Logical Analysis and Verification of Cryptographic Protocols - Loria

3.5. DECIDABILITY RESULTS 77
2. By definition of IAU, it is easy to see that E ⊆ all.Cons(E) IAU
.
3. (1) and (2) implies easily (3).
4. We have t ∈ E IAU
is equivalent to E IAU
= (E, t) IAU
, which is equivalent
to all.Cons(E) IAU
= all.Cons(E, t) IAU
by (3). By contradiction, assume
that t ∈ E IAU
and there is a constant c ∈ all.Cons(t) \ all.Cons(E). c /∈
all.Cons(E) implies that c /∈ all.Cons(E) IAU
, and c ∈ all.Cons(t) implies
that c ∈ all.Cons(E, t) IAU
. This contradicts the equality all.Cons(E) IAU
all.Cons(E, t) IAU
, and hence we deduce that all.Cons(t) ⊆ all.Cons(E).
Now, we prove the converse. We have all.Cons(t) ⊆ all.Cons(E), this
implies all.Cons(t) ⊆ all.Cons(E) IAU
. By (2), we have t ∈ all.Cons(t) IAU
,
and hence, t ∈ all.Cons(E) IAU
. By (3), we conclude that t ∈ E IAU
.
�
The consequence of Lemma 21 is that only the set of constants appearing
or not in the initial knowledge and the goal of a supposed derivation are relevant
to decide its feasibility. This has the important implication, with respect
to decidability, that it is not necessary to know the exact instance of intruder’s
knowledge (his initial knowledge and the messages in the output of the symbolic
derivation up to this point) and the goal (the next input message of the
symbolic derivation) to decide whether a derivation exists. It suffices to know
the guessable sets of constants of the knowledge and of the goal.
We give in Figure 3.2 the algorithm that solve ordered IAU-satisfiability problem
and then, show its correctness, completeness and termination.
The definition of satisfiability of symbolic derivations allows us to conclude
automatically the completeness of the algorithm:
Lemma 22 (Completeness) The algorithm described in Figure 3.2 is complete.
PROOF.
Let C = (V, S, K, In, Out) be a IAU symbolic derivation, KI be the initial
intruder knowledge, and ≺ be a linear ordering on the variables and constants
of C. Assume that C is satisfiable, this implies, by definition, that there exists a
IAU-symbolic derivation CI = (VI, SI, KI, InI, OutI), a closed composition Ca of
CI and C, and a substitution σ such that (1) σ |=IAU Ca and (2) for all x variable
in C and c constant in C, x ≺ c implies c /∈ all.Cons(xσ). Hence, the intruder
I receives all messages sent by the protocol participants, and every message
they receive is send by the intruder. We have that xσ is defined for all x ∈ V,
we let Px = all.Cons(xσ). Furthermore, we have that for all x ∈ In, (xσ)↓ ∈
K ′ IσIAU with K ′ I = KI ∪ {x ′ | x ′ ∈ Out and x ′ ≺ x}, and by Lemma 21, we have
=