Logical Analysis and Verification of Cryptographic Protocols - Loria

26 CHAPTER 2. PROTOCOL ANALYSIS USING CONSTRAINT SOLVING
1. It may terminate with failure because one of the H-equations can not be
ordered using >, or the normal forms of the terms in one of the critical
pairs are distinct and can not be ordered using >. In this case, one could
try to run the procedure again using another reduction order;
2. it may terminate successfully with output Rn;
3. it may run for ever since infinitely many new rules are generated.
Given an equational theory H and a reduction order >, in [21], the authors
showed that if the basic completion procedure applied on (H, >) terminates
successfully and outputs Rn, then Rn is a finite convergent rewrite system generating
H, and if the basic completion procedure applied on (H, >) does not
terminate, then R∞ = ∪i≥0Ri is an infinite convergent rewrite system generating
H.
Bachmair completion procedure
The basic completion procedure described above usually generates a huge number
of rules, and all these rules must be taken into account when computing critical
pairs. This implies that both run time and space requirements for the completion
process are often too high and unacceptable. In what follows, we present
an improved completion procedure that extends basic completion by simplification
rules. The goal of this procedure is to transform an initial pair (H, ∅),
where H is an equational theory, into a pair (∅, R) such that R is a convergent
rewrite system equivalent to H.
This procedure, introduced in [23], is described by the set of rules given in
Figure 2.2.
A completion procedure is a program that accepts as input an equational
theory H and a reduction order >, and uses the rules of Figure 2.2 to generate a
(finite or infinite) sequence:
(H0, R0) ⊢ (H1, R1) ⊢ . . .
where H0 = H, R0 = ∅, and (H, R) ⊢ (H ′ , R ′ ) means that (H ′ , R ′ ) is obtained
from (H, R) by applying a rule from Figure 2.2. This sequence is called a run of
the completion procedure on inputs H and >.
A run is said to be fair if
CP (∪i≥0 ∩j≥i Rj) ⊆ ∪i≥0Hi
Given a fair run, G. Huet [121] proved that if there is a step n in the run where
Hn = ∅ then Rn is convergent rewrite system equivalent to H.
When an equational theory H is generated by a convergent rewrite system
R, we have that s =H t if and only if s ↓= t ↓ [123, 120].