Formal Verification Case

Provable Detection of Pre-Authentication Resource Amplification

A FikreSekhel prototype case showing how attacker-controlled cryptographic cost parameters can be modeled, verified, and exposed through machine-checkable counterexamples before they become operational failures.

The challenge

Expensive cryptography before trust is established.

Security-critical systems often process request metadata, ciphertext headers, or protocol parameters before authentication is complete. If those values influence computational cost, an attacker may be able to amplify resource consumption without needing valid credentials.

No unauthenticated attacker-controlled parameter should be able to make the system exceed the declared computational cost budget.
Why it matters

Testing finds examples. Formal models expose classes of failure.

Traditional testing can show how a system behaves for selected inputs. This case instead translates the security requirement into a structured model and asks whether any admissible attacker-controlled value can violate the declared computational budget.

Operational impact

A design-level weakness becomes an actionable engineering fact.

The result is not a generic warning. The model identifies the unsafe parameter, its trust boundary, whether it is authenticated, and the exact cost condition that breaks the property.

Our approach

From requirement to verifiable evidence.

FikreSekhel modeled the requirement as an intermediate representation, verified the property against safe and vulnerable variants, and generated structured evidence suitable for dashboards, reports, and platform ingestion.

01
Define the property Express the expected security behavior as a precise claim.
02
Model assumptions Represent attacker control, authentication state, and cost limits.
03
Verify the model Check whether any admissible state violates the property.
04
Produce evidence Return machine-readable results and concrete counterexamples.
Verification summary

One safe model proven. One vulnerable model violated.

Model Property type Status Meaning
Safe requirement model crypto_budget Proven No unauthenticated attacker-controlled parameter exceeds the declared budget.
Vulnerable requirement model crypto_budget Violated A concrete counterexample demonstrates how the declared budget can be exceeded.
Counterexample

Attacker-controlled KDF iterations exceed the allowed cost budget.

The vulnerable model allows an unauthenticated attacker to control kdf_iterations, driving computational cost far beyond the declared maximum.

Parameter kdf_iterations
Source attacker
Authenticated false
Max value 1000000
Cost factor 1
Possible cost 1000000
Max cost 100
Result violated
Recommended controls

Turning the counterexample into remediation.

Reject unsafe inputs Reject attacker-controlled computational parameters before authentication.
Bind cost to policy Use fixed or policy-bound KDF parameters.
Validate early Validate cryptographic cost parameters before expensive processing.
Limit abuse Apply rate limiting before expensive cryptographic operations.
Protect metadata Authenticate or integrity-protect headers before using them to drive cost.
Research with operational impact

Verify the properties your security depends on.

FikreSekhel helps teams transform security requirements into formal models, expose design-level weaknesses, and generate evidence that engineering, security, and risk teams can act on.

Discuss a verification project