A Reduction for Automated Veri cation of AuthenticationProtocolsScott

Authentication protocols (including protocols that provide key establishment) are designed to work correctly in the presence of an adversary that can (1) perform an unbounded number of encryptions and tuplings while fabricating messages, and (2) prompt honest principals to engage in an unbounded number of concurrent runs of the protocol. The amount of local state maintained by a single run of an authentication protocol is bounded. Intuitively, this suggests that there is a bound on the resources needed to attack the protocol. Such bounds clarify the nature of attacks on and provide a rigorous basis for automated veriication of authentication protocols. However, few such bounds are known. This paper deenes a domain-speciic language for authentication protocols and establishes an upper bound on the resources needed to attack a large subset of the protocols expressible in that language, including versions of the Yahalom protocol and the Needham-Schroeder public-key protocol.