A semantics for a logic of authentication (extended abstract)

Burrows, Abadi, and Needham have proposed a logic for the analysis of authentication protocols. It is a logic of belief, with special constructs for expressing some of the central concepts used in au-thentication. The logic has revealed many subt Ieties and serious errors in published protocols. Unfortunately , it has also created some confusion. In this paper, we provide a new semantics for the logic, our attempt to clarify its meaning. In the search for a sound semantics, we have identified many sources of the past confusion. Identifying these sources has helped us improve the logic's syntax and inference rules, and extend its applicability. One of the greatest differences between our semantics and the original semantics is our treatment of belief as a form of resource-bounded, defensible knowledge. 1 Introduction Authentication is the act of determining the identity of a principal (such as a person, computer, or server) in a computer system. Authentication usually plays an important role in secure systems, since a principal controlling a resource must have some way of identifying principals requesting access to the resource. Authentication typically depends on secrets, such as passwords or encryption keys, that one principal can reveal or somehow use to prove its identity to others. Before these secrets can be used, however, they must be distributed to the principals in some way. An authentication protocol is a description of how these secrets are distributed to principals, and how these secrets are used to determine principals' identities. Permission to copy whhout fee all or part of this material is granted provided that the copies are not made or distributed for direct commercial advantage, the ACM cowrkht notice and th@title of the publication and its date appear, and notice is given that copying is by permission of the Association for Computing Machinery. To copy otherwise, or to republish, requires a fee andlor specific permission. A simple authentication protocol is given as an example in Figure 1. (This is actually a very incomplete description of the Kerberos key distribution protocol [M NSS87, KNS90].) The three principals involved are a server S trusted to generate good encryption keys, and two principals A and B. The goal of this protocol is for A and B to acquire a key that they can use in their communication. Principal A begins by aending a request for a key to the server S. The server responds with a message …