Logical Analysis and Verification of Cryptographic Protocols - Loria

6.4. OUR CONTRIBUTION 159
I is
CI
def
= {I(u1), . . . , I(un) → I(v) such that u1, . . . , un → v ∈ LI}
Example 23 The Dolev-Yao rules presented in Chapter 2, in Example 8, more exactly
the rules without explicit destructors are represented by the following set of Horn
clauses:
⎧
I(x), I(y) → I(< x, y >)
I(x), I(y) → I({x}
⎪⎨
CDY =
⎪⎩
s y)
I(x), I(y) → I({x} p y)
I(< x, y >) → x
I(< x, y >) → I(y)
I({x} s y), I(y) → I(x)
I({x} p y), I(y−1 ) → I(x)
I({x} p
y−1), I(y) → I(x)
Given a set of terms E, we define CE
def
= {I(u) such that u ∈ E}.
Lemma 56 Let CI be the set of clauses associated with the intruder I, E a set of ground
terms and m a ground term. If m ∈ ĒI then CE ∪ CI |= I(m).
PROOF.
Let E and m be respectively a set of ground terms and a ground term, and
assume that m ∈ ĒI . This implies that there is a derivation d starting from E of
goal m, d = E →I E1 →I . . . →I En−1, m, where Ei = Ei−1 ∪ mi, E0 = E and
mn = m. We reason by induction on the lenghth of the derivation d.
• lenghth(d) = 0: then m ∈ E and thus I(m) ∈ CE which implies that
CE |= I(m) and then CE ∪ CI |= I(m).
• lenghth(d) = 1: let u1, . . . , un → v be the intruder deduction rule applied
on E in the derivation d, we have {uiσ}1≤i≤n ⊆ E and m = vσ for a ground
substitution σ. Hence, for all i ∈ {1, . . . , n}, I(ui)σ ∈ CE which implies that
CE |= I(ui)σ. Consider an arbitrary model Int of CE ∪ CI, Int satisfies all
I(ui)σ. Let us prove that I(m) which is equal to I(v)σ is true in Int by contradiction.
If I(v)σ is false in Int then the clause I(u1)σ, . . . , I(un)σ → I(v)σ
is not satisfied by Int, and hence neither the clause I(u1), . . . , I(un) → I(v)
which belong to CI. But this contradicts Int being a model of CE ∪ CI.
Thus, I(m) = I(v)σ is true in Int. We conclude that CE ∪ CI |= I(m).
• Assume that CE ∪ CI |= I(m) for any length k of the derivation d, k ≤
n and n ≥ 0, and let us prove it for lenghth(d) = n + 1. Assume that
u1, . . . , un → v be the last applied rule in the derivation d. Then all uiσ
are in En and vσ = m for a ground substitution σ. By induction we have
CE ∪ CI |= I(ui)σ for all i. By the same reasoning as above, we deduce that
CE ∪ CI |= I(v)σ, and thus CE ∪ CI |= I(m).