Serveur d'exploration sur la recherche en informatique en Lorraine

Attention, ce site est en cours de développement !
Attention, site généré par des moyens informatiques à partir de corpus bruts.
Les informations ne sont donc pas validées.

Automatic Analysis of the Security of XOR-based Key Management Schemes.

Identifieur interne : 004992 ( Main/Exploration ); précédent : 004991; suivant : 004993

Automatic Analysis of the Security of XOR-based Key Management Schemes.

Auteurs : Véronique Cortier [France] ; Keighren Gavin [Royaume-Uni] ; Graham Steel [Royaume-Uni]

Source :

RBID : Hal:inria-00181616

Abstract

We describe a new algorithm for analysing security protocols that use XOR, such as key-management APIs. As a case study, we consider the IBM4758 CCA API, which is widely used in the ATM(cash machine) network. Earlier versions of the CCA API were shown to have serious flaws, and the fixes introduced by IBM in version 2.41 had not previously been formally analysed. We first investigate IBM's proposals using a model checker for security protocol analysis, uncovering some important issues about their implementation. Having identified configurations we believed to be safe, we describe the formal verification of their security. We first define a new class of protocols, containing in particular all the versions of the CCA API. We then show that secrecy after an unbounded number of sessions is decidable for this class. Implementing the decision procedure requires some improvements, since the procedure is exponential. We describe a change of representation that leads to an implementation able to verify a configuration of the API in a few seconds. As a consequence, we obtain the first security proof of the fixed IBM 4758 CCA API with unbounded sessions.

Url:


Affiliations:


Links toward previous steps (curation, corpus...)


Le document en format XML

<record>
<TEI>
<teiHeader>
<fileDesc>
<titleStmt>
<title xml:lang="en">Automatic Analysis of the Security of XOR-based Key Management Schemes.</title>
<author>
<name sortKey="Cortier, Veronique" sort="Cortier, Veronique" uniqKey="Cortier V" first="Véronique" last="Cortier">Véronique Cortier</name>
<affiliation wicri:level="1">
<hal:affiliation type="researchteam" xml:id="struct-2366" status="OLD">
<idno type="RNSR">200318302K</idno>
<orgName>Combination of approaches to the security of infinite states systems</orgName>
<orgName type="acronym">CASSIS</orgName>
<desc>
<address>
<country key="FR"></country>
</address>
<ref type="url">http://www.inria.fr/equipes/cassis</ref>
</desc>
<listRelation>
<relation active="#struct-160" type="direct"></relation>
<relation name="UMR7503" active="#struct-441569" type="indirect"></relation>
<relation active="#struct-300009" type="indirect"></relation>
<relation active="#struct-300291" type="indirect"></relation>
<relation active="#struct-300292" type="indirect"></relation>
<relation active="#struct-300293" type="indirect"></relation>
<relation active="#struct-866" type="direct"></relation>
<relation active="#struct-242365" type="indirect"></relation>
<relation active="#struct-300261" type="indirect"></relation>
<relation active="#struct-300360" type="indirect"></relation>
<relation name="UMR6174" active="#struct-441569" type="indirect"></relation>
<relation active="#struct-2496" type="direct"></relation>
</listRelation>
<tutelles>
<tutelle active="#struct-160" type="direct">
<org type="laboratory" xml:id="struct-160" status="OLD">
<orgName>Laboratoire Lorrain de Recherche en Informatique et ses Applications</orgName>
<orgName type="acronym">LORIA</orgName>
<desc>
<address>
<addrLine>Campus Scientifique BP 239 54506 Vandoeuvre-lès-Nancy Cedex</addrLine>
<country key="FR"></country>
</address>
<ref type="url">http://www.loria.fr</ref>
</desc>
<listRelation>
<relation name="UMR7503" active="#struct-441569" type="direct"></relation>
<relation active="#struct-300009" type="direct"></relation>
<relation active="#struct-300291" type="direct"></relation>
<relation active="#struct-300292" type="direct"></relation>
<relation active="#struct-300293" type="direct"></relation>
</listRelation>
</org>
</tutelle>
<tutelle name="UMR7503" active="#struct-441569" type="indirect">
<org type="institution" xml:id="struct-441569" status="VALID">
<idno type="ISNI">0000000122597504</idno>
<idno type="IdRef">02636817X</idno>
<orgName>Centre National de la Recherche Scientifique</orgName>
<orgName type="acronym">CNRS</orgName>
<date type="start">1939-10-19</date>
<desc>
<address>
<country key="FR"></country>
</address>
<ref type="url">http://www.cnrs.fr/</ref>
</desc>
</org>
</tutelle>
<tutelle active="#struct-300009" type="indirect">
<org type="institution" xml:id="struct-300009" status="VALID">
<orgName>Institut National de Recherche en Informatique et en Automatique</orgName>
<orgName type="acronym">Inria</orgName>
<desc>
<address>
<addrLine>Domaine de VoluceauRocquencourt - BP 10578153 Le Chesnay Cedex</addrLine>
<country key="FR"></country>
</address>
<ref type="url">http://www.inria.fr/en/</ref>
</desc>
</org>
</tutelle>
<tutelle active="#struct-300291" type="indirect">
<org type="institution" xml:id="struct-300291" status="OLD">
<orgName>Université Henri Poincaré - Nancy 1</orgName>
<orgName type="acronym">UHP</orgName>
<date type="end">2011-12-31</date>
<desc>
<address>
<addrLine>24-30 rue Lionnois, BP 60120, 54 003 NANCY cedex, France</addrLine>
<country key="FR"></country>
</address>
</desc>
</org>
</tutelle>
<tutelle active="#struct-300292" type="indirect">
<org type="institution" xml:id="struct-300292" status="OLD">
<orgName>Université Nancy 2</orgName>
<date type="end">2011-12-31</date>
<desc>
<address>
<addrLine>91 avenue de la Libération, BP 454, 54001 Nancy cedex</addrLine>
<country key="FR"></country>
</address>
</desc>
</org>
</tutelle>
<tutelle active="#struct-300293" type="indirect">
<org type="institution" xml:id="struct-300293" status="OLD">
<orgName>Institut National Polytechnique de Lorraine</orgName>
<orgName type="acronym">INPL</orgName>
<date type="end">2011-12-31</date>
<desc>
<address>
<country key="FR"></country>
</address>
</desc>
</org>
</tutelle>
<tutelle active="#struct-866" type="direct">
<org type="laboratory" xml:id="struct-866" status="VALID">
<idno type="IdRef">152639071</idno>
<idno type="RNSR">200412232H</idno>
<orgName>Franche-Comté Électronique Mécanique, Thermique et Optique - Sciences et Technologies</orgName>
<orgName type="acronym">FEMTO-ST</orgName>
<desc>
<address>
<addrLine>32 avenue de l'Observatoire 25044 BESANCON CEDEX</addrLine>
<country key="FR"></country>
</address>
<ref type="url">http://www.femto-st.fr</ref>
</desc>
<listRelation>
<relation active="#struct-242365" type="direct"></relation>
<relation active="#struct-300261" type="direct"></relation>
<relation active="#struct-300360" type="direct"></relation>
<relation name="UMR6174" active="#struct-441569" type="direct"></relation>
</listRelation>
</org>
</tutelle>
<tutelle active="#struct-242365" type="indirect">
<org type="institution" xml:id="struct-242365" status="VALID">
<idno type="IdRef">026403188</idno>
<idno type="ISNI">0000 0001 2188 3779 </idno>
<orgName>Université de Franche-Comté</orgName>
<orgName type="acronym">UFC</orgName>
<desc>
<address>
<country key="FR"></country>
</address>
<ref type="url">http://www.univ-fcomte.fr</ref>
</desc>
</org>
</tutelle>
<tutelle active="#struct-300261" type="indirect">
<org type="institution" xml:id="struct-300261" status="VALID">
<orgName>Université de Technologie de Belfort-Montbeliard</orgName>
<orgName type="acronym">UTBM</orgName>
<desc>
<address>
<country key="FR"></country>
</address>
</desc>
</org>
</tutelle>
<tutelle active="#struct-300360" type="indirect">
<org type="institution" xml:id="struct-300360" status="VALID">
<orgName>Ecole Nationale Supérieure de Mécanique et des Microtechniques</orgName>
<orgName type="acronym">ENSMM</orgName>
<desc>
<address>
<country key="FR"></country>
</address>
</desc>
</org>
</tutelle>
<tutelle name="UMR6174" active="#struct-441569" type="indirect">
<org type="institution" xml:id="struct-441569" status="VALID">
<idno type="ISNI">0000000122597504</idno>
<idno type="IdRef">02636817X</idno>
<orgName>Centre National de la Recherche Scientifique</orgName>
<orgName type="acronym">CNRS</orgName>
<date type="start">1939-10-19</date>
<desc>
<address>
<country key="FR"></country>
</address>
<ref type="url">http://www.cnrs.fr/</ref>
</desc>
</org>
</tutelle>
<tutelle active="#struct-2496" type="direct">
<org type="laboratory" xml:id="struct-2496" status="OLD">
<orgName>INRIA Lorraine</orgName>
<desc>
<address>
<addrLine>615 rue du Jardin Botanique 54600 Villers-lès-Nancy</addrLine>
<country key="FR"></country>
</address>
<ref type="url">http://www.inria.fr/centre-de-recherche-inria/nancy-grand-est</ref>
</desc>
<listRelation>
<relation active="#struct-300009" type="direct"></relation>
</listRelation>
</org>
</tutelle>
</tutelles>
</hal:affiliation>
<country>France</country>
<placeName>
<settlement type="city">Nancy</settlement>
<region type="region" nuts="2">Grand Est</region>
<region type="old region" nuts="2">Lorraine (région)</region>
</placeName>
<orgName type="university">Université Nancy 2</orgName>
<orgName type="institution" wicri:auto="newGroup">Université de Lorraine</orgName>
<placeName>
<settlement type="city">Nancy</settlement>
<region type="region" nuts="2">Grand Est</region>
<region type="old region" nuts="2">Lorraine (région)</region>
</placeName>
<orgName type="university">Institut national polytechnique de Lorraine</orgName>
<orgName type="institution" wicri:auto="newGroup">Université de Lorraine</orgName>
<placeName>
<settlement type="city" wicri:auto="siege">Besançon</settlement>
<region type="region" nuts="2">Franche-Comté</region>
</placeName>
<orgName type="university">Université de Franche-Comté</orgName>
<orgName type="institution" wicri:auto="newGroup">Université de Bourgogne Franche-Comté</orgName>
<placeName>
<settlement type="city" wicri:auto="siege">Belfort</settlement>
<region type="region" nuts="2">Franche-Comté</region>
</placeName>
<orgName type="university">Université de technologie de Belfort-Montbéliard</orgName>
</affiliation>
</author>
<author>
<name sortKey="Gavin, Keighren" sort="Gavin, Keighren" uniqKey="Gavin K" first="Keighren" last="Gavin">Keighren Gavin</name>
<affiliation wicri:level="1">
<hal:affiliation type="laboratory" xml:id="struct-22539" status="VALID">
<orgName>School of Informatics</orgName>
<orgName type="acronym">Informatics</orgName>
<desc>
<address>
<addrLine>School of Informatics Informatics Forum 10 Crichton Street Edinburgh EH8 9AB</addrLine>
<country key="GB"></country>
</address>
<ref type="url">http://www.ed.ac.uk/schools-departments/informatics/</ref>
</desc>
<listRelation>
<relation active="#struct-61277" type="direct"></relation>
</listRelation>
<tutelles>
<tutelle active="#struct-61277" type="direct">
<org type="institution" xml:id="struct-61277" status="VALID">
<orgName>University of Edinburgh</orgName>
<desc>
<address>
<addrLine>Old College South Bridge Edinburgh EH8 9YL</addrLine>
<country key="GB"></country>
</address>
<ref type="url">http://www.ed.ac.uk/home</ref>
</desc>
</org>
</tutelle>
</tutelles>
</hal:affiliation>
<country>Royaume-Uni</country>
<placeName>
<settlement type="city">Édimbourg</settlement>
<region type="country">Écosse</region>
</placeName>
<orgName type="university">Université d'Édimbourg</orgName>
</affiliation>
</author>
<author>
<name sortKey="Steel, Graham" sort="Steel, Graham" uniqKey="Steel G" first="Graham" last="Steel">Graham Steel</name>
<affiliation wicri:level="1">
<hal:affiliation type="laboratory" xml:id="struct-22539" status="VALID">
<orgName>School of Informatics</orgName>
<orgName type="acronym">Informatics</orgName>
<desc>
<address>
<addrLine>School of Informatics Informatics Forum 10 Crichton Street Edinburgh EH8 9AB</addrLine>
<country key="GB"></country>
</address>
<ref type="url">http://www.ed.ac.uk/schools-departments/informatics/</ref>
</desc>
<listRelation>
<relation active="#struct-61277" type="direct"></relation>
</listRelation>
<tutelles>
<tutelle active="#struct-61277" type="direct">
<org type="institution" xml:id="struct-61277" status="VALID">
<orgName>University of Edinburgh</orgName>
<desc>
<address>
<addrLine>Old College South Bridge Edinburgh EH8 9YL</addrLine>
<country key="GB"></country>
</address>
<ref type="url">http://www.ed.ac.uk/home</ref>
</desc>
</org>
</tutelle>
</tutelles>
</hal:affiliation>
<country>Royaume-Uni</country>
<placeName>
<settlement type="city">Édimbourg</settlement>
<region type="country">Écosse</region>
</placeName>
<orgName type="university">Université d'Édimbourg</orgName>
</affiliation>
</author>
</titleStmt>
<publicationStmt>
<idno type="wicri:source">HAL</idno>
<idno type="RBID">Hal:inria-00181616</idno>
<idno type="halId">inria-00181616</idno>
<idno type="halUri">https://hal.inria.fr/inria-00181616</idno>
<idno type="url">https://hal.inria.fr/inria-00181616</idno>
<date when="2007-03">2007-03</date>
<idno type="wicri:Area/Hal/Corpus">001097</idno>
<idno type="wicri:Area/Hal/Curation">001097</idno>
<idno type="wicri:Area/Hal/Checkpoint">003B45</idno>
<idno type="wicri:explorRef" wicri:stream="Hal" wicri:step="Checkpoint">003B45</idno>
<idno type="wicri:Area/Main/Merge">004B41</idno>
<idno type="wicri:Area/Main/Curation">004992</idno>
<idno type="wicri:Area/Main/Exploration">004992</idno>
</publicationStmt>
<sourceDesc>
<biblStruct>
<analytic>
<title xml:lang="en">Automatic Analysis of the Security of XOR-based Key Management Schemes.</title>
<author>
<name sortKey="Cortier, Veronique" sort="Cortier, Veronique" uniqKey="Cortier V" first="Véronique" last="Cortier">Véronique Cortier</name>
<affiliation wicri:level="1">
<hal:affiliation type="researchteam" xml:id="struct-2366" status="OLD">
<idno type="RNSR">200318302K</idno>
<orgName>Combination of approaches to the security of infinite states systems</orgName>
<orgName type="acronym">CASSIS</orgName>
<desc>
<address>
<country key="FR"></country>
</address>
<ref type="url">http://www.inria.fr/equipes/cassis</ref>
</desc>
<listRelation>
<relation active="#struct-160" type="direct"></relation>
<relation name="UMR7503" active="#struct-441569" type="indirect"></relation>
<relation active="#struct-300009" type="indirect"></relation>
<relation active="#struct-300291" type="indirect"></relation>
<relation active="#struct-300292" type="indirect"></relation>
<relation active="#struct-300293" type="indirect"></relation>
<relation active="#struct-866" type="direct"></relation>
<relation active="#struct-242365" type="indirect"></relation>
<relation active="#struct-300261" type="indirect"></relation>
<relation active="#struct-300360" type="indirect"></relation>
<relation name="UMR6174" active="#struct-441569" type="indirect"></relation>
<relation active="#struct-2496" type="direct"></relation>
</listRelation>
<tutelles>
<tutelle active="#struct-160" type="direct">
<org type="laboratory" xml:id="struct-160" status="OLD">
<orgName>Laboratoire Lorrain de Recherche en Informatique et ses Applications</orgName>
<orgName type="acronym">LORIA</orgName>
<desc>
<address>
<addrLine>Campus Scientifique BP 239 54506 Vandoeuvre-lès-Nancy Cedex</addrLine>
<country key="FR"></country>
</address>
<ref type="url">http://www.loria.fr</ref>
</desc>
<listRelation>
<relation name="UMR7503" active="#struct-441569" type="direct"></relation>
<relation active="#struct-300009" type="direct"></relation>
<relation active="#struct-300291" type="direct"></relation>
<relation active="#struct-300292" type="direct"></relation>
<relation active="#struct-300293" type="direct"></relation>
</listRelation>
</org>
</tutelle>
<tutelle name="UMR7503" active="#struct-441569" type="indirect">
<org type="institution" xml:id="struct-441569" status="VALID">
<idno type="ISNI">0000000122597504</idno>
<idno type="IdRef">02636817X</idno>
<orgName>Centre National de la Recherche Scientifique</orgName>
<orgName type="acronym">CNRS</orgName>
<date type="start">1939-10-19</date>
<desc>
<address>
<country key="FR"></country>
</address>
<ref type="url">http://www.cnrs.fr/</ref>
</desc>
</org>
</tutelle>
<tutelle active="#struct-300009" type="indirect">
<org type="institution" xml:id="struct-300009" status="VALID">
<orgName>Institut National de Recherche en Informatique et en Automatique</orgName>
<orgName type="acronym">Inria</orgName>
<desc>
<address>
<addrLine>Domaine de VoluceauRocquencourt - BP 10578153 Le Chesnay Cedex</addrLine>
<country key="FR"></country>
</address>
<ref type="url">http://www.inria.fr/en/</ref>
</desc>
</org>
</tutelle>
<tutelle active="#struct-300291" type="indirect">
<org type="institution" xml:id="struct-300291" status="OLD">
<orgName>Université Henri Poincaré - Nancy 1</orgName>
<orgName type="acronym">UHP</orgName>
<date type="end">2011-12-31</date>
<desc>
<address>
<addrLine>24-30 rue Lionnois, BP 60120, 54 003 NANCY cedex, France</addrLine>
<country key="FR"></country>
</address>
</desc>
</org>
</tutelle>
<tutelle active="#struct-300292" type="indirect">
<org type="institution" xml:id="struct-300292" status="OLD">
<orgName>Université Nancy 2</orgName>
<date type="end">2011-12-31</date>
<desc>
<address>
<addrLine>91 avenue de la Libération, BP 454, 54001 Nancy cedex</addrLine>
<country key="FR"></country>
</address>
</desc>
</org>
</tutelle>
<tutelle active="#struct-300293" type="indirect">
<org type="institution" xml:id="struct-300293" status="OLD">
<orgName>Institut National Polytechnique de Lorraine</orgName>
<orgName type="acronym">INPL</orgName>
<date type="end">2011-12-31</date>
<desc>
<address>
<country key="FR"></country>
</address>
</desc>
</org>
</tutelle>
<tutelle active="#struct-866" type="direct">
<org type="laboratory" xml:id="struct-866" status="VALID">
<idno type="IdRef">152639071</idno>
<idno type="RNSR">200412232H</idno>
<orgName>Franche-Comté Électronique Mécanique, Thermique et Optique - Sciences et Technologies</orgName>
<orgName type="acronym">FEMTO-ST</orgName>
<desc>
<address>
<addrLine>32 avenue de l'Observatoire 25044 BESANCON CEDEX</addrLine>
<country key="FR"></country>
</address>
<ref type="url">http://www.femto-st.fr</ref>
</desc>
<listRelation>
<relation active="#struct-242365" type="direct"></relation>
<relation active="#struct-300261" type="direct"></relation>
<relation active="#struct-300360" type="direct"></relation>
<relation name="UMR6174" active="#struct-441569" type="direct"></relation>
</listRelation>
</org>
</tutelle>
<tutelle active="#struct-242365" type="indirect">
<org type="institution" xml:id="struct-242365" status="VALID">
<idno type="IdRef">026403188</idno>
<idno type="ISNI">0000 0001 2188 3779 </idno>
<orgName>Université de Franche-Comté</orgName>
<orgName type="acronym">UFC</orgName>
<desc>
<address>
<country key="FR"></country>
</address>
<ref type="url">http://www.univ-fcomte.fr</ref>
</desc>
</org>
</tutelle>
<tutelle active="#struct-300261" type="indirect">
<org type="institution" xml:id="struct-300261" status="VALID">
<orgName>Université de Technologie de Belfort-Montbeliard</orgName>
<orgName type="acronym">UTBM</orgName>
<desc>
<address>
<country key="FR"></country>
</address>
</desc>
</org>
</tutelle>
<tutelle active="#struct-300360" type="indirect">
<org type="institution" xml:id="struct-300360" status="VALID">
<orgName>Ecole Nationale Supérieure de Mécanique et des Microtechniques</orgName>
<orgName type="acronym">ENSMM</orgName>
<desc>
<address>
<country key="FR"></country>
</address>
</desc>
</org>
</tutelle>
<tutelle name="UMR6174" active="#struct-441569" type="indirect">
<org type="institution" xml:id="struct-441569" status="VALID">
<idno type="ISNI">0000000122597504</idno>
<idno type="IdRef">02636817X</idno>
<orgName>Centre National de la Recherche Scientifique</orgName>
<orgName type="acronym">CNRS</orgName>
<date type="start">1939-10-19</date>
<desc>
<address>
<country key="FR"></country>
</address>
<ref type="url">http://www.cnrs.fr/</ref>
</desc>
</org>
</tutelle>
<tutelle active="#struct-2496" type="direct">
<org type="laboratory" xml:id="struct-2496" status="OLD">
<orgName>INRIA Lorraine</orgName>
<desc>
<address>
<addrLine>615 rue du Jardin Botanique 54600 Villers-lès-Nancy</addrLine>
<country key="FR"></country>
</address>
<ref type="url">http://www.inria.fr/centre-de-recherche-inria/nancy-grand-est</ref>
</desc>
<listRelation>
<relation active="#struct-300009" type="direct"></relation>
</listRelation>
</org>
</tutelle>
</tutelles>
</hal:affiliation>
<country>France</country>
<placeName>
<settlement type="city">Nancy</settlement>
<region type="region" nuts="2">Grand Est</region>
<region type="old region" nuts="2">Lorraine (région)</region>
</placeName>
<orgName type="university">Université Nancy 2</orgName>
<orgName type="institution" wicri:auto="newGroup">Université de Lorraine</orgName>
<placeName>
<settlement type="city">Nancy</settlement>
<region type="region" nuts="2">Grand Est</region>
<region type="old region" nuts="2">Lorraine (région)</region>
</placeName>
<orgName type="university">Institut national polytechnique de Lorraine</orgName>
<orgName type="institution" wicri:auto="newGroup">Université de Lorraine</orgName>
<placeName>
<settlement type="city" wicri:auto="siege">Besançon</settlement>
<region type="region" nuts="2">Franche-Comté</region>
</placeName>
<orgName type="university">Université de Franche-Comté</orgName>
<orgName type="institution" wicri:auto="newGroup">Université de Bourgogne Franche-Comté</orgName>
<placeName>
<settlement type="city" wicri:auto="siege">Belfort</settlement>
<region type="region" nuts="2">Franche-Comté</region>
</placeName>
<orgName type="university">Université de technologie de Belfort-Montbéliard</orgName>
</affiliation>
</author>
<author>
<name sortKey="Gavin, Keighren" sort="Gavin, Keighren" uniqKey="Gavin K" first="Keighren" last="Gavin">Keighren Gavin</name>
<affiliation wicri:level="1">
<hal:affiliation type="laboratory" xml:id="struct-22539" status="VALID">
<orgName>School of Informatics</orgName>
<orgName type="acronym">Informatics</orgName>
<desc>
<address>
<addrLine>School of Informatics Informatics Forum 10 Crichton Street Edinburgh EH8 9AB</addrLine>
<country key="GB"></country>
</address>
<ref type="url">http://www.ed.ac.uk/schools-departments/informatics/</ref>
</desc>
<listRelation>
<relation active="#struct-61277" type="direct"></relation>
</listRelation>
<tutelles>
<tutelle active="#struct-61277" type="direct">
<org type="institution" xml:id="struct-61277" status="VALID">
<orgName>University of Edinburgh</orgName>
<desc>
<address>
<addrLine>Old College South Bridge Edinburgh EH8 9YL</addrLine>
<country key="GB"></country>
</address>
<ref type="url">http://www.ed.ac.uk/home</ref>
</desc>
</org>
</tutelle>
</tutelles>
</hal:affiliation>
<country>Royaume-Uni</country>
<placeName>
<settlement type="city">Édimbourg</settlement>
<region type="country">Écosse</region>
</placeName>
<orgName type="university">Université d'Édimbourg</orgName>
</affiliation>
</author>
<author>
<name sortKey="Steel, Graham" sort="Steel, Graham" uniqKey="Steel G" first="Graham" last="Steel">Graham Steel</name>
<affiliation wicri:level="1">
<hal:affiliation type="laboratory" xml:id="struct-22539" status="VALID">
<orgName>School of Informatics</orgName>
<orgName type="acronym">Informatics</orgName>
<desc>
<address>
<addrLine>School of Informatics Informatics Forum 10 Crichton Street Edinburgh EH8 9AB</addrLine>
<country key="GB"></country>
</address>
<ref type="url">http://www.ed.ac.uk/schools-departments/informatics/</ref>
</desc>
<listRelation>
<relation active="#struct-61277" type="direct"></relation>
</listRelation>
<tutelles>
<tutelle active="#struct-61277" type="direct">
<org type="institution" xml:id="struct-61277" status="VALID">
<orgName>University of Edinburgh</orgName>
<desc>
<address>
<addrLine>Old College South Bridge Edinburgh EH8 9YL</addrLine>
<country key="GB"></country>
</address>
<ref type="url">http://www.ed.ac.uk/home</ref>
</desc>
</org>
</tutelle>
</tutelles>
</hal:affiliation>
<country>Royaume-Uni</country>
<placeName>
<settlement type="city">Édimbourg</settlement>
<region type="country">Écosse</region>
</placeName>
<orgName type="university">Université d'Édimbourg</orgName>
</affiliation>
</author>
</analytic>
</biblStruct>
</sourceDesc>
</fileDesc>
<profileDesc>
<textClass></textClass>
</profileDesc>
</teiHeader>
<front>
<div type="abstract" xml:lang="en">We describe a new algorithm for analysing security protocols that use XOR, such as key-management APIs. As a case study, we consider the IBM4758 CCA API, which is widely used in the ATM(cash machine) network. Earlier versions of the CCA API were shown to have serious flaws, and the fixes introduced by IBM in version 2.41 had not previously been formally analysed. We first investigate IBM's proposals using a model checker for security protocol analysis, uncovering some important issues about their implementation. Having identified configurations we believed to be safe, we describe the formal verification of their security. We first define a new class of protocols, containing in particular all the versions of the CCA API. We then show that secrecy after an unbounded number of sessions is decidable for this class. Implementing the decision procedure requires some improvements, since the procedure is exponential. We describe a change of representation that leads to an implementation able to verify a configuration of the API in a few seconds. As a consequence, we obtain the first security proof of the fixed IBM 4758 CCA API with unbounded sessions.</div>
</front>
</TEI>
<affiliations>
<list>
<country>
<li>France</li>
<li>Royaume-Uni</li>
</country>
<region>
<li>Franche-Comté</li>
<li>Grand Est</li>
<li>Lorraine (région)</li>
<li>Écosse</li>
</region>
<settlement>
<li>Belfort</li>
<li>Besançon</li>
<li>Nancy</li>
<li>Édimbourg</li>
</settlement>
<orgName>
<li>Institut national polytechnique de Lorraine</li>
<li>Université Nancy 2</li>
<li>Université d'Édimbourg</li>
<li>Université de Bourgogne Franche-Comté</li>
<li>Université de Franche-Comté</li>
<li>Université de Lorraine</li>
<li>Université de technologie de Belfort-Montbéliard</li>
</orgName>
</list>
<tree>
<country name="France">
<region name="Grand Est">
<name sortKey="Cortier, Veronique" sort="Cortier, Veronique" uniqKey="Cortier V" first="Véronique" last="Cortier">Véronique Cortier</name>
</region>
</country>
<country name="Royaume-Uni">
<region name="Écosse">
<name sortKey="Gavin, Keighren" sort="Gavin, Keighren" uniqKey="Gavin K" first="Keighren" last="Gavin">Keighren Gavin</name>
</region>
<name sortKey="Steel, Graham" sort="Steel, Graham" uniqKey="Steel G" first="Graham" last="Steel">Graham Steel</name>
</country>
</tree>
</affiliations>
</record>

Pour manipuler ce document sous Unix (Dilib)

EXPLOR_STEP=$WICRI_ROOT/Wicri/Lorraine/explor/InforLorV4/Data/Main/Exploration
HfdSelect -h $EXPLOR_STEP/biblio.hfd -nk 004992 | SxmlIndent | more

Ou

HfdSelect -h $EXPLOR_AREA/Data/Main/Exploration/biblio.hfd -nk 004992 | SxmlIndent | more

Pour mettre un lien sur cette page dans le réseau Wicri

{{Explor lien
   |wiki=    Wicri/Lorraine
   |area=    InforLorV4
   |flux=    Main
   |étape=   Exploration
   |type=    RBID
   |clé=     Hal:inria-00181616
   |texte=   Automatic Analysis of the Security of XOR-based Key Management Schemes.
}}

Wicri

This area was generated with Dilib version V0.6.33.
Data generation: Mon Jun 10 21:56:28 2019. Site generation: Fri Feb 25 15:29:27 2022