Predicting New Attacks: A Case Study in Security Analysis of Cryptographic Protocols

Knowledge about attacks is a necessary foundation for security analysis of information systems or cryptographic protocols. Current security verification methods for improving the security of target systems or the soundness of cryptographic protocols has limitations because they are all based on the assumptions from known attacks, while the attackers are trying every possible attacks against the information systems. Once a new-style attack was found by adversaries earlier, it would bring severe loss to the target systems. Therefore, it is essential to understand and take measures against new attacks previously. A new method has been proposed for predicting new attacks, but it lacks experimental results to prove its effectiveness. This paper confirms the effectiveness of the proposed method by a rediscovery experiment that shows several known attacks on cryptographic protocols rediscovered successfully. The paper also shows issues of the approach for predicting new attacks.