Analysing protocols subject to guessing attacks

Issue title: Special issue on WITS'02

Guest editors: Joshua Guttman

Article type: Research Article

Authors: Lowe, Gavin

Affiliations: Oxford University Computing Laboratory, Wolfson Building, Parks Road, Oxford, OX1 3QD, UK. E-mail: gavin.lowe@comlab.ox.ac.uk

Abstract: In this paper we consider guessing attacks upon security protocols, where an intruder guesses one of the values used (typically a poorly-chosen password) and then seeks to verify that guess. We formalise such attacks, and in particular the way in which the guess is verified. We then describe how to model such attacks within the process algebra CSP, so that they can be detected using the model checker FDR, and illustrate our technique on some examples.

DOI: 10.3233/JCS-2004-12104

Journal: Journal of Computer Security, vol. 12, no. 1, pp. 83-97, 2004