Metadata only
Date
2013Type
- Journal Article
ETH Bibliography
yes
Altmetrics
Abstract
We formally analyze the family of entity authentication protocols defined by the ISO/IEC 9798 standard and find numerous weaknesses, both old and new, including some that violate even the most basic authentication guarantees. We analyze the cause of these weaknesses, propose repaired versions of the protocols, and provide automated, machine-checked proofs of their correctness. From an engineering perspective, we propose two design principles for security protocols that suffice to prevent all the weaknesses. Moreover, we show how modern verification tools can be used for the falsification and certified verification of security standards. Based on our findings, the ISO working group responsible for the ISO/IEC 9798 standard has released an updated version of the standard. Show more
Publication status
publishedExternal links
Journal / series
Journal of Computer SecurityVolume
Pages / Article No.
Publisher
IOS PressOrganisational unit
03634 - Basin, David / Basin, David
Related publications and datasets
Is new version of: https://doi.org/10.3929/ethz-a-007278187
More
Show all metadata
ETH Bibliography
yes
Altmetrics