Logical Analysis and Verification of Cryptographic Protocols - Loria

100 CHAPTER 4. PROTOCOLS WITH VULNERABLE SIGNATURE SCHEMES
We conclude that D does not use rules in LI” \ LI ′. This yields the reciprocal
of the lemma. �
The next lemma proves that, for any set of terms E in normal form and any
term t in normal form, if t ∈ E I” then there is a I”-derivation starting from E of
goal t such that for any rule � l → r applied in the derivation with the substitution
σ, the instances, with respect to σ, of the non variable terms in � l belong to E, and
hence are not the result of another deduction rules.
We make use of Cons(D) to denote the set of terms constructed during the
derivation D, more formally, let E and t be respectively a set of terms and a
term in normal form and let D be a derivation starting from E of goal t, D : E =
E0 → E0, t1 → . . . → En−2, tn−1 → En−1, t, Cons(D) = E0 ∪ {t1, . . . , tn−1}.
Lemma 32 Let E (respectively t) be a set of terms (respectively a term) in normal form.
If t ∈ E I” , then for every I”-derivation D starting from E of goal t, we have either D
satisfies the following property
prop : for all I” rules � l → r applied with substitution σ, for all s ∈ � l \ X , we have
sσ ∈ E
or there exists another I”-derivation D ′ starting from E of goal t such that Cons(D) =
Cons(D ′ ) and D ′ satisfies the property prop.
PROOF.
We have t ∈ E I” implies that the set Ω(E, t) of I”-derivations starting from
E of goal t is not empty. Let D ∈ Ω(E, t), D : E = E0 → E1 → . . . → En−1, t,
and suppose that D does not satisfy the property prop. we denote � li → ri the
rule applied at step i with the substitution σ. Let us (pre-)order derivations
in Ω(E, t) with a measure M such that M(D ′ ) for a derivation D ′ is a multiset
of integers constructed as follows: starting with M(D ′ ) = ∅, for all steps k,
1 ≤ k ≤ n, for every term u ∈ lkσ obtained by former rule, add k to M(D ′ ).
Since this pre-order is well-founded, there exists a derivation d ∈ Ω(E, t) such
that M(d) is minimum, and Cons(d) = Cons(D). Let us prove that d satisfies
the property prop. By contradiction, assume that d does not satisfy prop and let
j be the first step in d such that � lj → rj is the rule applied with substitution σ
and there is a term u ∈ � lj \ X obtained by a former rule, let � lh → rh be this rule.
Since u /∈ X , Closure can be applied on � lh → rh and � lj → rj and the resulting
rule can be applied at step j instead of � lj → rj yielding also Ej. Let d ′ be the
derivation obtained after this replacement, d ′ ∈ Ω(E, t) and Cons(d ′ ) = Cons(d).
Since h < j and by definition of M, we have M(d ′ ) < M(d) which contradicts
the minimality of M(d). We deduce that d satisfies prop and then we have the
lemma. �