Secrecy Analysis in Protocol Composition Logic

We present formal proof rules for inductive reasoning about the way thatdata transmitted on the network remains secret from a malicious attacker. Extendinga compositional protocol logic with an induction rule for secrecy, we prove sound-ness for a conventional symbolic protocol execution model, adapt and extend previ-ous composition theorems, and illustrate the logic by proving properties of two keyagreement protocols. The first example is a variant of the Needham-Schroeder pro-tocol that illustrates the ability to reason about temporary secrets. The second ex-ample is Kerberos V5. The modular nature of the secrecy and authentication proofsfor Kerberos make it possible to reuse proofs about the basic version of the protocolfor the PKINIT version that uses public-key infrastructure instead of shared secretkeys in the initial steps.