Security Protocol Design via Authentication Tests

We describe a protocol design process, and illustrate its use by creating ATSPECT, an Authentication Test-based Secure Protocol for Electronic Commerce Transactions. The design process is organized around the authentication tests, a method for protocol verification based on the strand space theory. The authentication tests dictate how randomly generated values such as nonces may be combined with encryption to achieve authentication and freshness. ATSPECT offers functionality and security guarantees akin to the purchase request, payment authorization, and payment capture phases of SET, the secure electronic transaction standard created by the major credit card firms. In previous work [10, 12, 8], we have developed a method—called the “authentication test” method—that can be used by hand to verify cryptographic protocols. We also pointed out that the same ideas can be used to guide the protocol development process, quickly leading to new protocols; proofs of correctness for th...

• Type: Conference
• Year: 2002
• Where: CSFW
• Authors: Joshua D. Guttman
• Keywords: Authentication Test, CSFW 2002, Secure Electronic Transaction, Security Privacy, Test-based Secure Protocol