Book Chapter10.1007/978-3-642-04474-8_5
A Calculus to Detect Guessing Attacks
Bogdan Groza,Marius Minea +1 more
- 04 Sep 2009
- pp 59-67
TL;DR: A calculus for detecting guessing attacks, based on oracles that instantiate cryptographic functions, which shows how to derive a known weakness in the Anderson-Lomas protocol, and new vulnerabilities for a known faulty ATM system.
read more
Abstract: We present a calculus for detecting guessing attacks, based on oracles that instantiate cryptographic functions. Adversaries can observe oracles, or control them either on-line or off-line. These relations can be established by protocol analysis in the presence of a Dolev-Yao intruder, and the derived guessing rules can be used together with standard intruder deductions. Our rules also handle partial verifiers that fit more than one secret. We show how to derive a known weakness in the Anderson-Lomas protocol, and new vulnerabilities for a known faulty ATM system.
read more
Chat with Paper
AI Agents for this Paper
Find similar papers on Google Scholar, PubMed and Arxiv
Write a critical review of this paper
Analyze citations of this paper to find unaddressed research gaps
Citations
Security and Privacy Concerns About the RFID Layer of EPC Gen2 Networks
Joaquin Garcia-Alfaro,Joaquin Garcia-Alfaro,Jordi Herrera-Joancomartí,Jordi Herrera-Joancomartí,Joan Melià-Seguí,Joan Melià-Seguí +5 more
- 01 Jan 2015
TL;DR: This chapter provides an in-depth presentation of the RFID layer of the EPC Gen2 standard, and provides security and privacy threats that can affect such a layer, and survey some representative countermeasures that could be used to handle the reported threats.
Rethinking about guessing attacks
Zhiwei Li,Weichao Wang +1 more
- 22 Mar 2011
TL;DR: A new definition of guessing attacks is sought in this paper to fully characterize the attacker's guessing capabilities (i.e., guessability), which provides a general framework to reason about guessing attacks in a symbolic setting, independent of specific intruder models.
A formal approach for automated reasoning about off-line and undetectable on-line guessing
Bogdan Groza,Marius Minea +1 more
- 25 Jan 2010
TL;DR: In this article, the authors formalize guessing rules for symbolic verification and add their guessing rules as state transitions to protocol models that are input to model checking tools, which can detect guessing attacks in several protocols.
References
An efficient cryptographic protocol verifier based on prolog rules
Bruno Blanchet
- 11 Jun 2001
TL;DR: A new automatic cryptographic protocol verifier based on a simple representation of the protocol by Prolog rules, and on a new efficient algorithm that determines whether a fact can be proved from these rules or not, which proves secrecy properties of the protocols.
1.2K
Analysing protocols subject to guessing attacks
TL;DR: This paper formalises guessing attacks upon security protocols, where an intruder guesses one of the values used and then seeks to verify that guess, and describes how to model such attacks within the process algebra CSP so that they can be detected using the model checker FDR.
82
Guessing attacks and the computational soundness of static equivalence
Martín Abadi,Mathieu Baudet,Bogdan Warinschi +2 more
- 25 Mar 2006
TL;DR: This paper develops and analyzes a principled formal account of guessing attacks in terms of static equivalence, and defines and justifies an equational theory for standard, fundamental cryptographic operations.
•Journal Article
Analysing Password Protocol Security Against Off-line Dictionary Attacks
TL;DR: In this article, the security of password protocols against off-line dictionary attacks is studied. But the adversary abilities are modelled as equations between terms, and they are not considered when the password protocol is instantiated with particular encryption schemes.
59
Analysing Password Protocol Security Against Off-line Dictionary Attacks
Ricardo Corin,Jeroen Doumen,Sandro Etalle +2 more
- 01 Feb 2005
TL;DR: In this article, the security of password protocols against off-line dictionary attacks was studied. But the authors only considered the password protocol being instantiated with particular encryption schemes, and they did not consider the adversary's ability to distinguish ciphertexts from random noise.
53