Logical Analysis and Verification of Cryptographic Protocols - Loria

Chapter 2
Constraint systems to analyse
cryptographic protocols
The security of a cryptographic protocol is assessed with respect
to the environment in which the protocol is executed. Dolev and Yao
[107] have described the environment by the deductions an intruder
attacking a protocol is able to perform. They considered that the intruder
has a complete control over the communication medium (network),
he listen to the communication and can obtain any message
passing through the network, he can intercept, block, and/or redirect
all messages sent by honest agents. He also can masquerade his
identity and take part in the protocol under the identity of an honest
agent. His control of the network is modelled by assuming that
all messages sent by honest agents are sent directly to the intruder
and that all messages received by the honest agents are always sent
by the intruder. Besides the control of the network, the intruder has
some specific rules to deduce new messages [73, 72, 156].
Many procedures have been proposed to decide security problems
of cryptographic protocols in the Dolev-Yao model with respect
to a finite number of sessions [16, 53, 178]. Among the different approaches,
there is the symbolic approaches [156, 75, 29, 87] on which,
as mentionned in the introduction of this document, we work. In
these approaches, cryptographic primitives are represented by function
symbols, messages are represented by terms in a signature (a
set of function symbols representing the cryptographic primitives),
and intruder capacities are represented by deduction rules on sets of
messages representing his knowledge. These deduction rules allow
the intruder to derive new messages from a given (finite) set of messages
representing his knowledge. Cryptographic primitives may
have algebraic properties, such as the associativity for the concate-
19