Table Of ContentLecture Notes in Computer Science 7140
CommencedPublicationin1973
FoundingandFormerSeriesEditors:
GerhardGoos,JurisHartmanis,andJanvanLeeuwen
EditorialBoard
DavidHutchison
LancasterUniversity,UK
TakeoKanade
CarnegieMellonUniversity,Pittsburgh,PA,USA
JosefKittler
UniversityofSurrey,Guildford,UK
JonM.Kleinberg
CornellUniversity,Ithaca,NY,USA
AlfredKobsa
UniversityofCalifornia,Irvine,CA,USA
FriedemannMattern
ETHZurich,Switzerland
JohnC.Mitchell
StanfordUniversity,CA,USA
MoniNaor
WeizmannInstituteofScience,Rehovot,Israel
OscarNierstrasz
UniversityofBern,Switzerland
C.PanduRangan
IndianInstituteofTechnology,Madras,India
BernhardSteffen
TUDortmundUniversity,Germany
MadhuSudan
MicrosoftResearch,Cambridge,MA,USA
DemetriTerzopoulos
UniversityofCalifornia,LosAngeles,CA,USA
DougTygar
UniversityofCalifornia,Berkeley,CA,USA
GerhardWeikum
MaxPlanckInstituteforInformatics,Saarbruecken,Germany
Gilles Barthe Anupam Datta
Sandro Etalle (Eds.)
Formal Aspects
of Security and Trust
8th International Workshop, FAST 2011
Leuven, Belgium, September 12-14, 2011
Revised Selected Papers
1 3
VolumeEditors
GillesBarthe
UniversidadPolitecnicadeMadrid
IMDEASoftwareInstitute
CampusMontegancedo
28660BoadilladelMonte,Madrid,Spain
E-mail:[email protected]
AnupamDatta
CarnegieMellonUniversity
NASAResearchPark,Bldg.23(MS23-11)
P.O.Box1
MoffetField,CA94035-0001,USA
E-mail:[email protected]
SandroEtalle
TechnicalUniversityofEindhoven
FacultyofMathematicsandComputerScience
EmbeddedSystemsSecurityGroup
P.O.Box513
5600MBEindhoven,TheNetherlands
E-mail:[email protected]
ISSN0302-9743 e-ISSN1611-3349
ISBN978-3-642-29419-8 e-ISBN978-3-642-29420-4
DOI10.1007/978-3-642-29420-4
SpringerHeidelbergDordrechtLondonNewYork
LibraryofCongressControlNumber:2012934839
CRSubjectClassification(1998):C.2.0,K.6.5,D.4.6,E.3,K.4.4,H.3-4,J.1
LNCSSublibrary:SL4–SecurityandCryptology
©Springer-VerlagBerlinHeidelberg2012
Thisworkissubjecttocopyright.Allrightsarereserved,whetherthewholeorpartofthematerialis
concerned,specificallytherightsoftranslation,reprinting,re-useofillustrations,recitation,broadcasting,
reproductiononmicrofilmsorinanyotherway,andstorageindatabanks.Duplicationofthispublication
orpartsthereofispermittedonlyundertheprovisionsoftheGermanCopyrightLawofSeptember9,1965,
initscurrentversion,andpermissionforusemustalwaysbeobtainedfromSpringer.Violationsareliable
toprosecutionundertheGermanCopyrightLaw.
Theuseofgeneraldescriptivenames,registerednames,trademarks,etc.inthispublicationdoesnotimply,
evenintheabsenceofaspecificstatement,thatsuchnamesareexemptfromtherelevantprotectivelaws
andregulationsandthereforefreeforgeneraluse.
Typesetting:Camera-readybyauthor,dataconversionbyScientificPublishingServices,Chennai,India
Printedonacid-freepaper
SpringerispartofSpringerScience+BusinessMedia(www.springer.com)
Preface
The presentvolumecontainsthe proceedingsofthe 8thInternationalWorkshop
onFormalAspectsofSecurityandTrust(FAST2011),heldinLeuven,Belgium,
September 12–14, 2011, in co-location with the 16th European Symposium on
Research in Computer Security (ESORICS).
FAST sought original papers focusing on formal aspects of the following
topics: security and trust policy models; security protocol design and analysis;
formal models of trust and reputation; logics for security and trust; distributed
trustmanagementsystems;trust-basedreasoning;digitalassetsprotection;data
protection; privacy and ID issues; information flow analysis; language-basedse-
curity; security and trust aspects of ubiquitous computing; validation/analysis
tools;Webservicesecurity/trust/privacy;gridsecurity;securityriskassessment;
and case studies.
The ProgramCommittee of FAST 2011 received 42 submissions in response
to the Call for Papers. Our warmest thanks go to all the authors of submitted
papers for sending their work to the conference. Each paper was reviewed by
three members of the Program Committee; we thank all the external reviewers
fortheirvaluableefforts.Basedonthereviewreportsandelectronicdiscussions,
the ProgramCommittee selected 15 papers for inclusion in the proceedings.
The proceedings contain revised versions of these 15 accepted papers, and
two papers that accompany invited lectures by Andrew D. Gordon (Microsoft
ResearchandUniversityofEdinburgh),andFrankPiessens(KatholiekeUniver-
siteit Leuven).
We are grateful to the invited speakers for accepting to address the confer-
ence, and to the members of the ProgramCommittee for their assistance in the
paper selection. We are also grateful to the local organizers of ESORICS 2011
for providing a perfect environment for running the workshop, and to Andrei
Voronkov for his EasyChair system.
November 2011 Gilles Barthe
Anupam Datta
Sandro Etalle
Organization
Program Committee
Gilles Barthe IMDEA Software Institute, Spain
Konstantinos Chatzikokolakis CNRS and Ecole Polytechnique, France
Stephen Chong Harvard University, USA
Michael Clarkson George Washington University, USA
Ricardo Corin Universidad Nacional de Co´rdoba, Argentina
Cas Cremers ETH Zurich, Switzerland
Anupam Datta Carnegie Mellon University, USA
Sandro Etalle T.U. Eindhoven and University of Twente,
The Netherlands
C´edric Fournet Microsoft Research, USA
Deepak Garg Carnegie Mellon University, USA
Peter Herrmann NTNU Trondheim, Norway
Bart Jacobs Radboud University Nijmegen,
The Netherlands
Christian DamsgaardJensen Technical University of Denmark, Denmark
Steve Kremer LSV, ENS Cachan, CNRS, INRIA, France
Fabio Martinelli IIT-CNR, Italy
Fabio Massacci University of Trento, Italy
Sjouke Mauw University of Luxembourg, Luxembourg
Ron van der Meyden University of New South Wales, Australia
Mogens Nielsen BRICS, University of Aarhus, Denmark
Mark Ryan University of Birmingham, UK
Luca Vigan`o University of Verona, Italy
Additional Reviewers
Alvim, Mario S. Harvan, Matus
Barletta, Michele Huisman, Marieke
Bielova, Nataliia Jeffrey, Alan
Bursuc, Sergiu Koleini, Masoud
Clavel, Manuel Kordy, Barbara
Costa, Gabriele Koshutanski, Hristo
De Ruiter, Joeri Kunnemann, Robert
Dechesne, Francien Lee, Mat´ıas D.
Delaune, Stephanie Li, Ninghui
Gadyatskaya,Olga Manzano, Felipe
Garcia, Flavio D. Matteucci, Ilaria
VIII Organization
Melissen, Matthijs Schmidt, Benedikt
Mo¨dersheim, Sebastian Shkaravska, Olha
Paci, Federica Su, Kaile
Pagano,Miguel Torabi Dashti, Mohammad
Pang, Jun Ullman, Jonathan
Radomirovi´c,Saˇsa Van Deursen, Ton
Ramanujam, R. Verdult, Roel
Samardjiska, Simona Yautsiukhin, Artsiom
Table of Contents
Verifying Cryptographic Code in C: Some Experience and the Csec
Challenge ....................................................... 1
Mihhail Aizatulin, Franc¸ois Dupressoir, Andrew D. Gordon, and
Jan Ju¨rjens
Better SecurityandPrivacyforWeb Browsers:A SurveyofTechniques,
and a New Implementation........................................ 21
Willem De Groef, Dominique Devriese, and Frank Piessens
Differential Privacy: On the Trade-Off between Utility and Information
Leakage......................................................... 39
Ma´rio S. Alvim, Miguel E. Andr´es, Konstantinos Chatzikokolakis,
Pierpaolo Degano, and Catuscia Palamidessi
On-the-Fly Inlining of Dynamic Dependency Monitors for Secure
Information Flow ................................................ 55
Luciano Bello and Eduardo Bonelli
Min-Entropy Leakage of Channels in Cascade........................ 70
Barbara Espinoza and Geoffrey Smith
Secure Recharge of Disposable RFID Tickets ........................ 85
Riccardo Focardi and Flaminia L. Luccio
Avoiding Delegation Subterfuge Using Linked Local Permission
Names.......................................................... 100
Simon N. Foley and Samane Abdi
Verifiable Control Flow Policies for Java Bytecode ................... 115
Arnaud Fontaine, Samuel Hym, and Isabelle Simplot-Ryl
Concepts and Proofs for Configuring PKCS#11...................... 131
Sibylle Fro¨schle and Nils Sommer
Service Automata................................................ 148
Richard Gay, Heiko Mantel, and Barbara Sprick
Analysing Applications Layered on Unilaterally Authenticating
Protocols ....................................................... 164
Thomas Gibson-Robinson and Gavin Lowe
Type-Based Enforcement of Secure Programming Guidelines — Code
Injection Prevention at SAP....................................... 182
Robert Grabowski, Martin Hofmann, and Keqin Li
X Table of Contents
TBA : A Hybrid of Logic and Extensional Access Control Systems ..... 198
Timothy L. Hinrichs, William C. Garrison III, Adam J. Lee,
Skip Saunders, and John C. Mitchell
Diffie-Hellman without Difficulty................................... 214
Sebastian Mo¨dersheim
Is Cryptyc Able to Detect Insider Attacks?.......................... 230
Behnam Sattarzadeh and Mehran S. Fallah
Formal Analysis of Anonymity in ECC-Based Direct Anonymous
Attestation Schemes.............................................. 245
Ben Smyth, Mark Ryan, and Liqun Chen
Risk Balance in Optimistic Non-repudiation Protocols ................ 263
Mohammad Torabi Dashti, Jan Cederquist, and Yanjing Wang
Author Index.................................................. 279
Verifying Cryptographic Code in C:
Some Experience and the Csec Challenge
Mihhail Aizatulin1, Franc¸ois Dupressoir1,
Andrew D. Gordon2, and Jan Ju¨rjens3
1 The Open University
2 Microsoft Research and Universityof Edinburgh
3 TU Dortmundand Fraunhofer ISST
Abstract. The security of much critical infrastructure dependsin part
oncryptographicsoftwarecodedinC,andyetvulnerabilitiescontinueto
be discovered in such software. Wedescribe recent progress on checking
thesecurityof Ccodeimplementing cryptographicsoftware. Inparticu-
lar, we describe projects that combine verification-condition generation
and symbolic execution techniques for C, with methods for stating and
verifying security properties of abstract models of cryptographic proto-
cols. We illustrate these techniques on C code for a simple two-message
protocol.
1 Introduction
Wedescribeourexperienceofverifyingsecuritypropertiesofcryptographicsoft-
ware in C. This problem is far from solved, but we approach it in the context
ofmuchrecentprogressontheoriesandtoolsfor reasoningaboutcryptographic
protocols and their implementations.
The plan of this article (and the invited talk it accompanies) is to explain
two different approaches to the problem in the setting of a simple example.
Section 2 describes this example, a simple client-server protocol, introduced by
Fournet et al.(2011b),whichreliesonauthenticatedencryptiontoachieveboth
authenticationandsecrecy,andoutlines thestructureofourC programsforthe
client and server roles of the protocol.
In Section 3 we describe a method (Aizatulin et al. 2011b) for extracting ab-
stractmodelsofcryptographiccodebysymbolicexecution.Thetechniqueyields
models that may be verified with ProVerif (Blanchet 2001) to obtain results in
the symbolic model of cryptography. For some protocols, we may appeal to the
CoSP framework (Backes et al. 2009) to obtain computational soundness.
Next,inSection4,wedescribeamethod(Dupressoir et al.2011)forapplying
a general-purpose C verifier, specifically VCC (Cohen et al. 2009), to proving
protocol properties using the method of invariants for cryptographic structures
(Bhargavanet al.2010),amethoddevelopedoriginallyforfunctionalcodeusing
the F7 refinement-type checker (Bengtson et al. 2008). For this second method,
weobtainresultsonlyintheformalmodel(althoughwehaveworkunderwayon
G.Barthe,A.Datta,andS.Etalle(Eds.):FAST2011,LNCS7140,pp.1–20,2012.
(cid:2)c Springer-VerlagBerlinHeidelberg2012
2 M. Aizatulin et al.
recastinginVCC recenttechniques (Fournet et al.2011b) fordirectlyobtaining
computational guarantees via F7). Finally, Section 6 concludes.
Ourverificationworkassumescorrectnessofthecodefortheunderlyingcryp-
tographic algorithms; others have addressed how to verify code of such algo-
rithms (Erko¨k et al.2009;Barbosa et al.2010).Instead,our concernis to check
the correctusageofcryptographicalgorithmssoasto ensuresecurityproperties
of protocols and devices.
We have made our code, our verification tools, and our verification results
availableonthe web. A packageathttp://research.microsoft.com/csecin-
cludes the sourcecode forourexample andthe logsfromrunning ourtools,and
also, to replicate our results, instructions for first downloading our tools and
their dependencies, and then re-running verification.
Moreover, as described in Section 6, we have launched a companion web-
site, the Csec Challenge, to curate examples of cryptographic code, including
protocols and software for hardware tokens, as a basis for evaluating different
verification techniques.
Additonal details appear in a technical report (Aizatulin et al. 2011a).
2 Example: Encryption-Based Authenticated RPC
We define an example protocol,together with a deliberately informal statement
of security properties. In later sections we give a specific interpretation of these
properties, for each of our two verification techniques.
2.1 Protocol Description and Security Properties
We consider a protocol, due to Fournet et al. (2011b), that is an encryption-
basedvariantoftheRPCprotocolconsideredinpreviouspapers(Bhargavan et al.
2010; Dupressoir et al. 2011; Aizatulin et al. 2011b). In the following, the curly
braces{m} standfortheencryption,usinganauthenticatedencryptionmecha-
k
nism,ofplaintextmunderkeykwhilethecommarepresentsaninjectivepairing
operation in infix form.
We consider a population of principals, ranged over by A and B (and later,
in code, by a and b). The following protocol narration describes the process of
A in client role communicating to B in server role.
Authenticated RPC: RPC-enc
A : event client begin(A,B,req)
A→B: A,{req,kS}kAB
B : event server reply(A,B,req,resp)
B →A: {resp}
kS
A : event client accept(A,B,req,resp)
The key kAB is a unidirectional long-term key shared between A and B, for A
in client role, and B in server role. (Should B wish to play the client role, they
