In UC framework, real protocol p securely realizes ideal functionality if F, for ? A and ? Z, it has the same “action” as F,. Formally, a protocol p securely realizes an ideal functionality F is for any real-life adversary A there exists an ideal-process adversary S such that, for any environment Z and on any input, the probability that Z outputs “1” after interacting witha A and parties running p in the real-life model differs by at most a negligible fraction from the probability that Z outputs “1” after interacting with S and F in the ideal process.
Published in Chapter:
The Provably Secure Formal Methods for Authentication and Key Agreement Protocols
Jianfeng Ma (Xidian University, China) and Xinghua Li (Xidian University, China)
Copyright: © 2008
|Pages: 26
DOI: 10.4018/978-1-59904-899-4.ch015
Abstract
In the design and analysis of authentication and key agreement protocols, provably secure formal methods play a very important role, among which the Canetti-Krawczyk (CK) model and universal composable (UC) security model are very popular at present. This chapter focuses on these two models and consists mainly of three parts: (1) an introduction to CK model and UC models; (2) A study of these two models, which includes an analysis of CK model and an extension of UC security model. The analysis of CK model presents its security analysis, advantages, and disadvantages, and a bridge between this formal method and the informal method (heuristic method) is established; an extension of UC security model gives a universally composable anonymous hash certification model. (3) The applications of these two models. With these two models, the four-way handshake protocols in 802.11i and Chinese wireless LAN (WLAN) security standard WLAN authentication and privacy infrastructure (WAPI) are analyzed.