Strands Rocq: Why is a Security Protocol Correct, Mechanically?

2025-02-18

AI Summary

To address the error-proneness and difficulty of verifying correctness in manual security protocol analysis, this paper develops the first faithful, modular, and extensible strand spaces formalization in Coq. Methodologically, it introduces the novel concept of the “maximal adversary” to enable compositional reasoning about protocols; designs domain-specific Coq tactics and abstracts minimal security conditions to establish highly reusable proof structures; and integrates symbolic protocol modeling with static analysis techniques. The framework successfully verifies protocol families including ISO/IEC 9798-2 and Needham-Schroeder-Lowe, rectifies flaws in prior hand-written proofs, improves the precision of static analysis for key management APIs, and—crucially—achieves the first strictly compositional security proofs for such protocols within a mechanized setting.

Technology Category

Application Domains: SecurityKnowledge Representation and Reasoning: Automated Reasoning and Theorem ProvingConstraint Satisfaction and Optimization: Satisfiability Modulo Theories

Application Category

Security and Privacy: Large-scale security measurementsSemantics and Knowledge: Provenance, trust, security and privacy, and ethical issues in managing semantic dataGraph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs

Abstract

Strand spaces are a formal framework for symbolic protocol verification that allows for pen-and-paper proofs of security. While extremely insightful, pen-and-paper proofs are error-prone, and it is hard to gain confidence on their correctness. To overcome this problem, we developed StrandsRocq, a full mechanization of the strand spaces in Coq (soon to be renamed Rocq). The mechanization was designed to be faithful to the original pen-and-paper development, and it was engineered to be modular and extensible. StrandsRocq incorporates new original proof techniques, a novel notion of maximal penetrator that enables protocol compositionality, and a set of Coq tactics tailored to the domain, facilitating proof automation and reuse, and simplifying the work of protocol analysts. To demonstrate the versatility of our approach, we modelled and analyzed a family of authentication protocols, drawing inspiration from ISO/IEC 9798-2 two-pass authentication, the classical Needham-Schroeder-Lowe protocol, as well as a recently-proposed static analysis for a key management API. The analyses in StrandsRocq confirmed the high degree of proof reuse, and enabled us to distill the minimal requirements for protocol security. Through mechanization, we identified and addressed several issues in the original proofs and we were able to significantly improve the precision of the static analysis for the key management API. Moreover, we were able to leverage the novel notion of maximal penetrator to provide a compositional proof of security for two simple authentication protocols.

Problem

• Mechanizing symbolic protocol verification
• Addressing error-prone pen-and-paper proofs
• Enhancing security protocol correctness confidence

Innovation

• Mechanized symbolic protocol verification
• Novel maximal penetrator concept
• Custom Coq tactics automation