Paradigm shifts in protocol analysis

Authentication protocols are widely believed to be error prone because most analyses conclude with claims of discovering new attacks on the protocols. While proofs of security for authentication protocols are rightly viewed with circumspection, claims of attacks arc rarely challenged. We propose a closer examination of how protocol attacks are defined in the light of different conclusions of four different analyses of the Needham-Schroeder protocols. We argue that subtle paradigm shifts often occur during protocol analysis which affect the definition of a protocol attack. By becoming aware of these paradigm shifts, we can be more aware of what a specific attack actually accomplishes. 1 I n t r o d u c t i o n Authentication protocols are believed to be error prone because most analyses of these protocols conclude with the discovery of an at tack on the protocols. These errors are supposedly rooted in the protocol design and are characteristic of cryptographic protocols in general. There have been guidelines for better engineering of such protocols, e.g., [1] coupled with improved methods for protocol analysis. However, there is no standard way of detecting an Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advant -age and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. 1999 New Security Paradigm Workshop 9 /99 Ontario, Canada © 2000 ACM 1-58113-149-6/00/0004,.. $ 5.00 attack on a protocol. In fact, there exists several approaches in analysing a protocol. These include the use of formal logics (e.g. BAN [3], GNY [7], SVO [20]), process algebra (e.g. CSP [19]) and specialised state engines such as the NRL Protocol Analyser [16]. These various methods can yield different conclusions about a single protocol because each tool may detect a different type of attack although there may be flaws commonly found by most methods. What is disconcerting is to discover conflicting conclusions such as a pronouncement that a protocol is correct vis-a-vis a discovery of a flaw in the same protocol. Given such conflicting results, we generally believe that one tool has missed detecting the flaw found by the second tool. Specifically, we consider the case of the NeedhamSchroeder authentication protocols [18]. Published in the late 1970s, the first known analysis was that conducted by Denning and Sacco [4]. However, these protocols have been continuously analysed and these further analyses gave different conclusions about the security of the protocols. The BAN logic analysis of the protocols [3] is said to have failed to detect the attacks later claimed by Lowe [9] and Meadows [15]. Moreover, Lowe claims to have found a more subtle and more recent attack than that discovered by Denning and Sacco [9, 10] while Meadows claims to have reproduced Lowe's attack in addition to discovering new flaws [15]. Clearly, the use of one method of analysis gives no guarantee that another method will not discover a new flaw with the same protocol. Moreover, proofs