Logical Analysis and Verification of Cryptographic Protocols - Loria

3.4. SYMBOLIC FORMALISATION 75
with x1, x2, y1, y2 new variables (modulo the commutativity of ? =).
PROOF.
Let m1, m2, m3 ∈ T (Fh, X ) such that h(m1) = 1 HC h(m2) = 1 HC h(m3). If
m1 =HAU t1 · f(t1, t2, t3, t4) · t2 then, by Lemma 17 we have
� m2 =HAU t3 · g(t1, t2, t3, t4) · t4
m3 =HAU t1 · f(t1, t2, t3, t4) · t2
Let Sm1 = {m| h(m) =Hh h(m1)} then, by Lemma 17 we have Sm1 =
{m| m =HAU m1} ∪ {m| m =HAU t3 · g(t1, t2, t3, t4) · t4}.
We have σ |=Hh h(m) ? = h(m ′ ) that is h(mσ) =Hh h(m′ σ), and thus m ′ σ ∈ Smσ
which implies that either mσ =HAU m′ σ and then σ |=HAU m ? = m ′ or mσ =HAU
x1σ · f(x1σ, x2σ, y1σ, y2σ) · x2σ and m ′ σ =HAU y1σ �
· g(x1σ, x2σ, y1σ, y2σ) · y2σ and
m ? = x1 · g(x1, x2, y1, y2) · x2, m ′ ? �
= y1 · f(x1, x2, y1, y2) · y2 . �
then σ |=HAU
Lemma 19 Let E be a set of ground terms in normal form. If E → ∗ Ifree f(t1, t2, t ′ 1, t ′ 2)
and f(t1, t2, t ′ 1, t ′ 2) /∈ Sub(E) then E → ∗ Ifree t1, t2, t ′ 1, t ′ 2.
PROOF.
We have E → ∗ Ifree f(t1, t2, t ′ 1, t ′ 2) that is, there exists a finite sequence
of rewritings starting from E leading to f(t1, t2, t ′ 1, t ′ 2): E →Ifree E1 →Ifree
. . . →Ifree En−1 →IAU En−1, f(t1, t2, t ′ 1, t ′ 2). By hypothesis, we have
f(t1, t2, t ′ 1, t ′ 2) ∈ Sub(En) \ Sub(E). Let Ei be the smallest set in the derivation
such that f(t1, t2, t ′ 1, t ′ 2) ∈ Sub(Ei) \ Sub(Ei−1) [i ≥ 1]. By LI free and Hfree, the
rule applied in the step i of the derivation is x1, x2, y1, y2 → f(x1, x2, y1, y2). This
implies that there exists a normal ground substitution σ such that ti = xiσ and
t ′ i = yiσ for i ∈ {1, 2} and t1, t2, t ′ 1, t ′ 2 ∈ Ei−1. We deduce that E → ∗ Ifree t1, t2, t ′ 1, t ′ 2.
�
Lemma 20 Let E ⊆ T (Fh) be a set of ground terms in normal form, and assume
that E does not contain terms having the form f(t1, t2, t3, t4) or g(t1, t2, t3, t4) for some
terms t1, . . . , t4. Let m1, m2 be two terms in T (Fh, X ) such that (h(m1) ? = h(m2)) is
Hh-satisfiable. Let σ be a ground substitution which satisfies (h(m1) ? =Hh h(m2)). We
have:
E → ∗ IAU (m1σ)↓ if and only if E → ∗ IAU (m2σ)↓
PROOF.
By symmetry, it suffices to prove that E → ∗ IAU (m1σ)↓ implies E → ∗ IAU
(m2σ)↓. Since σ |=Hh (h(m1) ? = h(m2)), by Lemma 18 we have two cases:
• If σ |=HAU m1
?
= m2 then the result is obvious.