Logical Analysis and Verification of Cryptographic Protocols - Loria

48 CHAPTER 2. PROTOCOL ANALYSIS USING CONSTRAINT SOLVING
�
for all i. Since θ ∈ SolV ar(U ′ ), we deduce that θ |=H U ′ , and hence θ |=H U.
This implies that θτ |=I U, then (θτ)↓ |=I U and thus σ |=I U, which
concludes the proof of (2).
2.2 Cryptographic protocols
In this section, we introduce how we model protocols.
2.2.1 Specification of protocols
A k-party protocol consists in k roles glued together with an association that
maps each step of a role that expects a message m to the step of another role
where the message m is produced. This association essentially defines how the
execution of the protocol should proceed in the absence of the intruder. We give
next the high level specification of a protocol.
Definition 29 (Protocol) The high level specification of a k-party protocol is given by
a scenario, sequence of rules of the form “R1 ⇒ R2 : m ′′ with R1, R2 are two roles and
m ∈ T (F, X ) is the exchanged message. This scenario describes how the execution of a
protocol should proceed in the absence of the intruder.
Example 9 The Needham-Schroeder symmetric key protocol [163] (presented in chapter
1, at Section 1.3) is specified as follows:
⎧
1. A ⇒ S : 〈A, 〈B, NA〉〉
⎪⎨ 2. S ⇒ A : enc
PNS :
⎪⎩
s (〈NA, B, KAB, encs (〈KAB, A〉, KBS)〉, KAS)
3. A ⇒ B : encs (〈KAB, A〉, KBS)
4. B ⇒ A : encs (NB, KAB)
5. A ⇒ B : encs (NB − 1, KAB)
NA (respectively NB) represents the nonce freshly created by A (respectively B), KAS
(respectively KBS) represents the secret key shared between A (respectively B) and the
trusted server, and KAB the session key shared between A and B.
In this protocol, we have three roles, the trusted server (S), sender’s role (A) and
receiver’s role (B).
Definition 30 (Specification of role) A role R is given by a couple
({vi ⇒ Si; Ui} i∈I , KR) where:
• for every i, vi ∈ X , Si ∈ T (F, X ), and Ui is an unification system,