Draft: Implementation Dependencies and Assumptions in Authentication Protocols

Protocol specificationsmake various assumptions. These assumptionsmay concern the operation of trusted principals, the operation of principals under failure, the practical capabilities of an intruder or particular properties of the encryption system etc. Although some assumed properties may be ’obvious’, many may not be. Furthermore, such properties are rarely stated explicitly (we often lack a formalism inwhich to couch the properties) andwhen they are identified informally, it may be unclear whether an implementation of the protocol upholds them. In this paper we identify numerous ways in which protocols are shown to make assumptions and give many plausible examples of how obvious implementations will not uphold them. We draw on published work for some of the examples but provide some new attacks too. We address the following areas: Ciphertext manipulation. Algebraic properties. Assumed behaviour of legitimate principals. Field values and representations. Covert timing channels.