-
Notifications
You must be signed in to change notification settings - Fork 15
/
Copy pathtls12-tls13-draft18.pv
138 lines (113 loc) · 7.29 KB
/
tls12-tls13-draft18.pv
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
(* Following secrecy queries should fail *)
query cr:random, sr:random, psk:preSharedKey, p:pubkey, ms:bitstring, aek:ae_key, cb:bitstring, cr':random, sr':random, v:version, e:element;
event(ClientAEKeyLeaked(TLS13,cr,sr,psk,p)) ==>
(event(WeakOrCompromisedKey(p)) && (psk = NoPSK || event(CompromisedPreSharedKey(psk)))) ||
event(ServerChoosesKEX(cr,sr,p,TLS13,DHE_13(WeakDH,e))).
query cr:random, sr:random, psk:preSharedKey, p:pubkey, ms:bitstring, aek:ae_key, cb:bitstring, cr':random, sr':random, v:version, e:element;
event(ClientAEKeyLeaked(TLS13,cr,sr,psk,p)) ==>
(event(WeakOrCompromisedKey(p)) && (psk = NoPSK || event(CompromisedPreSharedKey(psk)))) ||
event(ServerChoosesHash(cr',sr',p,TLS13,WeakHash)).
query cr:random, sr:random, psk:preSharedKey, p:pubkey, ms:bitstring, aek:ae_key, cb:bitstring, cr':random, sr':random, v:version, e:element;
event(ClientAEKeyLeaked(TLS13,cr,sr,psk,p)) ==>
event(ServerChoosesKEX(cr,sr,p,TLS13,DHE_13(WeakDH,e))) ||
event(ServerChoosesHash(cr',sr',p,TLS13,WeakHash)).
(* Following authentication queries should fail *)
query cr:random, sr:random, cr':random, sr':random,
psk:preSharedKey,p:pubkey, e:element,
o:params, m:params,
ck:ae_key,sk:ae_key,ms:bitstring,cb:bitstring;
inj-event(ClientFinished(TLS13,cr,sr,psk,p,o,m,ck,sk,cb,ms)) ==>
inj-event(PreServerFinished(TLS13,cr,sr,psk,p,o,m,ck,sk,cb)) ||
(event(WeakOrCompromisedKey(p)) && (psk = NoPSK || event(CompromisedPreSharedKey(psk)))) ||
event(ServerChoosesKEX(cr',sr',p,TLS12,RSA(WeakRSADecryption))).
query cr:random, sr:random, cr':random, sr':random,
psk:preSharedKey,p:pubkey, e:element,
o:params, m:params,
ck:ae_key,sk:ae_key,ms:bitstring,cb:bitstring;
inj-event(ClientFinished(TLS13,cr,sr,psk,p,o,m,ck,sk,cb,ms)) ==>
inj-event(PreServerFinished(TLS13,cr,sr,psk,p,o,m,ck,sk,cb)) ||
(event(WeakOrCompromisedKey(p)) && (psk = NoPSK || event(CompromisedPreSharedKey(psk)))) ||
event(ServerChoosesKEX(cr,sr,p,TLS13,DHE_13(WeakDH,e))).
query cr:random, sr:random, cr':random, sr':random,
psk:preSharedKey,p:pubkey, e:element,
o:params, m:params,
ck:ae_key,sk:ae_key,ms:bitstring,cb:bitstring;
inj-event(ClientFinished(TLS13,cr,sr,psk,p,o,m,ck,sk,cb,ms)) ==>
inj-event(PreServerFinished(TLS13,cr,sr,psk,p,o,m,ck,sk,cb)) ||
event(ServerChoosesKEX(cr,sr,p,TLS13,DHE_13(WeakDH,e))) ||
event(ServerChoosesHash(cr',sr',p,TLS13,WeakHash)).
query cr:random, sr:random, cr':random, sr':random,
psk:preSharedKey,p:pubkey, e:element,
o:params, m:params,
ck:ae_key,sk:ae_key,ms:bitstring,cb:bitstring;
inj-event(ClientFinished(TLS13,cr,sr,psk,p,o,m,ck,sk,cb,ms)) ==>
inj-event(PreServerFinished(TLS13,cr,sr,psk,p,o,m,ck,sk,cb)).
(* Main channel-binding query: fails if cb = ms, succeeds if cb = m1 *)
query cr:random, sr:random, p:pubkey, cr':random, sr':random, p':pubkey;
event(MatchingChannelBinding(TLS13,cr,sr,p,TLS13,cr',sr',p')).
(* Following queries fail for TLS 1.2 but should succeed for TLS 1.3 *)
query cr:random, sr:random, p:pubkey, cr':random, sr':random, p':pubkey;
event(MatchingResumptionSecret(TLS13,cr,sr,p,TLS13,cr',sr',p')).
query cr:random, sr:random, p:pubkey, cr':random, sr':random, p':pubkey;
event(MatchingAEKey(TLS13,cr,sr,p,TLS13,cr',sr',p')).
(* 1-RTT handshake secrecy query: every disjunct is required *)
query cr:random, sr:random, psk:preSharedKey, p:pubkey, ms:bitstring, aek:ae_key, cb:bitstring, cr':random, sr':random, v:version, e:element;
event(ClientAEKeyLeaked(TLS13,cr,sr,psk,p)) ==>
(event(WeakOrCompromisedKey(p)) && (psk = NoPSK || event(CompromisedPreSharedKey(psk)))) ||
event(ServerChoosesKEX(cr,sr,p,TLS13,DHE_13(WeakDH,e))) ||
event(ServerChoosesKEX(cr',sr',p,TLS12,RSA(WeakRSADecryption))) ||
event(ServerChoosesHash(cr',sr',p,TLS13,WeakHash)).
(* 1-RTT handshake authentication query: every disjunct is required; commenting any of them results in "false" *)
query cr:random, sr:random, cr':random, sr':random,
psk:preSharedKey,p:pubkey, e:element,
o:params, m:params,
ck:ae_key,sk:ae_key,ms:bitstring,cb:bitstring;
inj-event(ClientFinished(TLS13,cr,sr,psk,p,o,m,ck,sk,cb,ms)) ==>
inj-event(PreServerFinished(TLS13,cr,sr,psk,p,o,m,ck,sk,cb)) ||
(event(WeakOrCompromisedKey(p)) && (psk = NoPSK || event(CompromisedPreSharedKey(psk)))) ||
event(ServerChoosesKEX(cr,sr,p,TLS13,DHE_13(WeakDH,e))) ||
event(ServerChoosesKEX(cr',sr',p,TLS12,RSA(WeakRSADecryption))) ||
event(ServerChoosesHash(cr',sr',p,TLS13,WeakHash)).
(* Main appData secrecy query: every disjunct is required *)
query cr:random, sr:random, psk:preSharedKey, p:pubkey, e:element, ms:bitstring, aek:ae_key, cb:bitstring, cr':random, sr':random, v:version;
attacker(m_c(TLS13,cr,sr,p,psk)) ==>
(event(WeakOrCompromisedKey(p)) && (psk = NoPSK || event(CompromisedPreSharedKey(psk)))) ||
event(ServerChoosesAE(cr,sr,p,TLS13,WeakAE)) ||
event(ServerChoosesKEX(cr,sr,p,TLS13,DHE_13(WeakDH,e))) ||
event(ServerChoosesKEX(cr',sr',p,TLS12,RSA(WeakRSADecryption))) ||
event(ServerChoosesHash(cr',sr',p,TLS13,WeakHash)).
query cr:random, psk:bitstring,kex:kex_alg,h:hash_alg,kc0:ae_key,ems0:bitstring,pt:psk_type;
attacker(m_c0(TLS13,cr,psk)) ==>
(psk = NoPSK || event(CompromisedPreSharedKey(psk))) ||
event(ClientOffersAE(cr,WeakAE)).
(* Main appData authentication query: every disjunct is required; commenting any of them results in "false" *)
(* Replay prevention relies on the recipient not accepting 2 messages with the same (n,ad);
it is not explicitly proved in ProVerif. *)
query cr:random, sr:random, cr':random, sr':random, psk:preSharedKey, e:element,
p:pubkey, n:bitstring, ad:bitstring, m:bitstring;
event(ServerReceives0(TLS13,cr,psk,n,ad,m)) ==>
event(ClientSends0(TLS13,cr,psk,n,ad,m)) ||
((psk = NoPSK || event(CompromisedPreSharedKey(psk)))) ||
event(ClientOffersAE(cr,WeakAE)).
query cr:random, sr:random, cr':random, sr':random, psk:preSharedKey, e:element,
p:pubkey, n:bitstring, ad:bitstring, m:bitstring;
event(ServerReceives(TLS13,cr,sr,psk,p,n,ad,m)) ==>
event(ClientSends(TLS13,cr,sr,psk,p,n,ad,m)) ||
((psk = NoPSK || event(CompromisedPreSharedKey(psk)))) ||
event(ServerChoosesAE(cr,sr,p,TLS13,WeakAE)) ||
event(ServerChoosesKEX(cr,sr,p,TLS13,DHE_13(WeakDH,e))) ||
event(ServerChoosesHash(cr',sr',p,TLS13,WeakHash)).
query cr:random, sr:random, cr':random, sr':random, psk:preSharedKey, e:element, v:version,
p:pubkey, n:bitstring, ad:bitstring, m:bitstring;
event(ClientReceives(TLS13,cr,sr,psk,p,n,ad,m)) ==>
event(ServerSends(TLS13,cr,sr,psk,p,n,ad,m)) ||
(event(WeakOrCompromisedKey(p)) && (psk = NoPSK || event(CompromisedPreSharedKey(psk)))) ||
event(ServerChoosesAE(cr,sr,p,TLS13,WeakAE)) ||
event(ServerChoosesKEX(cr,sr,p,TLS13,DHE_13(WeakDH,e))) ||
event(ServerChoosesKEX(cr',sr',p,v,RSA(WeakRSADecryption))) ||
event(ServerChoosesHash(cr',sr',p,v,WeakHash)).
process (
!Client13() | !Server13() |
!Client12() | !Server12() |
!longTermKeys() | !appData() |
!secrecyQuery() | !channelBindingQuery() )