Automatic Analysis of the Security of XOR-Based Key Management Schemes

  • Véronique Cortier
  • Gavin Keighren
  • Graham Steel
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 4424)


We describe a new algorithm for analysing security protocols that use XOR, such as key-management APIs. As a case study, we consider the IBM 4758 CCA API, which is widely used in the ATM (cash machine) network. Earlier versions of the CCA API were shown to have serious flaws, and the fixes introduced by IBM in version 2.41 had not previously been formally analysed. We first investigate IBM’s proposals using a model checker for security protocol analysis, uncovering some important issues about their implementation. Having identified configurations we believed to be safe, we describe the formal verification of their security. We first define a new class of protocols, containing in particular all the versions of the CCA API. We then show that secrecy after an unbounded number of sessions is decidable for this class. Implementing the decision procedure requires some improvements, since the procedure is exponential. We describe a change of representation that leads to an implementation able to verify a configuration of the API in a few seconds. As a consequence, we obtain the first security proof of the fixed IBM 4758 CCA API with unbounded sessions.


Decision Procedure Security Protocol Automate Teller Machine Unbounded Number Security Module 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


  1. 1.
    Baader, F., Schulz, K.: Unification in the Union of Disjoint Equational Theories: Combining Decision Procedures. In: Kapur, D. (ed.) CADE 1992. LNCS, vol. 607, pp. 50–65. Springer, Heidelberg (1992)Google Scholar
  2. 2.
    Bond, M.: Attacks on cryptoprocessor transaction sets. In: Koç, Ç.K., Naccache, D., Paar, C. (eds.) CHES 2001. LNCS, vol. 2162, pp. 220–234. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  3. 3.
    CCA Basic Services Reference and Guide (October 2006), Available online at
  4. 4.
    Chevalier, Y., et al.: An NP decision procedure for protocol insecurity with XOR. In: Proc. of 18th Annual IEEE Symposium on Logic in Computer Science (LICS ’03), pp. 261–270 (2003)Google Scholar
  5. 5.
    Comon-Lundh, H., Cortier, V.: New decidability results for fragments of first-order logic and application to cryptographic protocols. In: Nieuwenhuis, R. (ed.) RTA 2003. LNCS, vol. 2706, pp. 148–164. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  6. 6.
    Comon-Lundh, H., Shmatikov, V.: Intruder deductions, constraint solving and insecurity decision in presence of exclusive or. In: Proc. of 18th Annual IEEE Symposium on Logic in Computer Science (LICS ’03), pp. 271–280 (2003)Google Scholar
  7. 7.
    Cortier, V., Keighren, G., Steel, G.: Automatic analysis of the security of XOR-based key management schemes. Inf. Research Report EDI-INF-RR-0863, U. of Edinburgh (2006)Google Scholar
  8. 8.
    Courant, J., Monin, J.-F.: Defending the bank with a proof assistant. In: Proceedings of Workshop on Issues in the Theory of Security (WITS ’06), Vienna (March 2006)Google Scholar
  9. 9.
    IBM Comment on “A Chosen Key Difference Attack on Control Vectors” (January 2001) Available from
  10. 10.
    Keighren, G.: Model checking IBM’s common cryptographic architecture API. Informatics Research Report EDI-INF-RR-0862, University of Edinburgh (2006)Google Scholar
  11. 11.
    Nieuwenhuis, R. (ed.): CADE 2005. LNCS (LNAI), vol. 3632. Springer, Heidelberg (2005)zbMATHGoogle Scholar
  12. 12.
    Steel, G.: Deduction with XOR constraints in security API modelling. In: Nieuwenhuis, R. (ed.) CADE 2005. LNCS (LNAI), vol. 3632, pp. 322–336. Springer, Heidelberg (2005)Google Scholar
  13. 13.
    Turuani, M.: The CL-Atse Protocol Analyser. In: Pfenning, F. (ed.) RTA 2006. LNCS, vol. 4098, pp. 277–286. Springer, Heidelberg (2006)CrossRefGoogle Scholar
  14. 14.
    Verma, K.N., Seidl, H., Schwentick, T.: On the complexity of equational Horn clauses. In: Nieuwenhuis, R. (ed.) CADE 2005. LNCS (LNAI), vol. 3632, pp. 337–352. Springer, Heidelberg (2005)Google Scholar
  15. 15.
    Youn, P., et al.: Robbing the bank with a theorem prover. Technical Report UCAM-CL-TR-644, University of Cambridge (August 2005)Google Scholar
  16. 16.
    AVISPA Tool Set. Available from
  17. 17.
    AVISPA User Manual, version 1.1 (June 2006) Available online at

Copyright information

© Springer Berlin Heidelberg 2007

Authors and Affiliations

  • Véronique Cortier
    • 1
  • Gavin Keighren
    • 2
  • Graham Steel
    • 2
  1. 1.Loria UMR 7503 & CNRS & INRIA Lorraine projet CassisFrance
  2. 2.School of Informatics, University of EdinburghScotland

Personalised recommendations