Logical Analysis and Verification of Cryptographic Protocols - Loria

102 CHAPTER 4. PROTOCOLS WITH VULNERABLE SIGNATURE SCHEMES
while θ is a substitution in normal form (the construction of θ is shown in
Definition 28). Since C ′ is I”-satisfiable there exists a normal substitution
σ ′ such that (viθ)↓σ ′ ∈ (Eiθ)↓σ ′I”
implies that (viθσ ′ )↓ ∈ (Eiθσ ′ )↓ I
and thus (viθσ ′ )↓ ∈ (Eiθσ ′ )↓ I”
, which
(Lemma 31). Let σ = (θσ ′ )↓, we have that
(viσ)↓ ∈ (Eiσ)↓ I
, and by construction of θ, we have that θ |=H U, and hence
σ |=H U which concludes the proof. �
Figure 4.2 System of transformation rules.
Apply :
Cα, E ⊲ t, Cβ
(Cα, (E ⊲ y)y∈lx , Cβ)σ
Unif :
lx, l1, . . . , ln → r ∈ LI” and lx �
⊆ X , t /∈ X
e1, . . . , en ∈ E and σ = mgu(
Cα, E ⊲ t, Cβ
(Cα, Cβ)σ
u, t /∈ X
u ∈ E, σ = mgu(u ? = ∅ t)
(ei ? = ∅ li)i, r ? = ∅ t
Second step: Transformation in solved form. We give now the rules that simplify
a modified constraint system. These rules are given in Figure 4.2. Our
goal is to transform C ′ , the modified constraint system obtained from C at
the end of Step 1, into a modified constraint system in solved form.
The next Lemma shows that the application of a rule from Figure 4.2 on a
modified constraint system outputs a modified constraint system.
Lemma 35 Let C ′ be a modified constraint system. The application of Apply and Unif
rules on C ′ outputs a modified constraint system.
PROOF.
Let C ′ = (E1 ⊲ t1, . . . , En ⊲ tn) be a modified constraint system. Definition
22 (Chapter 2) implies that Ei ⊆ Ei+1 and V ar(Ei) ⊆ V ar({t1, . . . , ti−1}) for i ∈
{1, . . . , n}. Assume C ′ = (E1 ⊲ x1, . . . , Ei−1 ⊲ xi−1, Ei ⊲ ti, Ei+1 ⊲ ti+1, . . . , En ⊲ tn)
with ti /∈ X , and let us prove that the application of Apply and Unif rules on C ′
outputs a modified constraint system.
Unif rule. The application of Unif on C ′ outputs C” = (E1σ ⊲ x1σ, . . . , Ei−1σ ⊲
xi−1σ, Ei+1σ ⊲ ti+1σ, . . . , Enσ ⊲ tnσ) with σ = mgu(u ? =∅ ti), u ∈
Ei \ X . Ej ⊆ Ej+1 implies Ejσ ⊆ Ej+1σ. We prove next that
V ar(Ejσ) ⊆ V ar(x1σ, . . . , xi−1σ, ti+1σ, . . . , tj−1σ). Actually, we have
V ar(Ej) ⊆ V ar(x1, . . . , xi−1, ti, . . . , tj−1). This implies that V ar(Ejσ) ⊆
V ar(x1σ, . . . , xi−1σ, tiσ, ti+1σ, . . . , tj−1σ). We have that tiσ = uσ and u ∈ Ei,
thus V ar(tiσ) = V ar(uσ) ⊆ V ar(Eiσ) ⊆ V ar({x1σ, . . . , xi−1σ}). This implies
that V ar(Ejσ) ⊆ V ar(x1σ, . . . , xi−1σ, ti+1σ, . . . , tj−1σ), and hence, the
application of Unif rule on C ′ outputs a modified constraint system.
�
)