Logical Analysis and Verification of Cryptographic Protocols - Loria

68 CHAPTER 3. PROTOCOLS WITH VULNERABLE HASH FUNCTIONS
Example 19 Let us consider the protocol and the two symbolic derivations of Example
18. The normal execution of that protocol corresponds to the following composition
of the two symbolic derivations of the previous example: I1 = � xA �
2 , O1 = � yA �
1 ,
I2 = � xB �
1 , and O2 = � yB �
A
1 . This composition imposes that x2 = yB 1 which means
that the second message received by A is the first message send by B, and x B 1 = y A 1
which means that the first message received by B is the first message send by A. We
recall that the first message received by A is empty.
3.3.6 Ordered satisfiability problem
In chapter 2, we show how reduce the insecurity problem of cryptographic protocols
to the satisfiability problem of constraint systems. Since this reduction
is based on the fact that the capacity of the intruder attacking the protocol is
represented by rules of the form x1, . . . , xn → f(x1, . . . , xn), and since, in this
chapter, the intruder deduction rules have a different form, we can not apply
this reduction. To this end, we introduce next another satisfiability problem,
called Ordered satisfiability problem, to which we reduce the insecurity problem
of cryptographic protocols using collision-vulnerable hash functions. The Ordered
satisfiability problem has been initially defined in [72].
Definition 42 Ordered I-satisfiability problem Given an intruder deduction system
I = 〈F, LI, H〉, the ordered I-satisfiability problem is defined as follows:
Input: A I-symbolic derivation C, a set of ground terms Ki representing the
intruder knowledge, X = V ar(C), C = all.Cons(C) and a linear
ordering ≺ on X ∪ C.
Output: SAT if and only if there exists a I-symbolic derivation Ci =
(Vi, Si, Ki, Ini, Outi), a closed composition Ca of Ci and C, and a substitution
σ such that (1) σ |=I Ca and (2) for all x ∈ X and c ∈ C,
x ≺ c implies c /∈ all.Cons(xσ).
3.4 Symbolic formalisation of collision vulnerability property
We show in this section the symbolic formalisation of collision vulnerability
property for hash functions. We recall that the collision vulnerability property
of a hash function h means that it is computationally feasible to compute two
distinct inputs x and x ′ with h(x) = h(x ′ ) provided that x and x ′ are created at
the same time and independently one of the other.
In order to construct a couple of messages having the same hash value, we
introduce two new function symbols f, g, each of them with arity 4, and we