Logical Analysis and Verification of Cryptographic Protocols - Loria

2.1. PRELIMINARIES 31
Figure 2.4 Unification algorithm based on the finite variant property
Input:
An arbitrary equational theory H having the
�
finite variant property, and a Hunification
system U =
.
�
s1 ? =H t1, . . . , sn ? =H tn
Step 1:
Compute the term M = g(s1, t1, . . . , sn, tn) where g is a new function symbol not
appearing in F playing the role of cartesian product.
Step 2:
Compute the set of variant substitutions Σ(M).
Output:
• “U is H-unifiable” if there is a substitution θ ∈ Σ(M) and a substitution τ
such that (sjθ)↓τ = (tjθ)↓τ for every j ∈ {1, . . . , n};
• “U is not H-unifiable” otherwise.
Finite variant property and unification
We introduce in this section a general H-unification procedure, where H is an
arbitrary equational theory having the finite variant property. This algorithm is
given in Figure 2.4.
It is easy to see that the finite variant property reduces the H-unifiability
problem to the syntactic unifiability problem. We show next the correctness
and completeness of this unification procedure.
Lemma 1 Let H be an equational theory having the finite variant property, and let s
and t be two terms. Let M = g(s, t) where g is a new function symbol playing the role
of cartesian product. If there exists a variant substitution θ of M and a substitution
τ such that (sθ)↓τ = (tθ)↓τ then s and t are H-unifiable and σ = θτ is one of their
possible H-unifiers.
PROOF.
Let s, t be two terms such that (sθ)↓τ = (tθ)↓τ where θ is a variant substitution
of g(s, t) and τ an arbitrary substitution. (sθ)↓τ = (tθ)↓τ implies
(sθ)↓τ =H (tθ)↓τ. Let σ = θτ, we have (sσ)↓ = (sθτ)↓ = ((sθ)↓τ)↓ and similarly,
(tσ)↓ = ((tθ)↓τ)↓. Since (sθ)↓τ =H (tθ)↓τ, we conclude that ((sθ)↓τ)↓ =
((tθ)↓τ)↓ and hence (sσ)↓ = (tσ)↓ which implies that σ is an H-unifier of s and
t. �
Lemma 2 Let H be an equational theory having the finite variant property, and let s
and t be two terms. Let M = g(s, t) where g is a new function symbol playing the