R {'P:system[like default]} @system:(set:'P; equiv:None) :
forall (jj,ii:index), not happens(R1(jj)) || not happens(R(jj, ii))
axiom mutex_R_R1 {'P:system[like default]} @system:(set:'P; equiv:None) :
forall (jj,ii:index), not happens(R(jj, ii)) || not happens(R1(jj))
axiom depends_init_R1 {'P:system[like default]} @system:(set:'P; equiv:None)
: forall (jj:index), happens(R1(jj)) => init < R1(jj)
axiom depends_init_R {'P:system[like default]} @system:(set:'P; equiv:None) :
forall (jj,ii:index), happens(R(jj, ii)) => init < R(jj, ii)
axiom depends_init_T {'P:system[like default]} @system:(set:'P; equiv:None) :
forall (i,j:index), happens(T(i, j)) => init < T(i, j)
System after processing:
( !_i( !_j( sT(i) := H (sT i@τ, k); T: out(cT,G (sT i@τ, k')); null)) ) |
!_jj(
in(cT,x);
find (ii) such that x = G (H (sR ii@τ, k), k') in
sR(ii) := H (sR ii@τ, k); R: out(cR,ok); null
else
R1: null)
System Empty registered with actions (init).
System default registered with actions (init,T,R,R1).
RUNNING EXAMPLE
This protocol is a variant of the OSK protocol described in: M.
Ohkubo, K. Suzuki, S. Kinoshita et al., “Cryptographic approach to
“privacy-friendly” tags,” RFID privacy workshop, vol. 82. Cambridge,
USA, 2003.
Each tag is associated to a mutable state sT initialized with s0.
Readers have access to a database containing an entry sR for each
authorized tag.
sT := H(sT,k) T -> R : G(sT,k’)
input x; sR := H(sR,k) if x = G(H(sR,k),k’) with sR in DB R -> T :
ok
COMMENTS - In this model we use two keyed hash functions H and G with
fixed keys k and k’, instead of two not keyed hash functions as in the
specification. We address this issue in the file
running-ex-oracle.sp
by adding a process in order to
provide the attacker the ability to compute hashes with their respective
keys (without knowing these keys).
HELPING LEMMAS - last update - disjoint chains
SECURITY PROPERTIES - authentication
******************************************************************************