outline authentication in pervasive and social …social authentication trust & reputation...

Pervasiveauthentication

Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing

Socialauthentication

Trust & reputation

Locationauthentication

Conclusions andfuture work

Authentication inpervasive and social computation

Dusko Pavlovic

Kestrel Instituteand

Oxford University

January-May 2008

with thanks to Cathy Meadows, Mike Mislove,John Mitchell, Bill Roscoe


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Outline

Introduction

Model of network computation

Authentication with timed channels

Symbolic model with partial information and guessing

Authentication with social channels

Trust & reputation

Deriving location authentication protocols

Conclusions and future work


Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Outline

IntroductionProblem of security engineeringApproach: Protocol derivationsExample: Deriving CRTask





Trust & reputation




Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Problem of security engineering


Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation




Verified protocols often fail


Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation





Bull’s protocol

I Isabelle: secure for E(k ,m; n)

I Ryan & Schneider: not for E(k ,m; n) = n � Hk (m)


Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation





Bull’s protocol



IPSec GDoII IETF MSec WG: secure, verifiedI Cathy & Dusko: GDoI_PoP attack


Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation





Bull’s protocol




MQV

I NSA: "MQV is critical for national security of US"I Krawczyk: MQV insecure

I Menezes: HMQV insecure


Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation





Bull’s protocol




MQV

I NSA: "MQV is critical for national security of US"I Krawczyk: MQV insecure, HMQV proven secure

I Menezes: HMQV insecure


Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation





Bull’s protocol




MQV

I NSA: "MQV is critical for national security of US"I Krawczyk: MQV insecure, HMQV proven secureI Menezes: HMQV insecure


Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation




Thesis: Informal reasoning is error prone.

Antithesis: Formal reasoning hides some attacks

,and becomes error prone as it getscomplicated.

Synthesis: Incremental formalization:Do not try to say all at once.


Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation





Antithesis: Formal reasoning hides some attacks

,and becomes error prone as it getscomplicated.



Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation





Antithesis: Formal reasoning hides some attacks,and becomes error prone as it getscomplicated.



Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Derivational approach


Antithesis: Formal reasoning hides some attacks,and becomes error prone as it getscomplicated.



Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Derivational approach

ProblemIncompleteness is the central concernin security engineering.

SolutionProtocol derivations manage it interactively.


Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Example: Deriving authentications

A B�

⌫x✏✏� cAB x

// �✏✏� �rAB x

oo

A : (⌫x)A

✓

hhcABxiiA . ((rABx))A

=) hhcABxiiA . ((cABx))B . hhrABxiiB. . ((rABx))A

◆

(cr)


Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Example: Deriving authentications

A B�

⌫x✏✏� cAB x

// �✏✏� �rAB x

oo

A : (⌫x)A

✓

hhcABxiiA . ((rABx))A

=) hhcABxiiA . ((cABx))B . hhrABxiiB. . ((rABx))A

◆

(cr)


Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Signature-based challenge-response (CRS)

A B�

⌫x✏✏� cAB x:=x

// �✏✏� �rAB x:=SB x

oo

SBt = SBu =) t = u (sig1)

VB(y, t) () y = SBt (sig2)

hhSBtiiX. =) X = B (sig3)


Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation




A B�

⌫x✏✏� x

// �✏✏� �SB x

oo

(sig1-3) ^ (B honest) ` (cr)[cAB x:=x, rAB x:=SB x]


Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Problem

A I B�

⌫x✏✏� A to B:x

// � I to B:x// �

✏✏� �B to A :SB xoo �B to I:SB x

oo


Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation




A B�

⌫x✏✏� A to B:x

// �✏✏� �B to A :SB(A ,x)

oo

(sig1-3) ^ (B honest) ` (cr)[cAB x:=x, rAB x:=SB(A ,x)]

^ "B to A : SB(A , x)". . .


Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Problem

This becomes much easier with NFC phones!


Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Problem

This becomes much easier with NFC phones!


Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Near Field Communication (NFC)

Phone with a contactless smart card:

Secure Element (SE) is a miniSD flash memory, or a USIM card, or a separate microcontroller.


Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Agreement without proximity

A B C D

m n0 m0 n

�A

// �A

// �A

// �⌫x

✏✏�

✏✏

�D,x

oo �D,x

oo �D,x

oo

�SA (D,x)

// �SA (D,x)

// �SA (D,x)

// �


Dusko Pavlovic

IntroductionProblem

Approach

Example

Task

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Task

Study proximity authentication.


Dusko Pavlovic

Introduction

ModelProcess model

Network model

Timedauthentication

Symbolicguessing


Trust & reputation



Outline

Introduction

Model of network computationProcess modelNetwork model




Trust & reputation




Dusko Pavlovic

Introduction

ModelProcess model

Network model

Timedauthentication

Symbolicguessing


Trust & reputation



Process model

terms (T ,v),

principals (W,6),

actions A generated by:

action constructor form

send W2 ⇥ T hi,! A hA to B : ti

receive Var2W ⇥ VarT

(),! A (Y to Z : x)

match T ⇥ OpT ⇥ VarW(/),! A (t/p(x))

new VarT(⌫),! A (⌫x)

· · · · · · · · ·


Dusko Pavlovic

Introduction

ModelProcess model

Network model

Timedauthentication

Symbolicguessing


Trust & reputation



Process model

processes PP

// A ⇥W whereI (P, .) is a well-founded partial orderI PW(p)#PW(q) ) p#q

runs⇣

P,p

: recvs(P) �! sends(P)⌘

, (x) 6 .p(x)

I Pp

= P/ (p(x).(x))


Dusko Pavlovic

Introduction

ModelProcess model

Network model

Timedauthentication

Symbolicguessing


Trust & reputation



Network model

A communication network consists of

network graph N = (L�◆%

N), where

I N is the set of nodes,I L =

P

N⇥NNmn is the set of links,I Nmn = h�, %i�1(m, n)

control assignment c� :W �! }N, satisfying

A 6 B =) c�A ✓ c�B

A#B =) c�A \ c�B = ;

channel typing ✓ : L �! C,


Dusko Pavlovic

Introduction

ModelProcess model

Network model

Timedauthentication

Symbolicguessing


Trust & reputation



Network model



N), where


P



A 6 B =) c�A ✓ c�B

A#B =) c�A \ c�B = ;



Dusko Pavlovic

Introduction

ModelProcess model

Network model

Timedauthentication

Symbolicguessing


Trust & reputation



Network model



N), where


P



A 6 B =) c�A ✓ c�B

A#B =) c�A \ c�B = ;



Dusko Pavlovic

Introduction

Model

TimedauthenticationTimed challenge-response

Two responses

Solution 1: Commitment

Solution 2: One-wayresponse

Two challenges

Simple distance bounding

Symbolicguessing


Trust & reputation



Outline

Introduction


Authentication with timed channelsTimed challenge-responseDistance bounding with two responses

Solution 1: CommitmentSolution 2: One-way response

Distance bounding with two challengesSimple distance bounding



Trust & reputation




Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Timed challenge-response

V X

m ________ ________ n

�⌫x

✏✏• x⌧0

+3

________ ________ •

✏✏• •fx⌧1

ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

V : (⌫x)V

✓

⌧0hxiV . ⌧1(fx)V =) 9X . d(V ,X) c2(⌧1 � ⌧0)

◆

(crt)


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Timed challenge-response

V X

m ________ ________ n

�⌫x

✏✏• x⌧0

+3

________ ________ •

✏✏• •fx⌧1

ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

V : (⌫x)V

✓

⌧0hxiV . ⌧1(fx)V =) 9X . d(V ,X) c2(⌧1 � ⌧0)

◆

(crt)


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Distance bounding protocolsIdeaCombine (cr) and (crt).

Three familiesI with one challenge and two responses:

I rVPx, satisfying (cr)I fVPx, satisfying (crt)

I with two challenges and one response:I cVPy and frVP(x, y), satisfying (cr)I x and frVP(x, y), satisfying (crt)

I with one challenge and one response:I x and frVPx, satisfying

V : (⌫x)V

✓

⌧0hxiV . ⌧1(frVPx)V

=) ⌧0hxiV . (x)P . hfrVPxiP. . ⌧1(frVPx)V (crp)

^ d(V ,P) ⌧1 � ⌧0◆


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation




Three families

I with one challenge and two responses:I rVPx, satisfying (cr)I fVPx, satisfying (crt)



V : (⌫x)V

✓



^ d(V ,P) ⌧1 � ⌧0◆


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation








V : (⌫x)V

✓



^ d(V ,P) ⌧1 � ⌧0◆


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation








V : (⌫x)V

✓



^ d(V ,P) ⌧1 � ⌧0◆


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation








V : (⌫x)V

✓



^ d(V ,P) ⌧1 � ⌧0◆


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Distance bounding with two responsesIdea

V Pm YYZZ[[\\]]^__àabbccddee n

�

✏✏

�Poo

� V//

⌫x✏✏

�

• x⌧0

+3

________ ________ �

✏✏• �fx⌧1

ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

✏✏� �rVP xoo


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Distance bounding with two responsesProblem

V I P

m YYZZ[[\\]]^__àabbccddeeff XXYYZZ[[\\]]^__àabbccddee n

�✏✏

�Poo �P

oo

� V//

⌫x✏✏

� V// �

• x⌧0

+3

________ ________ �✏✏• �fx

⌧1ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

✏✏• x+3

________ ________ �✏✏• �fx

ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

✏✏� �rVPxoo �rVP x

oo


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Distance bounding with two responsesBasic template


�⌫x

✏✏

�⌫y

✏✏• x⌧0

+3

________ ________ �

✏✏•

✏✏

�f(x,y)

⌧1ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

✏✏� �rVP(x,y)oo


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Brands-Chaum 1


�⌫x

✏✏

�⌫y

✏✏• x⌧0

+3

________ ________ �

✏✏•

✏✏

�y⌧1

ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

✏✏� �SP(x,y)oo

I V : P honest =) d(V ,P) < ⌧1 � ⌧0I V : 8X . X responds =) d(V ,X) + d(X ,P) < ⌧1 � ⌧0


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Brands-Chaum 1


�⌫x

✏✏

�⌫y

✏✏• x⌧0

+3

________ ________ �

✏✏•

✏✏

�y⌧1

ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _


I V : P honest =) d(V ,P) < ⌧1 � ⌧0I V : 8X . X responds =) d(V ,X) + d(X ,P) < ⌧1 � ⌧0


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Discharge the honesty assumption?


�⌫x

✏✏

�⌫y

✏✏• x⌧0

+3

________ ________ �

✏✏•

✏✏

�x�y⌧1

ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _



Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



P can still cheat


�⌫x

✏✏

�⌫z

✏✏• x⌧0

+3

________ ________ �

✏✏•

✏✏

�z⌧1

ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

✏✏� �SP(x,x�z)oo


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Brands-Chaum 2


�⌫x

✏✏• x⌧0

+3

________ ________ �

✏✏•

✏✏

�x�m⌧1

ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

✏✏� �SP(x)oo

I Peggy cannot cheatI Ivan can impersonate her, and relay SP(x)


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Brands-Chaum 2


�⌫x

✏✏• x⌧0

+3

________ ________ �

✏✏•

✏✏

�x�m⌧1

ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _


I Peggy cannot cheat

I Ivan can impersonate her, and relay SP(x)


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Brands-Chaum 2


�⌫x

✏✏• x⌧0

+3

________ ________ �

✏✏•

✏✏

�x�m⌧1

ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _


I Peggy cannot cheatI Ivan can impersonate her, and relay SP(x)


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation





�⌫y

✏✏�⌫x

✏✏

�ct(y)oo

• x⌧0

+3

________ ________ �

✏✏•

✏✏

�f(x,y)

⌧1ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

✏✏� �dt(y), rVP(x,y)oo


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Digression: Symbolic commitment

Definition

A commitment schema consists of three publicly knownfunctions over the space of messages T ,I commitment ct : T �! T ,I decommitment dt : T �! T , andI open commitment ot : T ⇥ T �! T ,

such thatI ct is a one-way collision-free function,I ot (ct(x), dt(x)) = x.

E.g.,

ct(x) = H(x) ct(x) = H0(x) ct(x) = E(x0, x1)

dt(x) = x dt(x) = x::H1(x) dt(x) = x0

ot(y, z) = z ot(y, z) = z0 ot(y, z) = D(z, y)


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Digression: Symbolic commitment

Definition

A commitment schema consists of three publicly knownfunctions over the space of messages T ,I commitment ct : T �! T ,I decommitment dt : T �! T , andI open commitment ot : T ⇥ T �! T ,

such thatI ct is a one-way collision-free function,I ot (ct(x), dt(x)) = x.

E.g.,

ct(x) = H(x) ct(x) = H0(x) ct(x) = E(x0, x1)

dt(x) = x dt(x) = x::H1(x) dt(x) = x0

ot(y, z) = z ot(y, z) = z0 ot(y, z) = D(z, y)


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation





�⌫y

✏✏�⌫x

✏✏

�ct(y)oo

• x⌧0

+3

________ ________ �

✏✏•

✏✏

�f(x,y)

⌧1ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

✏✏� �dt(y), rVP(x,y)oo


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Brands-Chaum 3


�⌫y

✏✏�⌫x

✏✏

�H0yoo

• x⌧0

+3

________ ________ �

✏✏•

✏✏

�x�y⌧1

ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

✏✏� �y,H1y,SP(x,y)oo


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Capkun-Hubaux


�⌫y

✏✏�⌫x

✏✏

�H0yoo

• x⌧0

+3

________ ________ �

✏✏•

✏✏

�x�y⌧1

ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

✏✏� �y,H1y,x,HVP(x,y)oo


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



. . . but Peggy’s identity can be spoofed

V I P

m XXXXYYYYZZZZ[[[[\\\\]]]]^^__`àaaabbbbccccddddeeeeffff` n�

⌫y✏✏�

⌫x✏✏

�H0yoo

• x⌧0

+3

_________________ _________________ �

✏✏•

✏✏

�x�y⌧1

ks _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

✏✏� �y,H1y,x,HVI(x,y)oo �y,x,H1y,HVP(x,y)

oo


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



. . . and in general

V I P

m XXXXYYYYZZZZ[[[[\\\\]]]]^^__`àaaabbbbccccddddeeeeffff` n�

⌫y✏✏�

⌫x✏✏

�ct(y)oo

• x⌧0

+3

_________________ _________________ �

✏✏•

✏✏

�f(x,y)

⌧1ks _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

✏✏� �dt(y), rVI(x,y)oo �dt(y), rVP(x,y)

oo


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



. . . so we need

V Pm [[[[\\\\\\]]]]]]]]^^^^______```àaaaaaaabbbbbbcccc n

�⌫y

✏✏�⌫x

✏✏

�ct(y,P)oo

• x⌧0

+3

_________________ _________________ �

✏✏•

✏✏

�f(x,y)

⌧1ks _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

✏✏� �dt(y,P), rVP(x,y)oo


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Meadows et al

V P�

⌫y✏✏�

⌫x✏✏

�H0(y,P)oo

• x⌧0

+3

________ ________ �

✏✏•

✏✏

�x�y⌧1

ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

✏✏� �y,H1(y,P),x,HVP(x,y)oo


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Solution 2: One-way response


�⌫x

✏✏

�⌫y

✏✏• x⌧0

+3

________ ________ �

✏✏•

✏✏

�f(x,y)

⌧1ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

✏✏� �rVP(x,y)oo

where fVP(x,�) is a one-way function for every x.


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Meadows et bo


�⌫x

✏✏

�⌫y

✏✏• x⌧0

+3

________ ________ �

✏✏•

✏✏

�x�H(y,P)

⌧1ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

✏✏� �y,x,HVP(x,y)oo

I V : 9X . d(V ,X) < ⌧1 � ⌧0 ^ X ⇠ PI V : 8X . X responds =) d(V ,X) + d(X ,P) < ⌧1 � ⌧0


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Meadows et bo


�⌫x

✏✏

�⌫y

✏✏• x⌧0

+3

________ ________ �

✏✏•

✏✏

�x�H(y,P)

⌧1ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _


I V : 9X . d(V ,X) < ⌧1 � ⌧0 ^ X ⇠ P

I V : 8X . X responds =) d(V ,X) + d(X ,P) < ⌧1 � ⌧0


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Meadows et bo


�⌫x

✏✏

�⌫y

✏✏• x⌧0

+3

________ ________ �

✏✏•

✏✏

�x�H(y,P)

⌧1ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _


I V : 9X . d(V ,X) < ⌧1 � ⌧0 ^ X ⇠ PI V : 8X . X responds =) d(V ,X) + d(X ,P) < ⌧1 � ⌧0


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Distance bounding with two challengesIdea


�⌫y

✏✏� cVP y//

⌫x✏✏

�

✏✏• x⌧0

+3

________ ________ �

✏✏• �frVP(x,y)

⌧1ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

where

I frVP(x,�) satisfies (cr) for all x

I frVP(�, y) satisfies (crt) for all y


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Distance bounding with two challengesIdea


�⌫y

✏✏� cVP y//

⌫x✏✏

�

✏✏• x⌧0

+3

________ ________ �

✏✏• �frVP(x,y)

⌧1ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

where

I frVP(x,�) satisfies (cr) for all x

I frVP(�, y) satisfies (crt) for all y


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Distance bounding with two challengesTry


�⌫y

✏✏� cVP y//

⌫x✏✏

�

✏✏• x⌧0

+3

________ ________ �

✏✏• �x�rVPy⌧1

ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Distance bounding with two challengesProblem

m YYZZZZ[[[[[[\\\\]]]]]]^^______`àaaaaabbbbccccccddddee________ ________ ` ________ ________ n

�⌫y

✏✏� cVPy//

⌫x

✏✏

�

✏✏

�⌫ex

✏✏•✏✏

ex+3

________ ________ �✏✏•

✏✏

�ex�rVPyks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

•✏✏

x⌧0

+3

________ ________ �✏✏• �x�rVPy

⌧1ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Distance bounding with two challengesIdea 2: Find �


�⌫y

✏✏� cVP y//

⌫x✏✏

�

✏✏• x⌧0

+3

________ ________ �

✏✏• �x�rVPy⌧1

ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

where

I rVP satisfies (cr)

I x � (�) is one-way function for every x

I (�) � y satisfies (crt) for every y


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Hancke-KuhnCandidate


�⌫y

✏✏� y//

⌫x✏✏

�

✏✏• x⌧0

+3

________ ________ �

✏✏• �x�HVPy⌧1

ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

x � z = [z(xi)i ] where z = z(0)::z(1)


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Hancke-KuhnProblem

m VVWWWWXXYYYYZZ[[[[\\\\]]^^__`àabbbbccccddeeeeffgggghh________ ________ `

ggeeddccbbaa`__^]]\\[[ZZYY n

�⌫y

✏✏� y//

⌫x

✏✏

�✏✏�

✏✏

0n+3

________ ________ �✏✏�

✏✏

�0n�rVP yks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

�✏✏

V to P:y// �

✏✏�✏✏

1n+3

________ ________ �✏✏�

✏✏

�1n�rVP yks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

•✏✏

x⌧0

+3

________ ________ �✏✏• �x�rVPy

⌧1ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Hancke-KuhnProblem: a � z, a � z ` (�) � z, for any a

m VVWWWWXXYYYYZZ[[[[\\\\]]^^__`àabbbbccccddeeeeffgggghh________ ________ `

ggeeddccbbaa`__^]]\\[[ZZYY n

�⌫y

✏✏� y//

⌫x

✏✏

�✏✏�

✏✏

0n+3

________ ________ �✏✏�

✏✏

�0n�rVP yks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

�✏✏

V to P:y// �

✏✏�✏✏

1n+3

________ ________ �✏✏�

✏✏

�1n�rVP yks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

•✏✏

x⌧0

+3

________ ________ �✏✏• �x�rVPy

⌧1ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation



Simple distance bounding templateIdea 3: Use counters to disable querying of (�) � rVPy

V Pm YY ZZ[[\\]]^__`aabbccddee n76540123u

⌫x✏✏

u,v 76540123v

76540123u+1x⌧0

+3

________ ________ 76540123v+1

✏✏76540123u+2 76540123v+2x�rVP(u,v)

⌧1ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _



I (�) � z satisfies (crt) for every z

I the counters u, v are public, but never reused


Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation





⌫x✏✏

u,v 76540123v

76540123u+1x⌧0

+3

________ ________ 76540123v+1

✏✏76540123u+2 76540123v+2x�rVP(u,v)

⌧1ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

where






Dusko Pavlovic

Introduction

Model


Two responses



Two challenges


Symbolicguessing


Trust & reputation





⌫x✏✏

u,v 76540123v

76540123u+1x⌧0

+3

________ ________ 76540123v+1

✏✏76540123u+2 76540123v+2x�rVP(u,v)

⌧1ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

where






Dusko Pavlovic

Introduction

Model

Timedauthentication

SymbolicguessingAlgebra coding

Guessing

Base and dimension


Trust & reputation



Outline

Introduction



Symbolic model with partial information and guessingAlgebra codingGuessingBase and dimension


Trust & reputation




Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation



Algebra coding

I T be a term algebra over a clone TI L a language over an alphabet ⌃

DefinitionAn encoding (or implementation) of T in L is a pair of maps

~�� : T ! Lp

: L* T

such thatp~t� = t .


Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation



Algebra coding

I T be a term algebra over a clone TI L a language over an alphabet ⌃

DefinitionAn encoding (or implementation) of T in L is a pair of maps

~�� : T ! Lp

: L* T

such thatp~t� = t .


Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation



Feasible algebra

Notation and terminology

I ⌃? = ⌃ + {?}, where ? @ s for s 2 S

I L? = {↵ 2 ⌃⇤?| 9⇠ 2 L. ↵ v ⇠}I ↵ v � () |↵| |�| ^ 8i |↵|. ↵i @ �i _ ↵i = �i

I F ✓ [L? ) L?]t" , a submonoid of feasible maps


Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation



Feasible algebra


I ⌃? = ⌃ + {?}, where ? @ s for s 2 SI L? = {↵ 2 ⌃⇤?| 9⇠ 2 L. ↵ v ⇠}

I ↵ v � () |↵| |�| ^ 8i |↵|. ↵i @ �i _ ↵i = �i



Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation



Feasible algebra


I ⌃? = ⌃ + {?}, where ? @ s for s 2 SI L? = {↵ 2 ⌃⇤?| 9⇠ 2 L. ↵ v ⇠}I ↵ v � () |↵| |�| ^ 8i |↵|. ↵i @ �i _ ↵i = �i



Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation



Feasible algebra


I ⌃? = ⌃ + {?}, where ? @ s for s 2 SI L? = {↵ 2 ⌃⇤?| 9⇠ 2 L. ↵ v ⇠}I ↵ v � () |↵| |�| ^ 8i |↵|. ↵i @ �i _ ↵i = �i



Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation



Feasible algebra

Definition

An algebraic operation ' 2 T is called feasible if the partialmap

~'� : L * L~t� 7! ~'t�

can be extended to a feasible map.

Example

Hohenberger-Rivest: pseudo-free groups


Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation



Feasible algebra

Definition

An algebraic operation ' 2 T is called feasible if the partialmap

~'� : L * L~t� 7! ~'t�

can be extended to a feasible map.

Example

Hohenberger-Rivest: pseudo-free groups


Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation



Derivability

DefinitionFor ↵1, . . . ,↵n, � 2 L? define the derivability relation

↵1, . . . ,↵n ` � () 9f1, . . . fn 2 F .nG

i=1

fi↵i w �

For a multiset of terms s1, . . . , sn, t 2 T , we abbreviate

s1, . . . , sn ` t () ~s1�, . . . , ~sn� ` ~t�


Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation



Derivability

DefinitionFor ↵1, . . . ,↵n, � 2 L? define the derivability relation

↵1, . . . ,↵n ` � () 9f1, . . . fn 2 F .nG

i=1

fi↵i w �

For a multiset of terms s1, . . . , sn, t 2 T , we abbreviate

s1, . . . , sn ` t () ~s1�, . . . , ~sn� ` ~t�


Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation



Frequency distribution

AssumptionSuppose that L is given with a probability measure

Prob : M(L) �! [0, 1]

For simplicity, take

I L = {0, 1}⇤I M{0, 1}⇤ =

h

↵" ✓ {0, 1}⇤i

I where ↵" = {⇠ 2 {0, 1}⇤ | ↵ v ⇠}I

Prob(↵") = 2�|↵|


Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation



Frequency distribution

AssumptionSuppose that L is given with a probability measure

Prob : M(L) �! [0, 1]

For simplicity, take

I L = {0, 1}⇤I M{0, 1}⇤ =

h

↵" ✓ {0, 1}⇤i

I where ↵" = {⇠ 2 {0, 1}⇤ | ↵ v ⇠}I

Prob(↵") = 2�|↵|


Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation



Derivability with guessing

Guessing a term

IProb(t |A) =

Prob(~t�"\A")Prob(A")

IProb(t |↵) =

Prob(~t�"\↵")Prob(↵") =

8

>

>

<

>

>

:

2k↵k�|~t�| if ↵ v ~t�0 otherwise

I where k↵k = |↵�⌃ |

DefinitionFor ↵1, . . . ,↵n, � 2 L? and � � 0 define

↵1, . . . ,↵n `� � ()9f1, . . . fn 2 F . Prob (� | f1↵1, . . . , fn↵n) � �


Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation




Guessing a term

IProb(t |A) =


IProb(t |↵) =

Prob(~t�"\↵")Prob(↵") =

8

>

>

<

>

>

:




↵1, . . . ,↵n `� � ()9f1, . . . fn 2 F . Prob (� | f1↵1, . . . , fn↵n) � �


Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation




Guessing a term

IProb(t |A) =


IProb(t |↵) =

Prob(~t�"\↵")Prob(↵") =

8

>

>

<

>

>

:




↵1, . . . ,↵n `� � ()9f1, . . . fn 2 F . Prob (� | f1↵1, . . . , fn↵n) � �


Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation



Base and dimension

Base

Let ' 2 T be an algebraic operation andB = {b1, . . . , bk } ✓ T . DefineI '[B]� =

n

t 2 T | t ,B ,'(B) `� '(t)o

I base�✏(') =n

B 2 }<!T | Prob

⇣

'[B]�⌘

� ✏o

DimensionI dim�✏(') =

V

B2base�✏(')|B |


Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation



Base and dimension

Base


n

t 2 T | t ,B ,'(B) `� '(t)o

I base�✏(') =n

B 2 }<!T | Prob

⇣

'[B]�⌘

� ✏o


V

B2base�✏(')|B |


Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation



Base and dimension

Base


n

t 2 T | t ,B ,'(B) `� '(t)o

I base�✏(') =n

B 2 }<!T | Prob

⇣

'[B]�⌘

� ✏o


V

B2base�✏(')|B |


Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation



ExampleseXclusive OR

Refine b , b � c ` x � c for all b , c, x 2 {0, 1}` to show

I base�✏(� � c) =

8

>

>

<

>

>

:

{0, 1}⇤ if ✏ 2�k ^ � 2`�k

{0, 1}k if ✏ > 2�k ^ � 2`�k

I dim�✏ (� � c) =

8

>

>

<

>

>

:

0 if ✏ 2�k ^ � 2`�k

1 if ✏ > 2�k ^ � 2`�k


Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation



ExamplesOne-way XOR

For ⌃ = {0, 1, . . . , n � 1} and d = d(0)::d(1):: . . . d(n�1) 2 ⌃n`

define

(�) � d : ⌃` �! ⌃`

z 7!

d(z1)1 , d(z2)

2 , . . . , d(z`)`

�


Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation



ExamplesOne-way XOR

Refine0`, 1`, . . . , (n � 1)`, 0` � d, . . . , (n � 1)` � d ` x � dto show

dim�✏ (� � d) =

8

>

>

>

>

>

>

>

>

>

>

>

>

>

>

>

>

<

>

>

>

>

>

>

>

>

>

>

>

>

>

>

>

>

:

1 if ✏ 2h

0, 2�nki

2 if ✏ 2⇣

2�nk , 2(1�n)ki

...

i + 1 if ✏ 2⇣

2(i�1�n)k , 2(i�n)ki

...

n if ✏ 2⇣

2�k , 1i


Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation



Upshot

PropositionFor all �, ✏ � 0, and any A ✓ T holds

|A | < dim�✏(') =) Prob

⇣

t 2 T | t ,A ,'(A) `� '(t)⌘

< ✏


Dusko Pavlovic

Introduction

Model

Timedauthentication


Guessing

Base and dimension


Trust & reputation



Corollary

m YYZZ[[\\]]^__`aabbccddeeffn76540123u

⌫x✏✏

u,v 76540123v

/.-,()*+u+1x⌧0

+3

________ ________ /.-,()*+v+1

✏✏/.-,()*+u+2 /.-,()*+v+2x�rVP(u,v)

⌧1ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

satisfies

V : (⌫x)V

✓


=) ⌧0hxiV . (x)P . hfrVPxiP. . ⌧1(frVPx)V

^ d(V ,P) ⌧1 � ⌧0◆

with probability 1 � 2�|x |.


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing

SocialauthenticationSocial channel and its use

Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Outline

Introduction




Authentication with social channelsSocial channel and its useSocial commitmentAuthentication before decommitmentAuthentication after decommitmentSocially authenticated key exchangeSecurity homology

Trust & reputation




Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Preliminary example: a timed social protocol

A B• m

⌧0+3

______ ______ �

✏✏

� (m)⌧1oo

o/ o/ o/ o/ o/ o/ o/


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Social channel bandwidth

I � : T �! T : a short digest (hash) function

such thatI ��t = �t

I "The digest does not change short terms."I 8s 9t . s , t ^ �s = �t ^ s ` t

I "For every term s, it is feasible to find a different term twith the same digest."


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation






I "The digest does not change short terms."

I 8s 9t . s , t ^ �s = �t ^ s ` tI "For every term s, it is feasible to find a different term t

with the same digest."


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation






I "The digest does not change short terms."I 8s 9t . s , t ^ �s = �t ^ s ` t

I "For every term s, it is feasible to find a different term twith the same digest."


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Social actions

I lB to A : �m— B shows an action � to A

axiomatized as follows:I lB to A : �m =) A : �B

I "If A sees B perform �, then A knows that B hasperformed �."

I lB to A : � m . l C to A : �m =) A : �B . �CI "If A sees �B before �C , then she knows that �B

occurred before �C ."


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Social actions







Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Social actions







Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Social actions

I lB to A : tm— B shows a term t to A

axiomatized as follows:I lB to A : tm =) �t 2 �A

I "If B shows A a term t , then A sees the digest �t ."I lB to A : tm =) A : 9u. �u = �t ^ lA to B : umB

I "If B shows A a term t , then A knows that B has shownher some term with the digest �t ."


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Social actions



I "If B shows A a term t , then A sees the digest �t ."

I lB to A : tm =) A : 9u. �u = �t ^ lA to B : umBI "If B shows A a term t , then A knows that B has shown

her some term with the digest �t ."


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Social actions



I "If B shows A a term t , then A sees the digest �t ."I lB to A : tm =) A : 9u. �u = �t ^ lA to B : umB

I "If B shows A a term t , then A knows that B has shownher some term with the digest �t ."


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Social actionsGraphic notation

I �B //

/o

/o �A represents lB to A : �m

I �B�t

//

/o

/o �A represents lB to A : tm


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Socially authenticated key distributionBob announces his public key

A B

�

✏✏

��eoo

o/ o/ o/ o/ o/ o/ o/ o/

✏✏� �eoo

A B

�

✏✏

�eoo

✏✏� ��eoo

o/ o/ o/ o/ o/ o/ o/ o/

I e,�e 2 �A

I A : B honest =) 9u. �u = �e ^ hB to A : uiB


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Socially authenticated key distributionBob announces his public key

A B

�

✏✏

��eoo

o/ o/ o/ o/ o/ o/ o/ o/

✏✏� �eoo

A B

�

✏✏

�eoo

✏✏� ��eoo

o/ o/ o/ o/ o/ o/ o/ o/

I e,�e 2 �A



Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Socially authenticated key distribution. . . but Ivan may have replaced it

A I B

�

✏✏

��e=�uoo

o/ o/ o/ o/ o/ o/ o/ o/ o/

✏✏� �eoo �u

oo

A I B

�

✏✏

�eoo �u

oo

✏✏� ��e=�uoo

o/ o/ o/ o/ o/ o/ o/ o/ o/

I e,�e 2 �A



Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Social commitment

A B�⌫y

✏✏�

✏✏

�e, ct(e,y)oo

✏✏�

✏✏

��f(e,y)oo

o/ o/ o/ o/ o/ o/ o/ o/

✏✏� �dt(e,y)oo

A B�⌫y

✏✏�

✏✏

�e, ct(e,y)oo

✏✏�

✏✏

�dt(e,y)oo

✏✏� ��f(e,y)oo

o/ o/ o/ o/ o/ o/ o/ o/


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Authentication before decommitment

A B

�⌫y

✏✏�

✏✏

�e, ct(e,y)oo

✏✏�

✏✏

��yoo

o/ o/ o/ o/ o/ o/ o/ o/ o/


I A : 9y. �y = s ^ lB to A : smB


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation




A B

�⌫y

✏✏�

✏✏

�e, ct(e,y)oo

✏✏�

✏✏

��yoo

o/ o/ o/ o/ o/ o/ o/ o/ o/


I A : B honest =) 9y. l B to A : �ymB


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation




A B

�⌫y

✏✏�

✏✏

�e, ct(e,y)oo

✏✏�

✏✏

��yoo

o/ o/ o/ o/ o/ o/ o/ o/ o/


I A : B honest =) 9u9y.⌦

u, ct(u, y)↵

B D l�ymB


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation




A B

�⌫y

✏✏�

✏✏

�e, ct(e,y)oo

✏✏�

✏✏

��yoo

o/ o/ o/ o/ o/ o/ o/ o/ o/


I A : B honest =) 9u. (⌫y)B D⌦

u, ct(u, y)↵

B D l�ymB


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation




A B

�⌫y

✏✏�

✏✏

�e, ct(e,y)oo

✏✏�

✏✏

��yoo

o/ o/ o/ o/ o/ o/ o/ o/ o/


I A : B honest =) (⌫y)B D⌦

e, ct(e, y)↵

B D l�ymB D⌦

dt(e, y)↵

B


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Authentication before decommitmentWong-Stajano template

A B

�⌫s

✏✏�

✏✏

�e, H(k ,e,s)oo

✏✏�

✏✏

�s=�soo

o/ o/ o/ o/ o/ o/ o/ o/ o/

✏✏� �koo


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Authentication before decommitmentWong-Stajano- 1

2

A B

�⌫s

✏✏�

✏✏

�gb , H(k ,gb ,s)oo

✏✏�

✏✏

�s=�soo

o/ o/ o/ o/ o/ o/ o/ o/ o/

✏✏� �koo


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Authentication before decommitmentWong-Stajano

A B

�⌫sa

✏✏

�⌫sb

✏✏�ga , H(ka ,ga ,sa)

33

✏✏

�gb , H(kb ,gb ,sb)

ss

✏✏

� oo

sb

sa//

/o/o/o/o/o/o/o/o/o

✏✏

�

✏✏�ka

33 �kb

ss


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Authentication before decommitmentWong-Stajano 3

A B

� ga// �⌫sb

✏✏�

✏✏

�gb , H(k ,ga ,gb ,sb)oo

� 1//

/o/o/o/o/o/o/o/o/o �

✏✏�

✏✏

�sboo

o/ o/ o/ o/ o/ o/ o/ o/ o/

✏✏� �koo


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation




A B

�⌫y

✏✏�

✏✏

�e, ct(e,y)oo

✏✏�

✏✏

��yoo

o/ o/ o/ o/ o/ o/ o/ o/ o/


I A : B honest =) (⌫y)B D⌦

e, ct(e, y)↵

B D l�ymB D⌦

dt(e, y)↵

B


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Authentication before decommitmentHoepman- 1

2

A B

�⌫xe=y=gx

✏✏�

✏✏

�Hyoo

✏✏�

✏✏

��yoo

o/ o/ o/ o/ o/ o/ o/ o/ o/

✏✏� �yoo

I A : B honest =) (⌫x)B D⌦

H(gx)↵

B D l�(gx)mB D hgxiB


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Authentication after decommitment

A B�⌫y

✏✏� �e, ct(e,y)oo

?

✏✏

?

✏✏�

✏✏

�dt(e,y)oo

✏✏� ��f(e,y)oo

o/ o/ o/ o/ o/ o/ o/ o/ o/


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation




A B�⌫y

✏✏� �e, ct(e,y)oo

?

✏✏

// ?

✏✏�

✏✏

�dt(e,y)oo

✏✏� ��f(e,y)oo

o/ o/ o/ o/ o/ o/ o/ o/ o/


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation




A B�⌫y

✏✏�⌫x

✏✏

�e, ct(e,y)oo

� x// �

✏✏�

✏✏

�dt(e,y)oo

✏✏� ��f(e,x,y)oo

o/ o/ o/ o/ o/ o/ o/ o/ o/


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation




A B�⌫y

✏✏�⌫x

✏✏

�e, ct(e,y)oo

� x// �

✏✏�

✏✏

�dt(e,y)oo

✏✏� ��f(x,y)oo

o/ o/ o/ o/ o/ o/ o/ o/ o/

A B�⌫y

✏✏�⌫x

✏✏

�e, ct(y)oo

� x// �

✏✏�

✏✏

�dt(y)oo

✏✏� ��f(e,x,y)oo

o/ o/ o/ o/ o/ o/ o/ o/ o/


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Authentication after decommitmentVaudenay: SAS- 1

2

A B�⌫y

✏✏�⌫x

✏✏

�e, ct(e,y)oo

� x// �

✏✏�

✏✏

�dt(e,y)oo

✏✏� ��(x�y)oo

o/ o/ o/ o/ o/ o/ o/ o/ o/


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Authentication after decommitmentNguyen-Roscoe: HCBK- 1

2

A B�⌫y

✏✏�⌫x

✏✏

�e, Hyoo

� x// �

✏✏�

✏✏

�yoo

✏✏� ��(e,x,y)oo

o/ o/ o/ o/ o/ o/ o/ o/ o/


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Mutual authentication after decommitmentNguyen-Roscoe: HCBK (2-party)

A B�

⌫x✏✏

�⌫y

✏✏�

✏✏

eA , Hx++ �

eB , Hy

kk

✏✏�

✏✏

x++ �

ykk

✏✏

� �//�(eA ,eB ,x,y)oo

o/ o/ o/ o/ o/ o/ o/ o/ o/

Assumption: Initiator establishes the order


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation




A B�

⌫x✏✏

�⌫y

✏✏�

✏✏

eA , Hx++ �

eB , Hy

kk

✏✏�

✏✏

x++ �

ykk

✏✏

� �//�(eA ,eB ,x,y)oo

o/ o/ o/ o/ o/ o/ o/ o/ o/

Assumption: Initiator establishes the order


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation




✓

(⌫x)A heA ,HxiA (u1, u2)A ⌦

(⌫y)B heB ,HyiB (v1, v2)B

◆

;

✓

hxiA (u3)A (u1, u2/eB ,Hu3)A l �(eA , eB , x, u3) mA ⌦

hyiB (v3)B (v1, v2)/eA ,Hv3)B l �(eA , eB , v3, y) mB

◆


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Multi-party authentication after decommitmentNguyen-Roscoe: HCBK

Assumptions (to be discharged)

I agreed ordering of the principals

I all principals must digest at the same payloadI social protocol to compare the digests


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation





I agreed ordering of the principalsI all principals must digest at the same payload

I social protocol to compare the digests


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation





I agreed ordering of the principalsI all principals must digest at the same payload

I social protocol to compare the digests


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Structural similarity — conceptual difference

A B�⌫y

✏✏�⌫x

✏✏

�e, ct(e,y)oo

� x// �

✏✏�

✏✏

�dt(e,y)oo

✏✏� ��f(x,y)oo

o/ o/ o/ o/ o/ o/ o/ o/ o/

V P�⌫y

✏✏�⌫x

✏✏

�ct(y)oo

� x+3

________ ________ �

✏✏�

✏✏

�f(x,y)ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

✏✏� �dt(y),rVP(x,y)oo

Social authentication is not challenge-response:x on the left is not a challenge, but a binder, analogous to y.


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Social commitment

Auth. then decommit

Decommit then auth.

Social KE

Security homology

Trust & reputation



Structural similarity — conceptual difference

A B�⌫y

✏✏�⌫x

✏✏

�e, ct(e,y)oo

� x// �

✏✏�

✏✏

�dt(e,y)oo

✏✏� ��f(x,y)oo

o/ o/ o/ o/ o/ o/ o/ o/ o/

V P�⌫y

✏✏�⌫x

✏✏

�ct(y)oo

� x+3

________ ________ �

✏✏�

✏✏

�f(x,y)ks _ _ _ _ _ _ _ __ _ _ _ _ _ _ _

✏✏� �dt(y),rVP(x,y)oo

Social authentication is not challenge-response:x on the left is not a challenge, but a binder, analogous to y.


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Outline

Introduction





Trust & reputation




Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Trust and reputation

NOT PRESENTED


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Outline

Introduction





Trust & reputation




Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Deriving location authetication: Mobile IP

NOT PRESENTED


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Outline

Introduction





Trust & reputation




Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Summary

ConclusionsI space security for pervasive and social computation

I E2E model does not suffice

I bootstrap distance, proximity, routing. . .I derivational approach sine qua non

Future workI embed Social Web 2.0 in physical space

I enable the export of authenticated social linksI make the Web into a social channel

I electronic pheromones


Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Summary


I E2E model does not sufficeI bootstrap distance, proximity, routing. . .

I derivational approach sine qua non





Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Summary








Dusko Pavlovic

Introduction

Model

Timedauthentication

Symbolicguessing


Trust & reputation



Summary







outline authentication in pervasive and social …social authentication trust & reputation...

Documents