Logical Analysis and Verification of Cryptographic Protocols - Loria

94 CHAPTER 4. PROTOCOLS WITH VULNERABLE SIGNATURE SCHEMES
a new pair of secret and public keys (Sk”(pk, s), P k”(pk, s)), a new message m ′
(m ′ = f(pk, s)) such that the verification of s with respect to the new message m ′
and the new public key succeeds. We assume that FDEO = FDEOpub ∪ FDEOpri
where FDEOpub = {sig, ver, Sk”, P k”, f, 1} and FDEOpri = {Sk, P k}.
In addition to the signature FDEO, and as described in Chapter 2, we make
use of an infinite set of variables X and an infinite set of constants C.
The destructive exclusive ownership vulnerability property is represented
by the following equational theory, denoted by HDEO:
⎧
⎨ ver(x, sig(x, Sk(y)), P k(y)) = 1
HDEO = ver(x, sig(x, Sk”(y1, y2)), P k”(y1, y2)) = 1
⎩
sig(f(P k(y), sig(x, Sk(y))), Sk”(P k(y), sig(x, Sk(y))) = sig(x, Sk(y))
The intruder system we consider to analyse our class of cryptographic protocols
is given as follows:
with:
⎧
⎪⎨
⎪⎩
IDEO = 〈FDEO, TDEO, HDEO〉
FDEO = FDEOpub ∪ FDEOpri
FDEOpub = {sig, ver, Sk”, P k”, f, 1}
FDEOpri = {Sk, P k}
TDEO = {sig(x, y), ver(x, y, z), Sk”(x, y), P k”(x, y), f(x, y), 1}
The associated set of intruder deduction rules, denoted by LDEO is given as
follows:
⎧
x, y → sig(x, y)
⎪⎨
x, y, z → ver(x, y, z)
x, y → Sk”(x, y)
LDEO =
x, y → P k”(x, y)
⎪⎩
x, y → f(x, y)
∅ → 1
In what follows, we introduce the rewrite system, RDEO, generating the equational
theory HDEO, and we prove that RDEO is convergent. The rewrite system
RDEO is obtained by applying Knuth-Bendix completion procedure [131] on
HDEO. This completion procedure is described in Chapter 2, at Section 2.1.6.
Lemma 28 HDEO is generated by the convergent rewriting system:
⎧
⎪⎨
ver(x, sig(x, Sk(y)), P k(y)) → 1
ver(x, sig(x, Sk”(y1, y2)), P k”(y1, y2)) → 1
RDEO =
⎪⎩
ver(f(P k(y), sig(x, Sk(y))), sig(x, Sk(y)), P k”(P k(y), sig(x, Sk(y)))) → 1
sig(f(P k(y), sig(x, Sk(y))), Sk”(P k(y), sig(x, Sk(y)))) → sig(x, Sk(y))