Abstract :
Model checkers such as FDR have been extremely effective in checking for, and finding, attacks on cryptographic protocols. Their use in proving protocols has, on the other hand, generally been limited to showing that a given small instance, usually restricted by the finiteness of some set of resources such as keys and nonces, is free of attacks. While for specific protocols there are frequently good reasons for supposing that this will find any attack, it leaves a substantial gap in the method. The purpose of this paper is to show how techniques borrowed from data independence and related fields can be used to achieve the illusion, that nodes can call upon an infinite supply of different nonces, keys, etc., even though the actual types used for these things remain finite. It is thus possible to create models of protocols in which nodes do not have to stop after a small number of runs and to claim that, within certain limits, a finite-state run on a model checker has proved that a given protocol is secure from attack. The author uses a single protocol as a case study, but believe our techniques are much more widely applicable
