Logical Analysis and Verification of Cryptographic Protocols - Loria

22 CHAPTER 2. PROTOCOL ANALYSIS USING CONSTRAINT SOLVING
• if t ∈ X ∪ C or p = ɛ and t|p = t;
• if t = f(t1, . . . , tn) and p = i.p ′ with 1 ≤ i ≤ n then t|p = ti|p ′.
Given a term t, and a position p ∈ P os(t), we denote by t[p ← s] the term
obtained from t by replacing the subterm at position p by s.
2.1.4 Substitutions
A substitution σ is a partial function from variables X to terms T (F, X ), such
that its domain is finite. We define the support of a substitution σ, written Supp(σ)
as follows: Supp(σ) = {x|σ(x) �= x}, is a finite set. The substitution σ with
Supp(σ) = ∅ is called the empty substitution or the identity substitution. The substitution
σ with Supp(σ) = {x1, . . . , xn} and σ(xi) = ti for 1 ≤ i ≤ n, can also
be written as σ = {x1 ↦→ t1, . . . , xn ↦→ tn}. The range of σ, denoted by Ran(σ), is
defined by the set Ran(σ) = {σ(x) such that x ∈ Supp(σ)}. The substitution σ
with Supp(σ) = ∅ is called the identity substitution. We denote by V ar(σ) the set
V ar(Ran(σ)). A substitution σ is said to be ground if V ar(σ) = ∅, that is Ran(σ)
is a set of ground terms. A substitution σ instantiates a variable x if x ∈ Supp(σ),
and σ is said to be grounding x if x ∈ Supp(σ) and σ(x) is a ground term.
The application of a substitution σ to a term t is denoted σ(t) and is equal
to the term t where all variables x have been replaced by the term σ(x). More
formally, in order to apply a substitution σ to terms, we extend σ homomorphically
on terms by the rule σ(f(t1, . . . , tn)) = f(σ(t1), . . . , σ(tn)). Let E be a set of
terms, E ⊆ T (F, X ), we denote σ(E) = {σ(t) such that t ∈ E}.
From now on, we mean by xσ the application of σ to x, i.e. xσ = σ(x). In
similar way, if t (respectively E) is a term (respectively a set of terms), we will
write tσ (respectively Eσ) instead of σ(t) (respectively σ(E)).
A renaming ρ is an injective substitution such that Ran(ρ) ⊆ X .
The composition σθ of two substitutions σ and θ is defined as x(σθ) = (xσ)θ =
xσθ. A substitution θ is an extension of a substitution σ if Supp(σ) ⊆ Supp(θ), and
xσ = xθ for all x ∈ Supp(σ). A substitution σ is a restriction of a substitution θ if
θ is an extension of σ. A substitution σ is cyclic if there exists x1, . . . , xn, xn+1 ∈
Supp(σ) with n ≥ 1 such that xi+1 ∈ V ar(xiσ) for all 1 ≤ i ≤ n, with xn+1 =
x1. A substitution σ is idempotent if σ = σσ. We remark that a idempotent
substitutions are acyclic, and as we consider substitutions with finite domain,
the converse also holds. In this document, we will only consider idempotent
substitutions.
2.1.5 Equational theories and rewriting systems
Given a binary relation → over a set of terms S. The relations → + , → ∗ are respectively
the transitive and reflexive-transitive closure of →. The relation → is
said to be: