We show that BAN logic, an epistemic logic for analyzing security protocols, contains an inference rule that wrongly ascribes a certain property to cryptographic hash functions. This faulty inference rule makes the BAN logic not ‘sound’. That is, it is possible to derive counterintuitive beliefs which cannot be computationally justified. We will prove this in this paper. This result should coun...

In the past few years a lot of attention has been paid to the use of special logics to analyae cryptographic protocols, foremost among these being the logic of Burrows, Abadi and Needham (the BAN logic). These logics have been successful in finding weaknesses in various examples. In this paper a limitation of the BAN logic is illustrated with two examples. These show that it is easy for the BAN...

While there have been many attempts, going back to BAN logic, to base reasoning about security protocols on epistemic notions, they have not been all that successful. Arguably, this has been due to the particular logics chosen. We present a simple logic based on the well-understood modal operators of knowledge, time, and probability, and show that it is able to handle issues that have often bee...

This paper reports on two case-studies of applying BAN logic to industrial strength security protocols. These studies demonstrate the flexibility of the BAN language, as it caters for the addition of appropriate constructs and rules. We argue that, although a semantical foundation of the formalism is lacking, BAN logic provides an intuitive and powerful technique for security analysis.

With the emergence of numerous distributed services, the importance of electronic authentication in networks is rapidly increasing. Since more than a decade, authentication protocols have been proposed and discussed. Because of various flaws which were found late, Burrows, Abadi and Needham [BAN] created a logic of authentication to formally verify authentication protocols by the end of the 80’...

We present a logic for analyzing cryptographic protocols. This logic is based on a uniication of four of its predecessors in the BAN family of logics, namely those given in GNY90], AT91], vO93b], and BAN itself BAN89]. The logic herein captures the desirable features of its predecessors and more; nonetheless, as a logic it is relatively simple and simple to use. We also present a model-theoreti...

We present a logic for analyzing cryptographic protocols. This logic encompasses a uni cation of four of its predecessors in the BAN family of logics, namely those given in [GNY90], [AT91], [vO93], and BAN itself [BAN89]. We also present a model-theoretic semantics with respect to which the logic is sound. The logic herein captures all of the desirable features of its predecessors and more; non...

In the past few years a lot of attention has been paid to the use of special logics to analyse cryptographic protocols, foremost among these being the logic of Burrows, Abadi and Needham (the BAN logic). These logics have been successful in nding weaknesses in various examples. In this paper limitations of the BAN logic are illustrated with two examples. Consideration of the attacks leads to a ...

The famous BAN paper [3] determined the research agenda of security-protocol verification for nearly a decade. Many others had worked on verifying security protocols, and the problem appeared to be intractable. The real-world systems were too complicated; too many different things could go wrong; the formal treatments were unusable. The BAN logic was abstract, formalizing intuitive notions dire...

In this paper we develop a model of computation for the NRL Protocol Analyzer by modifying and extending the model of computation for Burroughs, Abadi, and Needham (BAN) logic developed by Abadi and Tuttle. We use the results to point out the similarities and di erences between the NRL Protocol Analyzer and BAN logic, and discuss the issues this raises with respect to the possible integration o...