Logical Analysis and Verification of Cryptographic Protocols - Loria
Logical Analysis and Verification of Cryptographic Protocols - Loria
Logical Analysis and Verification of Cryptographic Protocols - Loria
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
2.1. PRELIMINARIES 43<br />
2.1.12 Constraint systems<br />
In [156], the authors introduced the notions <strong>of</strong> “deduction constraint” <strong>and</strong> “Iconstraint<br />
systems”. They defined a deduction constraint to be an expression <strong>of</strong><br />
the form E � t where E is a set <strong>of</strong> terms <strong>and</strong> t is a term, <strong>and</strong> they defined an<br />
I-constraint system C as follows: C = (E1 � t1, . . . , En � tn) where Ei ⊆ Ei+1,<br />
<strong>and</strong> V ar(Ei) ⊆ V ar({t1, . . . , ti−1}). They defined also a solution <strong>of</strong> C as follows:<br />
a substitution σ is a solution <strong>of</strong> C if tiσ ∈ Eiσ for every i. This notion <strong>of</strong> Iconstraint<br />
system has been defined with the ∅ equational theory in mind.<br />
Unfortunately, such definitions <strong>of</strong> I-constraint systems are not adequate in<br />
presence <strong>of</strong> non empty equational theory. For instance, let us consider the<br />
equational theory H = {f(x, x) = a} which is generated by the convergent<br />
rewrite system R = {f(x, x) → a}, <strong>and</strong> let us consider the I-constraint system<br />
C = ({a, b} � f(x, y), {a, b, x} � b). This constraint system follows the definition<br />
<strong>of</strong> constraint system given above, <strong>and</strong> the substitution σ = {x ↦→ y} is a solution<br />
<strong>of</strong> C following the definition above. When we apply this substitution σ to C<br />
then normalise, we obtain the following system C ′ = ({a, b} � a, {a, b, y} � b). It<br />
is easy to see that C ′ does not satisfy the definition <strong>of</strong> constraint systems given<br />
above.<br />
In order to avoid such problem, in [73], the authors introduced another definition<br />
<strong>of</strong> constraint systems. This definition, given below, is adequate with the<br />
non empty equational theories, <strong>and</strong> it is the definition adapted in this document.<br />
Definition 20 (I-Constraint systems) Let I be an intruder deduction system. An Iconstraint<br />
system C is denoted (E1 ⊢ v1, . . . , En ⊢ vn, U) <strong>and</strong> is defined by a finite set<br />
<strong>of</strong> expressions Ei ⊢ vi, called deduction constraints, with:<br />
• vi ∈ X for i ∈ {1, . . . , n},<br />
• E1 ⊆ T (F), <strong>and</strong> Ei ⊆ T (F, X ) for i ∈ {2, . . . , n},<br />
• Ei ⊆ Ei+1 for i ∈ {1, . . . , n − 1},<br />
• V ar(Ei) ⊆ {v1, . . . , vi−1} for i ∈ {2, . . . , n},<br />
• <strong>and</strong> a H-unification system U.<br />
An I-Constraint system C is satisfied by a substitution σ, <strong>and</strong> we write σ |=I C, if for<br />
all i ∈ {1, . . . , n} we have viσ ∈ Eiσ I <strong>and</strong> if σ |=H U. We call such a substitution a<br />
solution <strong>of</strong> C.<br />
It is easy to see that if a substitution σ is a solution <strong>of</strong> a constraint system C, the<br />
substitution (σ)↓ is also a solution <strong>of</strong> C.