HLPSL Tutorial - AVISPA Project

1 Validation of Internet Security Protocols and ApplicationsHLPSL TutorialA Beginner s GuidetoModelling and Analysing Internet Security ProtocolsThe AVISPA teamDocument Version: 30, 2006 Project funded by the European Community under theInformation Society TechnologiesProgramme (1998-2002)CONTENTS1 Contents1 HLPSL Using the AVISPA Tool.. Basic Roles.. Transitions.. Composed Roles..72 HLPSL Example 1 - from Alice-Bob notation to HLPSL specification.. Example 2 - common errors, untrusted agents, attack traces.. Modelling Tips and Pitfalls.. Discussion and Analysis Results.

2 Example 3 - security goals.. Discussion and Analysis Results.. Example 4 - Algebraic Operators..343 HLPSL Priming Variables.. Witness and Request.. Secrecy.. Constants and Variables.. Concatenation (.) and Commas (,).. Exploring executability of your model.. Detecting Replay Attacks.. Instantiating Sessions.. Function Results.. Declaring Channels..474 Questions and answers about HLPSL48A Symbols and Keywords49 AVISPAHLPSL TutorialCONTENTS2 IntroductionThe AVISPA Tool provides a suite of applications for building and analysing formal models ofsecurity protocols.

3 Protocol models are written in theHigh Level Protocol Specification Language,or HLPSL [3,9]. The aim of this Tutorial is to provide some advice on constructing protocol modelsin addition to this Tutorial , the AVISPA Package User Manual [5] is another useful resourcefor beginners to HLPSL . Please refer to this manual if you require further information on HLPSLor any of the tools discussed throughout this of this Tutorial :Section1contains a very basic introduction to what HLPSL lookslike and how it is four introductory examples that illustrate modelling with HLPSL .

4 In dis-cussing the examples, we attempt to show both correct solutions and possible pitfalls that mod-ellers should be aware a number of tips useful for writing or reading HLPSL , Section4provides a list of questions and answers about HLPSL ,followed by an appendix containing a list of HLPSL keywords and Tutorial31 HLPSL BasicsAVISPA provides a language called theHigh Level Protocol Specification Language ( HLPSL )[3,9]for describing security protocols and specifying their intended security properties, as well as a setof tools to formally validate Using the AVISPA ToolTranslatorHLPSL2 IFHigh Level Protocol Specification Language ( HLPSL )Intermediate Format (IF)OutputModel CheckerCL basedCL AtSeSAT basedSATMCTA4 SPTree Automata basedOFMCOn the flyModel CheckerAttack SearcherProtocol AnalyserFigure 1.

5 Architecture of the AVISPA ToolThe structure of the AVISPA Tool [2] is shown in A HLPSL specification is trans-lated into theIntermediate Format (IF), using a translator calledhlpsl2if. IF is a lower-levellanguage than HLPSL and is read directly by the back-ends to the AVISPA Tool. Note thatthis intermediate translation step is transparent to the user, as the translator is called automati-cally. The interested reader can find more about the IF in the AVISPA User Manual and in theAVISPA deliverable which discusses IF [4,5]. The IF specification of a protocol is then input tothe back-ends of the AVISPA Tool to analyse if the security goals are satisfied or the time of this writing, the AVISPA Tool comprises four back-ends: OFMC [6], CL-AtSe [16], SATMC [1], and TA4SP[7]; this list may later be extended with new back-ends.

6 TheIntermediate Format IF is designed with the objective that it should be simple for developers ofother analysis tools to use IF as their input language. Because the analysis methods of the fourAVISPAHLPSL Using the AVISPA Tool4current back-ends are complementary (at least partially, in the sense that some basic techniquesare common to some of the back-ends) and not equivalent, situations might arise in which theback-ends return different and Running The AVISPA ToolThe AVISPA Tool, as well as a very helpful XEmacsmode for editing HLPSL specifications with syntax highlighting etc.

7 , and tools for documentingHLPSL specifications in LATEXand HTML format, is available for download See the INSTALL and README files contained in thepackage for further is also a web interface available allows users to experiment with HLPSL and the AVISPA Tool without having to installanything. Through the web interface, you can select one of the protocols of the AVISPA library,modify it if you like, or write a protocol on your own; you can use one of the four back-ends tocheck the given protocol, or even use all of them and then compare their a security goal of the specification is violated, the back-ends provide a trace which showsthe sequence of events leading up to the violation and displays which goal was violated.

8 Thecommand-line AVISPA Tool outputs attack traces in a textual form we will see later. The webinterface can also display an attack trace in the form of a Message Sequence AVISPA tool is called simplyavispa. The-hflag returns usage information as follows:% AVISPA -hGiven an HLPSL file called, for instance, , we can invoke the AVISPA toolwith its default options as shown here:% AVISPA default, the AVISPA Tool invokes the OFMC back-end, also called asub-moduleof the alternative sub-module can be specified on the command-line in order to invoke a differentback-end.

9 At the time of writing, the four valid sub-module arguments, corresponding to thefour back-ends listed above, are--ofmc,--satmc,--cl-atseand--ta4sp. For instance, we cananalyse the HLPSL file using SATMC as follows:% AVISPA --satmcIn this Tutorial , we will focus on invoking the AVISPA Tool with the default options. Theusage information, which is printed when invokingavispa -h, gives a more complete descriptionof the options not discussed now discuss the HLPSL language Basic Basic RolesIt is easiest to translate a protocol into HLPSL if it is first written in Alice-Bob (A-B) example, below we illustrate A-B notation with the well-known Wide Mouth Frog protocol [8]:A -> S : {Kab}_KasS -> B : {Kab}_KbsThis simple protocol illustrates A-B notation as well as some of the naming conventions weadopt throughout this document (and in general).

10 In this protocol,Awishes to set up a securesession withBby exchanging a new shared session key with the help of a trusted serverSwithwhichAandBeach share a key. We denote withKas(respectivelyKbs) the key shared betweenA(respectivelyB) by generating a new session key,Kab, which is intended forB. Sheencrypts this key withKasand sends it toSin the first message (note that encryption is denotedusing curly brackets and the encryption key is identified following an_).S, in turn, decrypts themessage, re-encryptsKabwithKbs, and sends the result on toB. After this exchange,AandBshare the new session key and can use it to communicate with one notation is convenient, as it gives us a clear illustration of the messages exchanged in anormal run of a given protocol.