Protocol design for integrity protection

The authors present a design method for message integrity protection. They illustrate the use of the method by designing large classes of message types whose integrity is provably preserved and by applying the method to the symmetric key option of the privacy-enhanced electronic mail protocol to help discover and eliminate an integrity vulnerability. The method is independent of the specific encryption system and checksum/digest functions used. It expresses desirable requirements for message integrity protection in terms of abstract encryption and checksum/digest properties, and relates these properties to the message type representation, and lifetime of the protocol run and keys used. The use of the method is illustrated by the design of a large class of message types whose integrity is provably preserved in the face of active intruder attacks. In particular, the method is used to help discover and eliminate a vulnerability in the symmetric-key option of the privacy-enhanced electronic mail (PEM) protocol for the internet