The Thousand-and-One Cryptographers

Chaum’s Dining Cryptographers protocol crystallises the essentials of security just as other famous diners once captured deadlock and livelock: it is a benchmark for security models and their associated verification methods. Here we give a correctness proof of the Cryptographers in a new style, one in which stepwise refinement plays a prominent role. Furthermore, our proof applies to arbitrarily many Diners: to our knowledge we are only the second group to have done that. The proof is based on the Shadow Security Model which integrates noninterference and program refinement: with it, we try to make a case that stepwise development of security protocols is not only possible but actually is quite a good idea. It benefits from more than three decades’ of experience of how layers of abstraction can both simplify the design process and make its outcomes more likely to be correct.