Logical Analysis and Verification of Cryptographic Protocols - Loria

160 CHAPTER 6. ON THE GROUND ENTAILMENT PROBLEMS
Again, by induction, we conclude that CE ∪ CI |= I(m) for any length of the
derivation d, and then, we conclude the proof. �
Insecurity problem of cryptographic protocols
We are concerned here with secrecy property of cryptographic protocols. We
show in this Section how secrecy property of cryptographic protocols can be
encoded as Horn clauses. As we see in the Section 6.4.1, the behaviour of the
intruder represented in Chapter 2 by a set of deduction rules can be modeled by
a set of Horn clauses. The initial knowledge of the intruder IK usually given
by a set of ground terms can be modeled by a set of clauses CIK. We show in
Chapter 2 that the insecurity problem of a protocol is reduced to a reachability
problem, and thus by constructing a constraint system for each execution of
the protocol and reducing the insecurity problem of the execution to the satisfiability
problem of its correspondant constraint system, and hence to a reachability
problem. Now, we will show how to reduce the satisfiability problem
of a ground constraint system to a ground entailment problem in the first order
logic. Let the ground constraint system C = (E1 ⊲ t1, . . . , En ⊲ tn), for each
constraint Ei ⊲ ti ∈ C, we associate the following Horn clause CEi
→ I(ti).
For example, the clause I(a), I(b) → I(< a, b >) corresponds to the constraint
{a, b} ⊲ < a, b >. The constraint system C will then be associated to the set of
ground Horn clauses CC = {CE1 → I(t1), . . . , CEn → I(tn)}, and we have that C
is satisfiable if and only if CC is entailed from CI. Thus, an execution exec does
not preserve the secrecy of a message s if and only if the set of Horn clauses
CC ′ exec is entailed from the set of Horn clauses CI, where C ′ exec is the extended
ground constraint system representing the execution exec. The construction of
the extended constraint system C ′ exec from an execution exec is given in Chapter
2.
A set S1 of Horn clauses is entailed from a set S2 of Horn clauses if each clause C
is S1 is entailed from S2. For example, S |= {C1, C2} if S |= C1 and S |= C2, S is a
set of clauses and C1, C2 are two clauses. Thus, assuming that the protocol runs
correctly (i.e. runs in presence of a passive intruder), each protocol execution is
associated to a ground constraint system, and then, the insecurity problem of
a protocol execution and hence of a cryptographic protocol under a bounded
number of sessions is reduced to the ground entailment problem for CI.
Example 24 Needham-Schroeder public key protocol.
Presentation of the protocol We consider the Needham-Schroeder symmetric key protocol
[163] as an example. This protocol intends to permit Alice to establish a shared
key (session key) with Bob and to obtain mutual conviction of the possession of the key
by each other. The session key is created by a trusted server which shares a secret key