A computational analysis of the Needham–Schroeder–(Lowe) protocol

Issue title: CSFW16

Article type: Research Article

Authors: Warinschi, Bogdan^{; *}

Affiliations: Department of Computer Science and Engineering, University of California, Santa Cruz, USA. E-mail: bogdan@soe.ucsc.edu

Note: [*] Research supported in part by NSF Career Awards CCR-0093029 and CCR-0208800.

Abstract: The Needham–Schroeder protocol and its repaired version due to Lowe are the main test cases used by symbolic methods for cryptographic protocol analysis. In this paper we proved the first computational analysis of the protocol. We start by translating Lowe's attack against the original protocol into the computational framework that we use in our analysis. Then we prove that the repaired protocol may not be secure, even when the encryption scheme that is used in its implementation satisfies indistinguishability under chosen-plaintext attack. This shows that symbolic security analysis is not sound for protocols that use this kind of encryption. Our main result is to prove that the Needham–Schroeder–Lowe protocol is secure if it is implemented with an encryption scheme that satisfies the stronger notion of indistinguishability under chosen-ciphertext attack.

Keywords: Protocol analysis, cryptography, Needham–Schroeder

DOI: 10.3233/JCS-2005-13307

Journal: Journal of Computer Security, vol. 13, no. 3, pp. 565-591, 2005