Logical Analysis and Verification of Cryptographic Protocols - Loria
Logical Analysis and Verification of Cryptographic Protocols - Loria
Logical Analysis and Verification of Cryptographic Protocols - Loria
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
136 CHAPTER 5. SATURATED DEDUCTION SYSTEMS<br />
The initial<br />
⎧<br />
set <strong>of</strong> deduction rules is given by the following set <strong>of</strong> rules:<br />
⎪⎨<br />
L0 =<br />
⎪⎩<br />
x, y → sig(x, y),<br />
x, y, z → ver(x, y, z),<br />
x, y → Sk ′ (x, y),<br />
x, y → P k ′ (x, y),<br />
∅ → 1.<br />
The saturation (modulo the simplification introduced in Section 5.4) outputs<br />
the following<br />
⎧<br />
set <strong>of</strong> deduction rules:<br />
L ′ ⎪⎨<br />
= L0 ∪<br />
⎪⎩<br />
x, sig(x, Sk(y)), P k(y) → 1,<br />
x, sig(x, Sk ′ (y1, y2)), P k ′ (y1, y2) → 1,<br />
x, sig(x, Sk(y)), P k ′ (P k(y), sig(x, Sk(y))) → 1,<br />
x, Sk ′ (P k(y), sig(x, Sk(y))) → sig(x, Sk(y)),<br />
Sk(y), P k(y) → 1,<br />
Sk ′ (y1, y2), P k ′ (y1, y2) → 1,<br />
x, Sk(y), P k ′ (P k(y), sig(x, Sk(y))) → 1,<br />
x, P k(y), sig(x, Sk(y)) → sig(x, Sk(y)),<br />
x, P k(y), Sk(y) → sig(x, Sk(y)),<br />
y1, y2, P k ′ (y1, y2) → 1,<br />
x, y1, y2, sig(x, Sk ′ (y1, y2)) → 1,<br />
y1, y2, Sk ′ (y1, y2) → 1,<br />
x, P k(y), sig(x, Sk(y)) → 1,<br />
x, P k(y), Sk(y), sig(x, Sk(y)) → 1,<br />
x, Sk(y), P k(y), P k ′ (P k(y), sig(x, Sk(y))) → 1,<br />
x, Sk(y), P k(y) → sig(x, Sk(y)).<br />
5.7 Decidability <strong>of</strong> ground reachability problems for the blind<br />
signature theory<br />
Blind signature was introduced in [136], it is defined by the signature FBS =<br />
{sig, ver, Bl,<br />
⎧<br />
Ubl, P k, Sk} which satisfies the following set <strong>of</strong> equations:<br />
⎨ ver(sig(x, Sk(y)), P k(y)) = x,<br />
HBS = Ubl(Bl(x, y), y) = x,<br />
⎩<br />
Ubl(sig(Bl(x, y), Sk(z)), y) = sig(x, Sk(z)).<br />
Let RBS be the set <strong>of</strong> rules obtained by orienting equations <strong>of</strong> HBS from left<br />
to right, RBS is convergent <strong>and</strong> it is obvious that any basic narrowing derivation<br />
(Definition 13) issuing from any <strong>of</strong> the right h<strong>and</strong> side term <strong>of</strong> the rules <strong>of</strong> RBS<br />
terminates. This implies that any narrowing derivation (<strong>and</strong> in particular basic<br />
narrowing derivation) issuing from any term terminates (Theorem 1) <strong>and</strong> thus<br />
HBS has finite variant property [86].<br />
The initial deduction system is given by the tuple I0 = 〈FBS, L0, HBS〉 <strong>and</strong><br />
we have: