1
$\begingroup$

When it comes to designing new PKI-based key-exchange protocols, why are security proofs needed?

Without them, can we show a protocol's security? Does there exist a PKI-based key-exchange protocol that is secure without a security proof?

$\endgroup$

closed as too broad by D.W., rath, Gilles, user6961, minar Sep 13 '13 at 19:47

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

1
$\begingroup$

If you cannot provide even a basic proof of security, or a reduction of the protocol security to the underlying algorithms in use, you should assume the protocol is insecure.

Even with a security proof, a logical analysis of attacks against the protocol should be performed, as a proof may be limited to security against a limited amount of attacks, and in practice all attacks must be considered, even those that are uncommon or even impractical.

$\endgroup$
1
$\begingroup$

Let me propose you this: Try to write down your protocol without any security proofs. Since you think that there are no attacks, give it a try here: Proverif (http://prosecco.gforge.inria.fr/personal/bblanche/proverif/) or Scyther (http://people.inf.ethz.ch/cremersc/scyther/). They are tools for formal verification of protocols. Not only will they tell you if your protocol is secure or not, but they will also show you how it can be attacked.

$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.