Categorizing Attacks on Cryptographic Protocols Based on Intruders ' Objectives and RolesChong

A taxonomy of cryptographic protocol attacks is helpful for cryptographic protocol analysis. There are taxonomies of cryptographic protocol awss5, 9] and a taxonomy of replay attacks in terms of message origin and destinationn25]. This paper presents an attack taxonomy based on an intruder's objectives when launching attacks and the roles s/he plays. Understanding an intruder's possible behavior and the roles s/he plays can beneet BAN-logic 4] as well as state machine-based cryptographic analysis approaches by allowing them to identify weakness and possible attacks on cryptographic protocols more eeciently. This paper also proposes several protocol design guidelines derived from the authors' observations while the taxonomy was exercised.

[1]  Roger M. Needham,et al.  Using encryption for authentication in large networks of computers , 1978, CACM.

[2]  Giovanni Maria Sacco,et al.  Timestamps in key distribution protocols , 1981, CACM.

[3]  Owen Rees,et al.  Efficient and timely mutual authentication , 1987, OPSR.

[4]  Natsume Matsuzaki,et al.  Key Distribution Protocol for Digital Mobile Communication Systems , 1989, CRYPTO.

[5]  Martín Abadi,et al.  A logic of authentication , 1989, Proceedings of the Royal Society of London. A. Mathematical and Physical Sciences.

[6]  Li Gong,et al.  Reasoning about belief in cryptographic protocols , 1990, Proceedings. 1990 IEEE Computer Society Symposium on Research in Security and Privacy.

[7]  Colin Boyd,et al.  Hidden assumptions in cryptographic protocols , 1990 .

[8]  Paul C. van Oorschot,et al.  Authentication and authenticated key exchanges , 1992, Des. Codes Cryptogr..

[9]  B. Clifford Neuman,et al.  A note on the use of timestamps as nonces , 1993, OPSR.

[10]  Paul F. Syverson.  On key distribution protocols for repeated authentication , 1993, OPSR.

[11]  Paul Syverson,et al.  A Taxonomy of Replay Attacks , 1994 .

[12]  Gustavus J. Simmons,et al.  Cryptanalysis and protocol failures , 1994, CACM.

[13]  Simon S. Lam,et al.  A lesson on authentication protocol design , 1994, OPSR.

[14]  Martín Abadi,et al.  Prudent engineering practice for cryptographic protocols , 1994, Proceedings of 1994 IEEE Computer Society Symposium on Research in Security and Privacy.

[15]  Gavin Lowe,et al.  An Attack on the Needham-Schroeder Public-Key Authentication Protocol , 1995, Inf. Process. Lett..

[16]  Ross J. Anderson,et al.  Robustness Principles for Public Key Protocols , 1995, CRYPTO.

[17]  Catherine A. Meadows,et al.  A Formal Language for Cryptographic Protocol Requirements , 1996, Des. Codes Cryptogr..

[18]  Gavin Lowe,et al.  Some new attacks upon security protocols , 1996, Proceedings 9th IEEE Computer Security Foundations Workshop.

[19]  Diomidis Spinellis,et al.  Cryptographic Protocols over Open Distributed Systems: A Taxonomy of Flaws and related Protocol Analysis Tools , 1997, SAFECOMP.

[20]  Bruce Schneier,et al.  Protocol Interactions and the Chosen Protocol Attack , 1997, Security Protocols Workshop.

[21]  Dawn Xiaodong Song.  Athena: a new efficient automatic checker for security protocol analysis , 1999, Proceedings of the 12th IEEE Computer Security Foundations Workshop.