Olivier Pourret
email: olivier.pourret@univ-rennes1.fr.

Mélanie Davranche

Gérard Gruau

Aline Dia

&RPSHWLWLRQ EHWZHHQ +XPLF $FLG DQG &DUERQDWHV IRU 5DUH (DUWK (OHPHQWV &RPSOH[DWLRQ

EVWUDFW The competitive binding of rare earth elements (REE) to humic acid (HA) and carbonates was studied experimentally at various pH and alkalinity values by combining Ultrafiltration and Inductively Coupled Plasma Mass Spectrometry techniques. The results show that the REE species occur as binary humate or carbonate complexes but not as ternary REEcarbonate-humate as previously proposed. The results also reveal the strong pH and alkalinity dependence of the competition as well as the existence of a systematic fractionation across the REE series. Specifically, carbonate complexation is at a maximum at pH 10 and increase with increasing alkalinity and with the atomic number of the REE (LuCO 3 >> LaCO 3 ). Modelling of the data using Model VI and recently published stability constants for complexation of REE by humic acid well reproduced the experimental data, confirming the ability of Model VI to accurately determine REE speciation in natural waters. This modelling also confirms the reliability of recently published stability constants. This work shed more light not only on the competition between carbonates and HA for REE complexation but also on the reliability of WHAM 6 and Model VI for calculating the speciation of REE with organic matter in alkaline organic rich-water.

.H\ ZRUGV Rare earth elements, humic acid, carbonates, binding, speciation, ultrafiltration

,QWURGXFWLRQ

The hydrochemical behavior of Rare Earth Elements (REE) is strongly influenced by their solution speciation [START_REF] Wood | The aqueous geochemistry of the rare-earth elements and yttrium. 1. Review of the available low-temperature data for inorganic complexes and inorganic REE speciation in natural waters[END_REF][START_REF] Byrne | Marine chemistry and geochemistry of the lanthanides[END_REF]. Due to the complexation of REE by a large variety of ligands, only a small fraction of each REE occurs as free hydrated ions (Ln 3+ -Ln as lanthanide) in circumneutral waters. In circumneutral waters, REE are mostly bound to humic substances (HM) such as fulvic acids (FA) and humic acids (HA) [START_REF] Viers | Chemical weathering in the drainage basin of a tropical watershed (Nsimi-Zoetele site, Cameroon): comparison between organic-poor and organic-rich waters[END_REF][START_REF] Dia | The distribution of rare earth elements in groundwaters: assessing the role of source-rock composition, redox changes and colloidal particle[END_REF][START_REF] Tang | Speciation of rare earth elements in natural terrestrial waters: Assessing the role of dissolved organic matter from the modeling approach[END_REF]. By contrast, in alkaline waters with high carbonates concentrations, REE complexation is generally dominated by carbonate complexes as LnCO 3

+ and Ln(CO 3 ) 2 - [START_REF] Byrne | Marine chemistry and geochemistry of the lanthanides[END_REF][START_REF] Tang | Speciation of rare earth elements in natural terrestrial waters: Assessing the role of dissolved organic matter from the modeling approach[END_REF]. However, competition reactions between carbonates and organic matter for REE complexation have not yet been experimentally constrained. At present, accurate models of REE chemistry in natural waters are only dependent on experimentally determined (i) REE carbonates complexation constants [START_REF] Cantrell | Rare earth element complexation by carbonate and oxalate ions[END_REF][START_REF] Millero | Stability constants for the formation of rare earth inorganic complexes as a function of ionic strength[END_REF][START_REF] Lee | Examination of comparative rare earth element complexation behavior using linear free-energy relationships[END_REF][START_REF] Liu | Cerium: A chemical tracer for paleo-oceanic redox conditions[END_REF][START_REF] Ohta | Rare earth element partitioning between Fe oxyhydroxide precipitates ans aqueous NaCl solutions doped with NaHCO3: Determinations of rare earth element complexation constants with carbonate ions[END_REF][START_REF] Luo | Carbonate complexation of yttrium and the rare earth elements in natural rivers[END_REF][START_REF] Quinn | Comparative scavenging of yttrium and the rare earth elements in seawater: competitive influences of solution and surface chemistry[END_REF] and (ii) REE humic substances constants [START_REF] Yamamoto | Systematics of stability constants of fulvate complexes with rare earth ions[END_REF][START_REF] Sonke | Lanthanide-humic substances complexation. I. Experimental evidence for a lanthanide contraction effect[END_REF][START_REF] Pourret | Rare Earth Elements complexation with humic acid[END_REF].

However, since there is no experimental data about the competition between carbonates and organic matter for REE complexation, an important piece of information is missing.

Previous studies [START_REF] Tang | Speciation of rare earth elements in natural terrestrial waters: Assessing the role of dissolved organic matter from the modeling approach[END_REF][START_REF] Wood | The aqueous geochemistry of the rare-earth elements: Critical stability constants for complexes with simple carboxylic acids at 25°C and 1 bar and their application to nuclear waste management[END_REF][START_REF] Fairhurst | The influence of humic acid on the adsorption of europium onto inorganic colloids as a function of pH[END_REF][START_REF] Lead | Europium binding by fulvic acids[END_REF] based on speciation calculation of some REE (e.g., La 3+ , Eu 3+ , Lu 3+ ) concluded that organic complexes dominate for intermediate pH range (from pH 4 to 8)

whereas carbonate complexes (Ln(CO 3 ) 2 -) are the predominant species at alkaline pH (> 8).

However, as discussed by these authors themselves, speciation calculations may underestimate the LnHM complexes, especially at alkaline pH (> 8). They suggest that this could have significant effects on ternary inorganic-colloid-HM-Ln interactions [START_REF] Fairhurst | The influence of humic acid on the adsorption of europium onto inorganic colloids as a function of pH[END_REF][START_REF] Dierckx | Mixed complex formation of Eu3+ with humic acid and a competing ligand[END_REF][START_REF] Moulin | Europium complexes investigations in natural waters by time-resolved laser-induced fluorescence[END_REF]. They also suggested that Ln speciation would be dominated by interactions with humic material. The lack of experimental data regarding LnHM interactions at neutral-to-alkaline pH leads to extrapolation and the speciation results obtained for alkaline waters should be regarded with caution [START_REF] Lead | Europium binding by fulvic acids[END_REF]. Takahashi et al. [START_REF] Takahashi | Comparison of adsorption behavior of multiple inorganic ions on kaolinite and silica in the presence of humic acid using the multitracer technique[END_REF] calculated speciation of Ce 3+ , Eu 3+ and Lu 3+ in solution in the presence of humic acid. Hydroxide carbonates and humate complexes were considered. Unlike the studies above, their results suggest that LnHA complexes should be predominant in a wide pH range (from pH 3 to 10.5), and even more at higher HA concentrations. Ln(CO 3 ) 2 -should be dominant at pH higher than 10.5. These observations are further illustrated by a new study considering Model VI fitted complexation constants between REE and HA. Model VI calculated high proportions of light REE (LREE) complexed with organic matter under alkaline pH conditions [START_REF] Pourret | Rare Earth Elements complexation with humic acid[END_REF]. Comparison of REE speciation model calculations, taking into account organic ligands, shows strong differences between each model regarding the competition between humic substances and carbonates for REE complexation.

In order to assess humic acid and carbonates competition for REE at alkaline pH, batch equilibration experiments with REE, Aldrich HA and carbonates were performed simultaneously for the 14 naturally occurring REE. This new dataset was obtained using an experimental method which combines an ultrafiltration technique and Inductively Coupled Plasma Mass Spectrometry.

These experiments were designed to elucidate the pH range where REE-humate complexes would be dominant in natural organic-rich waters for various alkalinity concentrations and test whether significant formation of ternary complexes can take place in such conditions. Moreover, Humic Ion Binding Model VI included in WHAM 6 -a model that does not considered ternary surface complexes -was used to model the binding of lanthanides to humic substances [START_REF] Tipping | Humic Ion-Binding Model VI: an improved description of the interactions of protons and metal ions with humic substances[END_REF]. This study should also evidence the ability of the newly determined HA-REE binding constants [START_REF] Pourret | Rare Earth Elements complexation with humic acid[END_REF] to accurately predict the speciation of REE in alkaline waters.

0DWHULDOV DQG 0HWKRGV

+XPLF DFLG

Purified humate, referred to below as HA (humic acid), was obtained from Aldrich™ humic acid (Aldrich™, H1, 675-2) following the protocol described by Vermeer et al. [START_REF] Vermeer | Adsorption of humic acid to mineral particles. 1. Specific and electrostatic interactions[END_REF]. HA sample was freeze-dried and stored in a glass container at room temperature. HA obtained was ash free and in its protonated form, with the following elemental composition (in weight percent): C = 55.8 %, O = 38.9 %, H = 4.6 %, N = 0.6 %. REE concentrations in HA were below the detection limit of ICP-MS method (i.e. below 1 ppt). HA has a mean molecular weight of 23 kDa [START_REF] Vermeer | Adsorption of humic acid to mineral particles. 1. Specific and electrostatic interactions[END_REF]. Prior to use, the freeze-dried humate was resuspended overnight in an 0.001 mol L -1

NaCl electrolyte solution at pH = 10, to ensure complete dissolution of the sample [START_REF] Davranche | Impact of humate complexation on the adsorption of REE onto Fe oxyhydroxide[END_REF][START_REF] Davranche | Adsorption of REE(III)-humate complexes onto MnO2: Experimental evidence for cerium anomaly and lanthanide tetrad effect suppression[END_REF].

([SHULPHQWDO VHWXS

REE complexation with HA and carbonates was investigated using a standard batch equilibration technique. 100 mL of solutions were prepared with 50 ppb of each REE (e.g., 360

nmol L -1 La to 286 nmol L -1 Lu), 5 mg L -1 of HA and various concentration of NaHCO 3 (from 10 -3 to 10 -2 mol L -1 ) in a 10 -3 mol L -1 NaCl-solution. Prior to addition of NaHCO equipped with permeable membranes of 5 kDa pore size (Millipore Amicon Ultra-15). All centrifugal filter devices used were washed and rinsed with 0.1 mol L -1 HCl and MilliQ water two times before use in order to minimize contamination. Centrifugations were performed using a Jouan G4.12 centrifuge with swinging bucket rotor at 3000 g for 30 minutes. This allowed the REE-HA complexes to be quantitatively separated from inorganic REE species. The selectivity of the 5 kDa membrane regards to the REE-HA complexes was verified by monitoring the Dissolved Organic Carbon (DOC) contents of the ultrafiltrates. Results show that the latter were systematically lower or equal to blank values (below 0.1 ppm). Possible adsorption of inorganic REE species onto the membrane or onto cell walls was also monitored. Inorganic REE solutions of given REE concentration were ultrafiltrated several times. Results showed that between 98.91 (for Ho) and 99.98 % (for Yb) of the REE present in solution were recovered in the ultrafiltrates, demonstrating that none REE were adsorbed either on the membranes or on the walls of the cell devices.

Amount of REE complexed with HA correspond to the difference between the initial REE concentration and the remaining REE concentration into the < 5 kDa ultrafiltrates. REE concentrations were determined by using an Agilent Technologies ™ HP4500 ICP-MS instrument.

Quantitative analyses were performed using a conventional external calibration procedure. Three external standard solutions with REE concentrations similar to the analyzed samples were prepared from a multi-REE standard solution (Accu Trace ™ Reference, 10 mg L -1 , USA). Indium was added to all samples as an internal standard at a concentration of 0.87 µmol L -1 (100 ppb) to correct for instrumental drift and possible matrix effects. Indium was also added to the external standard solutions. Calibration curves were calculated from measured REE/indium intensity ratios. The instrumental error on REE analysis in our laboratory as established from repeated analyses of multi-REE standard solution (Accu Trace ™ Reference, USA) and of the SLRS-4

water standard is below ± 2 % [START_REF] Dia | The distribution of rare earth elements in groundwaters: assessing the role of source-rock composition, redox changes and colloidal particle[END_REF][START_REF] Davranche | Adsorption of REE(III)-humate complexes onto MnO2: Experimental evidence for cerium anomaly and lanthanide tetrad effect suppression[END_REF]. Chemical blanks of individual REE were all lower than detection limit (1 ppt), which is negligible since they are three to four orders of magnitude lower than the concentrations measured in the synthetic solutions used for the complexation experiments. DOC concentrations were determined using a Shimadzu 5000 TOC analyzer. The accuracy of DOC concentration measurements is estimated at ± 5 % as determined by repeated analyses of freshly prepared standard solutions (potassium biphtalate). Carbonates concentrations were determined by potentiometric titrations (HCl 0.1 mol L -1 ), with Gran method analysis. The uncertainty is better than 5 %.

In order to check that no retention of REE or carbonates occurs inside the membrane during ultrafiltration, mass balance calculations were performed. The initial concentration of each element is compared with the sum of each element concentration in the ultrafiltrate and in the retentate. In the presented experiments, mass balanced calculations show that > 98 % of the REE and > 95 % of the carbonates and DOC were recovered. Moreover, in order to verify that no precipitation occurs, samples were filtrated at 0.2 µm before ultrafiltration. Concentrations of REE, HA and carbonates were systematically identical within analytical uncertainties in the 0.2 µm filtrates and the raw samples. K MB and log K MA [START_REF] Tipping | Humic Ion-Binding Model VI: an improved description of the interactions of protons and metal ions with humic substances[END_REF]. Then, a single adjustable parameter (log K MA ) is necessary to fully describe metal binding. Generic parameters for HA are presented in Table 1. WHAM 6 databases were modified and included new log K MA for REE complexation with humic acid [START_REF] Pourret | Rare Earth Elements complexation with humic acid[END_REF] and wellaccepted, infinite dilution (25°C) stability constants for REE carbonates complexes [START_REF] Luo | Carbonate complexation of yttrium and the rare earth elements in natural rivers[END_REF].

([SHULPHQWDO 5HVXOWV

Experimental data are reported for three REE (La, Eu and Lu) in Table 2 and illustrated in Fig. 1. Competition between HA and carbonates for REE complexation is examined by considering the mass fraction inorganic REE species as a function of pH. The complementary fraction is made up of REE organic complexes. Based on speciation calculations of the inorganic fraction using WHAM 6, REE were shown to consist mostly of carbonate complexes. In these experimental conditions (see section 2.1), hydroxide and free species are only present at very low concentrations (as regards to speciation calculations < 0.2 % and < 3.8 % of the inorganic fraction for La, respectively). Two REE-carbonate complexation reactions are considered in Fig. 1 and described by the following equations:

Ln 3+ + CO 3 2- LnCO 3 + [1] Ln 3+ + 2 CO 3 2- Ln(CO 3 ) 2 - [2]
whereas humic complexation are described by the following equation:

Ln 3+ + HA -LnHA 2+ [3]
As shown in Figure 1, LnCO 3 + and Ln(CO 3 ) 2 -concentrations depend strongly on the pHand the carbonate content. LnCO 3 + concentrations decrease with pH increase whereas Ln(CO 3 ) 2 concentrations increase while pH increases. Moreover, Ln(CO 3 ) 2 -and LnCO 3 + concentrations increase with the solution alkalinity. The slight "bump" in the pH range 8-8.5 corresponds to the competitive reaction between mono-(Eq. [START_REF] Wood | The aqueous geochemistry of the rare-earth elements and yttrium. 1. Review of the available low-temperature data for inorganic complexes and inorganic REE speciation in natural waters[END_REF]) and di-(Eq. [START_REF] Byrne | Marine chemistry and geochemistry of the lanthanides[END_REF]) carbonato-complexation reactions. This "bump" is more significant for LREE than for heavy REE (HREE), a result consistent with the difference in complexation constants of LREE-and HREE-carbonate complexes [START_REF] Luo | Carbonate complexation of yttrium and the rare earth elements in natural rivers[END_REF]. Thus, a fractionation is apparent between LREE and HREE regarding their complexation to carbonate. Let's consider for example a pH 10 value of alkalinity 10 -2 mol L -1 and the results observed under these conditions. Only 15 % of La is bound to carbonate whereas 30 % of Eu and up to 60 % of Lu are bound to carbonate. Moreover, carbonate concentrations were systematically identical in the ultrafiltrates and in the initial batches (within the uncertainty of the measures). Calculation considering that 1:1:2 ternary complexes could be formed were performed and further demonstrate that no carbonate was bound to HA in our experiments (Ln concentrations are several order of magnitude higher than maximum CO 3 2-concentration variation between ultrafiltrates and initial batches). Consequently, no additional interactions between metal (Ln 3+ ), ligand (CO

) and surface (HA) occurred demonstrating that ternary surface complexes did not develop.

'LVFXVVLRQ

Lack of evidence of ternary complexe formation

A common question when dealing with metal (M) speciation in systems containing humic substances (HS) such as HA and inorganic ligands (L) such as carbonate is, whether or not, ternary complexe (M-HA-L m with m corresponding to the ligand stoechiometry), can form.

Information about ternary complex formation in the literature is scarce, especially concerning REE. Even if such a mechanism was suggested for REE (e.g., [START_REF] Fairhurst | The influence of humic acid on the adsorption of europium onto inorganic colloids as a function of pH[END_REF]), only a few experimental studies brought direct evidence for possible formation of such complexes [START_REF] Dierckx | Mixed complex formation of Eu3+ with humic acid and a competing ligand[END_REF][START_REF] Moulin | Europium complexes investigations in natural waters by time-resolved laser-induced fluorescence[END_REF].

Dierckx et al. [START_REF] Dierckx | Mixed complex formation of Eu3+ with humic acid and a competing ligand[END_REF] provided evidence for mixed-ligand complex formation of Eu 3+ with humic acid and inorganic ligands (i.e., CO 3

2-

). However, the interpretation of Dierckx et al. [START_REF] Dierckx | Mixed complex formation of Eu3+ with humic acid and a competing ligand[END_REF] left some open questions, as they observed formation of either M-HA or M-HA-L complexes formed across the whole range of L concentrations, without observing the formation of M-HA-L¡ complexes. These observations are unusual with respect to common experiences found with inorganic ligands and oxide-based surfaces (e.g., [START_REF] Schindler | Co-adsorption of metal ions and organic ligands: formation of ternary surface complexes[END_REF]). Moreover, Glaus et al. [START_REF] Glaus | Stability of mixed-ligand complexes of metal ions with humic substances and low molecular weight ligands[END_REF][START_REF] Glaus | Trace metal-humate interactions. I. Experimental determination of conditional stability constants[END_REF] have shown that the formation of mixed-ligand-humic complexes is rather weak as compared to the formation of simple ligand-complexes with inorganic ligands. Ternary-humic complexes appear thus less important than predicted by the data of Dierckx et al. [START_REF] Dierckx | Mixed complex formation of Eu3+ with humic acid and a competing ligand[END_REF].

A possible explanation for the absence of ternary complex formation in the present work might be the electrostatic repulsion between the negatively charged HA and Ln-CO 3 . Due to the polyelectrolyte character of HA, this repulsion is stronger than that occurring between lowmolecular weights ligands. Schindler [START_REF] Schindler | Co-adsorption of metal ions and organic ligands: formation of ternary surface complexes[END_REF] reported that ternary complexes with SiO 2 and TiO 2 surfaces are rather weak. Both surfaces are negatively charged at the pH of Schindler's experiments and can therefore be considered as analogues to HS. Ternary surface complexes are thus not as important as previously stated and do not need to be considered in REE speciation calculation in systems dominated by organic and alkaline water.

Competition between humic acid and carbonates for REE complexation

In order to further constrain the competition between humic acid and carbonates for REE complexation, calculation using Model VI in WHAM 6 were performed. Calculations were conducted using Model VI in which a new determined log K MA dataset for HA-REE complexation was integrated [START_REF] Pourret | Rare Earth Elements complexation with humic acid[END_REF]. These log K MA values were estimated from REE complexation by HA experiments without any competing effect. The log K MA values range from 2.58 ± 0.16 (for La) to 2.65 ± 0.15 (for Eu); these latter being slightly higher than the one estimated by Lead et al. [START_REF] Lead | Europium binding by fulvic acids[END_REF] (2.36 ± 0.13). These calculations only considered trivalent REE species. Speciation calculations are illustrated on Figs. 1.2a, b and c for La, Eu and Lu, respectively, for the three experimental conditions (i.e. increasing alkalinity and pH). In particular, Model VI reproduced quite well the observed dependence of the proportion of carbonate complexes with pH and alkalinity. However, the observed experimental "bump" is not modelled by Model VI. This is due to the fact that only Ln complexation with two CO 3 2-is predicted whereas Ln complexation with a single CO 3 2-is overwhelmed by competition with HA (Fig. 2), fits can be considered of good quality, even if rmse values increase when competition between HA and carbonates is more developed (i.e., for alkalinity of 10 -2 mol L -1 ). Overall, it is clear that LREE to Middle REE (MREE) are strongly bound to HA whereas HREE are more shared between HA and carbonate fractions.

More in detail, pH is a crucial parameter affecting binding, since it regulates competition between HA and carbonates. Carbonate complexation mostly affects REE speciation in alkaline waters (pH above 8.5). These observations validate both the use of Model VI [START_REF] Tipping | Humic Ion-Binding Model VI: an improved description of the interactions of protons and metal ions with humic substances[END_REF] and of the log K MA (REE-HA) dataset determined by Pourret et al. [START_REF] Pourret | Rare Earth Elements complexation with humic acid[END_REF] to confidently predict REE speciation in natural alkaline waters. As stated by Tipping [START_REF] Tipping | Humic Ion-Binding Model VI: an improved description of the interactions of protons and metal ions with humic substances[END_REF], an important issue in increasing WHAM and Model VI capacity to perform chemical speciation calculations for field situations is whether significant formation of ternary complexes takes place. Simulations on some trace metals may have indeed significantly underestimated the extent of metal binding as compared to observation especially when binding occurs through the formation of ternary complexes There is no evidence of any ternary surface complex as previously proposed (e.g., [START_REF] Dierckx | Mixed complex formation of Eu3+ with humic acid and a competing ligand[END_REF]). These experiments elucidate the pH range where humate complexes could be the dominant species of REE(III) in natural organic-rich waters, for various alkalinity concentrations.

Carbonates are the only REE predominant species for HREE at higher alkalinity concentrations, above pH 8.5. A fractionation develops between LREE and HREE relative to REE complexation to carbonates, especially at higher alkalinity. Modelling calculations were performed with Model VI [START_REF] Tipping | Humic Ion-Binding Model VI: an improved description of the interactions of protons and metal ions with humic substances[END_REF]. Calculations were consistent with experimental result, namely the pH-and carbonate concentration-dependence. The results show the influence of the competitive reactions between carbonates and HA for REE complexation at alkaline pH. All these observations allow validating the log K MA (REE-HA) dataset [START_REF] Pourret | Rare Earth Elements complexation with humic acid[END_REF] that can be, therefore, used with confidence to predict REE speciation in natural alkaline waters. They also evidence the reliability of WHAM 6

and Model VI in calculating the speciation of REE with organic matter in alkaline organic richwater, as ternary surface complexes do not need to be modelled. Overall, the results of this study suggest that further considerations about organic matter should be taken into account especially at alkaline pH in organic-rich waters.

[29] S. Lofts and E.

2. 2 .

 2 WHAM 6 and Humic Ion Binding Model VI WHAM 6 (version 6.0.10), incorporating Humic Ion Binding Model VI (Model VI), was used to calculate REE speciation in the batch experiments. Model VI has been described in detail by Tipping [22]. The model is a discrete binding site model in which binding is modified by electrostatic interactions. There is an empirical relation between the net humic charge and an electrostatic interaction factor. The discrete binding sites are represented by two types of sites (types A and B), and within each type of site there are four different sites present in equal amounts. The two types of sites are described by intrinsic proton binding constants (pK A and pK B DQG VSUHDGV RI WKH YDOXHV S. A DQG S. B ) within each type of sites. There are n A (mol g - 1 ) A-type sites (associated with carboxylic type groups) and n B = n A /2 (mol g -1 ) B-type of sites (often associated with phenolic type groups). Metal binding occurs at single proton binding sites or by bidentate complexation between pairs of sites depending on a proximity factor that defines whether pairs of proton binding groups are close enough to form bidentate sites. Type A and Type B sites have separate intrinsic binding constants (log K MA and log K MB ), together associated ZLWK D SDUDPHWHU /. 1 , defining the spreads of values around the medians. A further parameter, /. 2 , takes into account a small number of stronger sites. By considering results from many GDWDVHWV D XQLYHUVDO DYHUDJH YDOXH RI /. 1 is obtained, and a correlation established between log

1 . 2 )

 12 . Comparison between experimental and calculated values evidences that Model VI slightly underpredicts (0 to 11 %) REE complexation by carbonate (Figs. 1.2a, b and c). Root mean square error (rmse) values represent the sum of the squares of the difference between observed and calculated values. As indicated by the rmse systematically below 0.06 (Fig. 1.

Fig. 1 . 2 -(

 12 Fig. 1. Proportion of inorganic species for (a) La, (b) Eu and (c) Lu (experimental concentrations: 50 ppb of each REE, 5 mg L -1 of HA and alkalinity of 10 -2 mol L -1 ). Squares represent

Fig. 2 .

 2 Fig. 2. Comparison between Model VI calculations and experiments. Proportion of lanthanides

  Fig. 1

  for 24 h at 60 °C to remove all possible REE contamination sources. Synthetic REE solutions were prepared from nitrate REE standards (10 ppm, Accu Trace ™ Reference Standard). All experiments were carried out at room temperature, i.e. 20 °C ± 2.

2.1. Experimental Binding of Rare Earth Elements by Humic Acid and Carbonates

All chemicals used were of analytical grade, and all the experimental solutions were prepared with doubly deionized water (MilliQ system, Millipore™). Complexes were prepared in polyethylene containers previously soaked in 10 % Ultrapure HNO 3 for 48 h at 60 °C, then rinsed with MilliQ water

Table 1 .

 1 Tipping, Modelling the solid-solution partitioning of metals in environmental systems, Environmental Geochemistry and Health 21 (1999) 299-304.[30] O. Pourret, M. Davranche, G. Gruau and A. Dia, Organic complexation of rare earth Model VI parameters for humic acid[START_REF] Tipping | Humic Ion-Binding Model VI: an improved description of the interactions of protons and metal ions with humic substances[END_REF].

	elements in natural waters: Evaluating model calculations from ultrafiltration data,
	Geochim. Cosmochim. Acta Revised version in review (2006).
	7DEOHV DQG )LJXUHV &DSWLRQV

Table 2 .

 2 Proportion of Ln species in the ultrafiltrate.

Table 1 .

 1

	Parameter Description

Table 2 .

 2

$FNQRZOHGJHPHQWV

We thank the technical staff at Rennes (M. Le Coz-Bouhnik, O. Hénin and P. Petitjean) for their assistance during the experimental and analytical work. Dr. R. E. Martinez is acknowledged for useful discussions and English corrections. This research was supported by the CPER programs 'pYHORSSHPHQW GH OD 5HFKHUFKH VXU OD 0DvWULVH GH OD 4XDOLWp GH O(DX HQ %UHWDJQH jointly funded by the French Government and the Council of Rennes Métropole. We thank two anonymous reviewers for their constructive comments.


Ivan Gazeau

Steve Kremer

Automated analysis of equivalence properties for security protocols using else branches (extended version)

In this paper we present an extension of the AKISS protocol verification tool which allows to verify equivalence properties for protocols with else branches, i.e., disequality tests. While many protocols are represented as linear sequences or inputs, outputs and equality tests, the reality is often more complex. When verifying equivalence properties one needs to model precisely the error messages sent out when equality tests fail. While ignoring these branches may often be safe when studying trace properties this is not the case for equivalence properties, as for instance witnessed by an attack on the European electronic passport. One appealing feature of our approach is that our extension re-uses the saturation procedure which is at the heart of the verification procedure of AKISS as a black box, without need to modify it. As a result we obtain the first tool that is able verify equivalence properties for protocols that may use xor and else branches. We demonstrate the tool's effectiveness on several case studies, including the AKA protocol deployed in mobile telephony.

Introduction

Security protocols are communication protocols that rely on cryptographic primitives, e.g. encryption, or digital signatures to ensure security properties, e.g., confidentiality or authentication. Well-known examples of security protocols include TLS [START_REF] Dierks | The transport layer security (TLS) protocol version 1.1. RFC 4346[END_REF], Kerberos [START_REF] Neuman | The kerberos network authentication service (v5). RFC 4120[END_REF] and IKE [START_REF] Kaufman | Internet key exchange protocol version 2 (ikev2). RFC 7296[END_REF]. These protocols are extremely difficult to design as they must ensure the expected security property, even if the network is under control of an attacker: each message sent on the network can be intercepted by the attacker, each received message potentially originates from the attacker, and the attacker may manipulate all received data by applying functions on it. Moreover, as several sessions of the protocol may be executed concurrently, one must consider all possible interleavings, and the attacker may even participate in some of these sessions as a legitimate participant. As a result, a security proof by hand is extremely tricky as it would require to explore all of the possible cases.

A successful approach to discover weaknesses in such protocols, or show their absence is to use dedicated formal verification tools. A variety of tools for analysing protocols exist: ProVerif [START_REF] Blanchet | Automatic Cryptographic Protocol Verifier, User Manual and Tutorial[END_REF], Scyther [START_REF] Cremers | The Scyther Tool: Verification, falsification, and analysis of security protocols[END_REF], Maude-NPA [START_REF] Escobar | Maude-NPA: Cryptographic protocol analysis modulo equational properties[END_REF], Tamarin [START_REF] Schmidt | The TAMARIN prover for the symbolic analysis of security protocols[END_REF], AVISPA [START_REF] Armando | The AVISPA tool for the automated validation of internet security protocols and applications[END_REF], . . . These tools were generally initially developed for verifying trace properties of rather simple protocols. In the last years there has been a large body of works for extending these tools to handle more general properties and more complex protocols.

Most tools were designed for analysing trace properties: a protocol cannot reach a bad state, e.g., a state where the attacker knows a secret value. Many important security properties are however stated in terms of indistinguishability: can an attacker distinguish two protocols? For instance real-or-random secrecy states the indistinguishability of two protocols, one outputting at the end of the run the "real" secret, used within the protocol, while the other protocol outputs a freshly generated random secret. Similarly, unlinkability can be modeled by the adversary's inability to distinguish two sessions run by the same party form two sessions run by two different parties. More generally, strong flavours of secrecy [START_REF] Blanchet | Automatic proof of strong secrecy for security protocols[END_REF], anonymity and unlinkability [START_REF] Arapinis | Analysing unlinkability and anonymity using the applied pi calculus[END_REF], as well as vote privacy [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF], are expressed as indistinguishability. This notion is naturally modelled in formal models through behavioural equivalences in cryptographic process calculi, such as the spi [START_REF] Abadi | A calculus for cryptographic protocols: The spi calculus[END_REF] and applied pi calculus [START_REF] Abadi | Mobile values, new names, and secure communication[END_REF]. During the last years, several specific tools for checking such equivalences have been developed [START_REF] Tiu | Automating open bisimulation checking for the spi-calculus[END_REF][START_REF] Cheval | Trace equivalence decision: Negative tests and non-determinism[END_REF][START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocol[END_REF], or existing tools have been extended to handle these properties [START_REF] Blanchet | Automated verification of selected equivalences for security protocols[END_REF][START_REF] Basin | Automated symbolic proofs of observational equivalence[END_REF][START_REF] Santiago | A formal definition of protocol indistinguishability and its verification using Maude-NPA[END_REF].

Similarly, many tools were designed to verify protocols that have a simple, linear execution flow: many protocol specification languages allow several roles in parallel, each consisting of a sequence of input, or output actions with the possibility to check equality between parts of messages. More complex protocols do however require branching, and allow to react differently according to whether an equality test holds or not (rather than just halting if a test fails). As demonstrated by an attack on the European electronic passport [START_REF] Chothia | A traceability attack against e-passports[END_REF], taking into account the exact error message in case a test fails may be crucial: the fact that in some versions of the passport output different error messages allowed an attacker to trace a given passport. In this paper we will extend the AKISS tool with the ability to verify protocols that have else branches.

An overview of the AKISS tool. The AKISS tool [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocol[END_REF] is a verification tool for checking indistinguishability properties. More precisely, it verifies trace equivalence in a replication free (i.e., considering a bounded number of sessions) and positive (no else branches) fragment of the applied pi calculus. The tool allows a wide range of cryptographic primitives that are specified by the means of a user defined equational theory. The tool is correct for any equational theory that can be oriented into a convergent rewrite system which has the finite variant property and was shown to guarantee termination on any subterm convergent equational theory. This class of theories include classical cryptographic primitives such as encryption, signatures and hashes, but also non-interactive zero knowledge proofs. Moreover, even though termination is not guaranteed protocols relying on blind signatures or trapdoor commitments have been successfully analysed. In addition, a recent extension of AKISS provides support for protocols that use the exclusive or (xor) operation [START_REF] Baelde | Symbolic verification of privacy-type properties for security protocols with XOR[END_REF].

In a nutshell, AKISS proceeds as follows. Protocols are translated into first-order Horn clauses. Next, the set of Horn clauses is saturated using a dedicated Horn clause resolution procedure. This saturated set of clauses provides a finite representation of all reachable states of the protocols, of the intruder knowledge and equality tests that hold on the protocol outputs. These equality tests are used by the adversary to distin-guish protocols, i.e., its aim is to find a test which holds on one protocol, but not the other. Next, AKISS uses this saturated set of Horn clauses to decide trace equivalence when the processes specifying the protocol are determinate (the precise definition of determinacy will be given in section 2). On general processes, AKISS may over-and under-approximate trace equivalence, as discussed in [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocol[END_REF].

Our contributions. Our main contribution is to extend the AKISS tool to allow more complex protocols which allow non trivial else branches. An interesting point of our approach is that we do not need to modify the saturation procedure of AKISS: we only need to saturate positive processes (in which disequality tests are ignored). The algorithm is based on the following simple observation: whenever a trace is not executable because of the failure of a disequality test t 1 = t 2 , the saturation of the process in which t 1 = t 2 is replaced by t 1 = t 2 computes all the traces that fail to execute on the original process (due to this particular disequality test). This test can then be confronted to the other process that we expect to be trace equivalent.

From a theoretical point, given that the saturation of AKISS was shown to terminate on any subterm convergent rewrite system our algorithm provides, en passant, a new decidability result for the class of subterm convergent equational theories for protocols with else branches, generalising the results of [START_REF] Baudet | Deciding security of protocols against off-line guessing attacks[END_REF][START_REF] Chevalier | Decidability of equivalence of symbolic derivations[END_REF] that do not allow else branches and the result of [START_REF] Cheval | Automating security analysis: symbolic equivalence of constraint systems[END_REF], which only applies to a particular equational theory. Moreover, the result is modular, in the sense that if we generalize the saturation procedure to other equational theories support for else branches comes for "for free". From a more practical point, we have implemented our new procedure in the AKISS tool and demonstrate its effectiveness on several case studies. Hence, we provide the first tool that is able to handle protocols that require both xor and else braches: in addition to previously analysed protocols, such as the private authentication protocol and the BAC protocol implemented in the European passport, this allows us to analyse protocols using xor, such as the AKA protocol [START_REF] Gpp | Technical specification group services and system aspects; 3G security; security architecture (release 9)[END_REF] used in 3G and 4G mobile telephony, as well as xor-based RFID protocols with key update (which requires an else branch for the modelling). A previous analysis of the AKA protocol with ProVerif replaced the use of xor with encryption [START_REF] Arapinis | New privacy issues in mobile telephony: fix and verification[END_REF]. Replacing xor by encryption may however miss attacks as it was shown by Ryan and Schneider in [START_REF] Ryan | An attack on a recursive authentication protocol. A cautionary tale[END_REF].

Related work. We consider two kinds of tools: those restricted to a bounded number of sessions (as in our work) and those that allow for an unbounded number of sessions. The first kind of tools includes the SPEC and APTE tools. SPEC [START_REF] Tiu | Automating open bisimulation checking for the spi-calculus[END_REF] allows to verify a symbolic bisimulation: it only supports a fixed equational theory (encryption, signature, hash and mac) and has no support for else branches. The APTE tool also supports a fixed equational theory (similar to SPEC), but allows else branches. Both tools are not restricted to determinate processes. Tools that allow protocol verification for an unbounded number of sessions include ProVerif, Maude NPA and Tamarin. Given that the underlying problem is undecidable when the number of sessions is not bounded, termination is not guaranteed. Each of these tools allows for else branches user-defined equational theories, but ProVerif and Tamarin do not include support for xor. While Maude NPA does support xor in principle, termination fails even on simple examples [START_REF] Santiago | A formal definition of protocol indistinguishability and its verification using Maude-NPA[END_REF]. We may also note that the support for else branches in Maude NPA is very recent [START_REF] Yang | Strand spaces with choice via a process algebra semantics[END_REF].

Finally, each of these three tools checks a more fine-grained relation that trace or observational equivalence, called diff-equivalence: this equivalence requires both processes to follow the same execution flow and is too fine-grained for some applications.

A formal model for security protocols

In this section we introduce our formal language for modelling security protocols. Messages are modelled as terms and equipped with an equational theory, that models the algebraic properties of cryptographic primitives. The protocols themselves will be modelled in a process calculus similar to the applied pi calculus [START_REF] Abadi | Mobile values, new names, and secure communication[END_REF]: protocol participants are modelled as processes and their interaction through message passing.

Term algebra

Terms are built over the following atomic messages : the set of names N , that is partitioned into private names N prv and public names N pub ; the set of message variables X , denoted x, y, . . .; the set of parameters W = {w 1 , w 2 , . . .}. Private names are used to model fresh, secret values, such as nonces or cryptographic keys. Public names represent publically known values such as identifier and are available to the attacker. Parameters allow the adversary to refer to messages that were previously output.

We consider a signature Σ, i.e., a finite set of function symbols together with their arity. Function symbols of arity 0 are called constants. Given a signature Σ and a set of atoms A we denote by T (Σ, A) the set of terms, defined as the smallest set that contains A and is closed under application of function symbols. We denote by vars(t) the set of variables occurring in a term t. A substitution is a function from variables to terms, lifted to terms homomorphically. The application of a substitution σ to a term u is written uσ, and we denote dom(σ) its domain, i.e. dom(σ) = {x | σ(x) = x}. We denote the identity substitution whose domain is the empty set by ∅.

We equip the signature Σ with an equational theory E: an equational theory is defined by a set of equations M = N with M, N ∈ T (Σ, X ). The equational theory E induces an equivalence relation = E on terms: = E is the smallest equivalence on terms, which contains all equations M = N in E, is closed under application of function symbols and substitutions of variables by terms.

Example 1. As an example we model the exclusive-or operator. Let Σ xor = {⊕, 0}, and the equational theory E xor defined by the following equations:

x ⊕ x = 0 x ⊕ (y ⊕ z) = (x ⊕ y) ⊕ z x ⊕ 0 = x x ⊕ y = y ⊕ x
Additional primitives, e.g. pairs, symmetric and asymmetric encryptions, signatures, hashes, etc, can be modelled by extending the signature and equational theory. andE + xor be defined by extending E xor with the following equations : proj 1 ( x, y ) = x, and proj 2 ( x, y ) = y.

Example 2. Let Σ + xor = Σ xor { •, • , proj 1 , proj 2 , h},
The symbol •, • models pairs and proj 1 and proj 2 projections of the first and second element. The unary symbol h models a cryptographic hash function. Let AU T N = SQN N ⊕ AK, M AC , then we have proj 1 (AU T N ) ⊕ AK = E SQN N .

As we build on the AKISS tool [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocol[END_REF][START_REF] Baelde | Symbolic verification of privacy-type properties for security protocols with XOR[END_REF] we suppose in the following that the signature and equational theory are an extension the theory of exclusive or, i.e., Σ is such that

Σ xor ⊆ Σ and E = E xor ∪ {M = N | M, N ∈ T (Σ Σ xor , X )}.
and that E can be oriented into a convergent rewrite system which has the finite variant property. This allows to model a wide range of cryptographic primitives, including symmetric and asymmetric encryption, digital signatures, hash functions and also zero knowledge proofs or blind signatures. We refer the reader to [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocol[END_REF] for the precise technical definitions, which are not crucial for this paper.

Process calculus

Syntax Let Ch be a set of public channel names. A protocol is a set of processes and a process is generated by the following grammar: P, P , P 1 , P 2 ::= 0 null process in(c, x).P input out(c, t).P output

[s = t].P test = [s = t].P test =
where x ∈ X , s, t ∈ T (Σ, N ∪ X ), and c ∈ Ch.

A receive action in(c, x) acts as a binding construct for the variable x and free and bound variables of processes are defined as usual. We also assume that each variable is bound at most once. A process is ground if it does not contain any free variables. For sake of conciseness, we sometimes omit the null process at the end of a process.

Following [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocol[END_REF], we only consider a minimalistic core calculus. Given that we only consider a bounded number of sessions (i.e., a process calculus without replication) and that we aim at verifying trace equivalence, parallel composition, denoted P Q can be added as syntactic sugar to denote the set of all interleavings at a cost of an exponential blow-up (see [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocol[END_REF]). Similarly, we can encode conditionals: a process

if t 1 = t 2 then P else Q can be encoded by the set {[t 1 = t 2 ].P, [t 1 = t 2 ]
.Q}. As usual we omit else Q when Q = 0 and sometimes write if t 1 = t 2 then P else Q for if t 1 = t 2 then Q else P . This will ease the specification of protocols and improve readability. A protocol typically consists of the set of all possible interleavings. Example 3. As an example consider a simplified version of the AKA protocol, which is vulnerable to replay attacks, depicted in Figure 1. The network (NS) and mobile station (MS) share a secret key k IM SI . NS generates a nonce r which it sends to MS together with f(k IM SI , r) where f models a message authentication code (MAC). MS verifies the MAC: if successful it sends another MAC based on function f 2 and generates sessions keys from r and k IM SI ; otherwise, it sends an error message. NS checks whether the received message is the expected MAC or the error message. In case the MAC is received it generates the sessions keys; otherwise it starts a recovery protocol.

N S = out(c, r, f(k IM SI , r) ).in(c, x).if x = f 2 (k IM SI , r) then out(c, RECOVER) M S = in(c, y). if y = f(k IM SI , r) then out(c, MAC FAIL) else out(c, f 2 (k IM SI , r))
If we skip the actions [x = f 2 (k IM SI , r)].out(c, RECOVER), the protocol corresponds to a set of 12 processes which include, for instance, the 4 following processes.

out(c, r, f(k IM SI , r) ).in(c, y).[y = f(k IM SI , r)].out(c, MAC FAIL).in(c, x) out(c, r, f(k IM SI , r) ).in(c, y).[y = f(k IM SI , r)].out(c, f 2 (k IM SI , r)).in(c, x) out(c, r, f(k IM SI , r) ).in(c, y).in(c, x).[y = f(k IM SI , r)].out(c, MAC FAIL) out(c, r, f(k IM SI , r) ).in(c, y).in(c, x).[y = f(k IM SI , r)].out(c, f 2 (k IM SI , r))
Note that since a test is an invisible action, there is no need to consider traces where a test does not strictly precede its following action. The correctness of this optimization is proven in [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocol[END_REF].

Semantics In order to define the operational semantics of our process calculus we define the notion of message deduction. Intuitively, message deduction models which new messages an intruder can construct from previously learnt messages. The messages output during a protocol execution are presented by a frame:

ϕ = {w 1 → t 1 , . . . , w → t }
A frame is a substitution dom(ϕ) = {w 1 , . . . , w }. An intruder may refer to the ith term through the parameter w i . Definition 1. Let ϕ be a frame, t ∈ T (Σ, N ) and R ∈ T (Σ, N pub ∪ dom(ϕ)). We say that t is deducible from ϕ using R, written ϕ R t, when Rϕ = E t.

Intuitively, an attacker can deduce new messages by applying function symbols in Σ to public names (in N pub ) and terms he already knows (those in ϕ). The term R is called a recipe.

A configuration is a pair (P, ϕ) where P is a ground process, and ϕ is a frame. The operational semantics is defined as a labelled transition relation on configurations -→ where is either an input, an output, or an unobservable action test defined as follows:

RECV (in(c, x).P, ϕ) in(c,R) ----→ (P {x → t}, ϕ) if ϕ R t SEND (out(c, t).P, ϕ) out(c) ---→ (P, ϕ ∪ {w |ϕ|+1 → t}) TEST = ([s = t].P, ϕ) test --→ (P, ϕ) if s = E t TEST = ([s = t].P, ϕ) test --→ (P, ϕ) if s = E t
Intuitively, the labels have the following meaning:

-in(c, R) represents the input of a message sent by the attacker on channel c and the message is deduced using recipe R; -out(c) represents the output of a message on channel c (adding the message to the frame); -test represents the evaluation of a conditional (in the equational theory). -----→ (P , ϕ ), and similarly for = ⇒.

Trace equivalence

The fact that an attacker cannot distinguish two protocols will be modelled through trace equivalence. We first define the notion of a test which an attacker may apply on a frame to try to distinguish two processes.

Definition 2. Let ϕ be a frame and R 1 , R 2 be two terms in T (Σ, N pub ∪ dom(ϕ)).

The test R 1 ? = R 2 holds on frame ϕ, written (R 1 = R 2 )ϕ, if R 1 ϕ = E R 2 ϕ.
Trace equivalence of processes P and Q states that any test that holds on process P (after some execution) also holds on process Q after the same execution.

Definition 3 ([15]).

A protocol P is trace included in a protocol Q, denoted P Q, if whenever (P, ∅) 1 ,..., n = ==== ⇒ (P, ϕ) and (R 1 = R 2 )ϕ, then there exists a configuration (Q , ϕ ) such that (Q, ∅) 1 ,..., n = ==== ⇒ (Q , ϕ ) and (R 1 = R 2 )ϕ . We say that P and Q are equivalent, written P ≈ Q, if P Q and Q P.
This notion of equivalence does not coincide with the usual notion of trace equivalence as defined e.g. in [START_REF] Cheval | Deciding equivalence-based properties using constraint solving[END_REF]. It is actually coarser and is therefore sound for finding attacks. However, it has been shown that the classical and above defined notions coincide for the class of determinate processes [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocol[END_REF]. Definition 4 ([15]). We say that a protocol P is determinate if whenever (P, ∅) = R 2 , we have that:

(R 1 = R 2 )ϕ if, and only if (R 1 = R 2 )ϕ .
Determinacy of a protocol can be achieved through sufficient syntactic conditions, e.g. enforcing action-determinism [START_REF] Baelde | Partial order reduction for security protocols[END_REF]: all executions of an action determinate process ensure that we cannot reach a process P where the same action may lead to two different processes, e.g. we forbid the set of processes generated by (out(c, a).P 1 ) ((out(c, b).P 2 ) but allow (out(c 1 , a).P 1 ) ((out(c 2 , b).P 2 ). Action-determinism is automatically checked by AKISS. Whenever processes are not determinate, the above equivalence can be used to disprove trace equivalence, i.e., find attacks. The capability of AKISS to under approximate trace equivalence consists in finding a one-to-one mapping between each process of P and Q such that the pair of processes, which are determinate by construction, are equivalent. Such an approach is still possible with our procedure. In this paper we develop a procedure which checks trace equivalence on determinate processes and may be used for finding attacks on general processes.

Modelling using Horn clauses

(P0, ϕ0) |= r 1 ,..., n if (P0, ϕ0) L 1 --→ (P1, ϕ1) . . . Ln --→ (Pn, ϕn) such that i =E Liϕi-1 for all 1 ≤ i ≤ n (P0, ϕ0) |= k 1 ,..., n (R, t) if when (P0, ϕ0) L 1 --→ (P1, ϕ1) L 2 --→ . . . Ln --→ (Pn, ϕn) such that i =E Liϕi-1 for all 1 ≤ i ≤ n, then ϕn R t (P0, ϕ0) |= i 1 ,..., n (R, R ) if there exists t such that (P0, ϕ0) |= k 1 ,..., n (R, t) and (P0, ϕ0) |= k 1 ,..., n (R , t) (P0, ϕ0) |= ri 1 ,..., n (R, R ) if (P0, ϕ0) |= r 1 ,..., n and (P0, ϕ0) |= i 1 ,..., n (R, R )

Fig. 2: Semantics of atomic formulas

Our decision procedure is based on a fully abstract modelling of a process in firstorder Horn clauses which has initially been developed in [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocol[END_REF] and adapted to support the Xor operator in [START_REF] Baelde | Symbolic verification of privacy-type properties for security protocols with XOR[END_REF]. In this section we recall the main definitions and theorems of [START_REF] Baelde | Symbolic verification of privacy-type properties for security protocols with XOR[END_REF].

Predicates

We define the set of symbolic runs, denoted u, v, w, . . ., as the set of finite sequences of symbolic labels:

u, v, w := | , w with ∈ {in(c, t), out(c), test | t ∈ T (Σ, N ∪ X ), c ∈ Ch}
The empty sequence is denoted by . Intuitively, a symbolic run stands for a set of possible runs of the protocol. We denote u E v when u is a prefix (modulo E) of v.

We assume a set Y of recipe variables disjoint from X , and we use capital letters X, Y, Z to range over Y. We assume that such variables may only be substituted by terms in T (Σ, N pub ∪ W ∪ Y).

We consider four kinds of predicates over which we construct the atomic formulas of our logic. Below, w denotes a symbolic run, R, R are terms in T (Σ, N pub ∪ W ∪ Y), and t is a term in T (Σ, N ∪X ). Informally, these predicates have the following meaning (see Figure 2 for the formal semantics).

r w holds when the run represented by w is executable; -k w (R, t) holds if whenever the run represented by w is executable, the message t can be constructed by the intruder using the recipe R; -i w (R, R ) holds if whenever the run w is executable, R and R are recipes for the same term; and ri w (R, R ) is a short form for the conjunction of the predicates r w and i w (R, R ).

A (ground) atomic formula is interpreted over a pair consisting of a process P and a frame ϕ, and we write (P, ϕ) |= f when the atomic formula f holds for (P, ϕ) or simply P |= f when ϕ is the empty frame. We consider first-order formulas built over the above atomic formulas and the usual connectives (conjunction, disjunction, negation, implication, existential and universal quantification). The semantics is defined as expected, but the domain of quantified variables depends on their type: variables in X may be mapped to any term in T (Σ, N ), while recipe variables in Y are mapped to recipes, i.e. terms in T (Σ, N pub ∪ W).

Statements and saturation

We now identify a subset of the formulas, which we call statements. Statements will take the form of Horn clauses, and we shall be mainly concerned with them.

Definition 5 ([15]

). A statement is a Horn clause of the form H ⇐ k u1 (X 1 , t 1 ), . . . , k un (X n , t n ) where:

-H ∈ {r u0 , k u0 (R, t), i u0 (R, R ), ri u0 (R, R )}; -u 0 , u 1 , . . . , u n are symbolic runs such that u i E u 0 for any i ∈ {1, . . . , n}; -t, t 1 , . . . , t n ∈ T (Σ, N ∪ X ); -R, R ∈ T (Σ, N pub ∪ W ∪ Y); and -X 1 , . . . , X n are distinct variables from Y.
Lastly, vars(t) ⊆ vars(t 1 , . . . , t n ) when H = k u0 (R, t).

In the definition above, we implicitly assume that all variables are universally quantified, i.e. all statements are ground. By abuse of language we sometimes call σ a grounding substitution for a statement H ⇐ B 1 , . . . , B n when σ is grounding for each of the atomic formulas H, B 1 , . . . , B n .

In [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocol[END_REF], the authors present a saturation-based procedure sat that given a ground process P produces a fully abstract set of solved statements sat(P ). The procedure starts by translating P and the equational theory into a finite set of statements. Then this set is saturated by applying Horn clause resolution rules. Finally, if the procedure terminates (which is guaranteed for subterm convergent equational theories), the set of solved statements K produced by the saturation procedure is a sound and complete abstraction of P : any statement that holds on the protocol P is a logical consequence of K. The notion of logical consequence is formalised through the (infinite) set H e (K).

Definition 6 ([8]

). Given a set K of statements, H(K) is the smallest set of ground facts that is closed under the rules of Figure 3. We define H e (K) to be the smallest set of ground facts containing H(K) and that is closed under the rules of Figure 4.

CONSEQ EXTEND f = H ⇐ B1, . . . , Bn ∈ K σ grounding for f B1σ ∈ H(K), . . . , Bnσ ∈ H(K) Hσ ∈ H(K) ku(R, t) ∈ H(K) kuv(R, t) ∈ H(K)
Fig. 3: Rules of H(K)

REFL iw(R, R) ∈ He(K) CONG iw(R1, R 1 ), . . . , iw(Rn, R n ) ∈ He(K) f ∈ Σ iw(f(R1, . . . Rn), f(R 1 , . . . R n )) ∈ He(K) EXT iu(R, R ) ∈ He(K) iuv(R, R ) ∈ He(K) EQ. CONSEQ. kw(R, t) ∈ H(K) iw(R, R ) ∈ He(K) kw(R , t) ∈ He(K)
Fig. 4: Rules of H e (K)

Theorem 1 ( [START_REF] Baelde | Symbolic verification of privacy-type properties for security protocols with XOR[END_REF]). Let K = sat(P ) for some ground process P . We have that:

-P |= f for any f ∈ K ∪ H e (K); -If (P, ∅) L1,...,Ln ------→ (Q, ϕ) then 1. r L1ϕ,...,Lnϕ ∈ E H e (K); 2. if ϕ R t then k L1ϕ,...,Lnϕ (R, t) ∈ E H e (K); 3. if ϕ R t and ϕ R t, then i L1ϕ,...,Lnϕ (R, R ) ∈ E H e (K).

Algorithm

We first introduce a few notations and preliminary definitions. We start by introducing the recipe function: its goal is to associate a sequence of labels to a symbolic run and a positive process (in the labels we replace the input terms of the symbolic run by the recipes used to deduce them).

Definition 7. Given a positive process P and a symbolic run 1 , . . . , k we define a function rec

P ( 1 . . . k ) = L 1 . . . L k where L i = in(c, R) if i = in(c, t) and k 1... i-1 (R, t) ∈ H(sat(P ) ∪ K) i otherwise and K = {k (X i , x i ) | 1 ≤ i ≤ n, vars( 1 , . . . , k ) = {x 1 , . . . x n }, X 1 , . . . X n ∈
Y are pairwise distinct and fresh}.

Note that several functions may satisfy the specification of this definition. Here we consider any possible implementation of this specification, e.g., the one presented in [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocol[END_REF]. The complicated case is when the symbolic label is an input: in that case we need to retrieve the corresponding recipe in sat(P ). As the symbolic labels may not be closed we simply enhance sat(P ) with a recipe X for each variable x (the set K).

To check equivalence between processes we rely on the notion of reachable identity test written RId L1,...,L k (R, R ) where L 1 , . . . , L k are (not necessarily ground) labels and R, R (not necessarily ground) recipes. For a test t we denote by lbl(t) its sequence of labels L 1 , . . . , L k . For commodity reason, we also define a reachability test as: R L1,...,L k =RId L1,...,L k (0, 0).

Given a ground process P and a test t the predicate Ver P (t) checks whether t holds in P . We define Ver P (RId L1,...,L k )(R, R ) to hold when (P, ∅)

L1σ,...,L k σ = ====== ⇒ (P , ϕ) and (Rσ = R σ)ϕ where σ is a bijection from vars(L 1 , . . . , L k , R, R ) to fresh names {c 1 , . . . , c n }. Finally the predicate is lifted to protocols and we write Ver P (t) for ∃P ∈ P. Ver P (t).

We note that when Ver P (t) holds and P is positive then Ver P (tσ) holds for any σ, as equality is stable by substitution. However, a disequality may hold when instantiated by distinct fresh names, while a different instantiation may make the test fail.

Next we define the process rm = (P ) which simply removes all inequality tests. Given a process P we define the set of reachable identity tests Test RId (P ).

Test

RId (P ) = {RId L1,...,L k (R, R ) | ri 1 ,..., k (R, R ) ⇐ k u1 (X 1 , x 1 ), . . . , k un (X n , x n ) ∈ sat(rm = (P )), L 1 , . . . , L k = (rec P ( 1 , . . . , k ))σ where σ = {X j → X min{i|xi=xj } | 1 ≤ j ≤ k}, Ver P (RId L1,...,L k (R, R ))}
We also define reachability tests Test R (P ) for a process P :

Test R (P ) = {t | t ∈ Test RId (P ), ∃L 1 , . . . , L k , t = R L1,...,L k }
We note that we can only apply the sat function to positive processes. If P was already a positive process Ver P (t) would hold for each of the constructed tests because of the soundness of sat. However, in general, Ver rm = (P ) (t) may hold while Ver P (t) does not hold, which is why we explicitly test the validity of t in P .

In [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocol[END_REF] it is shown that given a positive ground process P and a positive determinate protocol Q, we have that

P t Q iff ∀t ∈ Test RId (P ). Ver Q (t)
which can be used to check trace inclusion between protocols (as P t Q iff ∀P ∈ P.P t Q) and trace equivalence (as P ≈ t Q iff P t Q and Q t P). This result does however not hold for processes with disequality tests. (c,a). We have that P ≈ t Q but all tests that hold on P also hold on Q (and vice-versa). In particular

R in(c,X).out(c) ∈ Test R (P ) holds in Q, as (Q, ∅) in(c,c1).out(c) ========⇒ (0, ϕ) for a fresh name c 1 .
Whenever a test holds on rm = (P ) but not on P , it must be that a disequality test in P did not hold. We therefore compute the complement of a process, which is the set of positive processes which transforms a disequality into an equality and removes remaining disequalities. Definition 9. Let P be a process such that We easily see that we have the following property.

P = P 1 .[t 1 =
Lemma 1. Let P be a process and t a test. We have that Ver rm = (P ) (t) iff either Ver P (t) or Ver comp(P ) (t)

Lastly, before explaining our algorithm we need to introduce the shrink operator on processes which is used in conjunction with the Inst operators on sequences of labels. Given a process P and a sequence of labels lbl we define a process that only executes instances of lbl (up to test actions which are ignored). In the following we suppose that variables in Y, X and names in N are totally ordered by an order < Y , < X resp. < N .

Definition 10. Let P be a process, lbl a sequence of labels, σ an increasing bijection from vars(lbl) ∩ Y to a set of fresh and pairwise distinct term variable in X , θ an increasing bijection from vars(lbl) ∩ Y to a set of fresh and pairwise distinct names in N , such that (P, ∅) L1θ,...,Lnθ = ====== ⇒ (P , ϕ). Let lbl 0 be the subsequence of lbl obtained by removing all test labels. We define shrink lbl (P ) as shr ∅ lbl0 (P ) where

-shr v lbl ([s ∼ t].P ) = [s ∼ t].shr v lbl (P ) for ∼∈ {=, =} -shr v out(c)•lbl (out(c, t).P ) = out(c, t).shr v lbl (P ), -shr v in(c,R)•lbl (in(c, x).P ) = in(c s , X 1 σ). . . . .in(c s , X n σ).in(c, x).[x = Rϕθ -1 σ].shr vars(R)∪v lblσ (P )
where vars(R) ∩ Y \ v = {X 1 , . . . , X n } and X i < X i+1 , -0 otherwise and c s is a dedicated channel not appearing in P .

Note that the function shrink depends on the chosen bijection but this only changes the process up to alpha renaming. Note that we cannot force an execution to contain an instance of a particular recipe R. The inserted test [x = Rϕσ] only ensures that the input of x is produced by some recipe R such that (Rσ = R )ϕ . We therefore additionally add inputs in(c s , x i ) which will allow us to retrieve instance Rθ of R that yields the same protocol message as R.

Definition 11. Let lbl, lbl be sequences of labels. If

in(lbl) = in(c s , R 1 1 ) . . . in(c s , R n1 1 ).in(c 1 , R 1 ). . . . .in(c s , R k 1 ) . . . in(c s , R n k k ).in(c k , R k ); in(lbl ) = in(c 1 , R 1 ). . . . .in(c k , R k ) and vars(R i ) \ j<i vars(R j ) = {X 1 i , . . . , X ni i } with X j i < X j+1 i then we define Inst(lbl, lbl ) = {X j i → R j i | 1 ≤ i ≤ k, 1 ≤ j ≤ n i }. Otherwise Inst(lbl, lbl ) = ⊥.
Example 5. Let P = in(c, x).out(c, 0) be a process and lbl = in(c, Y, 0 ), out(c) a sequence of labels. Consider two bijections σ = {Y → y} and θ = {Y → a}. The process shrink lbl (P ) = in(c s , y).in(c, x).[x = y, 0 ].out(c, 0) allows to identify the recipes Y such that (P, ϕ) lblσ --→ (P , ϕ ). Indeed, assume Test R (shrink lbl (P )) contains r = R in(cs,h(0)).in(c, h(0),0 .out(c) , then rτ = R in(c, h(0),0 .out(c) where τ = Inst(lbl, lbl(r)) is such that Ver rτ (P ) and lbl(rτ ) is an instance of l.

The algorithm Equiv for verifying trace equivalence on determinate processes is detailed in Algorithm 1.

Theorem 2. Let P and Q be two determinate protocols. Then we have that

P ≈ t Q iff Equiv(P ≈ t Q)
The algorithm proceeds as follows. For each P ∈ P we check whether all traces of P are included in Q. For this we compute the set Rid P of reachable identity tests that hold in P and that need to be checked on Q. We next pick a test rid from the set (and remove it from the set, denoted rid := pop(Rid P )) and check whether this test holds for some process Q in Q. If this is not the case we violate trace equivalence. Otherwise we need to perform additional checks: indeed even if the test rid holds, an instance of rid might not hold on Q but still hold in P . Consider the following simple example:

P = in(c, x).out(c, a) Q 1 = in(c, x).[x = a].out(c, a) Q = {Q 1 , Q 2 } Q 2 = in(c, x).[x = a].out(c, a)
Algorithm 1: Decision procedure for P ≈ t Q

Function Check(P, Q) Input: Process P , protocol Q Output: Boolean RidP := Test RId (P ); while RidP = ∅ do rid := pop(RidP ); Note that P ≈ t Q. Let rid = RId in(c,X).out(c) (a, a). This test holds in Q 1 . However, the more instantiated test RId in(c,a).out(c) (a, a) would not hold. (Note that the test may actually only fail because reachability is violated.) We therefore need to identify the instances of rid Q 1 that do not hold on Q 1 . The process shrink Q (lbl(rid)) defines the process that only verifies instances of rid. Computing its complement defines the processes that verify the instances of rid that are not verified by Q: in our example we would identify the test r = R in(c,a).out(c) , as computing the complement transforms

SQ := {Q ∈ Q | VerQ(rid)}; if SQ = ∅ then return false; Q := pop(SQ); foreach Q ∈ comp(shrink lbl(rid) (Q)) do R Q := {r ∈ Test R (Q) | |lbl(r)| = |Q|}; foreach r ∈ R Q do σ := Inst(lbl(
[x = a] into [x = a]
. Finally, we check whether r is verified by P . If this is the case, we add the more instantiated test RId in(c,a).out(c) (a, a) to the set Rid P of tests to be checked. We note that the fact that Q 1 does not verify r, but P does is not yet a violation of trace equivalence: another trace in Q may well verify the instantiated test.

In our example, indeed the process Q 2 verifies RId in(c,a).out(c) (a, a). Theorem 2 above ensures partial correctness, i.e., soundness and completeness. We now state that total correctness only depends on the termination of sat. Theorem 3. If procedure sat terminates then procedure Equiv terminates.

As it was shown in [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocol[END_REF], termination of sat is ensured for a wide class of subterm convergent equational theories. While sat may not terminate in general on other theories such as xor, or blind signatures, the tool does terminate in practice on a wide range of examples [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocol[END_REF][START_REF] Baelde | Symbolic verification of privacy-type properties for security protocols with XOR[END_REF] (and Theorem 2 ensures the correctness of the result).

Implementation and case studies 5.1 The AKISS tool

In addition to parallel composition P Q and conditionals AKISS also supports nondeterministic choice P ++ Q, sequences P :: Q and phases P > > Q, which are convenient for defining complex scenarios under which we analyse protocols. A sequence P :: Q contains all sequences of a trace of P followed by a trace of Q while the set of traces for a phase P > > Q contains all traces made of the beginning of a trace of P followed by a full trace of Q.

We model unlinkability for two sessions in each of the protocols below as follows:

P 1 A > > P 2 A ≈ P 1 A > > P 2 B
The attacker first interacts with a first session of protocol P executed by A, denoted P 1 A . Then, in a new phase he interacts with a second session of the protocol, which is either executed by A (process P 2 A ) or by B (process P 2 A ). The protocol P satisfies unlinkability if the two scenarios cannot be distinguished. Note that the use of the phase operator is preferable to the sequential composition, as an attacker may not be able to finish the first session completely before starting the second session.

The implementation of the tool and the files corresponding to our case studies are freely available at https://github.com/akiss/.

The AKA protocol

Unlike the simplified version of AKA described in Figure 1, the actual AKA protocol (Figure 5) provides a mechanism against replay attacks. In addition to the mac value, both the network and the mobile station store a counter SQN used as a timestamps: each time the network station starts a session with a same mobile station, it sends in addition to the random value and the mac an obfuscated message SQN ⊕ k IM SI containing the incremented value of the counter. The mobile stores the maximum value which has been received. If the received value is not strictly greater than this maximum, the mobile sends a synchronization error message. Otherwise it updates the stored value.

Unlinkability is modelled as explained above: in a first session a mobile station A interacts with the network station and in a second session either mobile A or mobile B interact with the network station. The AKISS tool does not allow for comparison of integer. Instead we just check that the sent value was not the same as a previous one. Therefore during the first phase, since there was no SQN value sent to the mobile there is no need to perform a check while in the second session of the mobile A (in the first scenario) we check that the new SQN value is distinct from the first time.

Using the AKISS tool we find the (previously known) attack consisting of observing the first phase and sending the network station's message of the first phase in the second one: if the second phase is with the same mobile station then it sends a synchronization error message while if its another mobile station it sends a mac error message. Running our tool on a 30 core Intel(R) Xeon(R) CPU E5-2687W v3 @ 3.10GHz, the attack is found in 3 minutes.

Unlinkability on some other protocols

We also analysed the Basic Access Control (BAC) protocol [START_REF]Machine readable travel documents[END_REF], the Private Authentication Protocol (PAP) [START_REF] Abadi | Private authentication[END_REF] and two RFID protocols [START_REF] Van Deursen | Attacks on RFID protocols[END_REF]: LAK and SLK.

All these protocols use else branches to send error messages except for the LAK RFID protocol. However, even though this protocol does not contain branches, the scenarios required for expressing unlinkability does requires the use of an else branch for the key update. Indeed, when a session succeeds, the key is updated for the next session, while the previous key is reused in case of failure. This results into an if then else structure. Finally, for the SLK and LAK protocols where both the tag and the reader update their data, the scenarios to consider for two sessions are the following.

P same = ((T ag Aa Reader a ) > > (T ag A Reader)) ++ ((T ag A (Reader a > > 0)) :: (T ag Au Reader)) ++ (((T ag Aa > > 0) Reader) :: (T ag A Reader u )) ++ ((T ag A Reader) :: (T tag Au Reader u ))
The roles with index u model the role with a preliminary update if test then R else R where R is R with updated values. As the update test is not defined before all inputs have been received, we introduce R a for each role R to be the process where the last input and the update test are missing (and moreover the construct R > > 0 allows the adversary to stop that instance of the role even earlier): in this case, the update will not happen anyway. Therefore, our scenario has four cases depending on whether the tag, the reader, both or none have reached the update test or not. The scenario where the instances of the tags corresponds to different tag is similar.

Pdiff = ((T ag A Reader a ) > > (T ag B Reader)) ++ (((T ag A > > 0) Reader) :: (T ag B Reader u ))
Note that as we consider a different tag in the second session we do not need to worry whether T ag A was updated or not.

The AKISS tool establishes the equivalence for PAP in 4s. It finds known attacks on BAC in 1m30, on SLK in 6s and in 7h for LAK. The much longer time for LAK is due to the particular use of xor which leads to complex unifiers.

Conclusion

In this paper we present an extension of AKISS which allows automated verification of protocols with else branches. An appealing aspect of our approach is that we do not modify the saturation procedure underlying the AKISS tool. As a result we obtain a new decidability result for the class of subterm convergent equational theories and an effective automated analysis tool. We have been able to analyse several protocols including the AKA protocol, and RFID protocols which require both support for xor and else branches.

A The AKA protocol

MS kIMSI , SQNMS NETWORK kIMSI , SQNN nonce r AK ← f5(kIMSI , r) M AC ← f1(kIMSI , SQNN , r ) AU T N ← SQNN ⊕ kIMSI , M AC AU T H REQ, r, AU T N AK ← f5(kIMSI , r) XM SG ← π1(AU T N ) XM AC ← π2(AU T N ) XSQN ← XM SG ⊕ kIMSI M AC ← f1(kIMSI , XSQN, r ) if M AC = XM AC then RES ← MAC FAIL else if XSQN ≤ SQNMS then RES ← SY N C F AIL else RES ← f2(kIMSI , r) AU T H RESP, RES sessions keys SQNMS ← XSQN if RES = f2(kIMSI , r) then RECOVER else set sessions keys SQNN ← SQNN + 1

B Saturation

This section contains the definitions and lemmas from [START_REF] Baelde | Symbolic verification of privacy-type properties for security protocols with XOR[END_REF] which are needed for the proof of the algorithm.

We start by introducing a variant of H, called H , where uses of f + 0 clauses is constrained. Derivations establishing H ∈ H (K) (for some ground fact H) are essentially derivations of H ∈ H(K), decorated with + andannotations. In addition to it, we impose that EXTEND rules are only applied in H -derivations, and never repeatedly; this is done through s and e annotations.

Definition 12. Given a solved knowledge K, we define

H (K), H + (K), H -(K), H s -(K)
and H e -(K) to be the smallest sets of ground facts such that:

-H -(K) = H s -(K) ∪ H e -(K), -H (K) = H -(K) ∪ H + (K), and STD f = H ⇐ B 1 , . . . , B n ∈ K \ f + 0 B 1 σ, . . . , B n σ ∈ H (K) with skel(f σ) in normal form Hσ ∈ H s -(K) SUM f = H ⇐ B 1 , B 2 ∈ f + 0 B 1 σ, B 2 σ ∈ H (K) with skel(f σ) in normal form Hσ ∈ H + (K) EXTEND' k u (R, t) ∈ H s -(K) k uv (R, t) ∈ H e -(K) The sets of derivations associated to H(K), H (K), H -(K), H s -(K), H e -(K) and H + (K) are respectively denoted by Π(K), Π (K), Π -(K), Π s -(K), Π e -(K) and Π + (K).
We consider a solved knowledge base K, and we introduce the following notation:

1. the extraction extract(π) of a derivation tree π ∈ Π (K) is the set of derivation trees {π} in case π ∈ Π -(K); and extract(π 1 ) ∪ extract(π 2 ) where π 1 and π 2 are the immediate sub-derivation trees of π in case π ∈ Π + (K). 2. the size S(π) of a derivation tree π ∈ Π (K) is the number of nodes occurring in π excluding EXTEND' nodes. 3. the real world W(π) of a derivation tree π ∈ Π (K) whose root is labeled with k w (R, t) is w in case π ∈ Π e -(K), and W(π) = W(π ) where π is the immediate sub-derivation tree of π otherwise. 4. the l-restricted size Ŝl (π) of a derivation tree π ∈ Π (K) whose immediate subderivation tree are π 1 , . . . , π n is

1≤i≤n {S(π i ) | W( π i ) ≥ l}
Such a measure allows us to define the set H (l,κ) e (K) with l, κ ∈ N as the smallest set of facts that:

contains any H ∈ H (K) which has a derivation tree π ∈ Π (K) such that Ŝl (π) ≤ κ; and that is closed under the same rules as H e . Lemma 2. Let K be a saturated knowledge base. If r u ∈ H(K solved ), i u (R, R ) ∈ H(K solved ) then there exist a derivation tree π ∈ Π (K solved ) of i u (R, R and ri u (R, R ) ∈ H (|u|,κ) e (K solved ) with κ = Ŝ|u| (π). Lemma 3. Let K be a saturated knowledge base. If k u (R, t) has a derivation tree π ∈ Π (K solved ) and k uv (R , t) has a derivation tree π ∈ Π (K solved ) then i uv (R, R ) ∈ H (l,κ) e (K solved ) with κ ≤ Ŝl (π) + Ŝl (π ).

C Proof of the algorithm C.1 Correction of the algorithm

In this section we prove the two sides of Theorem 2 with Proposition 1 and Proposition 2 as well as Theorem 3. In the following we suppose that the equational theory has been in oriented in an AC-convergent rewrite system, as in [START_REF] Baelde | Symbolic verification of privacy-type properties for security protocols with XOR[END_REF].

Lemma 1. Let P be a process and t a test. We have that Ver rm = (P ) (t) iff either Ver P (t) or Ver comp(P ) (t)

Proof. We prove both directions separately.

⇐ If either Ver P (t) or Ver comp(P ) (t) we have that Ver rm = (P ) (t) as rm = (P ) has less tests and hence less constraints on the transitions. ⇒ If Ver rm = (P ) (t) and Ver P (t) fails then at least one disequality test fails in the execution of the trace t. However the process in comp(P ) which has replaced this test by an equality test and removed all other will pass. Finally, we cannot have both Ver P (t) and Ver comp(P ) (t). Indeed, if all inequalities pass in the execution of t on P then for each process in comp(P ) one equality test fails.

Lemma 4. Let {P 1 , . . . , P n } = comp(P ) and lbl a sequence of labels. We have that {shrink lbl (P 1 ), . . . , shrink lbl (P n )} = comp(shrink lbl (P ))

Proof. The shrink functions only changes input while the comp function operates on disequality tests.

Lemma 5. Let P be a ground process. Let M 1 , . . . , M n such that (P, ∅) M1,...,Mn ======⇒ (P , ϕ). For all substitution σ from vars(M 1 , . . . , M n ) to recipes, there exists recipes R 1,1 , . . . , R 1,k1 , . . . , R n,1 , . . . , R n,kn such that (shrink M1,...,Mn (P ), ∅) in(cs,R1,1),...,in(cs,R 1,k 1 ),M1σ,...,in(cs,Rn,1),...,in(cs,Rn,n 1 ),Mnσ = ========================================= ⇒ (P , ϕ ) where ϕ ⊂ ϕ .

Proof. The recipes are the one provided by σ. Lemma 6. Let a labels sequence N 1 , . . . , N m such that (shrink M1,...,Mn (P )) N1,...,Nm ------→ (P , ϕ). Let N 1 , . . . , N n the labels of N 1 . . . , N m which are not inputs of the dedicated channel c s . We have σ = Inst((N 1 , . . . , N m ), (M 1 , . . . , M n )) such that M i σϕ = N i ϕ for all 1 ≤ i ≤ n.

Proof. This result is immediate from the fact that the shrink function adds the suitable tests in the shrunk process.

Lemma 7. Let P be a ground process without inequalities, {c 1 , . . . , c k } be public names not occurring in P , θ : {c 1 , . . . , c k } → T (Σ, N ), and θ : {c 1 , . . . , c k } → T (Σ, N pub ∪ W).

If P |= r w , P |= k w (R, t), and P |= k wθ (c i θ , c i θ) then P |= k wθ (Rθ , tθ).

Proof. Suppose that P |= r wθ . Otherwise the conclusion trivially follows from the semantics of the k predicate. Let w = 1 . . . n .

As P |= r w , we have that (P, ∅) L1,...,Ln = ===== ⇒ (Q, ϕ) such that for all 1 ≤ i ≤ n it holds that L i ϕ↓ = AC i ↓.

As P |= r wθ , we have that (P, ∅)

L 1 ,...,L n = ===== ⇒ (Q , ϕ ) such that for all 1 ≤ i ≤ n it holds that L i ϕ ↓ = AC i θ↓.
By induction on n we can show that ϕ = AC ϕθ↓. Finally, we show by induction on R that ϕ R t and ϕθ ciθ c i θ (for 1 ≤ i ≤ k) implies that ϕθ Rθ tθ.

Lemma 8. Let P be a ground process without inequalities and K ∈ sat(K init (P )). Then for any statement f ∈ K, we have that:

1. if f = ri l1,...,ln (R, R ) ⇐ {k wi (X i , t i )} i∈{1,...,m} and x ∈ vars(l k ) then there exists w j = l 1 , . . . , l k with k < k such that x ∈ vars(t j ).

2. if f = k l1,...,ln (R, t) ⇐ {k wi (X i , t i )} i∈{1,...,m} and x ∈ vars(t) then x ∈ vars(t 1 , . . . , t m ).

Proof. The seed knowledge base satisfies the above properties and they are preserved by update and saturation. Lemma 9. Let P 0 be a ground process, ϕ 0 = ∅ the empty frame, and {c 1 , . . . , c k } names such that c i ∈ names(P 0 ) for all 1 ≤ i ≤ k. If

(P 0 , ϕ 0 ) L1 = = ⇒ (P 1 , ϕ 1 ) L2 = = ⇒ . . . Ln = = ⇒ (P n , ϕ n ) and ∀1 ≤ i ≤ k -either c i ∈ names(L 1 , . . . , L n )
or there exist R i and t i such that ϕ idx(ci)-1 θ Ri t i where θ = {c i → t i } i∈{1,...,k} and idx

(c i ) = min{j | c i ∈ names(L j )} then (P 0 , ϕ 0 ) L1θ = == ⇒ (P 1 θ, ϕ 1 θ) L2θ = == ⇒ . . . Lnθ = == ⇒ (P n θ, ϕ n θ),
where θ = {c i → R i } i∈{1,...,k} .

Proof. By induction on the length n of the derivation.

Lemma 10. Let P be a ground process and ϕ a frame such that (P, ϕ)

in(d,R)

====⇒ (P , ϕ ).

Let R be such that (R = R )ϕ. Then we that (P, ϕ)

in(d,R )

= ==== ⇒ (P , ϕ ).

Proof. R and R are recipes for the same term in ϕ and therefore the transition still holds.

Proposition 1 (Soundness). If Equiv(P, Q) returns false then P ≈ Q does not hold.

Proof. If Equiv(P, Q) returns false then there exist P ∈ P such that Check(P, Q) returns false or Q ∈ Q such that Check(Q, P) returns false. Due to symmetry, we consider only the first case. Check(P, Q) returns false if there exists rid ∈ Rid P such that for all Q ∈ Q, Ver Q (rid) fails. Since we have Ver P (rid), we conclude.

Proposition 2 (Completeness). Let P and Q be two determinate ground protocols. If P ≈ Q then Equiv(P, Q) returns false.

Proof. As P ≈ Q there exist L 1 , . . . , L n , R, R , and ϕ such that (P, ∅) L1,...,Ln ------→ (P , ϕ) and (R = E R )ϕ, and

1. either (Q, ∅) L1,...,Ln = ===== ⇒ (Q , ψ) for any (Q , ψ); 2. or (R = E R )ψ
where ψ is the frame reached by Q after the execution of L 1 , . . . , L n where either P ∈ P and Q ∈ Q or Q ∈ P and P ∈ Q. Note that, since Q is determinate, even if such a frame ψ is not unique, they all satisfy the same tests. Note also that we can w.l.o.g. consider that at least one test holds in P (possibly considering a trivial one, i.e. 0 = 0). We consider L 1 , . . . , L n such that n is minimal and w.l.o.g, we consider that P ∈ P and Q ∈ Q.

As (P, ∅) L1,...,Ln ------→ (P n , ϕ n ) = (P , ϕ) and (R = E R )ϕ n , we also have that

(rm = (P ), ∅) L1,...,Ln
------→ (P n , ϕ n ) = (P , ϕ), and by completeness: i L1ϕn↓,...,Lnϕn↓ (R, R ) ∈ H e (K solved ).

In the case 2, we also have that (R = E R )ψ. From the fact that i L1ϕn↓,...,Lnϕn↓ (R, R ) ∈ H e (K solved ) and (R = E R )ψ, we can show that there exist recipes R A , R A and k ≤ n

such that i L1ϕn↓,...,L k ϕn↓ (R A , R A ) ∈ H(K solved ) but (R A = R A )ψ.
Actually, we have that k = n in order to not contradict the minimality of n.

We now choose among all the minimal witnesses (w.r.t. the length) of non-inclusion, one such that Ŝn (π) is minimal too and such that (P, ∅) L1,...,Ln ------→ (P , ϕ). More formally, we consider a witness of non-inclusion such that Ŝn (π) is minimal where π is the derivation tree in Π (K solved ) of i L1ϕn↓,...,Lnϕn↓ (R A , R A ).

We denote by π m the derivation tree of such a minimal witness i L1ϕn↓,...,Lnϕn↓ (R A , R A ) ∈ H(K solved ).

In the first case (Hypothesis 1), we simply have to consider a witness of noninclusion of minimal length, and we may assume that R A = R A = 0 (in which case its derivation tree π m has size Ŝn (π m ) = 0), and of course, we do not have that (R A = R A )ψ. Now, considering such a minimal witness, we have that:

(rm = (P ), ∅) L1 -→ (P 1 , ϕ 1 ) L2 --→ . . . (P n-1 , ϕ n-1 ) Ln --→ (P n , ϕ n )
By Theorem 1 (completeness), we know that: r L1ϕn↓,...,Lnϕn↓ ∈ H e (K solved ).

By the definition of H e , we have that it contains no reachability statement in addition to those in H. Therefore, we have that:

r L1ϕn↓,...,Lnϕn↓ ∈ H(K solved ), and i L1ϕn↓,...,Lnϕn↓ (R A , R A ) ∈ H(K solved ).

Thanks to Lemma 2, we deduce that:

ri L1ϕ↓,...,Lnϕ↓ (R A , R A ) ∈ H (n, Ŝn(πm)) e (K solved ).
Therefore there exists a statement f = ri l1,...,ln (R B , R B ) ⇐ {k wi (X i , x i )} i∈{1,...,m} ∈ K solved and a substitution τ grounding for f such that:

-k wiτ (X i τ, x i τ ) ∈ H(K solved ) of derivation tree π i (for all 1 ≤ i ≤ m), -l 1 τ, . . . , l n τ = L 1 ϕ n ↓, . . . , L n ϕ n ↓, and -R B τ ↓ = R A ↓, and R B τ ↓ = R A ↓.
Due to the shape of f (note that (R B , R B ) = (n, n) for any public name n), we have that f ∈ K 0 solved . We suppose w.l.o.g. that i ≤ j implies w i w j for f . We now prove by induction on the number of iterations of the outer loop of the function Check that there exists a test RId M1,...,Mn (R B , R B ) in Rid P such that Ver P (RId M1,...,Mn (R B , R B )) and substitutions σ, σ , ρ , ρ and τ such that for all i ∈ {1, . . . , m},

1. k wiσ (X i σ , x i σ) ∈ H(K solved ), 2. (X i τ = X i τ )ϕ, 3. (X i τ = X i τ )ψ. 4. x i σρ = x i τ , 5. X i σ ρ = X i τ ; 6
. and for all j ∈ {1, . . . , n} such that M j = in(d i , R i ) for some d j and R j , k wnσ (R j , t j σ) ∈ H(K solved ).

Base case Let N c = {c 1 , . . . , c k } be the fresh public names which will be used to ground the initial test in Test RId P made from f and let σ : vars(l 1 , . . . , l n ) ∪ {x 1 , . . . , x m } → {c 1 , . . . , c k } be the bijection of inverse σ -1 used by the algorithm. We also build another substitution β as follows: for each 1 ≤ i ≤ m, consider the set comp i = { j | x j = x i } (x i x j defined in statement f ). We consider the map least :

{ 1 ≤ i ≤ m } → { 1 ≤ i ≤ m } defined as least(i) = x r where r = min{j | w j ∈ comp i }.
Finally β is the substitution such that β(X i ) = X least(i) . We also define σ where dom(σ ) = {X 1 , . . . , X m } and σ (X i ) = x i σ for all 1 ≤ i ≤ m. We also define the mapping σ -1 to be such that dom(σ -1 ) = {c 1 , . . . , c k } and σ -1 (c i ) = X j where j is such that σ (X j ) = c i and X j β = X j . Then we define ρ = σ -1 τ , ρ = σ -1 τ and τ = βτ .

We have that the Induction Hypothesis 1 as k wj σ (c j , c j ) ⇐ ∈ H(K solved ) for all 1 ≤ j ≤ k. The Induction Hypothesis 6 holds due to Definition 7. By construction we also have Induction Hypothesis 2, 4 and 5.

We now show Induction Hypothesis 3: (X i τ = E X i τ )ψ. We distinguish three cases:

1. Case: W(π i ) < n and W(π j ) < n. In such a case, from Lemma 3, we have i L1ϕn↓,...,L k ϕn↓ (X i τ, X j τ ) ∈ H (k,κ) e (K solved ) for some k < n and κ. Hence we have (X i τ = E X j τ )ϕ k By minimality of n we also have that (X i τ = E X j τ )ψ. 2. Case: W(π i ) = n and W(π j ) = n. In such a case, from Lemma 3, we have i L1ϕn↓,...,Lnϕn↓ (X i τ, X j τ ) ∈ H

(n,κ ) e (K solved ) with κ ≤ Ŝn (π i ) + Ŝn (π j ). Hence we have (X i τ = E X j τ )ϕ. Since Ŝn (π i ) ≤ S(π i ) -1 (the root node is not counted) and S(π i ) + S(π j ) ≤ Ŝn (π m ), we have κ < Ŝn (π m ). By minimality of our witness, we also have that (X i τ = E X j τ )ψ. 3. Case W(π i ) = n and W(π j ) < n. In such a case, from Lemma 3, we have i L1ϕn↓,...,Lnϕn↓ (X i τ, X j τ ) ∈ H

(n,κ ) e (K solved ) with κ ≤ Ŝn (π i ) since Ŝn (π j ) = 0. Hence we have (X i τ = E X j τ )ϕ. Since Ŝn (π i ) ≤ S(π i ) -1 (the root node is not counted) and S(π i ) ≤ Ŝn (π m ), we have κ < Ŝn (π m ). By minimality of our witness, we also have that (X i τ = E X j τ )ψ.

Induction case

We assume that k iterations of the loop has been performed. If the command rid ← Rid P does not select RId M1,...,Mn (R B , R B ), the conclusion is immediate (our witness and substitutions are the same). If the command rid ← Rid P selects RId M1,...,Mn (R B , R B ) but for all Q ∈ Q, (rm = (Q), ∅) M1,...,Mn ======⇒ (Q , ψ ) or R B ψ = R B ψ the result is also immediate (the program returns false qed.). Therefore, we can assume that there exist Q ∈ Q such that

(rm = (Q), ∅) M1,...,Mn ======⇒ (Q , ψ ) (1)
and R B ψ = R B ψ . We now prove that

(rm = (Q), ∅) L1,...,Ln = ===== ⇒ (Q , ψ) (2)
and

R B ρ ψ = R B ρ ψ (3)
Instantiating f with σ ∪ σ and given the Induction Hypothesis 1, we obtain that ri l1σ,...,lnσ (R B σ , R B σ ) ∈ H(K solved ).

By Theorem 1 (soundness), P |= ri l1σ,...,lnσ (R B σ , R B ). Therefore, there exist recipes R i (for all 1 ≤ i ≤ n such that l i = in(d i , t i )) such that P |= k l1σ,...,li-1σ (R i , t i σ).

By Theorem 1 (completeness) and definition of H e there exist recipes R i such that k l1σ,...,li-1σ (R i , t i σ) ∈ H(K solved ), and i l1σ,...,li-1σ (R i , R i ) ∈ H e (K solved ).

Let i be such that l i = in(d i , t i ). Applying Lemma 8 to f we have that for all x ∈ vars(t i ) there exists w j such that |w j | < i and x = x j . We have that k wj τ (X j τ, x j τ ) ∈ H(K solved ), by induction hypothesis 2 By Theorem 1 (soundness), we obtain that P |= k wj τ (X j τ , x j τ ). Hence, as |w j | < i, P |= k l1τ,...,li-1τ (X j τ , x j τ ). According to the induction hypothesis 4 and 5 We rewrite it as P |= k l1σρ,...,li-1σρ (X j σ ρ , x j σρ). We already established that P |= r l1σ,...,lnσ , and we know that k l1σ,...,li-1σ (R i , t i σ) ∈ H(K solved ) and therefore by Theorem 1 (soundness) we have that P |= k l1σ,...,li-1σ (R i , t i σ). We apply Lemma 7 to obtain that P |= k l1τ,...,li-1τ (R i ρ , t i τ ).

(4)

Now, we consider θ a mapping with dom(θ) = vars(M 1 , . . . , M n ) such that θ = θ n and θ i is defined as:

θ 0 is the identity function; and for c i ∈ vars(M 1 , . . . , M n ), θ j (c i ) = ρ (c i )ψ idx(ci)-1 θ j-1 where 1 ≤ j ≤ n, dom(θ j ) = {c i | idx(c i ) ≤ j} and where idx(c i ) = min{k | c i ∈ names(M k )}.

From (1) and by applying Lemma 9 inductively on n we have that (Q 0 , ψ 0 ) = (Q 0 θ, ψ 0 θ) We assume by the induction hypothesis that

(Q 0 θ, ψ 0 θ) L1 = = ⇒ (Q 1 θ, ψ 1 θ) L2 = = ⇒ . . . Li-1 = == ⇒ (Q i-1 θ, ψ i-1 θ)
and we show that

(Q i-1 θ, ψ i-1 θ) Li =⇒ (Q i θ, ψ i θ).
We will show that L i and M i ρ satisfy the conditions of Lemma 10 which allows us to conclude. Indeed, either L i = M i ρ (in the case of a test or out action), or L i = in(d i , R i ) and M i ρ = in(d i , R i ρ ) (in the case of a in action). In the second case, we need to show that (R i ρ = R i )(ψ i-1 θ). By the definition of |= and according to the induction hypothesis 6, we have that P |= k l1τ,...,li-1τ (R i , t i τ ). We have previously shown in (4) that P |= k l1τ,...,li-1τ (R i ρ , t i τ ) and therefore P |=

Fig. 1 :

 1 Fig. 1: A simplified version of the AKA protocol

When

  = test we define = ⇒ to be test --→ * -→ test --→ * and we lift -→ and = ⇒ to sequences of actions. Given a protocol P, we write (P, ϕ) 1,..., n -----→ (P , ϕ ) if there exists P ∈ P such that (P, ϕ) 1,..., n

1

  ,..., n = ==== ⇒ (P, ϕ), and (P, ∅) 1 ,..., n = ==== ⇒ (P , ϕ ), then for any test R 1 ?

Example 4 .

 4 Let P = in(c, x).out(c, a) and Q = in(c, x).[x = a].out

Fig. 5 :

 5 Fig. 5: The AKA protocol

M1ρ=

  == ⇒ (Q 1 θ, ψ 1 θ) M2ρ = == ⇒ . . . Mnρ ===⇒ (Q n θ, ψ n θ).Now we show by induction on n that(Q 0 θ, ψ 0 θ) L1 = = ⇒ (Q 1 θ, ψ 1 θ) L2 = = ⇒ . . . Ln = = ⇒ (Q n θ, ψ n θ).

  Definition 8. Let P be a process such that P = P 1 .[t 1 = t 1 ].P 2 . . . . .[t m = t m ].P m+1 and P 1 .P 2 . . . . .P m+1 is positive. We define the process rm = (P ) =P 1 . . . . .P m+1 .

  t 1 ].P 2 . . . . .[t m = t m ].P m+1 and P 1 .P 2 . . . . .P m+1 is positive. We define the complement of P , comp(P ) to be the set {P

1 .P 2 . . . . .P i-1 .[t i = t i ].P i . . . . .P m .P m+1 |1 ≤ i ≤ m}

The research leading to these results has received funding from the European Research Council (ERC) under the European Union's Horizon 2020 research and innovation program (grant agreements No 645865-SPOOC), as well as from the French National Research Agency (ANR) under the project Sequoia.

i l1τ,...,li-1τ (R i ρ , R i ), or, equivalently, (R i ρ = R i )ϕ i-1 . By the hypothesis (all traces shorter than n are equivalent), we have that there exists Q ∈ P such that

and (R i ρ = R i )ψ i-1 . By determinacy of Q it follows that ψ i-1 ≈ s ψ i-1 θ and therefore (R i ρ = R i )ψ i-1 θ as well. As the hypothesis of Lemma 10 are satisfied, we can conclude. We have shown [START_REF] Abadi | Private authentication[END_REF].

We know show [START_REF] Abadi | A calculus for cryptographic protocols: The spi calculus[END_REF]. As the equational theory is stable by substitution of terms for names and we know that

The proof is by induction on the size of R B . The only interesting case is the case when R B is X i for some 1 ≤ i ≤ m. In this case, we have that (R B σ ψ n )θ = c j θ where c j = σ(x i ).

By construction of θ, c j θ = ρ (c j )(ψ n θ) and ρ (c j ) is (by construction) X i τ . Hence we get that

Now, thanks to determinacy, we have that (R B τ = E R B τ )ψ where ψ is the frame (up to static equivalence) reached by Q after L 1 , . . . , L n .

We now show that:

From the induction hypothesis 3, we have that

We also have

since the case (R A = E R A )ψ is contradicted by [START_REF] Abadi | A calculus for cryptographic protocols: The spi calculus[END_REF]. From ( 1), ( 5) and Lemma 1, we

From Lemma 5 and the fact that

, by completeness of the saturation ( Q does not have any inequalities) and due to the induction hypothesis 2, we have that: r R1,1ψn↓,...,l1,m 1 ψn↓,L1ψn↓,...,ln,1ψn↓,...,ln,m n ψn↓,Lnψn↓ ∈ H( K) where R i,j are the recipes from Lemma 5. To lighten the notation, we now omit the label of the c s inputs in words such that the last reach predicate is now written:

Therefore there a statement

and a substitution τ grounding for g such that:

-

We suppose w.l.o.g. that i ≤ j implies w i w j for g. We also build another substitution β as follows: for each

Let N d = {d 1 , . . . , d k } be the set of fresh public names and let α : vars(l 1 , . . . , l n ) ∪ {y 1 , . . . , y m } → {d 1 , . . . , d k } be the bijection of inverse α -1 which have been used to compute the test R N1,...,Nn ∈ R Q corresponding to g. We have that:

where dom(α ) = {Y 1 , . . . , Y m } and α (Y i ) = x i α for all 1 ≤ i ≤ m. We also define the mapping α -1 to be such that dom(α -1 ) = N d and α -1 (d i ) = Y j where j is such that α (Y j ) = d i and Y j β = Y j . Instantiating g with α ∪ α , we obtain that r l 1 α,...,l n α ∈ H( K).

We denote by Ri the recipes of w i α provided by the algorithm to generate R N1,...,Nn from g. By Theorem 1 (soundness), P |= r l 1 α,...,l n α . Therefore, there exist recipes

. By Theorem 1 (completeness) and definition of H e there exist recipes Ri such that

. We now prove that Ver P (R M1δ ,...,Mnδ ). By induction hypothesis we have Ver P (RId M1,...,Mn (R B , R B )). Moreover, we have l 1 τ , . . . , l n τ = L 1 ψ n ↓, . . . , L n ψ n ↓ and i l 1 α,...,l i-1 α ( Ri , R i ) ∈ H e ( K). By hypothesis of our lemma, P and Q are determinate and equivalent for trace smaller than n, therefore the recipes Ri compute the same terms as R i also in P . We now prove that RId M1δ ,...,Mnδ (R B δ , R B δ ) is such that Ver P (RId M1δ ,...,Mnδ (R B δ , R B δ )) and that the following substitutions are the ones to prove our induction hypothesis.

σ 2 = σ δ , σ 2 = σδ where δ is such that, for all c ∈ vars(M 1 , . . . , M n ),k wiσ2 (cδ , cδ ) ∈ H e (K solved ), ρ 2 α -1 τ , ρ 2 is defined by for all d ∈ N d , k wiτ (dρ 2 , dρ 2 ) ∈ H e (K solved ), τ 2 = σ δ ρ 2

We have Induction Hypothesis 1, 6 and 2 from Lemma 7. Induction Hypothesis 5 and 4 holds by construction. We have Induction Hypothesis 3 from our initial hypothesis that P and Q are equivalent for traces of length smaller than n and due to the fact that δ is invariant for the variables relying on the full trace. Finally, we prove Ver P (RId M1δ ,...,Mnδ (R B δ , R B δ )). From Lemma 6, we have ( Ri = R i δ )ψ and therefore ( Ri = R i δ )ϕ due to our hypothesis that P and Q are equivalent for smaller traces. Finally, since R i δ ϕρ 2 = M i τ and that by assumption Ver P (RId M1τ,...,Mnτ (R B τ, R B τ )), all inequalities pass which allow us to conclude. Theorem 3. If procedure sat terminates then procedure Equiv terminates.

Proof. We define a descendant rid of a test rid, either rid or a descendant of one of the ridσ added from rid after an iteration of the loop.

The only reason for the procedure not to terminate would be that the while loop never ends. However, at each iteration, one rid is picked and is replaced by several (but finitely many) ridσ i . Since Ver Q(ridσ) and Q is a positive process, for any substitution θ we have Ver Q(ridσθ). From Lemma 1, this implies that Ver Q (ridσθ) does not hold. This means that for all descendants of rid, the set S Q does not contains Q. Therefore if Q has n process, descendants of the rid ∈ Test RId (P ) are descendants of n-th generation at most which allows to conclude.