Logical Analysis and Verification of Cryptographic Protocols - Loria

2.1. PRELIMINARIES 45
• Ei ⊆ Ei+1 for i ∈ {1, . . . , n − 1}.
In the rest of this document, we will make use of the modified I-ground
constraint systems (Definition 23) instead of the I-ground constraint system
(Definition 21), and for the aim of simplicity, we will abuse of the notation and
call modified I-ground constraint systems by I-ground constraint systems.
An I-ground constraint system C = (E1 ⊲ t1, . . . , En ⊲ tn) is satisfied, and we
I
write |=I C, if for all i ∈ {1, . . . , n} we have ti ∈ Ei , and ti, Ei in normal form.
Definition 24 (solved form) A modified I-constraint system (E1 ⊲ t1, . . . , En ⊲ tn) is
said to be in solved form if for all i, we have ti ∈ X .
Lemma 9 Let C be a modified I-constraint system, C = (Cα, E ⊲ t, Cβ) such that Cα is
in solved form and t �∈ X . Then, for all substitutions σ we have: σ |=I C if and only if
σ |=I (Cα, (E \ X ) ⊲ t, Cβ) .
PROOF.
It suffices to prove that if x ∈ E ∩ X and σ is a substitution such that σ |=I C,
then we have σ |=I (Cα, (E \ {x}) ⊲ t, Cβ). Given x ∈ E, by definition 20, there
exists a set of terms E ′ ⊆ E such that E ′ ⊲ x ∈ Cα. Since σ |=I C we have
σ |=I E ′ ⊲ x, and by the fact that E ′ ⊆ E \ {x} we have σ |=I E \ {x} ⊲ x. Since
we also have σ |=I (E ⊲t) then, σ |=I E \{x}⊲t. The reciprocal is obvious since
E \ X ⊆ E. �
Lemma 10 Let C = (Cα, E ⊲ x, Cβ) be a modified I-constraint system such that Cα is
in solved form and x /∈ V ar(Cβ) and let C ′ = (Cα, Cβ). We have:
1. If σ |= C then σ |= C ′ .
2. If σ ′ |= C ′ then we can extend σ ′ to σ such that σ |= C.
PROOF.
�
1. Let C = (Cα, E ⊲ x, Cβ) and let σ be a closed substitution such that σ |= C.
Since x /∈ V ar(Cβ), C ′ is a constraint system. It is trivial that σ |= C ′ .
2. Let σ ′ be a closed substitution such that σ ′ |= C ′ . Since V ar(E) ⊆ V ar(Cα),
σ ′ is defined on V ar(Cα, E, Cβ). We have two cases:
• If x /∈ V ar(Cα) then σ ′ (x) is not defined and x /∈ V ar(E). We then
extend σ ′ to σ as follows:
σ(y) = σ ′ (y) for y ∈ Supp(σ ′ ), σ(x) is a closed term in E.
Since x /∈ V ar(Cα, Cβ, E) and xσ ∈ Eσ, we deduce that σ |= C.
• If x ∈ V ar(Cα) then there exists Ex ⊲ x ∈ Cα. σ ′ |= (Cα, Cβ) implies that
σ ′ |= Ex ⊲ x, and since Ex ⊆ E, we have σ ′ |= E ⊲ x and hence σ ′ |= C.