Verifying the SET registration protocols Export

@article{citeulike:3855643, abstract = {Abstract—SET (Secure Electronic Transaction) is an immense e-commerce protocol designed to improve the security of credit card purchases. In this paper we focus on the initial bootstrapping phases of SET, whose objective is the registration of cardholders and merchants with a SET certificate authority. The aim of registration is twofold: getting the approval of the cardholder's or merchant's bank, and replacing traditional credit card numbers with electronic credentials that cardholders can present to the merchant, so that their privacy is protected. These registration sub-protocols present a number of challenges to current formal verification methods. First, they do not assume that each agent knows the public keys of the other agents. Key distribution is one of the protocols' tasks. Second, SET uses complex encryption primitives (digital envelopes) which introduce dependency chains: the loss of one secret key can lead to potentially unlimited losses. Building upon our previous work, we have been able to model and formally verify SET's registration with the inductive method in Isabelle/HOL. We have solved its challenges with very general techniques. IEEE Keywords: Business communication, Communication system security, Computer}, author = {Bella, Giampaolo and Fabio and Paulson, Lawrence C.}, citeulike-article-id = {3855643}, citeulike-linkout-0 = {http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.13.756}, journal = {IEEE J. of Selected Areas in Communications}, keywords = {copy, formal-method, security, theorem-proving}, posted-at = {2009-01-07 02:57:31}, priority = {2}, title = {Verifying the SET registration protocols}, url = {http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.13.756}, volume = {21}, year = {2003} }

TY - JOUR ID - citeulike:3855643 L3 - citeulike-article-id:3855643 N2 - Abstract—SET (Secure Electronic Transaction) is an immense e-commerce protocol designed to improve the security of credit card purchases. In this paper we focus on the initial bootstrapping phases of SET, whose objective is the registration of cardholders and merchants with a SET certificate authority. The aim of registration is twofold: getting the approval of the cardholder’s or merchant’s bank, and replacing traditional credit card numbers with electronic credentials that cardholders can present to the merchant, so that their privacy is protected. These registration sub-protocols present a number of challenges to current formal verification methods. First, they do not assume that each agent knows the public keys of the other agents. Key distribution is one of the protocols’ tasks. Second, SET uses complex encryption primitives (digital envelopes) which introduce dependency chains: the loss of one secret key can lead to potentially unlimited losses. Building upon our previous work, we have been able to model and formally verify SET’s registration with the inductive method in Isabelle/HOL. We have solved its challenges with very general techniques. IEEE Keywords: Business communication, Communication system security, Computer JF - IEEE J. of Selected Areas in Communications TI - Verifying the SET registration protocols VL - 21 KW - copy KW - formal-method KW - security KW - theorem-proving AU - Bella, Giampaolo AU - Fabio AU - Paulson, Lawrence PY - 2003/// UR - http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.13.756 ER -