Abstract:Cryptographic hash functions have become the basis of modern network computing for identity authorization and secure computing; protocol consistency of cryptographic hash functions is one of the most important properties that affect the security and correctness of cryptographic implementations, and protocol consistency should be well proven before being applied in practice. Software verification has seen substantial application in safety-critical areas and has shown the ability to deliver better quality assurance for modern software; thus, applying software verification to a protocol consistency proof for cryptographic hash functions is a reasonable approach to prove their correctness. Verification of protocol consistency of cryptographic hash functions includes modeling of the cryptographic protocol and program analysis of the cryptographic implementation; these require a dedicated cryptographic implementation model that preserves the semantics of the code, efficient analysis of cryptographic operations on arrays and bits, and the ability to verify large-scale implementations. In this paper, we propose a fully automatic software verification framework, VeriHash, that brings software verification to protocol consistency proofs for cryptographic hash function implementations. It solves the above challenges by introducing a novel cryptographic model design for modeling the semantics of cryptographic hash function implementations, extended array theories for analysis of operations, and compositional verification for scalability. We evaluated our verification framework on two SHA-3 cryptographic hash function implementations: the winner of the NIST SHA-3 competition, Keccack; and an open-source hash program, RHash. We successfully verified the core parts of the two implementations and reproduced a bug in the published edition of RHash.

Model Checking and Cryptographic Protocol Analysis

Model Checking Analysis of Needham-Schroeder Public-Key Protocol

Formal Analysis of QUIC Handshake Protocol Using Symbolic Model Checking

Model Checking Quantum Markov Chains

Model-checking Quantum Systems.

Model Checking on Clock Domain Crossing Design of System-on-Chip

Research on Model-Checking Based on Petri Nets

The role of model checking in software engineering

Model Checking Needham-Schroeder Security Protocol Based on Temporal Logic of Knowledge

Modeling and Analysis of Wireless Sensor Network Protocols by Stochastic Timed Automata and Statistical Model Checking

From Wireless Sensor Networks to Wireless Body Area Networks: Formal Modeling and Verification on Security Using PAT.

Model Checking Applied to Quantum Physics

Heuristic Methods for Security Protocols

Survey for Stochastic Model Checking

Network Protocol Safe Configuration Search in One Shot

BAN-like Logic for Cryptographic Protocols Analysis: a Survey

A formal verification method: model checking

Verification of Implementations of Cryptographic Hash Functions

Hierarchical Model Checking Based on Modules

Model Checking Techniques for Verification of an Encryption Scheme for Wireless Sensor Networks

An Economical Model for the Risk Evaluation of Dos Vulnerabilities in Cryptography Protocols