Logical Analysis and Verification of Cryptographic Protocols - Loria

7.5. CASES STUDIES 191
re-encryption.
dec(penc(x, y, P k(z)), z) = x
renc(penc(x, y, z), w) = penc(x, f(y, w), z)
The ElGamal encryption scheme exhibits the feature expressed by the equation
dec(penc(x, y, P k(z)), commit(penc(x, y, P k(z)), z)) = x
which is used by the protocol. We also add functions dvp, checkdvp to model
designated verifier proofs of the fact that a message is a re-encryption of another
one; we adopt the equations
checkdvp(dvp(x, renc(x, y), y, pk(z)),
x, renc(x, y), pk(z)) = true
checkdvp(dvp(x, y, z, w), x, y, pk(w)) = true
The second equation models that checkdvp also succeeds for a fake proof constructed
using the designated verifier’s private key. By a slight abuse of notation
we also interpret checkdvp(t1, t2, t3, t4) as a predicate which evaluates to true
whenever checkdvp(t1, t2, t3, t4) =E true.
We adopt the formalism for signature proofs of knowledge due to Backes et
al. [25]. A signature proof of knowledge is a term SPKi,j( ˜ M, Ñ, F ) where ˜ M =
(M1, . . . , Mi) denotes the witness (or private component), Ñ = (N1, . . . , Nj)
defines the public parameters and F is a formula over those terms. More
precisely F is a term without names or variables, but includes distinguished
constants αk, βl where k, l ∈ N. The constants αk, βl in F denote placeholders
for the terms Mk ∈ ˜ M, Nl ∈ Ñ used within a signature of knowledge
SPKi,j( ˜ M, Ñ, F ). For example the signature proof of knowledge used
by the Lee et al. voting protocol [141] demonstrates possession of a secret
key skT such that P k(skT ) = pkT and d = commit(b ′ , skT ) i.e. the
proof shows the public key pkT is correctly formed and d is a decryption
key for the voter’s ballot b ′ . This can be captured as SPK1,3((skT ), (pkT ,
commit(b ′ , skT ), b ′ ), FL) where FL = eq(β1, P k(α1)) ∧ eq(β2, commit(β3, α1)). A
term SPKi,j( ˜ M, Ñ, F ) represents a valid signature if the term obtained by substituting
Mk, Nl for the corresponding αk, βl evaluates to true. Verification of such
a statement is modelled by the function Veri,j. The equational theory includes
the following equations defined over all tuples ˜x = (x1, . . . , xi), ˜y = (y1, . . . , yj)
and formula F ∈ TΣ∪{αk,βl|k≤i, l≤j} without names or variables:
Publicp(SPKi,j(˜x, ˜y, F )) = nth j
p(˜y) where p ∈ [i, j]
Formula(SPKi,j(˜x, ˜y, F )) = F
We also make use of the predicate Veri,j defined as Veri,j(F, SPKi,j( ˜ M, Ñ, F ′ ))
if and only if F =E F ′ and F {M1/α1, . . . , Mi/αi, N1/β1, . . . , Nj/βj} holds where
i = | ˜ M|, j = | Ñ| and F, F ′ ∈ TΣ∪{αk,βl|k≤i, l≤j} without names or variables.