On the Complexity of Some Word Problems That Arise in Testing the Security of Protocols

Abstract

Consider the class of protocols, for two participants, in which the initiator applies a sequence of operators to a message M and sends it to the other participant; in each step, one of the participants applies a sequence of operators to the message received last, and sends it back. This “ping-pong” action continues several times, using sequences of operators as specified by the protocol. The set of operators may include public-key encryptions and decryptions.

A theorem of Dolev and Yao is presented with a new proof.

An O(n ³) algorithm, of Dolev, Even and Karp, for testing the security of two user ping-pong protocols, is described. It is shown that their results are easily extendible from the security of secret messages to more general questions of security, such as security against forged signatures.

The results of Even and Goldreich concerning the security of multi-party protocols are briefly described.

Finally, comments are made concerning recently published attacks on RSA. It is argued that it makes no sense to criticize a cryptographic system without reference to the protocols that use it, and that in fact, the attacks suggested assume an insecure protocol. Also, a theorem is stated to the effect that if a protocol (or set of protocols) is secure on the abstract level, then the algebraic properties used in these attacks will never convert a secure system into an insecure one.