Logical Analysis and Verification of Cryptographic Protocols - Loria

72 CHAPTER 3. PROTOCOLS WITH VULNERABLE HASH FUNCTIONS
Figure 3.1 Mode and Sign on Ih
Mode:
Mode(·, 1) = Mode(·, 2) = 0
Mode(g, i) = Mode(f, i) = 0, ∀i ∈ {1, . . . , 4}
Mode(h, 1) = 0
Sign:
Sign(·) = Sign(ɛ) = Sign(f) = Sign(g) = 0
Sign(h) = 1
PROOF.
Let l = r ∈ R(Hh) and suppose that l ∈ X and l /∈ V ar(r). Let t1 and t2
be two different terms in T (Fh, X ) and let σ1 and σ2 be two substitutions such
that σ1(l) = t1, σ2(l) = t2 and σ1(r) = σ2(r). Then, t1 =Hh t2. We deduce that if
l ∈ X and l /∈ V ar(r) for a rule l = r ∈ R(Hh), all terms in T (Fh, X ) are equals
modulo Hh which is impossible. Then for any rule l = r ∈ R(Hh), if l ∈ X , we
have l ∈ V ar(r). �
Lemma 14 Let t ∈ T (Fh, X ), we have:
1. If t ′ ∈ Sub(t) and Sign(t ′ ) = 1 then t ′ ∈ Subv(t);
2. If Sign(t) = 1 then Sign((t)↓) = 1.
PROOF.
1. Let t ∈ T (Fh, X ) and t ′ ∈ Sub(t) such that Sign(t ′ ) = 1, let us prove that
t ′ ∈ Subv(t). Since t ′ ∈ Sub(t), we have two cases:
• t ′ = t, then t ′ ∈ Subv(t).
• t ′ is a strict subterm of t, then there exists an integer p ≥ 0, an integer
i ≥ 1 such that t|p.i = t ′ . We have Sign(t|p.i) = 1 and by definition
of Ih theory, Mode(T op(t|p), i) = 0 then Mode(T op(t|p), i) �= Sign(t|p.i).
Thus t ′ is in ill-moded position in t, which implies that t ′ ∈ Subv(t).
2. Let t be a ground term in T (Fh) such that Sign(t) = 1. We have a finite
sequence of rewritings starting from t leading to (t)↓: t →R(Hh) ... →R(Hh)
ti →R(Hh) ti+1 →R(Hh) ... →R(Hh) (t)↓. Suppose that Sign(ti) = 1, and let
us prove that Sign(ti+1) = 1. Let l = r be the rule applied in the step i.
By definition of rewriting, there exists a ground substitution σ, a position
p such that ti|p = lσ, ti+1 = ti[p ← rσ] and lσ > rσ. We have two cases: