Logical Analysis and Verification of Cryptographic Protocols - Loria

112 CHAPTER 5. SATURATED DEDUCTION SYSTEMS
additional criterion is needed, in the sense that there exists deduction
systems on which the saturation algorithm terminates, but for which
the general reachability problems are undecidable. Another contribution
of this chapter is a decidability result of the ground reachability
problems for the theory of blind signature [136] using the initial definition
of subterm introduced in [10, 31], a similar result was given
in [9] using an extended definition of subterm. In [91], another decidability
result has been obtained for the class of cryptographic protocols
with blind signature schemes. This result has been obtained
using a different technique than the one followed in this chapter: in
[91], the authors showed the decidability of a fragment of first order
logic and used this result to obtain the decidability for the class of
cryptographic protocols using blind signature schemes. In addition
we give a decidability result to the general reachability problems for
a class of subterm convergent equational theories, while a more general
result was given in [31], the proof given in this chapter for our
special case is much shorter.
Outline. In section 5.1, we introduce the basic notions we use in this
chapter. We introduce the finite variant property in section 5.2.1, and
in section 5.2.2 we give some examples of equational theories having
finite variant property. We introduce the saturation algorithm in
Section 5.3.1 and show its properties in section 5.3.2. We give in section
5.4 an algorithm to solve reachability problems. We show the
decidability of the ground reachability problem in section 5.5.1, and
the decidability of the general reachability problem in section 5.5.3.
Some application of our results are shown in section 5.6. We show
in section 5.7 the decidability of the ground reachability problems for
the blind signature theory, and in section 5.8, we show the decidability
of the ground reachability problems for the subterm convergent
theories.
5.1 The model
To analyse cryptographic protocols, we follow in this chapter the symbolic
model described in Chapter 2. To this end, we assume an infinite set of variables
X , an infinite set of constants C, a set of function symbols F. In addition
to what is already intoducted in Chapter 2, we make use here of some additional
notions that we will show next. Given an equational theory H ′ , and rewrite system
R, rewriting modulo H ′ , also called equational rewriting, is the relation →H ′ \R
defined as follows: given two terms s, t, we have s →H ′ \R t if and only if there