Skip to main content
SpringerLink
Log in

Clarification of Ambiguity for the Simple Authentication and Security Layer

  • Conference paper
  • First Online:
Abstract State Machines, Alloy, B, TLA, VDM, and Z (ABZ 2018)

Part of the book series: Lecture Notes in Computer Science ((LNTCS,volume 10817))

Abstract

The Simple Authentication and Security Layer (SASL) is a framework for enabling application protocols to support authentication, integrity and confidentiality services. The SASL was originally specified in RFC 2222, and later updated in RFC 4422, using natural language. However, due to the richness of natural language this involves ambiguities and imprecision. Whilst there is an Oracle implementation of SASL, its documentation also contains informal descriptions and under-defined specifications of the RFCs. This paper provides clarification of ambiguity in SASL using Abstract State Machines (ASMs). This clarification is based on two ASM essential notions: a ground model to capture the intended SASL behavior in an understandable way, and a refinement notion to accurately explicate the ambiguous parts of the behavior. We also show some differences between RFCs and the description of the Oracle implementation. We believe our work can serve as a basis for further implementation and for formal analysis.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    http://asmeta.sourceforge.net/.

  2. 2.

    All the rules for the refined model that is based on RFC 2222/4422 are available online at https://doi.org/10.5281/zenodo.1204257, while for the refined model which is based on the description of Oracle implementation documentation are available at https://doi.org/10.5281/zenodo.1204242.

  3. 3.

    The full ground models are available online at https://doi.org/10.5281/zenodo.1200216.

References

  1. The CoreASM Project. http://www.coreasm.org/

  2. Al-Shareefi, F., Lisitsa, A., Dixon, C.: Abstract state machines and system theoretic process analysis for safety-critical systems. In: Cavalheiro, S., Fiadeiro, J. (eds.) SBMF 2017. LNCS, vol. 10623, pp. 15–32. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-70848-5_3

    Chapter  Google Scholar 

  3. Arcaini, P., Holom, R.M., Riccobene, E.: ASM-based formal design of an adaptivity component for a Cloud system. Formal Aspects Comput. 28(4), 567–595 (2016)

    Article  MathSciNet  Google Scholar 

  4. Bella, G., Riccobene, E.: Formal analysis of the Kerberos authentication system. J. Univers. Comput. Sci. 3(12), 1337–1381 (1997)

    MATH  Google Scholar 

  5. Bishop, S., Fairbairn, M., Norrish, M., Sewell, P., Smith, M., Wansbrough, K.: Engineering with logic: HOL specification and symbolic-evaluation testing for TCP implementations, pp. 55–66. ACM Press (2006)

    Article  Google Scholar 

  6. Börger, E., Stärk, R.: Abstract State Machines: A Method for High-Level System Design and Analysis. Springer, Heidelberg (2003). https://doi.org/10.1007/978-3-642-18216-7

    Book  MATH  Google Scholar 

  7. Chelemen, R.M.: Modeling a web application for cloud content adaptation with ASMs. In: International Conference on Cloud Computing and Big Data (CloudCom-Asia), pp. 44–55. IEEE (2013)

    Google Scholar 

  8. Froome, P., Monahan, B.: The role of mathematically formal methods in the development and assessment of safety-critical systems. Microprocess. Microsyst. 12(10), 539–546 (1988)

    Article  Google Scholar 

  9. Gargantini, A., Riccobene, E., Scandurra, P.: Model-driven language engineering: the ASMETA case study. In: The Third International Conference on Software Engineering Advances, ICSEA, pp. 373–378. IEEE (2008)

    Google Scholar 

  10. Gargantini, A.M., Riccobene, E., Scandurra, P.: A metamodel-based language and a simulation engine for abstract state machines. J. Univ. Comput. Sci. 14(12), 1949–1983 (2008)

    Google Scholar 

  11. Gurevich, Y.: Evolving algebras 1993: Lipari guide. In: Specification and Validation Methods, pp. 9–36. Oxford University Press (1995)

    Google Scholar 

  12. Leach, P., Newman, C.: Using Digest Authentication as a SASL Mechanism. RFC 2831 (2000)

    Google Scholar 

  13. Melnikov, A., Zeilenga, K.: Simple Authentication and Security Layer (SASL). RFC 4422 (2006)

    Google Scholar 

  14. Myers, J.: Simple Authentication and Security Layer (SASL). RFC 2222 (1997)

    Google Scholar 

  15. Oracle: Writing applications that use SASL. In: Developer’s Guide to Oracle Solaris®11 Security, Chap. 7, pp. 126–148. Oracle (2012)

    Google Scholar 

  16. Oracle: Java SASL API Programming and Deployment Guide. In: Java Platform, Standard Edition Security Developers Guide, Chap. 10, pp. 21–28. Oracle (2016)

    Google Scholar 

  17. Rosenzweig, D., Runje, D., Slani, N.: Privacy, abstract encryption and protocols: an ASM model - part I. In: Börger, E., Gargantini, A., Riccobene, E. (eds.) ASM 2003. LNCS, vol. 2589, pp. 372–390. Springer, Heidelberg (2003). https://doi.org/10.1007/3-540-36498-6_22

    Chapter  MATH  Google Scholar 

  18. Siemborski, R., Gulbrandsen, A.: IMAP Extension for Simple Authentication and Security Layer (SASL) Initial Client Response. RFC 4959 (2007)

    Google Scholar 

  19. Siemborski, R., Melnikov, A.: SMTP Service Extension for Authentication Initial Client Response. RFC 4954 (2007)

    Google Scholar 

  20. Zeilenga, K.: The PLAIN Simple Authentication and Security Layer (SASL) Mechanism. RFC 4616 (2006)

    Google Scholar 

Download references

Acknowledgments

The third author was partially supported by the EPSRC funded RAI Hub FAIR-SPACE (EP/R026092/1).

Author information

Authors and Affiliations

  1. Department of Computer Science, University of Liverpool, Liverpool, L69 3BX, UK

    Farah Al-Shareefi, Alexei Lisitsa & Clare Dixon

Authors
  1. Farah Al-Shareefi
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Alexei Lisitsa
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Clare Dixon
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Farah Al-Shareefi .

Editor information

Editors and Affiliations

  1. University of Southampton, Southampton, United Kingdom

    Michael Butler

  2. Universität Ulm, Ulm, Germany

    Alexander Raschke

  3. University of Southampton, Southampton, United Kingdom

    Thai Son Hoang

  4. Thales Austria GmbH, Vienna, Austria

    Klaus Reichl

Rights and permissions

Reprints and permissions

Copyright information

© 2018 Springer International Publishing AG, part of Springer Nature

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Al-Shareefi, F., Lisitsa, A., Dixon, C. (2018). Clarification of Ambiguity for the Simple Authentication and Security Layer. In: Butler, M., Raschke, A., Hoang, T., Reichl, K. (eds) Abstract State Machines, Alloy, B, TLA, VDM, and Z. ABZ 2018. Lecture Notes in Computer Science(), vol 10817. Springer, Cham. https://doi.org/10.1007/978-3-319-91271-4_13

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-91271-4_13

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-91270-7

  • Online ISBN: 978-3-319-91271-4

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation