Logical Analysis and Verification of Cryptographic Protocols - Loria

134 CHAPTER 5. SATURATED DEDUCTION SYSTEMS
modified constraint system C is transformed into
(Cα, (E ⊲ y)y∈lx\{x}, E ⊲ x, E ∪ {x} ⊲ t, C ′ β )σ
= Cασ, (Eσ ⊲ yσ)y∈lx\{x}, Eσ ⊲ x, Eσ ∪ {x} ⊲ tσ, C ′ β σ
≡ Cασ, (Eσ ⊲ yσ)y∈lx\{x}, Eσ ⊲ x, Eσ ⊲ tσ, Cβσ
≡ Cασ, (Eσ ⊲ yσ)y∈lx\{x}, Eσ ⊲ tσ, Cβσ
where the first ≡ is by Lemma 9, and the second one by Lemma 10.
Thus the resulting system is equivalent for solutions to one in which
lx ⊆ V ar(l1, . . . , ln). We can then apply the same reasoning as above.
�
We may now conclude by applying the previous results and again König’s
Lemma.
Theorem 12 Let I0 = 〈F, L0, H〉 be a deduction system such that the saturation of L0
terminates , and the resulting deduction system is contracting. Then the I0-reachability
problem is decidable.
PROOF.
It suffices to prove that the application of rules of Fig. 5.3 terminates. Assume
there exists a modified I ′ -constraint system C and an infinite sequence of
transformations starting from C. Let C1, . . . , Cn, . . . be the resulting sequence of
modified constraint systems. By Lemma 50, at each step nbv(Ci) ≥ nbv(Ci+1) and
if there is equality, then the substitution applied on Ci is the identity (does not instantiate
the variables of C). Since we must have a positive number of variables,
there is only a finite number of steps where the substitution is not the identity.
Let Cn be the last obtained modified constraint system with nbv(Cn−1) > nbv(Cn).
Since all subsequent transformation do not instantiate the variables of Cn and its
successor, the sequence has only a finite number of different modified constraint
systems.
Since L ′ is finite, each modified constraint system has only a finite number
of successors. Thus by König Lemma there is only a finite number of different
modified constraint systems. �
5.6 Applications: some relevant equational theories
We give here some examples of well-known equational theories where the saturation
applied on the corresponding initial set of deduction rules terminates.
5.6.1 Dolev-Yao theory with explicit destructors
The Dolev-Yao theory with explicit destructors is the classical Dolev-Yao model
with explicit destructors such as decryption and projections. This theory is
given by the following set of equations: