## Cryptology ePrint Archive: Report 2012/173

Automatically Verified Mechanized Proof of One-Encryption Key Exchange

Bruno Blanchet

Abstract: We present a mechanized proof of the password-based protocol One-Encryption Key Exchange (OEKE) using the computationally-sound protocol prover CryptoVerif. OEKE is a non-trivial protocol, and thus mechanizing its proof provides additional confidence that it is correct. This case study was also an opportunity to implement several important extensions of CryptoVerif, useful for proving many other protocols. We have indeed extended CryptoVerif to support the computational Diffie-Hellman assumption. We have also added support for proofs that rely on Shoup's lemma and additional game transformations. In particular, it is now possible to insert case distinctions manually and to merge cases that no longer need to be distinguished. Eventually, some improvements have been added on the computation of the probability bounds for attacks, providing better reductions. In particular, we improve over the standard computation of probabilities when Shoup's lemma is used, which allows us to improve the bound given in a previous manual proof of OEKE, and to show that the adversary can test at most one password per session of the protocol. In this paper, we present these extensions, with their application to the proof of OEKE. All steps of the proof, both automatic and manually guided, are verified by CryptoVerif.

Category / Keywords: cryptographic protocols / Automatic proofs, Formal methods, Provable security, Protocols, Password-based authentication

Publication Info: This is the full version of a paper to appear at CSF'12 (IEEE Computer Security Foundations Symposium). The full version adds all appendices.

Contact author: blanchet at di ens fr

Available format(s): Postscript (PS) | Compressed Postscript (PS.GZ) | PDF | BibTeX Citation

Short URL: ia.cr/2012/173

[ Cryptology ePrint archive ]