Logical Analysis and Verification of Cryptographic Protocols - Loria

2.2. CRYPTOGRAPHIC PROTOCOLS 49
• KR is a set of terms in T (F, X ) describing the knowledge of the role R,
• {vi ⇒ Si; Ui}i∈I is the set of rules describing the behaviour of that role, that is the
set of actions that he should follow, and
• I is a totally ordered set of integers.
For simplicity, we assume I = {1, 2, . . .}. A rule vi ⇒ Si; Ui means: at step i,
the role will receive a message, stored in vi, and then send a message represented by
Si if the tests represented by Ui succeed. At each step i, the message Si is created by
the role from his initial knowledge, from the previously received messages stored in
v1, . . . , vi, and from fresh created values. A fresh value is represented by a variable
appearing in Si and not in {v1, . . . , vi}. The set of fresh values for the role R is the set
� ♮I
i=1 (V ar(Si) \ {v1, . . . , vi}). We denote by parameters of a role R the set constructed
from his initial knowledge KR, and his fresh values. We then remark that each variable
in Si is either in {v1, . . . , vi} or represents a parameter. The fact that I is totally ordered
means that the rules describing the role are sequential, and they are executed in a specific
order given by the protocol. A role represents an abstract participant in the protocol,
and thus in the description of a role, we do not specify which concrete participant plays
the role. We remark that a role can be played by many concrete participants and the
same concrete participant can play many roles or the same role many times. We observe
that a “receive” is always coupled with a “send”. This is because we suppose that if a
received message is as expected, the role will send his response.
Example 10 We consider the Needham-Schroeder symmetric key protocol described in
Example 9. In that protocol, we have three roles: the trusted server (S), sender’s role
(A) and receiver’s role (B). The role server (or S) is given by the tuple constructed as
follows:
• KS = {A, B, S, KAS, KBS, KAB},
• and the set of rules is:
S1 : v1 ⇒ encs (〈π2(π2(v1)), 〈π1(π2(v1)), 〈Kπ1(v1)π1(π2(v1)), encs (〈Kπ1(v1)π1(π2(v1)),
π1(v1)〉, Kπ1(π2(v1))S)〉〉〉, Kπ1(v1)S);
?
= 〈X1, Y1, Z1〉
v1
The role sender (or A) is given by a tuple constructed by the follow:
• KA = {B, S, A, NA, KAS},
• and the set of rules is:
A1 : ∅ ⇒ 〈A, 〈X2, NA〉〉; ∅
A2 : v2 ⇒ π2(π2(π2(decs ?
(v2, KAS)))); v2 = encs A3 :
(〈NA, 〈X2, 〈Y2, Z2〉〉〉, KAS)
v3 ⇒ encs (decs (v3, π1(π2(π2(decs (v2, KAS))))) − 1, π1(π2(π2(decs (v2,
?
= encs (X ′ 2, π1(π2(π2(decs (v2, KAS)))))
KAS))))); v3