Logical Analysis and Verification of Cryptographic Protocols - Loria

24 CHAPTER 2. PROTOCOL ANALYSIS USING CONSTRAINT SOLVING
a normal form, this normal form is unique. A rewriting system is said to be
convergent if it is confluent and terminating. If R is convergent, each term has a
normal form which is unique, and for any terms s, t we have s ↔∗ R t if and only
if s ↓= t ↓ [21].
A rewrite system R is said to be ground confluent if for any ground terms
t, u, v such that t→∗ Ru, t→∗R v, there exists a ground term w verifying u→∗R w and
v→∗ Rw. A rewrite system R is said to be ground convergent if it is ground confluent
and terminating. If R is ground convergent, each ground term has a normal
form which is unique.
A substitution σ is said to be in normal form if for all x ∈ Supp(σ), the term
xσ is in normal form.
2.1.6 The completion procedures
Given an equational theory H, and a rewrite system R, we say that H is generated
by R if R and H are equivalent, that is for any terms s and t, we have
s =H t if and only if s ↔∗ R t [21].
In this section, we present techniques to construct a convergent rewrite system
or a ground convergent rewrite system generating a given equational theory.
Given an equational theory H, many procedures aiming to construct a
convergent (or a ground convergent) rewrite system R equivalent to H have
been given in the literature, for example [131, 23, 120]. In this section, we make
use of the notions of two terms are ∅-unifiable and a most general ∅-unifier of two
terms. Let u, v be two terms, a ∅-unifier (or unifier in the ∅-theory) of u and v is
a substitution σ such that uσ = vσ. We say that u and v are unifiable in the
∅-theory (or syntactically unifiable, or ∅-unifiable) if they have a ∅-unifier. We say
that a substitution σ is more general modulo ∅ than a substitution σ ′ , and we write
σ � σ ′ , if there exists a substitution θ such that σ ′ = σθ. Given two terms u
and v, it is well-known that if u and v are ∅-unifiable then there exists a unique
most general ∅-unifier θ, denoted by mgu(u, v), such that for every unifier σ of
u, v, there exists a substitution σ ′ verifying σ = θσ ′ [22]. The notions of ∅-unifier,
∅-unifiable, most general ∅-unifier are generalised to an arbitrary theory in Section
2.1.7.
Given a pair of rewrite rules l → r and g → d, and an integer p ∈ P os(l) such
that l|p �∈ X , l|p and g are ∅-unifiable with σ is their most general ∅-unifier, the
pair 〈l[d]p)σ, rσ〉 is a critical pair of the rules l → r and g → d. The rules l → r
and g → d do not need to be different in order to compute their critical pairs,
furthermore, we assume that the rules l → r and g → d do not share variables,
and to this end, we rename their variables before computing their critical pairs.
Given a rewrite system R, we denote by CP (R) the set of all critical pairs
obtained from the rules of R.