the power of simulation relations sixty and beyond toronto, august 20, 2008 roberto segala -...

The Power of Simulation Relations Sixty and BeyondToronto, August 20, 2008 Roberto Segala - University of Verona 1

The Power ofSimulation Relations

Roberto SegalaUniversity of Verona

Hierarchical Verification

I11 I12 I2 I3

S1 S2 S3

Some properties

verified here

Modules verified

separately

Implementation

• Some form of behavioral inclusion– Traces, Failures, Tests, …

• Features– Preserves properties of interest– Transitive– Compositional– Affine with logical implication

• … when properties are sets of behaviors

• Hard to check– Often Pspace-complete– But simulation relations help

Automata

A = (Q , q0 , E , H , D)

coffee

Execution: q0 n q1 n q2 ch q3 coffee q5

Trace: n n coffee

Forward Simulations

Forward simulation from A1 to A2 (A1 FA2) Relation R Q1 x Q2 such that

q, s, a, q s

Simulation Implies Trace Inclusion

• The step condition can be applied repeatedly

• Thus existence of simulation implies trace inclusion– Even more it implies a close correspondence between

executions

Application of Simulation Relations

• Distributed Systems– Automata, I/O Automata

• Real-Time Systems– Add time component to states– Add time-passage actions or trajectories

• Time-passage modifies only time component

• Hybrid Systems– Time passage modifies entire state

• Randomized Systems– Transitions lead to probability measures

Example: Probabilistic Automata

qpflip

Example: Probabilistic Automata

q5fair

unfair

What is the probability of beeping?

Probabilistic Executions

q0 q1 q3

unfair flip

beep(beep) = 2/3

(beep) = 1/2

fair beepflip 1/2

Example: Probabilistic Executions

unfair

1/21/2

Forward Simulations

Forward simulation from A1 to A2 (A1 FA2) Relation R Q1 x Q2 such that

q, s, a,

Lifting of R

Lifting and Transfer of Masses

q1 q2 s1 s2 s3

Simulation Implies Behavioral Inclusion

A Potential Area of ApplicationSecurity

• With simulations– Global properties validated via local properties– … almost as proving a property by induction

• Can we use simulations for security?– Properties are typically global– There is randomization

• Challenges– Specifications do not fail– Implementations fail with negligible probability– Some approximations appear to be necessary– Need for computational assumptions

Bellare and Rogaway MAP1 Protocol

• Nonces are generated randomly• The key s is the secret for a Message Authentication

Code– Specifically, MAC based on pseudo-random functions

[B.A.RA.RB]s

[A.RB]s

Nonces

• Number ONCE– Typically drawn randomly

• Claim– For each constant c and polynomial p– There exists k such that for each k k

– If n1,n2,…,np(k) are random nonces from {0,1}k

– Then Pr[ijninj]<k-c

Message Authentication Code

• Triple (G,A,V)– G on input 1k generates s {0,1}k

– For each s and each a• Pr[V(s,a,A(s,a))=1]=1

• Forger– On input 1k obtains MAC of strings of its choice– Outputs a pair (a,b)– Successful if V(s,a,b)=1 and a different from previous

queries

• Secure MAC– Every feasible forger succeeds with negligible probability

MAP1: Matching Conversations

• Matching conversation between A and B– Every message from A to B delivered

unchanged• Possibly last message lost• Response from B returned to A

– Every message received by A generated by B• Messages generated by B delivered to A• Possibly last message lost

• Correctness condition– Matching conversation implies acceptance– Negligible probability of acceptance without

matching conversation

MAP1: Correctness Proof• Let A be a PPT machine that interacts with the agents

• Show that A induces “no-match” with negligible probability– Argue that repeated nonces occur with negligible probability– Argue that A is an attack against a message authentication code

• Features– Relies on underlying pseudo-random functions– Proves correctness assuming truly random functions– Builds a distinguisher for PRFs if an attack exists

• Criticism– The arguments are semi-formal and not immediate– Three different concepts intermixed

• Nonces • Message authentication codes• Matching conversations

MAP1: Hierarchical Analysis

• Agents indexed by X, Y, t

AdversaryKeeps history

(PPT function f)

A1 A2 A3 A4

Keygenerator

Noncegenerator(coin flip)

(PPT function f)

A1 A2 A3 A4

Keygenerator

Noncegenerator

(ideal)

AdversaryKeep history

(no forged signatures)

A1 A2 A3 A4

Keygenerator

Noncegenerator

(ideal)

Nonce Generators• State

– valueX,Y,t initially – FreshNonces initially {0,1}k

• Transitions– Input NonceRequestX,Y,t

– Effect• Let v R {0,1}k

• valueX,Y,t = v• FreshNonces = FreshNonces-{v}

– Output NonceResponseX,Y,t(n)– Precondition

• n = valueX,Y,t

– Effect• valueX,Y,t =

• Let v R FreshNonces

IdealCoin flip

Adversary

• Keeps a variable history– Holds all previous messages

• Real adversary– Runs a cycle where

• Computes the next message to send using a PPT function f• Sends the message• Waits for the answer if expected

• Ideal adversary– Highly nondeterministic– Stores all input– Sends messages that do not contain forged

authentications

Problems with Simulations

– Consider a transition of the real nonce generator– With some probability there is a repeated nonce– The ideal nonce generator does not repeat nonces– Thus, we cannot match the step

(PPT function f)

A1 A2 A3 A4

Keygenerator

(PPT function f)

A1 A2 A3 A4

Keygenerator

Noncegenerator

(ideal)

A1 A2 A3 A4

Keygenerator

Noncegenerator

(ideal)

Approximated Simulations [ST07]

• Change lifting on measures

– 1 2 iff• 1 = (1-)1’ + 1’’• 2 = (1-)2’ + 2’’• 1’ 2’

1’ 1’’

2’ 2’’

{2/3 q1, 1/3 q2} = 2/3 {1/2 q1, 1/2 q2} + 1/3{1

{1/3 s1, 1/3 s2, 1/3 s3} = 2/3 {1/2 s1, 1/2 s2} + 1/3{1 s3}

? = 1/3

Approximated Simulations

{Ak} {Rk} {Bk}

• For each constant c and polynomial p• There exists k such that for each k k• Whenever

– 1 reached within p(k) steps in Ak

– 1 L(Rk,) 2

– 1 1’

• There exists 2’ such that– 2 2’– 1’ L(Rk,+k-c) 2’ 1 1

2 2’

Approximated SimulationsStep Condition

(1--k-c) 2’

1’ (1--k-c)

Simulation Implies Behavioral Inclusion

…0 k-c 2k-c 3k-c p(k)k-c

• Observation– pkk-c can be smaller than any k-c’ by choosing

c=c’+degree(p)

Example: Approximate SimulationsBellare-Rogaway MAP1 Protocol

• Negation of the step condition– 1: Two random nonces are equal with high probability– 2: Function f defines a forger for a signature scheme

A1 A2 A3 A4

Keygenerator

Noncegenerator

(ideal)

(PPT function f)

A1 A2 A3 A4

Keygenerator

Noncegenerator

(ideal)

(PPT function f)

A1 A2 A3 A4

Keygenerator

Step Condition

{Ak} {Rk} {Bk}

• For each constant c and polynomial p• There exists k for each k k• Whenever

– 1 L(Rk,) 2

– 1 1’• There exists 2’ such that

– 2 2’– 1’ L(Rk,+k-c) 2’

2 2’

Negation of Step Condition

{Ak} {Rk} {Bk}

• There exists constant c and polynomial p• For each k there exists k k• There exists

– 1 L(Rk,) 2

– 1 1’• There is no 2’ such that

– 2 2’– 1’ L(Rk,+k-c) 2’

2 2’

+k-c• Signature forged in

1’– Probability at least k-c

• Nonce replicated in 1’– Probability at least k-c

(1--k-c) 2’

1’(1--k-c)

Nonces

• Number ONCE– Typically drawn randomly

• Claim– For each constant c and polynomial p– There exists k such that for each k k

– If n1,n2,…,np(k) are random nonces from {0,1}k

– Then Pr[ijninj]<k-c

Example: Approximate SimulationsBellare-Rogaway MAP1 Protocol

• Proof Completed

A1 A2 A3 A4

Keygenerator

Noncegenerator

(ideal)

(PPT function f)

A1 A2 A3 A4

Keygenerator

Noncegenerator

(ideal)

(PPT function f)

A1 A2 A3 A4

Keygenerator

Problems with NondeterminismMAP1 Protocol [BR93]

• Potential problems– Let s be the shared key– Adversary queries k agents– Agent i replies if ith bit of s is 1– The adversary knows the shared key

• Solution– One query at a time– Wait for the answer (agents as oracles)

(PPT function f)

A1 A2 A3 A4

Keygenerator

We Are Not Alone• Mitchell, Ramanathan, Scedrov, Teague

– Probabilistic polynomial time calculus

• Canetti, Cheung, Kaynar, Liskov, Lynch, Pereira, Segala– Task Probabilistic I/O Automata

• Chatzikokolakis, Palamidessi– Syntactic restrictions for schedulers

• Canetti– UC framework

• Backes, Pfitzmann, Waidner– Reactive simulatability Framework

• Van Breugel, Worrel– Metrics and approximation

• Desharnais, Gupta, Jagadeesan, Panangaden– Metrics and approximation

Work in Progress

• Applications– Soundness of Dolev-Yao model– Analysis of the Crypto-Library

• Approximated simulations versus– Approximated language inclusion (Task PIOAs)– Restricted schedulers– Metrics

• Flexibility on restrictions– Many ways to restrict– Are we restricting too much?

Summing Up

• Simulation relations are powerful– Interact well with hierarchical verification– Global properties verified via local arguments– Apply to several frameworks

• Security is a new interesting area – We have interesting case studies– We have still many open questions

• We are having a lot of fun

the power of simulation relations sixty and beyond toronto, august 20, 2008 roberto segala -...

roberto segala university

simulation relations

q q s s

existence of simulation

n n coffee slide

q qq s ss

beep beep

bc slide

Documents

french – english relations a 1950s-1980s simulation

simulation modelling practice and theory · a...

numerical simulation of phonon dispersion relations for 2d...

roberto fugiglando.-

zé roberto

modelling and simulation of rainfall-runoff relations for...

hydrological simulation of mahanadi river · pdf...

modeling and simulation of critical infrastructures ·...

roberto a lange financial disclosure report for lange,...

two-dimensional dam break flooding simulation: a gis...

racbay consulting international business simulation october...

roberto clemente by: zach staszak. roberto clemente

canadian provinces’ international relations ... -...

lorenzo bordogna, roberto pedersini between the … ·...

thermal simulation of the effect of windings … simulation...

ingv physics-based simulation of spatiotemporal patterns...

roberto foschino

roberto crespo

roberto di marino · 2020. 7. 9. · roberto di marino...

public relations/event planning logistics: widener...