Logical Analysis and Verification of Cryptographic Protocols - Loria

42 CHAPTER 2. PROTOCOL ANALYSIS USING CONSTRAINT SOLVING
�
with s < t1. t1 < x implies t1 < xσ for all σ and then for σ = {x ↦→ s}, we
have t1 < s which contradicts s < t1. We conclude that either t1 = t2 or
t1 is the minimal ground term in T (F) for < which exists due to the wellfoundness
of < and which is unique due to the fact that < is total over
ground terms.
Lemma 7 Let I = 〈F, TI, H〉 be an intruder deduction system, and let I ′ = 〈F, L ′ , ∅〉
be the variant intruder deduction system of I. If t1, . . . , tn → t ∈ L ′ , then V ar(t) ⊆
V ar(t1, . . . , tn).
PROOF.
Let t1, . . . , tn → t ∈ L ′ , we have two cases:
1. If t1, . . . , tn → t ∈ L then, by definition of L, t1, . . . , tn → t = x1, . . . , xn →
f(x1, . . . , xn) where f is a public function symbol in F and hence, V ar(t) ⊆
V ar(t1, . . . , tn).
2. If t1, . . . , tn → t �∈ L, then, by definition of L ′ , there exists a rule
x1, . . . , xn → f(x1, . . . , xn) ∈ L, a variant substitution θ of f(x1, . . . , xn)
such that ti = xiθ for every i, and (f(x1, . . . , xn)θ)↓ = t. We
have that V ar(f(x1, . . . , xn)θ) = �n i=1 V ar(xiθ), and (f(x1, . . . , xn)θ)↓ ≤
f(x1, . . . , xn)θ. Lemma 6 implies that V ar((f(x1, . . . , xn)θ)↓) ⊆
V ar(f(x1, . . . , xn)θ) and hence, V ar((f(x1, . . . , xn)θ)↓) ⊆ �n i=1 V ar(xiθ)
which concludes the lemma.
�
We prove in what follows (Lemma 8) that when considering only deductions
on ground terms in normal form and yielding ground terms in normal
form, it is sufficient to consider derivations modulo the empty theory.
Lemma 8 Let E and F be two sets of ground terms in normal form we have: E →I F
if and only if E →I ′ F .
PROOF.
Let E and F be two sets of ground terms in normal form and assume there
is a rule x1, . . . , xn → f(x1, . . . , xn) ∈ L such that E →x1,...,xn→f(x1,...,xn) F .
By definition there exists a ground substitution σ in normal form such that
(x1, . . . , xn)σ ⊆ E and F = E ∪ {(f(x1, . . . , xn)σ)↓}. Due to the finite variant
property, there exists a variant substitution θ of f(x1, . . . , xn) and a ground normal
substitution σ ′ such that (f(x1, . . . , xn)σ)↓ = (f(x1, . . . , xn)θ)↓σ ′ and σ = θσ ′ .
The rule x1θ, . . . xnθ → (f(x1, . . . , xn)θ)↓ was added to L ′ by definition of I ′
(Definition 19). This implies that E →I ′ F . To prove the converse, notice that if
(x1, . . . , xn)θ → (f(x1, . . . , xn)θ)↓ can be applied with the normal ground substitution
σ ′ on E, then the rule x1, . . . , xn → f(x1, . . . , xn) can be applied with the
ground substitution σ = (θσ ′ )↓ on E. �