Formal analysis of signal protocol based on logic of events theory

Abstract

The Signal is an end-to-end encrypted communication protocol composed of a double ratchet (DR) protocol and an extended triple Diffie-Hellman (X3DH) protocol. Its complex ratchet structure and the characteristics of protocol composition make it challenging to realize formal analysis. A formal analysis method based on logic of events theory (LoET) is proposed to conduct a security analysis of the Signal protocol. The method includes inference rules with key relation and key chain as the core to realize the formal analysis of ratchet structure, and the inference relation between sub-protocols is established by putting forward the composition theorem. The proposed method achieves a formal analysis of Signal, revealing that it does not satisfy a strong authentication property during the X3DH phase. The results show that the LoET-based method can be effectively applied in the formal analysis of Signal protocols, thus promoting the application and development of these protocols with ratchet structure and composition properties.

Introduction

Extensive monitoring and privacy disclosure make network users pay more attention to the security of network communication products. In particular, they hope to ensure the security of two-party and multi-party communication even when they do not trust the product provider and network environment. End-to-end encryption technology is an effective method for solving communication in an insecure network environment. Common network communication protocols using end-to-end encryption technology include off-the-record (OTR), OMEMO, Signal protocol, etc. The Signal protocol, developed by open whisper systems, is already widely used in social and instant messaging apps such as Signal, WhatsApp, Facebook, and Threema to provide secure communications. According to statistics, more than 1.5 billion users used Signal applications in 2018¹. The predecessor of the Signal protocol is called TextSecure. From 2014 to 2016, all versions of the TextSecure protocol were gradually unified and called Signal. Signal protocol inherited the core module of TextSecure protocol, therefore, TextSecure and Signal are regarded as the same protocol in this article.

The research on the provable security of Signal protocol is to construct an adversary and user interaction model based on the game-based method, and then reduce the protocol security problem into a mathematical problem. The game-based method has been recognized by many scholars in the research on the security of Signal protocol^2–7, but the game-based approach does not directly map the adversary's attack path. Therefore, some scholars use logic-based structured reasoning methods to describe, analyze, and prove Signal and other cryptographic protocols^8–16. Our research is based on LoET.

LoET is a formal method based on reasoning, which is mainly used for the formal analysis of distributed systems, especially the description and analysis of security protocols^10,11,17. The basic LoET includes protocol description language, event system, axiom system, and security property definition. The protocol description language is used to precisely abstract the action of the security protocol, while the event system is the protocol action eventalized transformation rules, and the axiom system and the security property definition are a set of proof systems. In recent years, LoET has been used to analyze and prove the security of PUF, 5G-AKA, RCIA, and other protocols^15,16,18.

Contribution

1. We propose an analysis method of the ratchet structure of security protocols based on LoET. By extending the analysis capabilities of LoET on key relations and key chains. The formal analysis of symmetric ratchets and asynchronous ratchets is realized.

2. We propose a method to prove the security properties of the composition protocol. By constructing a composition theorem between protocols and their sub-protocols, the modular analysis of complex protocols is realized and the complexity of the protocol analysis process is simplified.

3. We conduct LoET to prove that Signal protocol cannot resist unknown key-share (UKS) attacks, and give suggestions for improvement. The results show that the extended LoET can be effectively applied to the security analysis of complex protocols with ratchet structures such as Signal.

Paper organization

The remaining organizational structure of this paper is as follows: Sect. "Related Work" introduces the current international research on the Signal protocol. Sect. "Signal Protocol" briefly describes the structure and basic functions of the protocol, and analyzes the interactive process and characteristics of Signal protocol. Sect.

"Logic of Event Theory" introduces LoET, gives the axioms and symbols needed in the following sessions, and presents the extended LoET. In Sect."Authentication proof of signal protocol" "Authentication Proof of Signal Protocol", extended LoET is used to prove the authentication of the Signal protocol. Sect."Discussion" "Discussion" discusses research results. Sect."Conclusion and future work" "Conclusion and Future Work" summarizes the work done and puts forward future work.

Related work

As an end-to-end encryption protocol, Signal is widely adopted in various instant messaging applications due to its stronger security properties. This widespread utilization has made researchers vigilant about security of Signal, prompting many scholars to dedicate their efforts to studying its security measures.

Frosch et al.¹⁹ first provided a comprehensive and accurate description of interaction process of the TextSecure protocol and conducted a security analysis. They established formal security definitions and security proof for the three component modules of the protocol and found that it was vulnerable to a UKS attack. After TextSecure was upgraded to Signal, Cohn-Gordon et al.² proposed a formal security analysis method that can capture the ratchet structure. Moreover, they proved that the key exchange core of Signal protocol could satisfy standard security properties. Building on this approach, Cohn-Gordon et al.⁴ proposed an Asynchronous Ratcheting Trees (ART) design method for stronger security properties.Frosch and Cohn-Gordon's work discussed the security of the whole Signal protocol, while Bellare et al.³ focused on the ratchet structure of the Signal protocol, which used a game-based method to provide semantic and security definitions of protocol ratchet encryption and key exchange, presented a ratchet key exchange method with security verification, and then showed how to capture ratchet encryption properties from the ratchet key exchange and standard encryption. Compared with the research of Cohn-Gordon et al.² Bellare et al. focused on a ratchet structure independent of Signal and other protocols as simple as possible, so as to capture the essence of the ratchet algorithm that needs to reach the target. Therefore, for the analysis of Cohn-Gordon, the ratchet step stops at key distribution. Bellare defines ratchet encryption as a two-party protocol based on trusted initial key distribution, which isolates ratchet key exchange from the message key exchange used to generate the initial key. This has the advantage of allowing for more modular processing. Poettering and Rösler⁵ proposed an improved unidirectional ratcheted key exchange (URKE) security model on the basis of Bellare et al.³ and introduced security models of sesquidirectional ratcheted key exchange (SRKE), bidirectional ratcheted key exchange (BRKE), gave the provable security structures of URKE and SRKE.

Multi-user participation in protocol operation makes protocol interaction more complex and security more uncertain. Rösler, Mainka & Schwenk⁶ proposed a comprehensive security model for analyzing group Signal, and found that the group communication of Signal protocol did not meet the requirements of post-compromise security.

Consider the security of the Signal protocol implementation. Alwen, Coretti & Dodis²⁰ first formalized immediate decryption properties of Signal protocol and established a modular universal Signal protocol. Vatandas et al.²¹ first conducted formal research on the offline deniability of Signal protocol, proposed a general theorem, which linked the deniability of the communication session with the deniability of the key distribution protocol that initiates the session, extended the deniability result of the X3DH protocol in the initial phase to the entire Signal protocol. For software applications that use the Signal protocol, Paterson et al.²² conducted an in-depth analysis of Signal protocol implementation of Threema, especially focusing on its user registration, private key backup, and multiple user interaction.

Most of the above research is a game-based security analysis of the whole Signal protocol or only the ratchet structure. Other formal methods and tools are also applied to the research of Signal protocol. Almuzaini and Ahmad used Scyther, a formal verification tool, to conduct formal modeling and verification of Signal protocol. Jacomme et al.²³ used Tamarin to verify the security properties of the protocol. Kamkuemah et al.¹⁴ proposed using epistemic logic for the security properties and interactive behavior of the Signal protocol. Zhao et al.²⁴ used Spin to research the composition property of security protocols. Beguinet et al.²⁵ used Tamarin to conduct formal modeling and verification of the Signal protocol. The related work is summarized in Table 1.

Table 1.

Summarization of the related work.

Related Work	Summarization
Frosch et al.19	Established formal security definitions and security proof for the three component modules of the Signal protocol and found that it was vulnerable to UKS attack
Cohn-Gordon et al.2	Proposed a formal security analysis method that can capture the ratchet structure and proved that the key exchange core of Signal protocol could satisfy standard security properties
Cohn-Gordon et al.4	Proposed an ART design method for stronger security properties
Bellare et al.3	Proposed security definitions of the rachet mechanism, presented a ratchet key exchange method with security verification and showed how to capture ratchet encryption properties
Poettering and Rösler5	Proposed an improved URKE security model, introduced SRKE and BRKE security model, and gave the provable security structures of URKE and SRKE
Rösler, Mainka & Schwenk6	Proposed a comprehensive security model analyzing group Signal protocol
Alwen, Coretti & Dodis20	First formalized immediate decryption properties of Signal protocol and established a modular universal Signal protocol
Vatandas et al.21	First conducted formal research on the offline deniability of Signal protocol
Paterson et al.22	Conducted an in-depth analysis of Signal protocol implementation of Threema
Kamkuemah et al.14	Proposed using epistemic logic to analyze the security properties and interactive behavior of the Signal protocol
Zhao et al.24	Used Spin to research the composition property of security protocols
Beguinet et al.25	Used Tamarin to conduct formal modeling and verification of the Signal protocol

As can be seen from Table 1 and the above-related work, the current analysis of the Signal protocol is insufficient, and the research mainly focuses on the ratchet part of the Signal protocol, without considering whether the composition of subprotocols will affect the overall security of Signal. However, the key that triggers the Signal ratchet is generated by the initial sub-protocol negotiation, which leads to an unreasonable assumption that the key that triggers the Signal ratchet is secure if the Signal ratchet structure is considered separately. Therefore, a protocol composition analysis technology is urgently needed to realize the comprehensive analysis of Signal protocol. The current modeling of the DR structure of Signal is not accurate enough, because most of the work is based on the consideration of different ratchet states of Signal. However, this cannot express the continuity of ratchet operation in the protocol, and will lead to ignoring the intermediate process of ratchet conversion, that is, the relation and transmission of keys between different ratchets are not considered. So, for the DR structure of Signal, it is necessary to propose an analysis method that considers its continuous operation.

Signal protocol

In essence, the Signal protocol is a multi-stage authentication key exchange (AKE) protocol. The secure exchange of keys between users is the core function of the Signal protocol^26,27. The Signal protocol generates an ephemeral key pair before each session to ensure the independence of the session but also retains a long-term key to identify the agents and avoid missing messages due to out-of-order messages, thus maintaining some relevance between sessions. The goals to be achieved in different stages of the Signal protocol are inconsistent, so the security strength of different stages of the Signal protocol is different. However, the key generation and exchange mechanism as the core of the protocol is unified, the key generated in the initial stage flows to the next stage along with the implementation of the protocol, so the strong security phase that leads to the protocol does not necessarily have stronger security. The independence of different phases should be considered in the security analysis of Signal, but the integrity of the entire protocol and the relation between phases should not be ignored. Therefore, we divide Signal into the X3DH phase and DR Phase. The action symbols of Signal protocol are described in Table 2.

Table 2.

Action symbol of Signal protocol.

Action	Meaning	Action	Meaning
$send(x)$	Send message x	$enc(x,k,c)$	The plaintext x is encrypted by the key k to obtain the ciphertext c
$rcv(x)$	Receive message x	$dec(x,k,c)$	The ciphertext c is decrypted by the key to obtain the plaintext x
$kdf(x,y)$	The kdf is key derivation function (KDF), x as input message and y as kdf output	$sign(x,k,s)$	The message x is signed by the key k to get the signature s
$dh(m,n,x)$	The dh denotes an implementation of Diffie-Hellman (DH) algorithm, that is, dh function randomly chooses a group g, then computes x = g^(mn)	$verify(x,k,s)$	The signature s is verified by the key k for consistency with the message x
$del(x)$	Delete message x	$genkey(<k,pk>)$	Generate key pair
$bond(m,n,x)$	The bond denotes connection, that is, x is the result of the end-to-end connection of messages m and n	$encode(x)$	Encode the message x

X3DH phase

We divide the X3DH phase into the registration and the Diffie-Hellman (DH). Participants in the registration section are users and a server. Users need to upload their identity key, signed pre-key, signature of signed pre-key by user’s identity key, and one-time pre-shared key to the server²⁶. The identity key is a long-term key, and the signed pre-key is a semi-long-term key, which is updated periodically as required. The one-time pre-key is a bundle of keys. After the server distributes a one-time pre-key to the session initiator, the key is deleted. In order to enhance the efficiency of the protocol, some simplified versions of the Signal protocol do not use the one-time pre-key. As a result, the security of the entire protocol deteriorates. This would make the overall protocol less secure, and we do not consider this scenario. Table 3 shows the symbolic representation of the key pair in the registration section (Fig. 1).

Table 3.

The key pair of the registration section.

Key pair		Meaning
$IK_{}^{\ast }$	$IPK_{}^{\ast }$	Agent's long-term keys pair, * denotes an agent
$SRK_{}^{\ast }$	$SRKP_{}^{\ast }$	Agent's signed pre-key pair, * denotes an agent
$OTK_{}^{\ast }[n]$	$OTPK_{}^{\ast }[n]$	Agent's bundle of one-time pre-key pair, the length is n, * denotes an agent
$OTK_l^{\ast }$	$OTPK_l^{\ast }$	Agent's lth one-time pre-key, * denotes an agent

Fig. 1.

Protocol interaction of the X3DH phase.

The registration section is when all Signal protocol users register their own keys with the server. This registration mechanism is to realize the offline communication function of the protocol. However, in the analysis and proof of the protocol, we do not consider the registration server of the initiator. This is because the key registered by the protocol initiator to the server does not participate in the session, so it is not considered.

In the DH section, the protocol initiator verifies the signature after obtaining the key data registered by the responder on the server. If the verification succeeds, the protocol continues to be executed. The goal of the DH section is to achieve the first session between the protocol initiator and responder and generate the initial root key of the DR Protocol after the first interaction. Table 4 shows the symbol of the key in the DH section.

Table 4.

The key pair of the DH section.

Key pair		Meaning
$EK_i^{\ast }$	$EPK_i^{\ast }$	The ith generation ephemeral key pair generated by the agent *
$SK_{}^{\ast }$	-	Shared key
$\mathit{AD}$	-	Associated data byte string
$\mathit{dh}$	-	The result of the DH calculation output
$S_{\mathit{dh}}$	-	The results of the bond calculation output
$encode(Key)$	-	Encoding calculation

The interaction between the registration section and the DH section is depicted by the protocol description language, as shown in Fig. 2. The symbols outside the key are described as shown in Table 4.

Fig. 2.

The interaction of the DR Protocol.

The DR phase

The DR Phase is the actual session phase of the Signal protocol. This phase has two parts, one called the DH ratchet and the other called the symmetric ratchet²⁷ The DH ratchet is used to trigger the rotation of the symmetric ratchet. When the symmetric ratchet is activated by the DH ratchet, the symmetric ratchet automatically rotates to generate a message key for encryption and decryption. The key symbols in the DR phase include the ratchet key, root key, chain key, and message key, as shown in Table 5.

Table 5.

The key pair of the DR phase.

Key pair		Meaning
$RHK_i^{\ast }$	$RHPK_i^{\ast }$	The ratchet key pair is generated by the agent * for the ith time
$R{K}_{i,j}^{IR/RI}$	-	The root key is generated by the initiator (responder) for the ith DH ratchet, jth symmetric ratchet rotation
$C{K}_{i,j}^{IR/RI}$	-	Chain key, explain in detail such as the root key
$M{K}_{i,j}^{IR/RI}$	-	Message key, explain in detail such as the root key

The root key used at the beginning of the first round of DR protocol is the shared key $SK_{\ast }^{}$ obtained in the X3DH phase. This key and the ratchet key generated by the protocol executor act as the wedge of the root key, chain secret key, and message key of the DR protocol. The difference between the nth round of DR protocol and the initial round is that the root key of the initial round is from the shared key calculated in the X3DH phase, while the root key of the nth round is calculated in the last DR phase. The specific interaction of the DR phase is shown in Fig. 2.

The generation of the key of the DR protocol is in the form of trees^28–30. The update of the root key $R{K}_{i,j}^{IR/RI}$ is the trunk of the whole tree, and the chain key $C{K}_{i,j}^{IR/RI}$ and the message key $M{K}_{i,j}^{IR/RI}$ are the branches of the tree, as shown in Fig. 3. Both encryption and decryption keys are branches derived from the trunk of a tree. Combined with the concept of DR, the rotation of the DH ratchet is the growth of the tree, and the rotation of the symmetric ratchet is the generation and growth of branches.

Fig. 3.

The tree structure of the key chain.

Logic of event theory

Brief introduction of event logic and its defects

The LoET is a formal method based on theorem proving, which is mainly used for the formal analysis of distributed systems. According to the characteristics of security protocol, the basic LoET includes protocol description language, event system, axiom system, and security property definition. The protocol description language is used to precisely abstract the action of the security protocol, while the event system is the protocol action eventalized transformation rules, and the axiom system and the security property definition are a subset of proof systems. The main symbols and symbolic semantics of the event system are shown in Table 6.

Table 6.

Basic symbolic syntax and semantic.

Symbol and Form	Expression	Semantic
$A$,$B$… $th{r}_1$,$th{r}_2$…	$A=B$,$A\ne B$	Agent or thread’s identifier
$\mathit{atom}$ = $\{$ $a$,$b$,$\mathit{data}$,$\mathit{Key}$…$\}$	$a=b$,$a\ne b$, $<a,b,key\dots >$	Atom denotes basic data unit
$E$ = $\{$ $\mathit{New}$,$\mathit{Send}$,$\mathit{Rcv}$,$\mathit{Sign}$,$\mathit{Verify}$,$\mathit{Enc}$,$\mathit{Dec}$,$e$ $\}$	$E(e)$,$E(Atom)$ = $<Atom>$	Events describe the protocol state
$\mathit{action}$ = $\{$ $\mathit{new}$,$\mathit{send}$,$\mathit{rcv}$,$\mathit{sign}$,$\mathit{verify}$,$\mathit{enc}$,$\mathit{dec}$ $\}$	$action(E(e))$	Action describes protocol run and behavior
$\mathit{Honest}$	$\mathit{HonestId}$	The agent of identifier $\mathit{Id}$ is honest
$\mathit{loc}$	$Id=loc(E)$	Event E occurs at the location of the identifier $\mathit{Id}$
$\mathit{bss}$	$bss(Id,Id,Id)$	Basic sequence $\mathit{bss}$ denotes event sequence
$\mathit{oneOf}$	$oneOf(bss,Id)$	The $\mathit{bss}$ is event basic sequence of identifier $\mathit{Id}$
$\mathit{inOneOf}$	$inOneOf(E,Id,bss,Id)$	The event E in $\mathit{bss}$ occurs at the agent of the first identifier $\mathit{Id}$ and thread of the second identifier $\mathit{Id}$
$\mathit{MatchingKeys}$	$MatchingKeys(Key,Key)$	The two keys match
$\mathit{has}$	$Id/EhasAtom$	Atom is included in the content of the agent or thread
$\Vert$	$Id/E\Vert Atom$	Atom independent of the content of the agent or thread
$\stackrel{\mathit{atom}}{⟶}$	$e_1$ $\stackrel{\mathit{atom}}{⟶}$ $e_2$	An event has atom data that derives from another event
$<$, $\le$	$e_1<e_2$,$e_1\le e_2$	The event of the symbolic left side occurs earlier than the event of the symbolic right side, or equality
$\stackrel{n}{\approx }$	$th{r}_1\stackrel{n}{\approx }th{r}_2$	There are n matching sessions between the two threads

LoET was first proposed in the literature^11,17 and used to analyze and prove the authentication of security protocols. Later, the extension of LoET was mainly about the simplification of the proof steps and the security properties proof of the fine-grained protocol model. LoET urgently needs to strengthen the analysis ability of complex structure protocols. LoET has the following defects:

1. LoET cannot analyze the ratchet structure. The ratchet structure of the security protocol generates a tree-like key chain, which grows in a depth-first way, and each leaf node represents a different key. At present, LoET analyzes key transfer and exchange through flow relation axioms, order, independence, and ownership relations, but these cannot analyze the relation between leaf nodes in the tree secret key chain, and cannot conduct a comprehensive security analysis of ratchet structure.

2. LoET lacks the ability to analyze composition protocols. The current security protocol is usually a combination of multiple protocols, for example, the Signal protocol consists of the X3DH protocol and the DR protocol. For the analysis of the composition properties of multiple protocols, LoET lacks corresponding theorems to guide the analysis process, that is, it cannot effectively analyze the relation and the key flow between protocols.

Therefore, in view of the above problems, we extend the LoET and use the extended LoET to analyze and prove the Signal protocol.

Extend logic of event theory

In order to capture the ratchet structure in the protocol, key generation events $GenKey(<Key,Key>)$, DH events $DH(<Key,Key>,Key)$, KDF events $KDF(<Key,Key>,Key)$, bond events $Bond(<Atom,Atom,Atom>)$, and deletion events $Del(Key)$ are proposed. According to these events, corresponding theorems and lemmas are proposed.

Definition 1.

Event Value. Event value refers to the item contained in the event operator, the symbol is expressed as $Val(E(x))=x$.

Definition 2.

Key Generation Event. The key generation event $GenKey(<Key,Key>)$ generates a new key or key pair in the agent. The new key is guaranteed to be unique and does not exist in any location before generation.

Definition 3.

Del Event. The deletion event $Del(Key)$ deletes the key in the protocol agent, and then the key does not exist in the protocol agent.

Definition 4.

Key Relation. The key relation means that there is a key that participates in the calculation of a certain event and generates a new key, then the set of all keys participating in the calculation is related to the newly generated key, but the generated new key is no related between them, and the specific definitions are as follows:

$$KRel(K_1,K_2){\equiv }_{\mathit{def}}\left(\exists e:E.ehas(K_1\wedge K_2)\Rightarrow K_1\to K_2\right)$$

Theorem 1

If the key $K$ constructs a relation with the key $K\prime$ in an event, then the key $K$ can deduce the key $K\prime$. The formal description is as follows:

$$\left(K,K\prime \subseteq Val(E(e)).KRel(K,K\prime )\Rightarrow (K\to K\prime )\right)$$

Proof: This can be proved according to the definition of the key relation.

Theorem 2

Analysis for a single agent A, If no event $E(Rcv)$ occurs in the key lifetime, then there must be an event generating the key. The formal description is as follows:

$$\left(E(Rcv)||k\Rightarrow \exists e:E.ehask\wedge e=E(GenKey)\right)$$

Proof: Suppose that there is no key generation event $E(GenKey)$ in agent A when agent A uses a key $k$ to encrypt, decrypt, or sign data, the key $k$ does not originate from internal generation, then the agent must obtain $k$ through $E(Rcv)$, which is in contradiction with the precondition $E(Rcv)||k$.

Lemma 1

Analysis for a single agent A, If there is not an associated computation event in the key's lifetime, then there must be an $E(Rcv)$ event.

$$\left(E(GenKey)||k\Rightarrow \exists e:E.ehask\wedge e=E(Rcv)\right)$$

Proof: Suppose that there is no receiving event $E(Rcv)$ in agent A, when agent A uses a key $k$ to encrypt, decrypt, or sign data, the key $k$ does not originate from external receiving, then the agent must be generated through $E(GenKey)$, which is in contradiction with the precondition $E(GenKey)||k$.

Definition 5

Bond Event. The bond event $Bond(<Atom,Atom,Atom,\dots >)$ inputs the atomic type parameter in the protocol agent and outputs the result of the bond calculation. This event is proposed to avoid the ambiguity between the independent symbol and the bond symbol.

Definition 6

Key Chain. Key chain $KChain(Key,n,l=0,1,2)$ refers to similar keys (generated in the same way and with the same function) that have relevance, order, causality, and functional consistency. Then these keys form a key chain, and the specific definitions are as follows:

$$KChain(Key,n,l=0,1,2){\equiv }_{\mathit{def}}\left(\begin{array}{c}\exists n:{\mathbb{N}}^{+}.\exists K_n:Key.\exists e:E.K_k\subseteq Val(e).\\ ((l=2\vee l=1)\wedge (K_1\to K_2\to K_3\to \dots \\ \to K_{n-1}\to K_n)).((l=2\vee l=0)\wedge \\ (K_1\leftarrow K_2\leftarrow K_3\leftarrow \dots \leftarrow K_{n-1}\leftarrow K_n))\\ \end{array}\right)$$

The $l$ is direction label of the key chain, the $l$ = 0 refers to a reverse key chain, the $l$ = 1 refers to a forward key chain, and the $l$ = 2 refers to a two-way key chain. The ${\mathbb{N}}^{+}$ is a set of positive integers, the n is the length of the key chain. An application example of predicates $\mathit{KRel}$ and $\mathit{KChain}$ is shown in Appendix A.

Definition 7 DH Event

The DH event $DH(<Key,Key,\dots >,Key)$ executes calculations based on the DH algorithm in the agent of the protocol.

Theorem 3

The key $K_1$ can deduce the Key $K_2$, the Key $K_2$ can deduce the key $K_3$, then it is considered that the key $K_1$ can deduce the $K_3$.

$$\left(KRel(K_1,K_2)\wedge KRel(K_2,K_3)\Rightarrow KRel(K_1,K_3)\right)$$

Proof: When there is $KRel(K_1,K_2)$ then $K_1$ can be derived $K_2$; When there is $KRel(K_2,K_3)$ then $K_2$ can be derived $K_3$. According to definition 7, there is a key chain $KChain(K,3,1)$, then $KRel(K_1,K_3)$ can be obtained.

Definition 8

KDF Event. KDF event $KDF(<Key,Key,\dots >,Key)$ executes the calculation based on the KDF algorithm in the agent of the protocol.

Theorem 4.

The key generated by the event $E(KDF)$ can not reversely imply the input key of this event. The formal description is as follows:

$$\left(<K,K^{\prime }>=Val(E(KDF))\Rightarrow KChain(K^{\prime },n,1)\wedge \neg KChain(K^{\prime },n,0)\right)$$

Proof: According to the definition of event $E(KDF)$, it can be seen that it is a one-way event, so a one-way key chain can be formed.

Definition 9

Match. Similar to encryption and decryption, such corresponding events are called matches, and the existing matches are as follows:

1. Given a decryption event, if there is an encryption event and an existing equation $Val\left(Dec\left(x\right)\right)=Val(Enc(x^{\prime }))$, then the encryption event matches the decryption event, defined as $DEMatch(E(Dec),E(Enc))$.

2. Given a receiving event, if there is a sending event and an existing equation $Val\left(Rcv\left(x\right)\right)=Val(Send(x^{\prime }))$, then the sending event matches the receiving event, defined as $RSMatch(E(Rcv),E(Send))$.

3. Given a verification event, if there is a signature event and an existing equation $Val\left(Rcv\left(x\right)\right)=Val(Send(x^{\prime }))$, then the signature event matches the verification event, defined as $VSMatch(E(Verify),E(Sign))$.

The definition of match leads to the axiom about the uniqueness of a match:

• DEM $Val(Dec(m,k,s))=Val(Enc(m\prime ,k\prime ,s))\iff DEMatch(E(Dec),E(Enc))\wedge E(Enc)<E(Dec)$.

• RSM $Val(Rcv(m,k,s))=Val(Send(m\prime ,k\prime ,s))\iff RSMatch(E(Rcv),E(Send))\wedge E(Send)<E(Rcv)$.

• VSM $Val(Verify(m,k,s))\wedge Val(Sign(m\prime ,k\prime ,s))\wedge m=m\prime \wedge MatchK(k,k\prime )\iff VSMatch(E(Verify),E(Sign))\wedge E(Sign)<E(Verify)$.

The Decryption and Encryption Match (DEM) axiom states that when there is a decryption event, there must be an encryption event before the decryption event that matches it. The Receiving and Sending Match (RSM) axiom states that when there is a receiving event, there must be a sending event that matches the receiving event. The Verification and Signature Match (VSM) axiom states that when there is a verification event, there must be a signature event that matches it before the verification event.

Definition 10

Authentication. The authentication of the protocol is defined through the matching of sessions between agents. The specific definitions are as follows:

$$\left(Pr|=auth(bss,n){\equiv }_{\mathit{def}}\left(\begin{array}{c}\forall A,B.\forall th{r}_1.(Honest(A)\wedge Honest(B)\wedge Pr(A)\wedge \\ Pr(B)\wedge A\ne B\wedge loc(th{r}_1)=A\wedge bss(A,B,th{r}_1))\\ \end{array}\right)\Rightarrow \exists th{r}_2.loc(th{r}_2)=B\wedge th{r}_1\stackrel{n}{\approx }th{r}_2\right)$$

The definition of strong authentication in LoET is to add a strict event ordering based on the authentication definition, that is, $E(Send)$ match with $E(Rcv)$, and $E(Send)$ must occur before $E(Rcv)$.

Theorem 5

Protocol Composition. Given protocol P, if the protocol consists of p and q, and the initial data $k$ in protocol q is passed by protocol p, then for the security property formula $\varphi$, there is $p\models \varphi \wedge q\models \varphi \Rightarrow P\models \varphi$, if and only if $k$ is not leaked.

Proof: If protocol P does not satisfy the formula $\varphi$, then P may not satisfy the formula $\varphi$ in part p, or it may not satisfy the formula $\varphi$ in part q. If the failure to satisfy $\varphi$ occurs in the process of running subprotocol p, obviously, protocol P does not run to sub-protocol q, so protocol p directly does not satisfy the formula $\varphi$, hence the contradiction. If the failure to satisfy $\varphi$ occurs during the operation of sub-protocol q, protocol p is completed before protocol q, the key $k$ is passed to protocol q as the initial data, then for q, as long as the initial data is secure, the operation of protocol q is independent of the operation of p. Therefore, if the key $k$ is not leaked, protocol q directly fails to satisfy the formula $\varphi$, resulting in a contradiction.

Authentication proof of signal protocol

Proof procedures

The Signal protocol is a composition of X3DH and DR protocols in sequence. We use the extended LoET to prove the authentication of X3DH and DR Protocols respectively through the process shown in Appendix B.

Detailed steps of Fig. 4 are explained as follows:

1. Describe the protocol using the protocol description language and divide the basic sequence.

2. Assume existing the honest agent, and make the honest agent the instance in the basic sequence. Recursively proves whether there is a match between basic sequences.

3. According to decryption and encryption match axiom DEM, Receiving and Sending Match axiom RSM, Theorem 1, and flow relation deduce match event。

4. The match session is proved by the honesty AxiomS, DEM, and protocol interaction specification, taking the match event in the instantiation basic sequence as the entry point.

5. The order of match sessions is proved by the flow relation, the verification and signature match axiom VSM. This step completes the proof of strong authentication.

Fig. 4.

Proof process of LoET.

After all the sub-protocols are proved, Theorem 5 is finally demonstrated to determine whether the protocol is satisfied with the security properties. The axioms of the LoET axiom system used in the proof are shown in Fig. 4.

Authentication proof of X3DH

Analyzing the X3DH protocol of Fig. 1, we can divide the protocol getting the basic sequence of the protocol. The basic sequence of the initiator is as follows:

$$\left(\begin{array}{c}{I}_1=send(B)\\ I_2=I_1,rcv(IP{K}^B,SRP{K}^B,S_0,OTP{K}_l^B),verify(encode(SP{K}^B),IP{K}^B,S_0)\\ I_3=I_2,genkey(<E{K}_i^A,EP{K}_i^A>),dh(I{K}^A,SRP{K}^B,d{h}_1),dh(E{K}_i^A,IP{K}^B,d{h}_2),\\ dh(E{K}_i^A,SRP{K}^B,d{h}_3),dh(E{K}_i^A,OTP{K}_l^B,d{h}_4),bond(d{h}_1,d{h}_2,d{h}_3,d{h}_4,S_{\mathit{dh}}),\\ kdf(S_{\mathit{dh}},S{K}^A)\\ I_4=I_3,del(E{K}_i^A,d{h}_1,d{h}_2,d{h}_3,d{h}_4),bond(encode(I{K}^A),encode(IP{K}^A),AD)\\ I_5=I_4,enc(m_0,<AD,SKA>,S_1),send(IP{K}_A,EP{K}_i^A,l,S_1)\\ \end{array}\right)$$ 1

The basic sequence of the responder is as follows:

$$\left(\begin{array}{c}{R}_1=genkey(<SR{K}^B,SRP{K}^B>,<OT{K}^B[n],OTP{K}^B[n]>),\\ sign(encode(SP{K}^B),I{K}^B,S_0),send(B,IP{K}^B,SRP{K}^B,S_0,OTP{K}_l^B)\\ R_2=R_1,rcv(IP{K}^A,EP{K}_i^A,l,S_1)\\ R_3=R_2,dh(SR{K}^B,IP{K}^A,dh_1^{\ast }),dh(I{R}^B,EP{K}_i^A,dh_2^{\ast }),dh(SR{K}^B,EP{K}_i^A,dh_3^{\ast }),\\ dh(OT{K}_l^B,EP{K}_i^A,dh_4^{\ast }),bond(dh_1^{\ast },dh_2^{\ast },dh_3^{\ast },dh_4^{\ast },S_{\mathit{dh}}^{\ast }),kdf(S_{\mathit{dh}}^{\ast },S{K}^B)\\ R_4=R_3,del(dh_1^{\ast },dh_2^{\ast },dh_3^{\ast },dh_4^{\ast }),bond(encode(IP{K}^A),encode(I{K}^B),AD_{}^{\ast })\\ R_5=R_4,dec(m_0^{\ast },<AD_{}^{\ast },SK_{}^{}>,S_B),del(OT{K}_l^B)\\ \end{array}\right)$$ 2

The basic sequence of the server-side protocol is as follows:

$$\left(\begin{array}{c}{S}_1=rcv(B,IP{K}^B,SRP{K}^B,S_0,OTP{K}_l^B)\\ S_2=S_1,rcv(B)\\ S_3=S_2,send(IP{K}^B,SRP{K}^B,S_0,OTP{K}_l^B),del(OTP{K}_l^B)\\ \end{array}\right)$$ 3

The X3DH protocol is $Protocol\left(\left[I_1,I_2,I_3,I_4,I_5,R_1,R_2,R_3,R_4,R_5,S_1,S_2,S_3\right]\right)$, first proves the authentication, satisfying $X3DH|=auth(R_5,4)$. Assuming that two honest agents A and B follow the Signal protocol, the instantiated threads $th{r}_1$ of A and the instantiated threads $th{r}_2$ of B execute the operations in the basic sequence of the X3DH protocol, and the operations in the basic sequence of the X3DH protocol are mapped to events in the thread. According to the actual protocol interaction in this case, A refers to the initiator, and B refers to the responder.

Make the thread $th{r}_2$ of the honest agent B instantiate as an instance in the sequence $R_5$, so that there are an event sequence $e_0{<}_{\mathit{loc}}{e}_1{<}_{\mathit{loc}}\dots {<}_{\mathit{loc}}{e}_{13}$ in the sequence containing some atoms type such as $S_0$, $S_1$, $S{K}_B$, $AD_{}^{\ast }$, and atoms-like information parameters. $R_5$ instantiation looks like this:

$$\left(\begin{array}{c}{e}_0{<}_{\mathit{loc}}{e}_1{<}_{\mathit{loc}}\dots {<}_{\mathit{loc}}{e}_{13}\\ GenKey(e_0)=<<SR{K}^B,SRP{K}^B>,<OT{K}^B[n],OTP{K}^B[n]>>\wedge \\ Sign(e_1)=<encode(SP{K}^B),I{K}^B,S_0)\wedge Send(e_2)=<B,IP{K}^B,SRP{K}^B,S_0,OTP{K}_l^B>\wedge \\ Rcv(e_3)=<IP{K}^A,EP{K}^A,l,S_1>\wedge DH(e_4)=<SR{K}^B,IP{K}^A,dh_1^{\ast }>\wedge \\ DH(e_5)=<I{R}^B,EP{K}_i^A,dh_2^{\ast }>\wedge DH(e_6)=<SR{K}_B,EP{K}_i^A,dh_3^{\ast }>\wedge \\ DH(e_7)=<OT{K}_l^B,EP{K}_i^A,dh_4^{\ast }>\wedge Bond(e_8)=<dh_1^{\ast },dh_2^{\ast },dh_3^{\ast },dh_4^{\ast },S_{\mathit{dh}}^{\ast }>\wedge \\ KDF(e_9)=<S_{\mathit{dh}}^{\ast },S{K}^B>\wedge Del(e_{10})=<dh_1^{\ast },dh_2^{\ast },dh_3^{\ast },dh_4^{\ast }>\wedge \\ Bond(e_{11})=<encode(IP{K}^A),encode(I{K}^B),AD_{}^{\ast }>\wedge Dec(e_{12})=<m_0^{\ast },<AD_{}^{\ast },S{K}^B>,S_1>\wedge \\ Del(e_{13})=<OT{K}_l^B>\\ \end{array}\right)$$ 4

The event $e_{12}$ is the decryption for the message $S_1$, so according to the axiom AxiomS and the axiom DEM, we know that there must be an encryption event $e\prime$ that matches $e_{12}$ so that the following formula is satisfied:

$$\left(e\prime <e_{12}\wedge DEMatch(e_{12},e\prime )\wedge loc(e\prime )=B\vee loc(e\prime )=A\right)$$ 5

Among the instances of the basic sequence, only $I_5$ contains the encryption event $E(Enc)$, so supposing that $e\prime$ is an instance in $I_5$, including $S_1\prime$ and other atom or atom-like parameters, we can get:

$$\left(\begin{array}{c}{e}_0\prime {<}_{\mathit{loc}}{e}_1\prime {<}_{\mathit{loc}}\dots {<}_{\mathit{loc}}{e}_{13}\prime \\ Send(e_0\prime )=<B\prime >\wedge Rcv(e_1\prime )=<IP{K}^B\prime ,SRP{K}^B\prime ,S_0\prime ,OTP{K}_l^B\prime >\\ Verify(e_2\prime )=<encode(SP{K}^B\prime ),IP{K}^B\prime ,S_0\prime >\wedge GenKey(e_3\prime )=<E{K}_i^A\prime ,EP{K}_i^A\prime >\wedge \\ DH(e_4\prime )=<I{K}^A\prime ,SRP{K}^B\prime ,d{h}_1\prime >\wedge DH(e_5\prime )=<E{K}_i^A\prime ,IP{K}^B\prime ,d{h}_2\prime >\wedge \\ DH(e_6\prime )=<E{K}_i^B\prime ,SRP{K}^B\prime ,d{h}_3\prime >\wedge DH(e_7\prime )=<E{K}_i^A\prime ,OTP{K}_l^B\prime ,d{h}_4\prime >\wedge \\ Bond(e_8\prime )=<d{h}_1\prime ,d{h}_2\prime ,d{h}_3\prime ,d{h}_4\prime ,S_{\mathit{dh}}\prime >\wedge KDF(e_9\prime )=<S_{\mathit{dh}}\prime ,S{K}^A\prime >\wedge \\ Del(e_{10}\prime )=<E{K}_i^A\prime ,d{h}_1\prime ,d{h}_2\prime ,d{h}_3\prime ,d{h}_4\prime >\wedge Bond(e_{11}\prime )=<encode(I{K}^A\prime ),encode(IP{K}^B\prime ),AD\prime >\wedge \\ Enc(e_{12}\prime )=<m_0\prime ,<AD\prime ,S{K}^A\prime >,S_1\prime >\wedge Send(e_{13}\prime )=<IP{K}^A\prime ,EP{K}_i^A\prime ,l\prime ,S_1\prime >\\ \end{array}\right)$$ 6

From the formula, it can be found that the structure of events $e_{12}\prime$ and $e_{12}$ is equal, and according to the decryption axiom DEM, the following formula can be obtained:

$$\left(Enc(e_{12}\prime )=<m_0\prime ,<AD\prime ,S{K}^A\prime >\wedge Dec(e_{12})<m_0^{\ast },<AD_{}^{\ast },S{K}^B>,S_1>\Rightarrow DEMatch(e_{12},e_{12}\prime )\right)$$ 7

Therefore, the encryption event $e_{12}\prime$ in the thread $th{r}_1$ matches the decryption event $e_{12}$ in the thread $th{r}_2$, and gets:

$$\left(DEMatch(e_{12},e_{12}\prime )\wedge loc(e_{12}\prime )=B\Rightarrow S_1\prime =S_1\wedge (<AD\prime ,S{K}^{\prime }>=<AD_{}^{\ast },S{K}^B>)\right)$$ 8

Then according to the axiom AxiomK:

$$\left(MachingKeys(AD\prime ,AD_{}^{\ast })\wedge MachingKeys(S{K}^{\prime },S{K}^{\prime })\right)$$ 9

It can be seen that the generated keys $AD\prime$ and $AD_{}^{\ast }$, $S{K}^{\prime }$ and $S{K}^{\prime }$ match, so according to Theorem 1 and the flow relation, it can be concluded that:

$$\left(\begin{array}{c}(I{K}^{\prime }=IP{K}^A\wedge IP{K}^{\prime }=I{K}^B)\wedge (S_{\mathit{dh}}\prime =S_{\mathit{dh}}^{\ast }\wedge d{h}_1\prime =dh_1^{\ast }\wedge d{h}_2\prime =dh_2^{\ast }\wedge d{h}_3\prime =dh_3^{\ast }\wedge \\ d{h}_4\prime =dh_4^{\ast }\wedge (OTP{K}_{l\prime }^B\prime =OT{K}_l^B\Rightarrow l\prime =l)\wedge E{K}_i^A\prime =EP{K}_i^A\wedge SRP{K}^{\prime }=SR{K}_B)\\ \end{array}\right)$$ 10

In summary, it can be proved that $DEMatch(e_{13}\prime ,e_3)$, $Enc(e_{13}\prime )$ and $Dec(e_3)$ match.

In the case of the above analysis, there is an event $Rcv(e_1\prime )$ in the sequence $I_5$, and according to the receiving the axiom RSM, it can be known that there must be an event $E(Send)$ that matches $Rcv(e_1\prime )$. $I_1$-$I_5$, $S_3$, $R_1$-$R_5$ contain the event $E(Send)$, considering the validity of the protocol, the interaction of the protocol should be two or more parties, excluding $R_1$-$R_5$. the event $E(Send)$ of $I_1$-$I_5$ and the event $Rcv(e_1\prime )=<IP{K}^{\prime },SRP{K}^{\prime },S_0\prime ,OTP{K}_1^B\prime >$ cannot be one-to-one in structure, so it is excluded.

Suppose that there is an event $e$ matching $Rcv(e\prime )$ in $S_3$, it can be obtained.

$$\left(\begin{array}{c}{e}_0^{″}{<}_{\mathit{loc}}{e}_1^{″}{<}_{\mathit{loc}}{e}_2^{″}{<}_{\mathit{loc}}{e}_3^{″}\\ Del(e_0^{″})=<OTP{K}_l^{″}″>\wedge Send(e_1^{″})=<IP{K}^B,SRP{K}^B,S_0^{″},OTP{K}_l^{″}″>\wedge \\ Rcv(e_2^{″})=<B^{″}>\wedge Rcv(e_3^{″})=<B^{″},IP{K}^B,SRP{K}^B,S_0,OPT{K}_l^{″}″[n]>\\ \end{array}\right)$$ 11

According to the axiom RSM, $Rcv(e_0^{_{}^{″}})$ and $Rcv(e_1^{_{}^{″}})$ must have $E(Send)$ to match with them, so there are $I_1$-$I_5$, $S_3$,$R_1$-$R_5$ with the event $E(Send)$, and considering the actual interaction meaning of the protocol, $S_3$, $I_3$-$I_5$, $R_2$-$R_5$ are excluded. It can be seen that there are:

$$\left(RSMatch(e_0^{_{}^{″}},e_2)\wedge RSMatch(e_1^{_{}^{″}},e_0\prime )\right)$$ 12

It can be obtained that the event $Rcv(e_0^{_{}^{″}})$ matches the event $Send(e_2)$, and the event $Rcv(e_1^{_{}^{″}})$ matches the event $Send(e_0\prime )$. According to the flow relation, the event $Send(e_2^{_{}^{″}})$ parameters in $S_3$ can be obtained, and get:

$$\left(\begin{array}{c}Del(e_0^{_{}^{″}})=<OTP{K}_l^B>\wedge Send(e_1^{_{}^{″}})=<IP{K}^B,SRP{K}^B,S_0,OTP{K}_l^B>\wedge \\ Rcv(e_2^{_{}^{″}})=<B\prime >\wedge Rcv(e_3^{_{}^{″}})=<B,IP{K}^B,SRP{K}^B,S_0,OPT{K}^B[n]>\\ \end{array}\right)$$ 13

To sum up, $RSMatch(e_1\prime ,e_2^{_{}^{″}})$ can be proved, the events $Rcv(e_1\prime )$ and $Send(e_2^{_{}^{″}})$ match. After the above proof, the new basic sequence $I_5$ is deduced as follows:

$$\left(\begin{array}{c}Send(e_0\prime )=<B\prime >\wedge Rcv(e_1\prime )=<IP{K}^B,SRP{K}^B,S_0,OTP{K}_l^B>\\ Verify(e_2\prime )=<encode(SP{K}^B),IP{K}^B,S_0>\wedge GenKey(e_3\prime )=<E{K}_i^A\prime ,EP{K}_i^A\prime >\wedge \\ DH(e_4\prime )=<I{K}^A\prime ,SRP{K}^B,d{h}_1\prime >\wedge DH(e_5\prime )=<E{K}_i^A\prime ,IP{K}^B,d{h}_2\prime >\wedge \\ DH(e_6\prime )=<E{K}_i^A\prime ,SRP{K}^B,d{h}_3\prime >\wedge DH(e_7\prime )=<E{K}_i^A\prime ,OTP{K}_l^B,d{h}_4\prime >\wedge \\ Bond(e_8\prime )=<d{h}_1\prime ,d{h}_2\prime ,d{h}_3\prime ,d{h}_4\prime ,S_{\mathit{dh}}\prime >\wedge KDF(e_9\prime )=<S_{\mathit{dh}}\prime ,S{K}_A\prime >\wedge \\ Del(e_{10}\prime )=<E{K}_i^A\prime ,d{h}_1\prime ,d{h}_2\prime ,d{h}_3\prime ,d{h}_4\prime >\wedge Bond(e_{11}\prime )=<encode(I{K}^{\prime }),encode(IP{K}^B),AD\prime >\wedge \\ Enc(e_{12}\prime )=<m_0\prime ,<AD\prime ,S{K}_A\prime >,S_1\prime >\wedge Send(e_{13}\prime )=<IP{K}^{\prime },EP{K}_i^A\prime ,l,S_1\prime >\\ \end{array}\right)$$ 14

The basic sequence $R_5$ is as follows:

$$\left(\begin{array}{c}GenKey(e_0)=<<SR{K}^B,SRP{K}^B>,<OT{K}^B[n],OTP{K}^B[n]>>\wedge \\ Sign(e_1)=<encode(SP{K}^B),I{K}^B,S_0)\wedge Send(e_2)=<B,IP{K}^B,SRP{K}^B,S_0,OTP{K}_l^B>\wedge \\ Rcv(e_3)=<IP{K}^{\prime },EP{K}^{\prime },l,S_1\prime >\wedge DH(e_4)=<SR{K}_B,IP{K}^{\prime },d{h}_1\prime >\wedge \\ DH(e_5)=<I{R}_B,EP{K}_i^A\prime ,d{h}_2\prime >\wedge DH(e_6)=<SR{K}_B,EP{K}_i^A\prime ,d{h}_3\prime >\wedge \\ DH(e_7)=<OT{K}_l^B,EP{K}_i^A\prime ,d{h}_4\prime >\wedge Bond(e_8)=<d{h}_1\prime ,d{h}_2\prime ,d{h}_3\prime ,d{h}_4\prime ,S_{\mathit{dh}}\prime >\wedge \\ KDF(e_9)=<S_{\mathit{dh}}\prime ,S{K}^{\prime }>\wedge Del(e_{10})=<d{h}_1\prime ,d{h}_2\prime ,d{h}_3\prime ,d{h}_4\prime >\wedge \\ Bond(e_{11})=<encode(IP{K}^{\prime }),encode(I{K}^B),AD\prime >\wedge Dec(e_{12})=<m_0\prime ,<AD\prime ,S{K}^A>,S_1\prime >\wedge \\ Del(e_{13})=<OT{K}_l^B>\\ \end{array}\right)$$ 15

It is proved that A and B have two matching sessions during the execution of the protocol, and a shared key is generated, which satisfies the weak authentication, but to prove the strong authentication of agents also needs to prove the orderings $e_{13}\prime <e_3$, $e_2^{_{}^{″}}<e_1\prime$, $e_1^{_{}^{″}}<e_1\prime$, $e_0^{_{}^{″}}<e_2$. According to the above process of proving that events $e_{13}\prime$ and $e_3$ is matching session, we can get $e_{13}\prime <e_3$, then prove $e_2^{_{}^{″}}<e_1\prime$, $e_1^{_{}^{″}}<e_1\prime$, $e_0^{_{}^{″}}<e_2$. There is an event $e_2\prime$ in the basic sequence $I_5$, and according to the axiom VSM, there must be a sign event matching it. The sequence containing sign events is $R_1$-$R_5$, considering the sequence of protocol execution, and ignoring events that have not occurred, then excluding $R_2$-$R_5$, the only sequence containing sign event is only $R_1$. Then $VSMatch(e_1\prime ,e_1)$ can be obtained from the axiom VSM, the events $Verify(e_1\prime )$ match with $Sign(e_1)$, and there are $e_2<e_1\prime$, but $e_2^{_{}^{″}}<e_1\prime$, $e_1^{_{}^{″}}<e_1\prime$, $e_0^{_{}^{″}}<e_2$ are not sufficient conditions, then X3DH does not satisfy the strong authentication property, but only satisfies the weak authentication property.

Authentication proof of DR

In the Signal protocol, the X3DH protocol provides one-way authentication services for the initiator and the responder and provides an initial key for the subsequent interaction of the DR protocol. Its relation with the DR protocol is only that the shared key $\mathit{SK}$ is used as the initial root key in the DR protocol to generate message keys.

Figure 2 shows the nth round of DR protocol interaction. In the process of using LoET to analyze the DR protocol, each interaction of the protocol, that is, the success of the interaction in the symmetric ratchet phase is regarded as a one-way authentication of B to A or A to B. If the agent of the receiving message can successfully decrypt the message sent by the agent of the sending message, the authentication is successful; otherwise, the protocol does not satisfy the authentication. The relation between protocol interaction and authentication makes the protocol from the first interaction to the kth interaction regarded as the interaction of the protocol completion k/2 round, that is, the protocol completes the second two-way authentication k/2 times. So the protocol interaction has universal characteristics, analyzing the authentication of the first round of interaction in the protocol can deduce the authentication of (k/2)th round of interaction. The basic sequence of the initiator of the first round of the DR protocol is divided as follows:

$$\left(\begin{array}{c}I_1^{\ast }=genkey(RH{K}_0^A,RHP{K}_0^A),dh(RH{K}_0^A,SRP{K}^B,d{h}_{r1}),\\ kdf(d{h}_{r1},S{K}^A,<C{K}_{0,0}^{\mathit{IR}},R{K}_{0,0}^{\mathit{IR}}>),kdf(C{K}_{0,0}^{\mathit{IR}},<C{K}_{0,1}^{\mathit{IR}},M{K}_{0,0}^{\mathit{IR}}>),enc(m_1,M{K}_{0,0}^{\mathit{IR}},S_2)\\ I_2^{\ast }=I_1^{\ast },send(S_2,RHP{K}_0^A),del(C{K}_{0,0}^{\mathit{IR}},S{K}^A,M{K}_{0,0}^{\mathit{IR}})\\ I_3^{\ast }=I_2^{\ast },rcv(S_3,RHP{K}_0^B)\\ I_4^{\ast }=I_3^{\ast },dh(RH{K}_0^A,RHP{K}_0^A,d{h}_{r2}),kdf(d{h}_{r2},R{K}_{0,0}^{\mathit{IR}},<C{K}_{1,0}^{\mathit{IR}},R{K}_{1,0}^{\mathit{IR}}>,\\ kdf(C{K}_{1,0}^{\mathit{IR}},<C{K}_{1,1}^{\mathit{IR}},M{K}_{1,0}^{\mathit{IR}}>)),dec(m_2,M{K}_{1,0}^{\mathit{IR}},S_3),del(C{K}_{1,0}^{\mathit{IR}},R{K}_{0,0}^{\mathit{IR}},M{K}_{1,0}^{\mathit{IR}})\\ \end{array}\right)$$ 16

The basic sequence of the responder is divided as follows:

$$\left(\begin{array}{c}R_1^{\ast }=rcv(S_2,RHP{K}_0^A)\\ R_2^{\ast }=R_1^{\ast },dh(RHP{K}_0^A,SR{K}_B,dh_{r1}^{\ast }),kdf(dh_{r1}^{\ast },S{K}^B,<C{K}_{0,0}^{\mathit{RI}},R{K}_{0,0}^{\mathit{RI}}>),\\ kdf(C{K}_{0,0}^{\mathit{RI}},<C{K}_{0,1}^{\mathit{RI}},M{K}_{0,0}^{\mathit{RI}}>),dec(m_1,M{K}_{0,0}^{\mathit{RI}},S_2),del(C{K}_{0,0}^{\mathit{RI}},S{K}_B,M{K}_{0,0}^{\mathit{RI}})\\ R_3^{\ast }=R_2^{\ast },genkey(<RH{K}_0^B,RHP{K}_0^B>),dh(RH{K}_0^B,RHP{K}_0^A,dh_{r2}^{\ast }),\\ kdf(dh_{r2}^{\ast },R{K}_{0,0}^{\mathit{RI}},<C{K}_{1,0}^{\mathit{RI}},R{K}_{1,0}^{\mathit{RI}}>),kdf(C{K}_{1,0}^{\mathit{RI}},<C{K}_{1,1}^{\mathit{RI}},M{K}_{1,0}^{\mathit{RI}}>),\\ enc(m_2,M{K}_{1,0}^{\mathit{RI}},S_3),del(C{K}_{1,0}^{\mathit{RI}},R{K}_{0,0}^{\mathit{RI}},M{K}_{1,0}^{\mathit{RI}})\\ R_4^{\ast }=R_3^{\ast },send(S_3,RHP{K}_0^B)\\ \end{array}\right)$$ 17

The first round of the DR protocol is as follows $Protocol\left(\left[I_1^{\ast },I_2^{\ast },I_3^{\ast },I_4^{\ast },I_5^{\ast },R_1^{\ast },R_2^{\ast },R_3^{\ast },R_4^{\ast },R_5^{\ast },S_1^{\ast },S_2^{\ast },S_3^{\ast }\right]\right)$. Prove the authentication of A to B $DR|=auth(I_4^{\ast },2)$. Suppose there is an honest agent $A_{}^{\ast }$ executing thread $thr_1^{\ast }$, an honest agent $B_{}^{\ast }$ executing thread $thr_2^{\ast }$, and the agent follows the DR protocol. Thread $thr_1^{\ast }$ is an instance of $I_4^{\ast }$, then there is an event sequence $e_0^{\ast }{<}_{\mathit{loc}}e_1^{\ast }{<}_{\mathit{loc}}\dots {<}_{\mathit{loc}}e_{12}^{\ast }$ in the agent $A_{}^{\ast }$, for some Id, Atoms, Key type parameters $S_2$, $RH{K}_0^A$, $RHP{K}_0^A$, etc.:

$$\left(\begin{array}{c}e_0^{\ast }{<}_{\mathit{loc}}e_1^{\ast }{<}_{\mathit{loc}}\dots {<}_{\mathit{loc}}e_{12}^{\ast }\\ GenKey(e_0^{\ast })=<RH{K}_0^A,RHP{K}_0^A>\wedge DH(e_1^{\ast })=<RH{K}_0^A,SRP{K}^B,d{h}_{r1}>\wedge \\ KDF(e_2^{\ast })=<d{h}_{r1},S{K}^B,<C{K}_{0,0}^{\mathit{IR}},R{K}_{0,0}^{\mathit{IR}}>>\wedge KDF(e_3^{\ast })=<C{K}_{0,0}^{\mathit{IR}},<C{K}_{0,1}^{\mathit{IR}},M{K}_{0,0}^{\mathit{IR}}>>\wedge \\ Enc(e_4^{\ast })=<m_1,M{K}_{0,0}^{\mathit{IR}},S_2>\wedge Send(e_5^{\ast })=<S_2,RHP{K}_0^A>\wedge \\ Del(e_6^{\ast })=<C{K}_{0,0}^{\mathit{IR}},S{K}^A,M{K}_{0,0}^{\mathit{IR}}>\wedge Rcve_7^{\ast }=<S_3,RHP{K}_0^B>\wedge \\ DH(e_8^{\ast })=<RH{K}_0^A,RHP{K}_0^A,d{h}_{r2}>\wedge KDF(e_9^{\ast })=<d{h}_{r2},R{K}_{0,0}^{\mathit{IR}},<C{K}_{1,0}^{\mathit{IR}},R{K}_{1,0}^{\mathit{IR}}>>\wedge \\ KDF(e_{10}^{\ast })=<C{K}_{1,0}^{\mathit{IR}},<C{K}_{1,1}^{\mathit{IR}},M{K}_{1,0}^{\mathit{IR}}>>\wedge Dec(e_{11}^{\ast })=<m_2,M{K}_{1,0}^{\mathit{IR}},S_3>\wedge \\ Del(e_{12}^{\ast })=<C{K}_{1,0}^{\mathit{IR}},R{K}_{0,0}^{\mathit{IR}},M{K}_{1,0}^{\mathit{IR}}>\\ \end{array}\right)$$ 18

According to the rules of the axioms DEM and AxiomS, it can be deduced that the existence event $e_{}^{{\ast }^{\prime }}$ satisfies the formula $e_{}^{{\ast }^{\prime }}<e_{11}^{\ast }\wedge DEMatch(e_{}^{{\ast }^{\prime }},e_{11}^{\ast })\wedge loc(e_{}^{{\ast }^{\prime }})=B$. The honest agent B follows the DR protocol, then the event $e_{}^{{\ast }^{\prime }}$ must be an instantiation in the basic sequence of the DR protocol. It can be known that the basic sequence contains an event $E(Enc)$ including $I_1^{\ast }$, $I_2^{\ast }$, $I_3^{\ast }$, $I_4^{\ast }$, $R_3^{\ast }$, $R_4^{\ast }$. If $e_{}^{{\ast }^{\prime }}$ is an instantiation in the basic sequence $I_1^{\ast }$, $I_2^{\ast }$, $I_3^{\ast }$, $I_4^{\ast }$, then according to the actual meaning of the implementation of the protocol, there is $loc(e_{}^{{\ast }^{\prime }})=A\ne B$, which does not meet the requirements of $loc(e^{\prime })=B$, so it is excluded. If $e_{}^{{\ast }^{\prime }}$ is an instantiation event in the basic sequence $R_4$, then there are parameters such as $RH{K}_0^B$, $RHP{K}_0^B$, $SR{K}^B$ in agent A, and the event sequence $e_0^{\ast }\prime {<}_{\mathit{loc}}e_1^{\ast }\prime {<}_{\mathit{loc}}\dots {<}_{\mathit{loc}}e_{12}^{\ast }\prime$ can be expressed as follows:

$$\left(\begin{array}{c}e_0^{\ast }\prime {<}_{\mathit{loc}}e_1^{\ast }\prime {<}_{\mathit{loc}}\dots {<}_{\mathit{loc}}e_{12}^{\ast }\prime \\ Rcv(e_0^{\ast }\prime )=<S_2\prime ,RHP{K}_0^A\prime >\wedge DH(e_1^{\ast }\prime )=<RHP{K}_0^A\prime ,SR{K}^{\prime },dh_{r1}^{\ast }\prime >\wedge \\ KDF(e_2^{\ast }\prime )=<dh_{r1}^{\ast }\prime ,S{K}^{\prime },<C{K}_{0,0}^{\mathit{RI}}\prime ,R{K}_{0,0}^{\mathit{RI}}\prime >>\wedge KDF(e_3^{\ast }\prime )=<C{K}_{0,0}^{\mathit{RI}}\prime ,<C{K}_{0,1}^{\mathit{RI}}\prime ,M{K}_{0,0}^{\mathit{RI}}\prime >>\wedge \\ Dec(e_4^{\ast }\prime )=<m_1\prime ,M{K}_{0,0}^{\mathit{RI}}\prime ,S_2\prime >\wedge Del(e_5^{\ast }\prime )=<C{K}_{0,0}^{\mathit{RI}}\prime ,S{K}^{\prime },M{K}_{0,0}^{\mathit{RI}}\prime >\wedge \\ GenKey(e_6^{\ast }\prime )=<RH{K}_0^B\prime ,RHP{K}_0^B\prime >\wedge DH(e_7^{\ast }\prime )=<RH{K}_0^B\prime ,RHP{K}_0^A\prime ,dh_{r2}^{\ast }\prime >\wedge \\ KDF(e_8^{\ast }\prime )=<dh_{r2}^{\ast }\prime ,R{K}_{0,0}^{\mathit{RI}}\prime ,<C{K}_{1,0}^{\mathit{RI}}\prime ,R{K}_{1,0}^{\mathit{RI}}\prime >>\wedge KDF(e_9^{\ast }\prime )=<C{K}_{1,0}^{\mathit{RI}}\prime ,<C{K}_{1,1}^{\mathit{RI}}\prime ,M{K}_{1,0}^{\mathit{RI}}\prime >>\wedge \\ Enc(e_{10}^{\ast }\prime )=<m_2\prime ,M{K}_{1,0}^{\mathit{RI}}\prime ,S_3\prime >\wedge Del(e_{11}^{\ast }\prime )=<C{K}_{1,0}^{\mathit{RI}}\prime ,R{K}_{0,0}^{\mathit{RI}}\prime ,M{K}_{1,0}^{\mathit{RI}}\prime >\wedge \\ Send(e_{12}^{\ast }\prime )=<S_3\prime ,RHP{K}_0^B\prime >\\ \end{array}\right)$$ 19

Events $e_{11}^{\ast }$ and $e_{10}^{\ast }\prime$ in the above sequence satisfy:

$$\left(Enc(e_{10}^{{\ast }^{\prime }})=<m_2\prime ,M{K}_{1,0}^{\mathit{RI}}\prime ,S_3\prime >\wedge Dec(e_{11}^{\ast })=<m_2,M{K}_{1,0}^{\mathit{IR}},S_3>\Rightarrow DEMatch(e_{10}^{{\ast }^{\prime }},e_{11}^{\ast })\right)$$

The encryption event $e_{11}^{\ast }$ is matched with the decryption event $e_{10}^{\ast }\prime$, getting $m_1\prime =m_1$, $MatchingKeys(M{K}_{0,1}^{\mathit{IR}}\prime ,M{K}_{0,1}^{\mathit{RI}})$, $S_2\prime$ = $S_2$. According to Lemma 1, it can be known that $RHP{K}_0^B$ = $RHP{K}_0^B\prime$, then there is an event $Rcv(e_7^{\ast }\prime )=<S_3,RHP{K}_0^B>$ in the basic sequence $I_4$, which matches the event $Send(e_{12}^{\ast })=<S_3\prime ,RHP{K}_0^B\prime >$ in $R_4$.

If $e_{}^{{\ast }^{\prime }}$ is an instantiation of the basic sequence $R_3$, the reasoning process is similar to the instantiation reasoning process of $R_4$, but it cannot deduce the match between events $E(Send)$ and event $E(Rcv)$, so it is excluded, instantiation $R_4$ has:

$$\left(\begin{array}{c}Rcv(e_0^{\ast }\prime )=<S_2\prime ,RHP{K}_0^A\prime ,M{K}_{0,1}^{\mathit{IR}}\prime >\wedge DH(e_1^{\ast }\prime )=<RHP{K}_0^A\prime ,SR{K}^{\prime },dh_{r1}^{\ast }\prime >\wedge \\ KDF(e_2^{\ast }\prime )=<dh_{r1}^{\ast }\prime ,S{K}^{\prime },<C{K}_{0,0}^{\mathit{RI}}\prime ,R{K}_{0,0}^{\mathit{RI}}\prime >>\wedge KDF(e_3^{\ast }\prime )=<C{K}_{0,0}^{\mathit{RI}}\prime ,<C{K}_{0,1}^{\mathit{RI}}\prime ,M{K}_{0,0}^{\mathit{RI}}\prime >>\wedge \\ Dec(e_4^{\ast }\prime )=<m_1,M{K}_{0,0}^{\mathit{RI}},S_2>\wedge Del(e_5^{\ast }\prime )=<C{K}_{0,0}^{\mathit{RI}}\prime ,S{K}^{\prime },M{K}_{0,1}^{\mathit{RI}}>\wedge \\ GenKey(e_6^{\ast }\prime )=<RH{K}_0^B\prime ,RHP{K}_0^B\prime >\wedge DH(e_7^{\ast }\prime )=<RH{K}_0^B\prime ,RHP{K}_0^A\prime ,dh_{r2}^{\ast }\prime >\wedge \\ KDF(e_8^{\ast }\prime )=<dh_{r2}^{\ast }\prime ,R{K}_{0,0}^{\mathit{RI}}\prime ,<C{K}_{1,0}^{\mathit{RI}}\prime ,R{K}_{1,0}^{\mathit{RI}}\prime >>\wedge KDF(e_9^{\ast }\prime )=<C{K}_{1,0}^{\mathit{RI}}\prime ,<C{K}_{1,1}^{\mathit{RI}}\prime ,M{K}_{1,0}^{\mathit{RI}}\prime >>\wedge \\ Enc(e_{10}^{\ast }\prime )=<m_2\prime ,M{K}_{1,0}^{\mathit{RI}}\prime ,S_3\prime >\wedge Del(e_{11}^{\ast }\prime )=<C{K}_{1,0}^{\mathit{RI}}\prime ,R{K}_{0,0}^{\mathit{RI}}\prime ,M{K}_{1,0}^{\mathit{RI}}\prime >\wedge \\ Send(e_{12}^{\ast }\prime )=<S_3\prime ,RHP{K}_0^B\prime >\\ \end{array}\right)$$ 20

In terms of the instantiation result of an event $e_{}^{{\ast }^{\prime }}$ in the basic sequence $R_4$, it can be seen that there is an event $Dec(e_4^{\ast }\prime )$, and according to the rules of DEM and AxiomS, there must be some event $e_{}^{{\ast }^{\prime }}\prime$ satisfying $e_{}^{{\ast }^{\prime }}\prime <e_4^{\ast }\prime \wedge DEMatch(e_{}^{{\ast }^{\prime }}\prime ,e_4^{\ast }\prime )\wedge loc(e_{}^{{\ast }^{\prime }}\prime )=A$. The sequences with events $E(Enc)$ are $I_1^{\ast }$, $I_2^{\ast }$, $I_3^{\ast }$, $I_4^{\ast }$, $R_3^{\ast }$, $R_4^{\ast }$, and the sequences $I_3^{\ast }$, $I_4^{\ast }$, $R_3^{\ast }$, $R_4^{\ast }$ do not conform to the validity of the protocol, so they are excluded. If $e_{}^{{\ast }^{\prime }}\prime$ is an instantiation event in $I_2^{\ast }$, then the Id, Atoms, and Key type parameters have an event sequence $e_0^{\ast }_{}^{″}{<}_{\mathit{loc}}{e}_1{\ast }^{\prime }\prime {<}_{\mathit{loc}}\dots {<}_{\mathit{loc}}e_6^{\ast }_{}^{″}$, which is obtained as follows:

$$\left(\begin{array}{c}GenKey(e_0^{\ast }″)=<RH{K}_0^A″,RHP{K}_0^A″>\wedge DH(e_1^{\ast }″)=<RH{K}_0^A″,SRP{K}^B,dh_{r1}^{\ast }>\wedge \\ KDF(e_2^{\ast }″)=<d{h}_{r1},S{K}^A,<C{K}_{0,0}^{\mathit{IR}}″,R{K}_{0,0}^{\mathit{IR}}″>>\wedge \\ KDF(e_3^{\ast }″)=<C{K}_{0,0}^{\mathit{IR}}″,<C{K}_{0,1}^{\mathit{IR}}″,M{K}_{0,0}^{\mathit{IR}}″>>\wedge Enc(e_4^{\ast }″)=<m_1^{″},M{K}_{0,0}^{\mathit{IR}}″,S_2>\wedge \\ Send(e_5^{\ast }″)=<S_2,RHP{K}_0^A″>\wedge Del(e_6^{\ast }″)=<C{K}_{0,0}^{\mathit{IR}}″,S{K}^A,M{K}_{0,0}^{\mathit{IR}}″>\\ \end{array}\right)$$ 21

The instantiated events $e_4^{\ast }″$ and $e_4^{\ast }\prime$ in $I_2^{\ast }$ satisfy:

$$\left(Enc(e_4^{\ast ″})=<m_1,M{K}_{0,1}^{\mathit{IR}}″,S_2>\wedge Dec(e_4^{\ast }\prime )=<m_1\prime ,M{K}_{1,0}^{\mathit{RI}}\prime ,S_2\prime >\Rightarrow DEMatch(e_4^{\ast ″},e_4^{\ast }\prime )\right)$$

The encryption event $e_4^{\ast }″$ is matched with the decryption event $e_4^{\ast }\prime$, and $m_1$ = $m_1\prime$, $MatchingKeys(M{K}_{0,1}^{\mathit{IR}}\prime \prime ,M{K}_{1,0}^{\mathit{RI}}\prime )$, and $S_2^{″}$ = $S_2\prime$, and then according to Lemma 1, it can be known that $RHP{K}_0^A$ = $RHP{K}_0^A\prime$, then there is a matching $RSMatch(e_0^{\ast }\prime ,e_5^{\ast }″)$, and the event $Send(e_5^{\ast }″)$ matches the event $Rcv(e_0^{\ast }\prime )$.

Analysis procedure of $I_1^{\ast }$ is similar to $I_2^{\ast }$, but $E(Send)$ and $E(Rcv)$ can not be deduced, so it is excluded. The analysis process of $I_3^{\ast }$ and $I_4^{\ast }$ is consistent with that of $I_2^{\ast }$, but because of the order of sessions (the second session must occur after the first session), there is no need to consider the occurrence of the second session during the analysis of the first session, so exclude $I_3^{\ast }$, $I_4^{\ast }$. Therefore, the final $I_2^{\ast }$ has:

$$\left(\begin{array}{c}GenKey(e_0^{\ast }″)=<RH{K}_0^A″,RHP{K}_0^A″>\wedge DH(e_1^{\ast }″)=<RH{K}_0^A″,SRP{K}^B,d{h}_{r1}>\wedge \\ KDF(e_2^{\ast }″)=<d{h}_{r1},S{K}^A,<C{K}_{0,0}^{\mathit{IR}}″,R{K}_{0,0}^{\mathit{IR}}″>>\wedge KDF(e_3^{\ast }″)=<C{K}_{0,0}^{\mathit{IR}}″,<C{K}_{0,1}^{\mathit{IR}}″,M{K}_{0,0}^{\mathit{IR}}″>>\wedge \\ Enc(e_4^{\ast }″)=<m_1,M{K}_{0,0}^{\mathit{IR}}\prime ,S_2>\wedge Send(e_5^{\ast }″)=<S_2,RHP{K}_0^A\prime \prime >\wedge Del(e_6^{\ast }″)=<C{K}_{0,0}^{\mathit{IR}}\prime \prime ,S{K}^A,M{K}_{0,0}^{\mathit{IR}}\prime \prime >\\ \end{array}\right)$$ 22

The above proves that the DR protocol has two weak match sessions in the basic sequence $I_4^{\ast }$, and the strong match session also needs to prove that $e_{12}^{\ast }\prime$ < $e_7^{\ast }$ and $e_5^{\ast }″$ < $e_0^{\ast }\prime$. Based on the matching proof of $e_{12}^{\ast }\prime$ and $e_7^{\ast }$, according to the Lemma 1 of the key and the nonce axiom AxiomF, it can be known that the key $RHP{K}_0^B$ of the basic sequence $I_4^{\ast }$ must appear for the first time in the event $Rcve_7^{\ast }$, and $RHP{K}_0^B$ is generated from the instantiation event $GenKey(e_6^{\ast }\prime )$ of the basic sequence $R_4^{\ast }$, and is released for the first time in the event $Send(e_{12}^{\ast }\prime )$, proves that $e_{12}^{\ast }\prime$ < $e_7^{\ast }$.The proof of $e_5^{\ast }″$ is similar to that of $e_0^{\ast }\prime$, it can be proved that $e_5^{\ast }″$ < $e_0^{\ast }\prime$, so far there are two strong matching sessions, and the authentication $DR|=auth(I_4^{\ast },2)$ is obtained. The authentication proof of B is similar to that of A, which proves that it satisfies strong authentication.□

Finally, according to Theorem 5, the X3DH protocol, as the first-phase sub-protocol of the Signal protocol, does not meet the strong authentication, so the Signal protocol does not meet the strong authentication. The result is consistent with the result found in Ref.¹⁹ that the protocol may be attacked by the UKS. The defect of the Signal protocol is possible cause the server does not include signature data in the process of distributing the key, which renders the server susceptible to impersonation by malicious users. If the sending message sequence contains the server's signature of the initiator's identity, this defect can be avoided.

The X3DH protocol may be vulnerable to UKS attacks in practical application scenarios due to its lack of strong authentication. A UKS attack refers to a situation where a participant in the protocol establishes a shared session key with an adversary without verifying the identity of the interacting party, which can be considered a type of man-in-the-middle attack. From the perspective of a man-in-the-middle attack, there may be several potential modes of attack as follows:

1. The adversary intercepts the initiator's request for access to the server and applies for access to the server disguised as the initiator. The adversary intercepts the initiator's access request to prevent the server from receiving it and then impersonates the initiator to make a session request to the server. As a result, the message that the initiator receives back from the server is the one that the adversary expects.

2. The adversary utilizes messages from a previous session to impersonate the server and interact with the initiator. The adversary is able to store messages from the initiator's prior session, and when the initiator requests a new session from the server, the adversary, disguised as the server, relays those previous messages to the initiator.

3. The adversary impersonates the responder by sending data to the server for storage. By directly assuming the identity of the responder and registering with the server, the adversary ensures that any messages the initiator retrieves from the server are the ones the adversary intends for the initiator to receive. This leads to a situation where the responder, in subsequent interactions, mistakenly treats the adversary as the genuine responder.

4. The adversary sends a corresponding request to the server at the same time as the initiator sends an access request. Specifically, while the adversary requests access to the server, the initiator also sends an access request to the server. In this case, due to the two access requests, the server needs to respond twice. However, because the server's feedback lacks digital signature markings, the initiator cannot distinguish whether the received message is from their own request or the adversary's request. This situation may lead to the initiator receiving a message intended for the adversary.

Discussion

The proof process of the Signal protocol demonstrates that the extended LoET can be effectively applied to the security proof of DR protocols and composition protocols. LoET extends key predicates $\mathit{KRel}$ and $\mathit{KChain}$ for the DR structure. Predicate $\mathit{KRel}$ characterizes the relation between keys to capture the key chain that appears in the protocol, and predicate $\mathit{KChain}$ is used to establish the tree structure of the protocol's key chain based on this. The tree structure of the key chain abstracts the protocol's DR mechanism, and we propose axioms DEM, RSM, and VSM to achieve the security proof of the DR. Complex protocols are usually composed of multiple sub-protocols, and the security of a single protocol cannot meet the security properties of the composition protocol. Therefore, we propose a composition theorem to prove the security of the protocol composition by ensuring the security of the sub-protocols. Table 7 shows a comparison between this article and similar methods, indicating that the extended LoET has outstanding advantages in analyzing ratchet protocols and the properties of protocol composition. It can be effectively applied to the security proof of complex protocols. However, compared to methods Ref.^12,24,25,33, LoET lacks automated proof tools, and the proof process is more complex, which is not user-friendly for non-professionals.

Table 7.

Comparison of similarity methods.

Articles	Protocols	Analysis ability of ratchet structure	Analysis ability of composition	Find Attack	Tools
This Work	Signal	√	√	Unknown key-share attack	-
Ref.2	Signal	√	◊	None	-
Ref.8	CR	◊	◊	None	-
Ref.12	Signal	√	◊	Unknown key-share attack	Scyther
Ref.19	TextSecure	√	◊	Unknown key-share attack	-
Ref.24	NSB, NSL	◊	√	Man-in-the-middle attack	Spin
Ref.25	Signal	√	◊	Unknown key-share attack	Tamarin
Ref.31	RFIDs	√	◊	Impersonation attack	-
Ref.32	Toy	◊	◊	Temporary information attack Privilege insider attack Stolen smart card attack	-
Ref.33	MTProto 2.0	√	◊	Unknown key-share attack	ProVerif

Given that this article takes into account the ratchet structure of the Signal protocol and key exchange within protocol composition, the primary focus is on proofing the authentication of the Signal protocol. However, building upon the extensions made to the LoET, LoET is also equipped to demonstrate the security proof of a variety of protocols. Consequently, we present the conceptual approach of LoET in proving the security properties of other protocols in Table 8. It provides a succinct summary of the proofs of secrecy, integrity, and availability for the DTLS (Datagram Transport Layer Security) protocol, the proof of secrecy for the DTLS-SRTP (Secure Real-Time Transport Protocol), and the proof of integrity for the PUF (Physical Unclonable Functions) protocol.

Table 8.

Proof summary of multiple protocols.

Protocols	Security Properties	Proof Summary
DTLS	Secrecy, Integrity, Availability	Secrecy:                                                                                                                                                                                                                        (1)By employing Predicate $\mathit{KRel}$, ascertain which keys associated with the session key exist within the DTLS protocol and establish a key chain concerning the session key (2) Prove the direction of the secret key chain in (1) by Theorem 1 (3) Suppose that the key chain can be destroyed by the adversary, that is, the adversary can obtain a link in the key chain. According to Theorem 2, Theorem 3, and Theorem 4, it can be obtained that the key chain does not exist when the hypothesis is true, and the secrecy can be proved Integrity: (1) Determine the associated key of the encrypted data key by predicate $\mathit{KRel}$, and establish the key chain for protecting the data key (2) Theorem 2, lemma 1 is used to analyze whether the data protection key is released during the whole life cycle (3) Use axiom DEM, RSM, and VSM to prove that messages cannot be tampered with. Complete proof of the integrity of the DTLS protocol Availability: (1) Use $\mathit{Val}$ to extract the values of event Send and Rcv to get the protocol message structure (2) Use axioms DEM, RSM, and VSM. it is proved that Send event and Rcv event message structures are equivalent (3) The flow relation axiom is used to prove that the match events Send and Rcv in 2) have a sequential relation, with Send < Rcv. This proves the availability of the DTLS protocol
DTLS-SRTP	Secrecy	Secrecy: (1) Predicate $\mathit{KRel}$ is used to determine which keys related to the session key exist in the DTLS protocol and establish the key chain about the session key (2) Prove the direction of the DTLS protocol key chain in (1) by Theorem 1 (3) Suppose that the key chain can be destroyed by the adversary, that is, the adversary can obtain a link in the secret key chain. According to Theorem 2, Theorem 3, and Theorem 4, it is obtained that the key chain does not exist if the hypothesis is true (4) Use the same method to prove the secrecy of SRTP session keys, and then use Theorem 5 (Composition theorem) to prove that the sequential composition of DTLS protocol and SRTP protocol meets the secrecy. The secrecy of DLS-SRTP protocol is proven
PUF	Integrity	Integrity: (1) Predicate $\mathit{KRel}$ is used to determine the key related to the encrypted data in the PUF protocol, and predicate $\mathit{KChain}$ is used to establish the one-way key chain of the protocol (2) Use lemma 1 to determine that the key in the one-way key chain is not released during the lifetime (3) Use axiom DEM and RSM to prove that there are match events Send and Rcv in PUF protocol (4) Then prove the existence of a digital signature in the message by axiom VSM. By (2) there is no released key in the obtained key chain, so the adversary cannot construct the same digital signature. Complete proof of the integrity of PUF protocol

Conclusion and future work

We achieve the formal analysis of the DR structure and protocol composition characteristics of Signal protocol by extending LoET. For the DR structure of Signal, predicates $\mathit{KRel}$ and $\mathit{KChain}$ are extended to facilitate its formal abstract representation. The predicate $\mathit{KRel}$ is capable of expressing the interrelation between keys during the ratchet generation process, while the predicate $\mathit{KChain}$ delineates the ratchet trace, that is, describes generation of key chain during the ratchet turns. Meanwhile, the axioms DEM, RSM, and VSM, along with a set of theorems and lemmas, facilitate the security proof of the ratchet structure. Our approach is applicable to the formal analysis of the DR structure, with the core focus on establishing key relations and the ratchet trace, which can clearly depict the switching and continuous operation of the ratchet within the Signal protocol. The Signal protocol is a sequential composition of the X3DH protocol and the DR protocol. The DR mechanism resides within the DR protocol, with the output of the X3DH protocol serving as the initial input for the DR protocol. Therefore, the DR mechanism cannot guarantee the security of the entire protocol, necessitating a composition analysis of the sub-protocols within Signal. To address this, this article extends the composition theorem to achieve a composition analysis of the Signal protocol. The extended LoET is used to analyze Signal, the result shows that the Signal protocol cannot resist UKS attack in the X3DH phase because the registration session of X3DH is not signed effectively, so the server is susceptible to impersonation by adversaries. Therefore, including the server's signature of the long-term key during the registration session can solve this problem.

The LoET doesn't support the analysis and proof of group protocols. However, group communication services do exist universally, such as multi-server systems, audio/video conferencing, and various collaboration applications that need to support dynamic groups. As a special communication group, the relation of group members in dynamic groups can change frequently and generally adopt one-to-many or many-to-many, rather than one-to-one communication mode. This situation makes the security mechanism of dynamic groups very complicated. So, the future work we will start from the above point.

Author contributions

Z.H. provided ideas and wrote the first draft, M.X. supervised the entire project process and gave methodological guidance, Z.H., M.H. and R.H. revised the first draft, Z.H. and R.H. wrote the experimental code, M.H. integrated the experimental data. All authors reviewed the manuscript.

Funding

This research was funded by the National Natural Science Foundation of China, Grant Number 62362033, 61962020), Double Thousand Talent Plan of Jiangxi Province (No. jxsq2023201009), Natural Science Foundation of Jiangxi Province (No. 20224ACB202006).

Data availability

All data generated or analyzed during this study are included in this published article.

Competing interests

The authors declare no competing interests.

Ethical approval

This article does not contain any studies with human participants or animals performed by any of the authors.

Supplementary Information

The online version contains supplementary material available at 10.1038/s41598-024-71666-y.