Skip to main content
SpringerLink
Log in

Formally sound implementations of security protocols with JavaSPI

  • Original Article
  • Published:
Formal Aspects of Computing

Abstract

Designing and coding security protocols is an error prone task. Several flaws are found in protocol implementations and specifications every year. Formal methods can alleviate this problem by backing implementations with rigorous proofs about their behavior. However, formally-based development typically requires domain specific knowledge available only to few experts and the development of abstract formal models that are far from real implementations. This paper presents a Java-based protocol design and implementation framework, where the user can write a security protocol symbolic model in Java, using a well defined subset of the language that corresponds to applied π-calculus. This Java model can be symbolically executed in the Java debugger, formally verified with ProVerif, and further refined to an interoperable Java implementation of the protocol. Soundness theorems are provided to prove that, under some reasonable assumptions, a simulation relation relates the Java refined implementation to the symbolic model verified by ProVerif, so that, for the usual security properties, a property verified by ProVerif on the symbolic model is preserved in the Java refined implementation. The applicability of the framework is evaluated by developing an extensive case study on the popular SSL protocol.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Similar content being viewed by others

References

  1. Almeida JB, Bangerter E, Barbosa M, Krenn S, Sadeghi AR, Schneider T (2010) A certifying compiler for zero-knowledge proofs of knowledge based on Σ-protocols. In: 15th European conference on research in computer security (ESORICS 2010). Lecture notes in computer science, vol 6345. Springer, Berlin, pp 151–167

  2. Almeida JB, Barbosa M, Barthe G, Dupressoir F (2013) Certified computer-aided cryptography: efficient provably secure machine code from high-level implementations. In: 2013 ACM SIGSAC conference on computer and communications security (CCS 2013), ACM, pp 1217–1230

  3. Avanesov T, Chevalier Y, Mekki MA, Rusinowitch M (2012) Web services verification and prudent implementation. In: Data privacy management and autonomous spontaneus security. Lecture notes in computer science, vol 7122. Springer, Berlin, pp 173–189

  4. Abadi M, Fournet C: Mobile values, new names, and secure communication. ACM SIGPLAN Not 36(3), 104–115 (2001)

    Article  MATH  Google Scholar 

  5. Al Fardan NJ, Paterson KG (2013) Lucky thirteen: breaking the TLS and DTLS record protocols. In: 2013 IEEE symposium on security and privacy (S & P 2013), IEEE, pp 526–540

  6. Aizatulin M, Gordon AD, Jürjens J (2012) Computational verification of C protocol implementations by symbolic execution. In: 2012 ACM conference on computer and communications security (CCS 2012), ACM, pp 712–723

  7. Apple goto fail bug (2014) CVE-2014-1266. https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1266

  8. Avalle M, Pironti A, Pozza D, Sisto R: JavaSPI: a framework for security protocol implementation. Int J Secure Softw Eng 2(4), 34–48 (2011)

    Article  Google Scholar 

  9. Avalle M, Pironti A, Sisto R: Formal verification of security protocol implementations: a survey. Form Asp Comput 26(1), 99–123 (2014)

    Article  Google Scholar 

  10. Avalle M, Pironti A, Sisto R, Pozza D (2011) The JavaSPI framework for security protocol implementation. In: 6th international conference on availability, reliability and security (ARES 2011), IEEE Computer Society, pp 746–751

  11. Albrecht MR, Paterson KG, Watson G (2009) Plaintext recovery attacks against ssh. In: IEEE symposium on security and privacy (S & P 2009), IEEE, pp 16–26

  12. Bhargavan K, Corin R, Deniélou PM, Fournet C, Leifer JJ (2009) Cryptographic protocol synthesis and verification for multiparty sessions. In: 22nd IEEE computer security foundations symposium (CSF 2009), IEEE Computer Society, pp 124–140

  13. Bettassa Copet P, Pironti A, Pozza D, Sisto R, Vivoli P (2012) Visual model-driven design, verification and implementation of security protocols. In: IEEE 14th international symposium on high-assurance systems engineering (HASE 2012), IEEE, pp 62–65

  14. Basin D, Doser J, Lodderstedt T: Model driven security: from UML models to access control infrastructures. ACM Trans Softw Eng Methodol 15(1), 39–91 (2006)

    Article  Google Scholar 

  15. Bhargavan K, Fournet C, Gordon AD, Tse S: Verified interoperable implementations of security protocols. ACM Trans Program Lang Syst 31(1), 1–61 (2008)

    Article  MATH  Google Scholar 

  16. Blanchet B (2001) An efficient cryptographic protocol verifier based on prolog rules. In: 14th IEEE workshop on computer security foundations (CSF 2001), IEEE Computer Society, pp 82–96

  17. Blanchet B: Automatic verification of correspondences for security protocols. J Comput Secur 17(4), 363–434 (2009)

    Article  Google Scholar 

  18. Bhargavan K, Lavaud AD, Fournet C, Pironti A, Strub PY (2014) Triple handshakes and cookie cutters: breaking and fixing authentication over TLS. In: IEEE symposium on security and privacy (S & P 2014), IEEE, pp 98–113

  19. Bierman G, Parkinson M, Pitts A (2003) MJ: an imperative core calculus for Java and Java with effects. Technical report 563, Cambridge University Computer Laboratory

  20. Cade D, Blanchet B (2012) From computationally-proved protocol specifications to implementations. In: 7th international conference on availability, reliability and security (ARES 2012), IEEE Computer Society, pp 65–74

  21. Dupressoir F, Gordon AD, Jürjens J, Naumann DA: Guiding a general-purpose C verifier to prove cryptographic protocols. J Comput Secur 22(5), 823–866 (2014)

    Article  Google Scholar 

  22. Dolev D, Yao A: On the security of public key protocols. IEEE Trans Inf Theory 29(2), 198–207 (1983)

    Article  MathSciNet  MATH  Google Scholar 

  23. GnuTLS certificate verification issue (2014) CVE-2014-0092. https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0092

  24. Gorrieri R, Versari C (2015) Transition systems and behavioral equivalences. Springer, Berlin, pp 21–79

  25. Heartbleed bug (2014) CVE-2014-0160. https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0160

  26. Heintze N, Tygar JD: A model for secure protocols and their compositions. IEEE Trans Softw Eng 22(1), 16–30 (1996)

    Article  Google Scholar 

  27. Jürjens J (2001) Secrecy-preserving refinement. In: Fiadeiro J, Zave P (eds) International symposium on formal methods Europe (FME). Lecture notes in computer science, vol 2021. Springer, Berlin, pp 135–152

  28. Jürjens J: Secure systems development with UML. Springer, Berlin (2005)

    MATH  Google Scholar 

  29. Kiyomoto S, Ota H, Tanaka T (2008) A security protocol compiler generating C source codes. In: Information security and assurance, IEEE, pp 20–25

  30. Montrieux L, Jürjens J, Haley CB, Yu Y, Schobbens PY, Toussaint H (2010) Tool support for code generation from a umlsec property. In: IEEE/ACM international conference on automated software engineering (ASE 2010), ACM, pp 357–358

  31. O’Shea N (2008) Using elyjah to analyse Java implementations of cryptographic protocols. In: Joint workshop on foundations of computer security, automated reasoning for security protocol analysis and issues in the theory of security, pp 221–226

  32. Pironti A, Sisto R (2007) An experiment in interoperable cryptographic protocol implementation using automatic code generation. In IEEE Symposium on computers and communications, pages 839–844. IEEE

  33. Pironti A, Sisto R: Safe abstractions of data encodings in formal security protocol models. Form Asp Comput 26(1), 125–167 (2014)

    Article  MathSciNet  MATH  Google Scholar 

  34. Rescorla E, Ray M, Dispensa S, Oskov N (2010) Transport layer security (TLS) renegotiation indication extension. RFC 5746

  35. Song DX, Perrig A, Phan D (2001) AGVI: automatic generation, verification, and implementation of security protocols. In: 13th international conference on computer aided verification (CAV 2001). Lecture notes in computer science, vol 2102. Springer, Berlin, pp 241–245

  36. The Legion of Bouncy Castle. Bouncy castle crypto API. https://www.bouncycastle.org/java.html

Download references

Author information

Authors and Affiliations

  1. Dipartimento di Automatica e Informatica, Politecnico di Torino, Turin, Italy

    Riccardo Sisto, Piergiuseppe Bettassa Copet & Matteo Avalle

  2. IOActive, Madrid, Spain

    Alfredo Pironti

Authors
  1. Riccardo Sisto
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Piergiuseppe Bettassa Copet
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Matteo Avalle
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Alfredo Pironti
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Riccardo Sisto.

Additional information

Mark Ryan, Feng Hao, and Eerke Boiten

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Sisto, R., Bettassa Copet, P., Avalle, M. et al. Formally sound implementations of security protocols with JavaSPI. Form Asp Comp 30, 279–317 (2018). https://doi.org/10.1007/s00165-017-0449-8

Download citation

  • Received:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s00165-017-0449-8

Keywords

Search

Navigation