Logical Analysis and Verification of Cryptographic Protocols - Loria

2.1. PRELIMINARIES 35
Remark. It is easy to see that the first point (point (1)) of Theorem 1 implies
that: for any term t and for any substitution σ in normal form, there exists a
term t ′ and a substitution σ ′ ∗
in normal form such that t �b R t′ and t ′ σ ′ = (tσ)↓.
Lemma 4 Let H be an equational theory generated by a convergent rewrite system R
such that the right hand side of every rule in R is not R-narrowable. Let t be a term and
D be a R-basic narrowing derivation starting from t. Then, the length of D in bounded
by �t�dag.
PROOF.
Let t be a term and D be a R-basic narrowing derivation starting from t,
D : t = t0 � b R t1 � b R . . . �b R tn
R is convergent and any basic narrowing derivation starting from the right
members of the rules of R terminates (in fact, all right members of the rules
of R are not R-basic narrowable), then every R-narrowing derivation starting
from any term terminates (Theorem 1), and hence D terminates. We prove next
that �D� ≤ �t�dag. Let Qi be the number of distinct subterms of ti where we can
apply the basic narrowing. We note that if the basic narrowing can be applied
on a term s at a position p and if there exists another subterm of s at position
q such that t|p = t|q, we apply the basic narrowing at the positions p and q at
the same time. Since all right members of R rules are not narrowable, and by
definition of narrowing (Definition 11), we deduce that Qi+1 < Qi, and hence,
�D� ≤ Q0. By definition, we have Q0 ≤ �t�dag, which implies that �D� ≤ �t�dag,
and hence the length of any R-basic narrowing derivation starting from any
term t is bounded by �t�dag. �
Lemma 5 Let H be an equational theory generated by a convergent rewrite system R
such that the right hand side of every rule in R is not R-narrowable. For any term
t, and for any variant substitution θ of t, we can guess in NP time another variant
substitution θ ′ of t such that θ ′ is more general modulo H than θ.
PROOF.
Let H be an equational theory generated by a convergent rewrite system
R such that the right hand side of every rule in R is not R-narrowable. This
implies that every R-narrowing derivation starting from any term terminates
1, and hence H has the finite variant property [86]. Let t be a term, the finite
variant property implies that we can construct a finite set of variant substitutions
Σ(t) = {σ1, . . . , σn} of t. We remark, by definition of finite variant
property (Definition 46), that substitutions in Σ(t) are in normal form. Let
σ ∈ Σ(t), and let the derivation tσ = t ′ 0 →R t ′ 1 →R . . . →R t ′ n such that t ′ n
is in normal form. Theorem 1 implies that there exists a R-basic narrowing