Logical Analysis and Verification of Cryptographic Protocols - Loria

40 CHAPTER 2. PROTOCOL ANALYSIS USING CONSTRAINT SOLVING
and the associated equational theory is defined by:
H :
The rules Lencs are defined as follows:
� π1(< x, y >) = x
π2(< x, y >) = y
and the associated equational theory is defined by:
The rules Lencp are defined as follows:
x, y → enc s (x, y) (2.12)
x, y → dec s (x, y) (2.13)
Henc s = {decs (enc s (x, y), y) = x}
and the associated equational theory is defined by:
x, y → enc p (x, y) (2.14)
x, y → dec p (x, y) (2.15)
�
p p −1 dec (enc (x, y), y ) = x
Hdecp :
decp (encp (x, y−1 ), y) = x
The Dolev-Yao deduction system with explicit destructors is given by
where
I e DY = 〈FDY , LDY , HDY 〉
• FDY = {< −, − >, enc s , dec s , enc p , dec p },
• LDY = L ∪ Lencs ∪ Lencp, • HDY = H ∪ Hencs ∪ Hencp. From now on, we consider only intruder deduction systems with explicit
destructors, and for simplicity, we will use the notation “intruder deduction
systems” to mean “intruder deduction systems with explicit destructors”.
This intruder deduction system will be denoted by I = 〈F, TI, H〉
and LI denotes the set of deduction rules associated to I.