  Internet browsers use security protocols to protect sensitive messages. An
inductive analysis of TLS (a descendant of SSL 3.0) has been performed using
the theorem prover Isabelle. Proofs are based on higher-order logic and make no
assumptions concerning beliefs or finiteness. All the obvious security goals
can be proved; session resumption appears to be secure even if old session keys
have been compromised. The proofs suggest minor changes to simplify the
analysis. TLS, even at an abstract level, is much more complicated than most
protocols that researchers have verified. Session keys are negotiated rather
than distributed, and the protocol has many optional parts. Nevertheless, the
resources needed to verify TLS are modest: six man-weeks of effort and three
minutes of processor time.
