JP2010010863A - Safety verification device, safety verification method, and program of encryption protocol - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To verify an encryption protocol in accordance with a level of safety. <P>SOLUTION: In an authentication and key exchange protocol, regarding cryptographic primitives listed up, when there is risk information, it is determined the primitives are not safe. When there is no risk information, a role of the cryptographic primitive is set, evidence of safety is set, and flow data and the kind and state of the cryptographic primitive parameter are set. When a wrong relationship between the set flow data and the kind and state of the cryptographic primitive parameter is included, the encryption protocol is determined not to be safe. When all the relationships between the flow data and the kind and state of the cryptographic primitive parameter are determined to be correct, verification items regarding safety are selected. When there are verification items which are not satisfied, the encryption protocol is determined not to be safe; when all the selected verification items are satisfied, the encryption protocol is determined to be safe. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a cryptographic protocol having a security function such as authentication and key sharing, and relates to a cryptographic protocol safety verification device, a security verification method, and a program for verifying the security of such a cryptographic protocol.

  Conventionally, a secure cryptographic protocol has been proposed empirically based on a heuristic approach based on insight of security and cryptographic technology possessed by a protocol designer. However, there were some cases where security vulnerabilities were pointed out after the proposed cryptographic protocol specifications were made public. In fact, when vulnerabilities are discovered after standardized cryptographic protocols have been widely disseminated through products and the like, the cost associated with refurbishment becomes a major problem.

  In particular, when a fatal vulnerability is discovered, it is necessary to urgently deal with such issues as applying software patches and replacing hardware chips and components in order to avoid economic damage. Therefore, the more popular the proposed cryptographic protocol and related products, the greater the social impact, and in some cases, the entire system may fail.

For this reason, the descriptions described in Patent Document 1 and Patent Document 2 disclose an apparatus, a method, and a program for verifying the security of a cryptographic protocol using a concept called “general-linkable security”. Here, “general-linkable security” means that a cryptographic protocol is safe if the cryptographic protocol safely realizes an ideal function related to the security function. For example, if a key exchange protocol securely implements the key exchange ideal function, the key exchange protocol has been shown to be secure.
JP 2007-28447 A JP 2008-35117 A

  The “general connectable safety” used in the above prior art documents is said to be the strongest safety at present, and the ideal function covers all the safety required for the security function. Therefore, when a certain cryptographic protocol safely realizes its ideal function, this cryptographic protocol satisfies all the security required for the security function.

  However, the security and efficiency of the cryptographic protocol are in a trade-off relationship, and the efficiency decreases as the security of the cryptographic protocol increases. Therefore, when importance is attached to the efficiency of the cryptographic protocol, it is desired to reduce the security to an allowable range. However, in the above prior art, although it is possible to verify the strict security of the cryptographic protocol, it is not possible to perform verification according to the security level.

  Therefore, the present invention has been made in view of the above-described problems, and provides a cryptographic protocol safety verification device, a security verification method, and a program capable of verifying a cryptographic protocol according to a safety level. With the goal.

  The present invention proposes the following matters in order to solve the above problems.

  (1) The present invention proposes a cryptographic protocol security verification device comprising verification means for verifying the security of an authentication protocol and a key exchange protocol among cryptographic protocols having at least authentication and key sharing security functions. Yes.

  (2) In the cryptographic protocol security verification apparatus according to (1), the verification unit includes a verification item for active attack security of the authentication protocol as a verification item for verifying the security of the authentication protocol. We propose a cryptographic protocol security verification device characterized by this.

  (3) The present invention relates to the cryptographic protocol security verification device according to (2), wherein the verification means uses a verification that the cryptographic primitive to be authenticated cannot be counterfeited as a verification item in active attack security of the authentication protocol. Whether the cryptographic primitive argument appears for the first time in the protocol, previously appeared in the protocol in the same session, or is temporary public information that appeared in the protocol that could not be used repeatedly in another session Cryptographic primitives that either appear for the first time in the protocol, appear in the protocol before in the same session, contain temporary secret information that appears repeatedly in another session that cannot be used repeatedly, or are subject to authentication Has a one-way nature and no argument for the cryptographic primitive Also has proposed a safety verification device of the cryptographic protocol, characterized in that the check, it includes a temporary secret information for the first time appeared in the protocol.

  (4) The present invention relates to the cryptographic protocol security verification apparatus according to (1), wherein the verification means uses the key exchange protocol as an active attack safety, passive as a verification item for verifying the security of the key exchange protocol. We have proposed a cryptographic protocol security verification device characterized by including verification items in attack security, offline dictionary attack security, known key attack security, and forward secrecy.

  (5) In the cryptographic protocol security verification apparatus of (4), the present invention identifies cryptographic primitives included in arguments of cryptographic primitives that are key generation targets as verification items in active attack security of the key exchange protocol. It is impossible or unidirectional in nature, and all of the cryptographic primitive arguments are temporary secrets that first appear in the protocol, and can be used repeatedly in different sessions and appear in the protocol An apparatus for verifying the security of a cryptographic protocol characterized by checking whether secret information or long-term incomplete secret information is included is proposed.

  (6) In the cryptographic protocol security verification device according to (4), the cryptographic primitive as a key generation target has the property of being indistinguishable as a verification item in the passive attack security of the key exchange protocol. However, any of the cryptographic primitive arguments includes temporary secret information that appears for the first time in the protocol, or the cryptographic primitive that is the key generation target has a one-way property and is included in the cryptographic primitive arguments. Cryptographic protocol security verification device, characterized in that the cryptographic primitive has a property of indistinguishability and the argument of the cryptographic primitive contains temporary secret information that appears for the first time in the protocol Has proposed.

  (7) According to the present invention, in the cryptographic protocol security verification device of (4), a cryptographic primitive including long-term and incomplete secret information is unidirectional as a verification item in the off-line dictionary attack security of the key exchange protocol. Including any temporary secret information that appears for the first time in the protocol, either in the protocol for the first time, in the same session before in the protocol, or repeatedly unavailable in another session We have proposed a cryptographic protocol security verification device characterized by checking whether or not

  (8) In the cryptographic protocol security verification apparatus according to (4), the cryptographic primitive as a key generation target is indistinguishable or unidirectional as a verification item in the known key attack security of the key exchange protocol. Including any temporary secret information that appears for the first time in the protocol, either in the protocol for the first time, in the same session before in the protocol, or repeatedly unavailable in another session We have proposed a cryptographic protocol security verification device characterized by checking whether or not

  (9) The present invention relates to the cryptographic protocol security verification device according to (4), wherein the cryptographic primitive that is the key generation target is indistinguishable or unidirectional as a verification item in the forward secrecy of the key exchange protocol. Including any temporary secret information that has appeared in the protocol, either the argument of the cryptographic primitive first appears in the protocol, previously appeared in the protocol in the same session, or repeatedly unavailable in another session We have proposed a cryptographic protocol security verification device characterized in that

  (10) The present invention provides a security verification method for verifying the security of a cryptographic protocol, the first step of enumerating cryptographic primitives used in the authentication and key exchange protocol, and the ciphers listed above A second step of verifying the presence or absence of compromise information for a primitive and determining that the cryptographic protocol is not secure if there is one with compromise information, and a compromise among the listed cryptographic primitives When there is no information, a third step for setting the role of the cryptographic primitive, a fourth step for setting a ground for security of the cryptographic primitive, and a fifth step for enumerating the flows And a sixth step for setting the flow data and the type and state of the argument of the cryptographic primitive, and the set flow data and the cryptographic pre-set. A seventh step of determining whether or not the relationship between the type of argument and the state of the Tive is correct, and including an incorrect one, and determining that the encryption protocol is not secure; and the set flow data and encryption If it is determined that the relationship between the types and states of the arguments of the primitives is all correct, an eighth step of selecting verification items regarding safety and whether or not all of the selected verification items are satisfied; A ninth step of determining that the cryptographic protocol is not secure with respect to the selected security if it includes an unsatisfactory one; and determining that the cryptographic protocol is secure if all of the selected verification items are satisfied A safety verification method characterized by having a tenth step.

  (11) The present invention is a program for causing a computer to execute a security verification method for verifying the security of a cryptographic protocol, and enumerates cryptographic primitives used in an authentication and key exchange protocol. A first step that verifies the presence or absence of compromise information for the enumerated cryptographic primitives and determines that the cryptographic protocol is not secure if there is any compromise information; A third step for setting the role of the cryptographic primitive, and a fourth step for setting a basis for security of the cryptographic primitive when none of the cryptographic primitives has compromise information; A fifth step for enumerating flows, and a sixth step for setting the types and states of arguments of flow data and cryptographic primitives And whether or not the relationship between the set flow data and the type and state of the argument of the cryptographic primitive is correct, and if it includes an incorrect one, it is determined that the cryptographic protocol is not secure An eighth step of selecting a verification item related to security when it is determined that all the relations between the step and the types and states of the arguments of the set flow data and the cryptographic primitive are correct, and the selected verification item is Ninth step for judging whether or not all are satisfied, and including those not satisfying, the ninth step for judging that the cryptographic protocol is not secure with respect to the selected security, and when all the selected verification items are satisfied The tenth step of determining that the cryptographic protocol is safe and a program for causing a computer to execute the program are proposed.

  According to the present invention, an authentication protocol and a key exchange protocol among cryptographic protocols can be verified according to the security level.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
Note that the constituent elements in the present embodiment can be appropriately replaced with existing constituent elements and the like, and various variations including combinations with other existing constituent elements are possible. Therefore, the description of the present embodiment does not limit the contents of the invention described in the claims.

<Existing security model for cryptographic protocol safety level>
Before going into the description of the embodiments of the present invention, the existing security model is shown with respect to the security level of the cryptographic protocol. The present invention uses a concept called “provable security” that proves the security of a cryptographic protocol based on the computational complexity theory. “Cryptographic protocol has provable security” means that it can be proved theoretically that the security of the cryptographic protocol results in the security of a certain cryptographic primitive.

  Assuming an attacker who breaks a cryptographic protocol, by proving that it is possible to construct a machine that breaks a cryptographic primitive in polynomial time, if this cryptographic primitive is not broken, the cryptographic protocol will not be broken. Prove it. In the present invention, an authentication protocol and a key exchange protocol are considered among cryptographic protocols.

In the above provable security, the authentication protocol matches
In conversion and key exchange protocol, there is a concept of security called semantic security. For each concept, according to the security required for the authentication and key exchange protocol, an actual attack model was assumed and classified into the following security. However, the inside of () represents the attack corresponding to safety.

(1) matching conversion
In the authentication protocol, it indicates that the attacker can do nothing but send the message received from one party to the other party as it is. That is, the attacker cannot perform fraud such as message tampering, new message sending, message blocking, and message order switching.

(1A) Active attack safety (impersonated attack)
Active attack safety in matching conversions indicates that even if an attacker dominates communication between parties, the authentication protocol cannot be broken.

(2) semantic security
In the key exchange protocol, indicates that the attacker cannot obtain any information about the session key. That is, the attacker cannot distinguish the session key and the random number in polynomial time.

(2A) Active attack safety (spoofed attack)
Active attack security in semantic security indicates that even if an attacker dominates communication between parties, the key exchange protocol cannot be broken.

(2B) Passive attack safety (Eavesdropping attack)
Passive attack security in semantic security indicates that even if an attacker eavesdrops on communication between parties, the key exchange protocol cannot be broken.

(2C) Offline dictionary attack safety (offline dictionary attack)
The off-line dictionary attack safety in the semantic security indicates that the attacker cannot search the password of the party that matches the past history offline from the password guessing dictionary.

(2D) Known key attack safety (known key attack)
The known key attack security in the semantic security indicates that even if an attacker can obtain a session key, it cannot obtain another session key.

(2E) forward secrecy (long-term key destruction attack)
forward in the semantic security
The secrecy indicates that even if the attacker can obtain a long-term key such as a secret key or a password, the attacker cannot obtain a session key shared before that time.

However, in the case of a key exchange protocol that does not use a password and a long-term key, (2C) offline dictionary attack security, (2E) forward
Security of security is not required for each.

<Information and symbols set in cryptographic primitives>
The information set in the cryptographic primitives used in the authentication / key exchange protocol is as follows.
(A) Cryptographic primitive (AGF) to be authenticated in the authentication protocol
(B) Cryptographic primitive (KGF) that is a key generation target in the key exchange protocol
(C) Cryptographic primitives (ACP) included in AGF and KGF arguments
(D) Other cryptographic primitives (OCP)

<Information that is the basis of security set for cryptographic primitives>
The information that is the basis of security set for the cryptographic primitive set above is as follows.
(A) Indistinguishability (IND): Indicates that two corresponding events cannot be identified in polynomial time without knowing secret information.
(B) Unidirectionality (OW): Indicates that an input value cannot be calculated in polynomial time from an output value without knowing secret information.
(C) Unforgeability (UF): Indicates that the authenticator of the required message cannot be generated in polynomial time without knowing the secret information.

<Components set in all flow data and cryptographic primitives in the authentication / key exchange protocol>
The components set in all flow data and cryptographic primitives in the authentication / key exchange protocol are as follows.
(A) Types of arguments of flow data and cryptographic primitives a) Public information (PUB)
b) Specific public information (ID)
c) Temporary public information (TPK)
d) Long-term and complete confidential information (LLK)
e) Long-term and incomplete confidential information (PW)
f) Temporary confidential information (TSK)
(B) Flow data and cryptographic primitive argument status a) First appearance in public state (PFT)
b) Previously published in the same session (PSS)
c) It can be used repeatedly in other sessions and appears in public (PRS)
d) Appears in a public state that cannot be used repeatedly in another session (PNS)
e) First appearance in a secret state (SFT)
f) Appeared in secret before in the same session (SSS)
g) Can be used repeatedly in different sessions and appears in a secret state (SRS)
h) Cannot be used repeatedly in another session and appears in a secret state (SNS)

<Items to verify authentication and key exchange protocol according to security level>
The items for verifying the authentication and key exchange protocol according to the security level are as follows.

<Matching conversion for authentication protocol>
(A) Verification items and verification contents in active attack safety a) AGF is UF and arguments of AGF are all TPK-PFT, TPK-PSS, TPK-PNS, TSK-SFT, TSK-SSS, or TSK-SNS. Is included.
b) AGF is OW, and all arguments of AGF include TSK-SFT.

<Semantic security for key exchange protocol>
(B) Verification items and verification contents in active attack safety a) ACP is IND or OW, and all arguments of ACP include TSK-SFT and LLK-SRS or PW-SRS.

(C) Verification items and verification contents in passive attack safety a) KGF is IND, and all arguments of KGF include TSK-SFT.
b) KGF is OW, ACP is IND, and the argument of ACP includes TSK-SFT.

(D) Verification items and verification contents in off-line dictionary attack security a) OCP including PW is OW, and each argument of OCP includes TSK-SFT, TSK-SSS, or TSK-SNS.

(E) Verification items and verification contents in known key attack security a) KGF is IND or OW, and all arguments of KGF include TSK-SFT, TSK-SSS, or TSK-SNS.

(F) Verification items and verification contents in forward secrecy a) KGF is IND or OW, and any argument of KGF includes TSK-SFT, TSK-SSS, or TSK-SNS.

<Configuration of cryptographic protocol security verification device>
The configuration of the cryptographic protocol security verification apparatus according to the present embodiment will be described with reference to FIG. As shown in FIG. 1, the cryptographic protocol security verification device according to the present embodiment includes a cryptographic primitive enumeration unit 1, a compromise information determination unit 2, a role setting unit 3, a safety rationale setting unit 4, The flow enumeration unit 5, the argument setting unit 6, the setting information determination unit 7, the safety selection unit 8, the verification item determination unit 9, and the safety determination unit 10 are configured.

  The cryptographic primitive enumeration unit 1 lists all cryptographic primitives used in the authentication / key exchange protocol. The compromise information determination unit 2 confirms whether there is compromise information for the enumerated cryptographic primitives. If there is even one piece of compromise information, the security judgment unit 10 judges that the authentication / key exchange protocol is not secure.

  The role setting unit 3 sets information, for example, AGF, KGF, ACP, OCP, which is the role of the cryptographic primitive among the listed cryptographic primitives. The safety rationale setting unit 4 sets information that is a security rationale, for example, IND, OW, and UF, for cryptographic primitives for which roles are set.

  The flow enumeration unit 5 enumerates all the flows for the authentication / key exchange protocol. For the enumerated flow data and cryptographic primitives, the argument setting unit 6 specifies the types of arguments of the flow data and cryptographic primitives, such as PUB, ID, TPK, LLK, PW, TSK, and the arguments of the flow data and cryptographic primitives. The state, for example, PFT, PSS, PRS, PNS, SFT, SSS, SRS, SNS, and other components are set.

  Based on the data table showing the relationship between the type of flow data and the argument of the cryptographic primitive and the state shown in FIG. Determine if. If even one of the relationships is not correct, the security determination unit 10 determines that the authentication / key exchange protocol is not secure.

  The security selection unit 8 selects the required security in the authentication / key exchange protocol. A plurality of safety may be selected. The verification item determination unit 9 verifies the above-described verification items related to safety using the information set by the argument setting unit 6 for the safety selected by the safety selection unit 8.

However, before verifying the verification items, the following preparations are made according to each security in the authentication / key exchange protocol.
<Matching conversion for authentication protocol>
(A) Verification items in active attack safety Active attack safety is a response to spoofing attacks and generates information for the attacker to authenticate the other party from information obtained by controlling the communication between parties. Indicates that you can't. Note that the information set by the spoofing attack is all flows.

The following items are set for the set information in order of protocol flow. Here, it is assumed that the flow data and the argument state are updated. However, the public state has priority over the public state and the secret state.
a) Types of AGF, ACP, OCP and grounds for safety b) Types and states of arguments of AGF, ACP, OCP c) Types and states of flow data

  If cryptographic primitives are nested in the arguments of AGF and ACP, the state of the arguments of AGF and ACP is set to the final stage.

<Semantic security for key exchange protocol>
(A) Verification items in active attack safety Active attack safety is to distinguish a session key and a random number in polynomial time from information obtained by an attacker controlling communication between parties in response to a pretending attack. Indicates that you cannot. Note that the information set by the spoofing attack is all flows.

The following items are set for the set information in order of protocol flow. Here, it is assumed that the flow data and the argument state are updated. However, the public state has priority over the public state and the secret state.
a) KGF, ACP, OCP types and safety grounds b) KGF, ACP, OCP argument types and states c) Flow data types and states

  When cryptographic primitives are nested in the arguments of KGF and ACP, the state of the arguments of KGF and ACP is set to the final stage.

(B) Verification Items in Passive Attack Safety Passive attack safety corresponds to an eavesdropping attack, in which an attacker can distinguish session keys and random numbers in polynomial time from information obtained by eavesdropping on communication between parties. Indicates that it is not possible. Note that the information set by the wiretapping attack is all flows.

The following items are set for the set information in order of protocol flow. Here, it is assumed that the flow data and the argument state are updated. However, the public state has priority over the public state and the secret state.
a) KGF, ACP, OCP types and safety grounds b) KGF, ACP, OCP argument types and states c) Flow data types and states

  When cryptographic primitives are nested in the arguments of KGF and ACP, the state of the arguments of KGF and ACP is set to the final stage.

(C) Verification Items in Offline Dictionary Attack Safety Offline dictionary attack safety is a response to offline dictionary attacks. From the past history for an attacker to search for a party password offline from a password guessing dictionary, the session key and It shows that random numbers cannot be distinguished by polynomial time. The information set by the off-line dictionary attack is all flows.

The following items are set for the set information in order of protocol flow. Here, it is assumed that the flow data and the argument state are updated. However, the public state has priority over the public state and the secret state.
a) OCP type and grounds for safety b) OCP argument type and status c) Flow data type and status

(D) Verification Items in Known Key Attack Safety Known key attack safety corresponds to a known key attack, and an attacker cannot distinguish a session key and a random number in polynomial time from a session key obtained in another session. It is shown that. Note that the information set by the known key attack is the session key of all other sessions.

The following items are set for the set information in order of protocol flow. Here, it is assumed that the flow data and the argument state are updated. However, the public state has priority over the public state and the secret state.
a) KGF, ACP, OCP types and safety grounds b) KGF, ACP, OCP argument types and states c) Flow data types and states

  When cryptographic primitives are nested in the arguments of KGF and ACP, the state of the arguments of KGF and ACP is set to the final stage.

(E) Verification item in forward secrecy forward secrecy corresponds to a long-term key destruction attack, and a session key and a random number are expressed in polynomial time from a long-term key such as a secret key or a password obtained by an attacker entering a party terminal. Indicates that they cannot be distinguished. The information set by the long-term key destruction attack is a long-term key.

The following items are set for the set information in order of protocol flow. Here, it is assumed that the flow data and the argument state are updated. However, the public state has priority over the public state and the secret state. In this case, the long-term key is handled as public information.
a) KGF, ACP, OCP types and safety grounds b) KGF, ACP, OCP argument types and states c) Flow data types and states

  When cryptographic primitives are nested in the arguments of KGF and ACP, the state of the arguments of KGF and ACP is set to the final stage.

<Processing of cryptographic protocol security verification device>
Processing of the cryptographic protocol security verification apparatus will be described with reference to FIG.
First, cryptographic primitives used in the authentication and key exchange protocol are listed (step S101). Next, for the enumerated cryptographic primitives, the presence / absence of compromise information is verified (step S102), and if there is any compromise information (“No” in step S102), it is determined that the cryptographic protocol is not secure. .

  On the other hand, if none of the listed cryptographic primitives has compromise information (“Yes” in step S102), the role of the cryptographic primitive is set (step S103). Further, the basis of security of the cryptographic primitive is set (step S104), the flow is enumerated (step S105), and the type and state of the argument of the flow data and the cryptographic primitive are set (step S106).

  Then, it is determined whether or not the relationship between the set flow data and the type and state of the argument of the cryptographic primitive is correct (step S107), and if it contains an incorrect one (“No” in step S107), the cryptographic protocol is Judge that it is not safe. On the other hand, when it is determined that the relationship between the set flow data and the type and state of the argument of the cryptographic primitive is all right (“Yes” in step S107), a verification item related to security is selected (step S108).

  Then, it is determined whether or not all of the selected verification items are satisfied (step S109), and if any are not satisfied (“No” in step S109), it is determined that the cryptographic protocol is not secure with respect to the selected security. If all the selected verification items are satisfied (“Yes” in step S109), it is determined that the cryptographic protocol is secure.

  Therefore, according to the present embodiment, the authentication protocol and the key exchange protocol among the cryptographic protocols can be verified according to the security level.

  The above-described series of processing is recorded as a program on a computer-readable recording medium, and the program recorded on the recording medium is read by the cryptographic protocol security verification device and executed, thereby executing the cryptographic protocol of the present invention. A safety verification device can be realized.

  In addition, if a WWW (World Wide Web) system is used, a homepage providing environment (or display environment) is also included. Further, the program may be transmitted from a computer storing the program in a storage device or the like to another computer via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.

  The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer, what is called a difference file (difference program) may be sufficient.

  The embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the embodiments, and includes designs and the like that do not depart from the gist of the present invention.

It is a figure which shows the structure of the security verification apparatus of the encryption protocol which concerns on this embodiment. It is a figure which shows the relationship between the kind and state of the flow data which concern on this embodiment, and the argument of a cryptographic primitive. It is a processing flow of the security verification apparatus of the encryption protocol which concerns on this embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Cryptographic primitive enumeration part 2 ... Compromise information determination part 3 ... Role setting part 4 ... Safety ground setting part 5 ... Flow enumeration part 6 ... Argument setting part 7 ... Setting information determination unit 8 ... Safety selection unit 9 ... Verification item determination unit 10 ... Safety determination unit

Claims (11)

  A cryptographic protocol safety verification device comprising verification means for verifying the security of an authentication protocol and a key exchange protocol among cryptographic protocols having at least authentication and key sharing security functions.   2. The cryptographic protocol security verification apparatus according to claim 1, wherein the verification means includes a verification item for active attack security of the authentication protocol as a verification item for verifying the security of the authentication protocol.   As a verification item in the active attack safety of the authentication protocol, the verification means is that the cryptographic primitive to be authenticated has the property of non-forgery, and all the arguments of the cryptographic primitive appear in the protocol for the first time. Whether it was previously published in the protocol in a session, is temporary public information that has been repeatedly unavailable in another session and has appeared in the protocol, or has first appeared in the protocol, previously appeared in the protocol in the same session, Or temporary secret information that appears in the protocol that cannot be used repeatedly in the current session, or the cryptographic primitive to be authenticated has a one-way property, and all the arguments of the cryptographic primitive are in the protocol Check whether it contains temporary confidential information that appears for the first time. Security verification device of the cryptographic protocol of claim 2, characterized in that the click.   As verification items for verifying the security of the key exchange protocol, the verification means includes verification items for active attack safety, passive attack safety, offline dictionary attack safety, known key attack safety, and forward secrecy of the key exchange protocol. The cryptographic protocol security verification apparatus according to claim 1, further comprising:   As a verification item in active attack security of the key exchange protocol, a cryptographic primitive included in an argument of a cryptographic primitive that is a key generation target has an indistinguishability property or a one-way property. Check whether it contains temporary secret information that first appeared in the protocol and long-term complete secret information or long-term incomplete secret information that can be used repeatedly in another session and appears in the protocol The cryptographic protocol security verification device according to claim 4, wherein:   As a verification item in the passive attack security of the key exchange protocol, the cryptographic primitives that are key generation targets have the property of being indistinguishable, and temporary secret information in which all the arguments of the cryptographic primitives appear for the first time in the protocol Or a cryptographic primitive that is a key generation target has a one-way property, a cryptographic primitive included in the cryptographic primitive argument has a non-identifiable property, and the cryptographic primitive argument is 5. The cryptographic protocol security verification device according to claim 4, wherein it is checked whether or not temporary secret information that appears for the first time in the protocol is included.   As a verification item in the off-line dictionary attack security of the key exchange protocol, a cryptographic primitive including long-term and incomplete secret information has a one-way property, and all the arguments of the cryptographic primitive first appear in the protocol, Checking whether the cryptographic protocol according to claim 4 includes whether it contains temporary secret information that appeared previously in the protocol in the same session or that could not be used repeatedly in another session and appeared in the protocol. Safety verification device.   As a verification item in the known key attack security of the key exchange protocol, the cryptographic primitives that are key generation targets have indistinguishability or one-way properties, and all the arguments of the cryptographic primitives appear for the first time in the protocol, Checking whether the cryptographic protocol according to claim 4 includes whether it contains temporary secret information that appeared previously in the protocol in the same session or that could not be used repeatedly in another session and appeared in the protocol. Safety verification device.   As a verification item in the forward secrecy of the key exchange protocol, the cryptographic primitive that is the key generation target has an indistinguishability property or a one-way property, and all the arguments of the cryptographic primitive appear in the protocol for the first time, or the same 5. The security of a cryptographic protocol according to claim 4, characterized in that it checks whether it has previously appeared in the protocol in a session or contains temporary secret information that has been repeatedly unavailable in another session and has appeared in the protocol. Sex verification device. A security verification method for verifying the security of a cryptographic protocol,
A first step enumerating cryptographic primitives used in an authentication and key exchange protocol;
A second step of verifying the presence or absence of compromise information for the listed cryptographic primitives and determining that the cryptographic protocol is not secure if there is any compromise information;
A third step of setting a role of the cryptographic primitive when none of the enumerated cryptographic primitives has compromise information;
A fourth step of setting a basis for security of the cryptographic primitive;
A fifth step of enumerating flows;
A sixth step of setting the type and state of arguments of flow data and cryptographic primitives;
A seventh step of determining whether or not the relationship between the set flow data and the type and state of the argument of the cryptographic primitive is correct, and determining that the cryptographic protocol is not secure when including the incorrect one;
An eighth step of selecting a verification item related to security when it is determined that all the relations between the set flow data and the types and states of the arguments of the cryptographic primitive are correct;
A ninth step of determining whether or not all the selected verification items are satisfied, and determining that the cryptographic protocol is not secure with respect to the selected security if it includes those that are not satisfied;
A tenth step of determining that the cryptographic protocol is secure if all of the selected verification items are satisfied;
A safety verification method characterized by comprising: A program for causing a computer to execute a security verification method for verifying the security of a cryptographic protocol,
A first step enumerating cryptographic primitives used in an authentication and key exchange protocol;
A second step of verifying the presence or absence of compromise information for the listed cryptographic primitives and determining that the cryptographic protocol is not secure if there is any compromise information;
A third step of setting a role of the cryptographic primitive when none of the enumerated cryptographic primitives has compromise information;
A fourth step of setting a basis for security of the cryptographic primitive;
A fifth step of enumerating flows;
A sixth step of setting the type and state of arguments of flow data and cryptographic primitives;
A seventh step of determining whether or not the relationship between the set flow data and the type and state of the argument of the cryptographic primitive is correct, and determining that the cryptographic protocol is not secure when including the incorrect one;
An eighth step of selecting a verification item related to security when it is determined that all of the relation between the set flow data and the type and state of the argument of the cryptographic primitive are correct;
A ninth step of determining whether or not all the selected verification items are satisfied, and determining that the cryptographic protocol is not secure with respect to the selected security if it includes those that are not satisfied;
A tenth step of determining that the cryptographic protocol is secure if all of the selected verification items are satisfied;
A program that causes a computer to execute.

Images