% File              : ccittx509_3.tex
% Version           : $Revision: 1.1 $
% Last-modified     : $Date: 2005/01/04 11:45:32 $
% Last-modifier     : FJ

\documentclass{splib}

\begin{document}
% main environment
\begin{protocol}%
% name
{CCITT X.509 (3)}%
% authors
{CCITT}%
% date of the first publication
{1987}%
% editor name
{}%
% date of submission
{}%
% date of last change, empty or = date of submission
{22/11/2002}

\begin{abstract}
Three messages protocol in the recommendations of the CCITT for the CCITT.X.509 standard.
\end{abstract}

\begin{remark}
This protocol presented here is actually a simplified version from
\cite{BurrowsAbadiNeedham89} and \cite{abadi96prudent}.
\end{remark}

\begin{core}
\begin{declarations}
\dcl{A, B}{principal}
\dcl{Na, Nb}{nonce}
\dcl{Ta, Tb}{timestamp}
\dcl{Ya, Yb}{userdata}
\dcl{Xa, Xb}{userdata}
\dcl{PK, SK}{principal -> key (keypair)}
\end{declarations}

\begin{messages}
\msg{1}{A}{B}{A, \crypt{Ta, Na, B, Xa, \crypt{Ya}{PK(B)}}{SK(A)}}
\msg{2}{B}{A}{B, \crypt{Tb, Nb, A, Na, Xb, \crypt{Yb}{PK(A)}}{SK(B)}}
\msg{3}{A}{B}{A, \crypt{Nb}{SK(A)}}
\end{messages}
\end{core}

\begin{explanation}
See \crossref{ccittx509_1}.
\end{explanation}

\begin{remark}
%As said above, this is a simplified version of the protocol of \cite{CCITT_X.509}.
As in the case of \crossref{ccittx509_1},
in the original protocol specification \cite{CCITT_X.509},
only a hash of the data is signed, for efficiency reasons.
Hence the messages specification ought to be:
\begin{messages}
\msg{1}{A}{B}{A, Ta, Na, B, Xa, \crypt{Ya}{PK(B)}, 
  \crypt{h(Ta, Na, B, Xa, \crypt{Ya}{PK(B)})}{SK(A)}}
\msg{2}{B}{A}{B, Tb, Nb, A, Na, Xb, \crypt{Yb}{PK(A)}, 
  \crypt{h(B, Tb, Nb, A, Na, Xb, \crypt{Yb}{PK(A)})}{SK(B)}}
\msg{3}{A}{B}{A, \crypt{Nb}{SK(A)}}
\end{messages}
where \code{h} is a one-way function.
\end{remark}

\begin{property}
The protocol must ensure the confidentiality of \code{Ya} and \code{Yb}: 
if \code{A} and \code{B} follow the protocol,  
then an attacker should not be able to obtain \code{Ya} or \code{Yb}.

The protocol must ensure the recipient \code{B} of the message \code{1}
that the data \code{Xa} and \code{Ya} originate from \code{A}.

The protocol must ensure the recipient \code{A} of the message \code{2}
that the data \code{Xb} and \code{Yb} originate from \code{B}.
\end{property}

\begin{references}
\cite{BurrowsAbadiNeedham89}, \cite{CCITT_X.509}.
\end{references}

\begin{attacks}
\paragraph{1.}
This parallel session attack presented in \cite{BurrowsAbadiNeedham89}
works if \code{B} does not check the timestamp \code{Ta} in the first message.
\begin{messages}
\msg{i.1}{A}{I(B)}{A, \crypt{Ta, Na, B, Xa, \crypt{Ya}{PK(B)}}{SK(A)}}
\msg{i.1}{I(A)}{B}{A, \crypt{Ta, Na, B, Xa, \crypt{Ya}{PK(B)}}{SK(A)}}
\msg{i.2}{B}{I(A)}{B, \crypt{Tb, Nb, A, Na, Xb, \crypt{Yb}{PK(A)}}{SK(B)}}
\msg{ii.1}{A}{I}{A, \crypt{Ta', Na', C, Xa', \crypt{Ya'}{PK(I)}}{SK(A)}}
\msg{ii.2}{I}{A}{I, \crypt{Ti, Nb, A, N'a,Xi, \crypt{Yi}{PK(A)}}{SK(I)}}
\msg{ii.3}{A}{I}{A, \crypt{Nb}{SK(A)}}
\msg{ii.3}{I(A)}{B}{A, \crypt{Nb}{SK(A)}}
\end{messages}

\paragraph{2.}
Another attack can be found in \cite{AnsonMitchell90}.
\end{attacks}

\begin{see} %\crossref{}, see all.aux for labels names
\crossref{ccittx509_1},
\crossref{ccittx509_1c},
\crossref{ccittx509_3BAN}.
\end{see}

\end{protocol}
\end{document}

%%% Local Variables: 
%%% mode: latex
%%% TeX-master: t
%%% End: 
