Logical Analysis and Verification of Cryptographic Protocols - Loria

16 CHAPTER 1. INTRODUCTION
the ordered satisfiability problem for the intruder exploiting the collision vulnerability
property of hash functions can be reduced to the ordered satisfiability
problem for an intruder operating on words, that is with an associative symbol
of concatenation. We show the decidability of the last problem, which is interesting
in its own as it is the first decidability result that we are aware of for an
intruder system for which unification is infinitary. Furthermore, it permits one
to consider in other contexts an associative concatenation of messages instead
of their pairing.
Chapter 4: Analysis of protocols with vulnerable digital signature schemes.
In chapter 4, we study two classes of cryptographic protocols: the class of protocols
using digital signature schemes vulnerable to constructive exclusive ownership
property, and the class of protocols using digital signature schemes vulnerable
to destructive exclusive ownership property. The constructive exclusive ownership
vulnerability property for a digital signature schemes permits the intruder, given
a public verification key and a signed message, to compute a new pair of signature
and verification keys such that the message appears to be signed with the
new signature key; and the destructive exclusive ownership vulnerability property
for a digital signature schemes permits the intruder, given a public verification
key and a signed message, to compute a new pair of signature and verification
keys, and a new message, such that the given signature appears to be the signature
of the new computed message with the new signature key. We show
the decidability of the insecurity problem for these two classes of cryptographic
protocols, and that by reducing the insecurity problem to the reachability problem
for our intruder deduction systems.
Chapter 5: Decidability results for saturated deduction systems.
In chapter 5, we generalise the results obtained in Chapter 4. We consider the
class of cryptographic protocols where the cryptographic primitives are represented
by equational theories generated by convergent rewrite systems having
the finite variant property. This property has been introduced in [86], and means
that one can compute all possible normal forms of the instances of a term t.
First, we show the decidability of the ground reachability problem for our
class of deduction systems. This decidability result is obtained by (1) reducing
the reachability problem modulo an equational theory to the reachability problem
modulo the empty theory, (2) computing a transitive closure of the possible
deductions (using a saturation procedure), and (3) showing that the termination
of this computation implies the decidability of the ground reachability problem.
Next, we give a new criterion, based on counting the number of variables
in a reachability problem before and after a deduction is guessed, that permits