We propose a new simple logic that can be used to specify , i.e. security properties that refer to a single participant of the protocol specification. Our technique allows a protocol designer to provide a formal specification of the desired security properties, and integrate it naturally into the design process of cryptographic protocols. Furthermore, the logic can be used for formal verification. We illustrate the utility of our technique by exposing new attacks on the well studied protocol TMN.
In @cite_20 , Cremers, Mauw and de Vink present another logic for specifying local security properties. Similarly to us, in @cite_20 the authors define the message authenticity property by referring to the variables occurring in the protocol role. In addition, in @cite_20 , it is defined a new kind of authentication, called , which is then compared with the Lowe's intensional specification. The logic presented in this paper cannot handle the specification of the synchronization authentication. In fact, we cannot handle the weaker notion of injective authentication, since we cannot match corresponding events in a trace. However, we believe we can extend our logic to support these properties. Briefly, this could be achieved by decorating the different runs with label identifiers and adding a primitive to reason about events that happenned before others in a trace.
@cite_20
146967524
In this paper we define a general trace model for security protocols which allows to reason about various formal definitions of authentication. In the model, we define a strong form of authentication which we call synchronization. We present both an injective and a noninjective version. We relate synchronization to a formulation of agreement in our trace model and contribute to the discussion on intensional vs. extensional specifications.