Abstract:Cryptographic hash functions have become the basis of modern network computing for identity authorization and secure computing; protocol consistency of cryptographic hash functions is one of the most important properties that affect the security and correctness of cryptographic implementations, and protocol consistency should be well proven before being applied in practice. Software verification has seen substantial application in safety-critical areas and has shown the ability to deliver better quality assurance for modern software; thus, applying software verification to a protocol consistency proof for cryptographic hash functions is a reasonable approach to prove their correctness. Verification of protocol consistency of cryptographic hash functions includes modeling of the cryptographic protocol and program analysis of the cryptographic implementation; these require a dedicated cryptographic implementation model that preserves the semantics of the code, efficient analysis of cryptographic operations on arrays and bits, and the ability to verify large-scale implementations. In this paper, we propose a fully automatic software verification framework, VeriHash, that brings software verification to protocol consistency proofs for cryptographic hash function implementations. It solves the above challenges by introducing a novel cryptographic model design for modeling the semantics of cryptographic hash function implementations, extended array theories for analysis of operations, and compositional verification for scalability. We evaluated our verification framework on two SHA-3 cryptographic hash function implementations: the winner of the NIST SHA-3 competition, Keccack; and an open-source hash program, RHash. We successfully verified the core parts of the two implementations and reproduced a bug in the published edition of RHash.

Cryptographic protocol conformance testing based on domain-specific state machine

Study of protocol conformance test sequence generation algorithm based on FSM

DY Fuzzing: Formal Dolev-Yao Models Meet Cryptographic Protocol Fuzz Testing

A Formal TLS Handshake Model in LNT

A Novel Method Of State Identification Sequences Generation For Testing Communication Protocols Modeled As Extended Finite State Machines

A New Method to Generate Test Sequences for Protocol Conformance Testing

Degrees of Security: Protocol Guarantees in the Face of Compromising Adversaries

Test Execution Method Based on TTCN's Operational Semantics

An Automated Mechanism of Security Test on Network Protocols

Conformance Testing for Stochastic Cyber-Physical Systems

TPBT - a TraversalProbability BasedConformance Testing Method Forprotocols Specifiedas Communicating Finite Sate Machines

DeepSec: Deciding Equivalence Properties for Security Protocols -- Improved theory and practice

Inferring State Machine from the Protocol Implementation via Large Language Model

Inferring State Machine from the Protocol Implementation Via Large Langeuage Model.

Generating Interoperability Test Sequence for Distributed Test Architecture : A Generic Formal Framework

Extracting Protocol Format as State Machine via Controlled Static Loop Analysis

Test Sequences Generation in Protocol Test

Improving active Mealy machine learning for protocol conformance testing

A Security Verification Framework of Cryptographic Protocols Using Machine Learning

Verification of Implementations of Cryptographic Hash Functions

Effective grey-box testing with partial FSM models