Logical Analysis and Verification of Cryptographic Protocols - Loria
Logical Analysis and Verification of Cryptographic Protocols - Loria
Logical Analysis and Verification of Cryptographic Protocols - Loria
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
76 CHAPTER 3. PROTOCOLS WITH VULNERABLE HASH FUNCTIONS<br />
�<br />
• If σ |=HAU<br />
�<br />
m ? = x1 · g(x1, x2, y1, y2) · x2, m ′ ? �<br />
= y1 · f(x1, x2, y1, y2) · y2 then<br />
� m1σ =HAU x1σ · f(x1σ, x2σ, y1σ, y2σ) · x2σ<br />
m2σ =HAU y1σ · g(x1σ, x2σ, y1σ, y2σ) · y2σ<br />
Since E → ∗ IAU (m1σ)↓, we have E → ∗ IAU (x1σ · f(x1σ, x2σ, y1σ, y2σ) · x2σ)↓<br />
<strong>and</strong> thus, E → ∗ IAU (x1σ)↓ · f((x1σ)↓, (x2σ)↓, (y1σ)↓, (y2σ)↓) · (x2σ)↓ which<br />
implies that E → ∗ IAU (x1σ)↓, (x2σ)↓, f((x1σ)↓, (x2σ)↓, (y1σ)↓, (y2σ)↓).<br />
By hypothesis, f((x1σ)↓, (x2σ)↓, (y1σ)↓, (y2σ)↓) /∈ SubE, Lemma 19<br />
implies E → ∗ IAU (x1σ)↓, (x2σ)↓, (y1σ)↓, (y2σ)↓ <strong>and</strong> thus E → ∗ IAU<br />
g((x1σ)↓, (x2σ)↓, (y1σ)↓, (y2σ)↓) which implies that E → ∗ IAU (y1σ)↓ ·<br />
g((x1σ)↓, (x2σ)↓, (y1σ)↓, (y2σ)↓) · (y2σ)↓. We conclude that E → ∗ IAU (m2σ)↓.<br />
3.5 Decidability results<br />
We show next the decidability <strong>of</strong> respectively ordered IAU, ordered If, ordered<br />
Ig, ordered Ifree-satisfiability problems, <strong>and</strong> we conjecture the decidability <strong>of</strong><br />
the ordered Ih-satisfiability problem.<br />
3.5.1 Decidability <strong>of</strong> ordered IAU-satisfiability problem<br />
We state below some basic facts on IAU = 〈{.}, LI AU, HAU〉.<br />
Lemma 21 Let E <strong>and</strong> t be respectively a set <strong>of</strong> terms <strong>and</strong> a term in normal form with<br />
respect to the equational theory HAU. We have:<br />
1. all.Cons(E) ⊆ E IAU<br />
,<br />
2. E ⊆ all.Cons(E) IAU<br />
,<br />
3. E IAU<br />
4. t ∈ E IAU<br />
= all.Cons(E) IAU<br />
,<br />
if <strong>and</strong> only if all.Cons(t) ⊆ all.Cons(E).<br />
PROOF.<br />
Let E <strong>and</strong> t be respectively a set <strong>of</strong> ground terms <strong>and</strong> a ground term in<br />
normal form with respect to the equational theory HAU.<br />
1. Let c ∈ all.Cons(E) be a constant, <strong>and</strong> let e be a term in E such that c ∈<br />
all.Cons(e). We have therefore e = e1.c.e2. By associativity <strong>of</strong> ., we have<br />
e = e1.c.e2 = (e1.c).e2 = e1.(c.e2). Thus E →IAU E, (e1.c) →IAU E, (e1.c), c.<br />
This implies all.Cons(E) ⊆ E IAU<br />
.