Daniel Mertens
email: mertens@soz.uni-frankfurt.de

Matthias Thiemann

Building a hidden investment state? The European Investment Bank, national development banks and European economic governance

Keywords: EIB, EIF, economic governance, European Commission, Investment Plan for Europe, public banking

The European Commission's Investment Plan for Europe and the enduring economic crisis has brought state-owned development banks again to the fore of public and scholarly debate in Europe. This article proposes to place these banks' activities and recent institutional co-operation in the context of European integration and assumes a historical perspective on European economic governance and development banking. Most importantly, it argues that the European Investment Bank has become a centre of gravity in long-standing political attempts to increase the investment firepower of the European Union. Based on detailed process-tracing analysis through publicly available data and interview material, the article delineates a gradual process of institutional innovation and network formation that advanced since the late 1980s and culminated in recent post-crisis policy processes. The contemporary visibility of development banking in Europe, we conclude, follows from these and is representative of a nucleus for a -somewhat hidden -European investment state, whose reach and stability, however, is yet to be determined.

Introduction

The post-crisis restructuring of the European economy has brought political and academic attention to a heretofore rather backstage operating actor in the financial landscape, state-owned development banks. 1 The European Investment Bank (EIB), which is the multilateral development bank of the European Union (EU), as well as national development banks (NDBs) were called upon by policy-makers to expand their activities to fuel investment across the Union. Accordingly, most of these banks expanded their balance sheets significantly between 2007 and 2014: the EIB increased its assets by almost 100 per cent, the large Italian Cassa Depositi e Prestiti (CDP) and German Kreditanstalt für Wiederaufbau (KfW) by roughly 80 and 40 per cent respectively, and a small NDB like the Finnish Finnvera by a staggering 275 per cent. 2 Simultaneously, one could observe a new wave of institutional diffusion of development banks in Europe. Since 2010, several member states have engaged in founding new financial institutions that promote socioeconomic developmentamong them Ireland (Strategic Banking Corporation of Ireland in 2014), Portugal (Instituição Financeira de Desenvolvimento in 2014) and the United Kingdom (UK) (British Business Bank and Green Investment Bank in 2012)such that every EU country today holds at its behest one such institution or is amid the founding process (DG Internal Policies 2016a).

The importance of development banks to the current European political economy came to the fore after Jean-Claude Juncker's election as President of the European Commission (EC) in November 2014, when the Investment Plan for Europe and its European Fund for Strategic Investment (EFSI) became the prime attempt to bolster economic recovery in the EU. A key feature of this plan was its implementation through the EIB that was equipped to leverage funds from the EU budget to mobilize private investment. Furthermore, NDBs received positions as both stakeholders and contributors, on which the success of the plan was said to hinge critically (European Commission 2014; European Commission 2015b). Surprisingly, scholars of European integration and political economy have not reflected much on these observations yet. Those contributions tackling the growing importance and role of development banks in the European Union have mainly welcomed and advocated this trend, explaining it by the counter-cyclical function these banks traditionally fulfil (Griffith-Jones and Cozzi 2016; Griffith-Jones and Tyson 2013; Kollatz-Ahnen 2015; Mazzucato and Penna 2016). 3 However, this functional explanation misses important points about the institutional evolution of European economic governance and the historical trajectory of development banking in the European political economy. The fact that, before the crisis, state banking was severely under pressure of European liberalization policies and even declared near death [START_REF] Seikel | How the European Commission deepened financial market integration. The battle over the liberalization of public banks in Germany[END_REF][START_REF] Verdier | The rise and fall of state banking in OECD countries[END_REF] begs for historical and political placement of recent events. The outlined growth of the EIB and its national counterparts, this article therefore contends, is significantly rooted in two parallel processes of European integration. First, it is intrinsically linked to a long-standing political quest for a European investment state that compensates poor fiscal capacity on the supranational level. Development banks, in this sense, have become increasingly relevant to create a governmental infrastructure that ties together the fragmented landscape of European economic policy-making. Second, the recent diffusion and activities of development banks rest on a historical lineage of innovating financial instruments that depart from the traditional business of subsidized lending and instead tap European budgetary resources based on leveraging and revolving funds. Again, this has gradually allowed for intensified coordination between different levels of policy-making in Europe. Importantly, in both realms, the financial and economic crisis has served as a catalyst of these processes, but was not their original driver. Rather, the EC's Investment Plan for Europe interlocked several less-visible institutional and policy-making tendencies of the last three decades into what might be the nucleus of a European investment state. In its basic tenet, this investment state provides a gradually built multilevel infrastructure for furthering investment, allowing supranational, national and subnational actors such as development banks to 'make use of Europe' [START_REF] Woll | Using Europe: strategic action in multi-level politics[END_REF] by channelling leveraged funds into the 'real economy'.

To develop this argument, the article proceeds as follows. The next section reviews the literature on development banking in the European political economy and proposes several theoretical avenues to make our observations fruitful for debates on European integration more generally. We then move on to follow the evolution of the EIB and NDBs within European economic governance through four historical sections, based on process-tracing methods and both document analysis and expert interviews (see Appendix). This diachronic approach enables us to juxtapose qualitative transformations such as the formation of new institutional ties between development banks, the EC and member states with gradual adjustments in development bank activity. These sections will concomitantly discuss these trends in European development banking in the light of several pillars of current economic governance, including the reform of fiscal capacity, state-aid regulations and subsidiarity, arguing that they coalesce to provide the ground for a hidden European investment state on which we conclude.

Development banks in the European political economy

State-owned development banks have the 'mission' to promote pre-defined socioeconomic goals. Their role, institutional set-up, and size have differed significantly across countries and are closely linked to the historical trajectory of national political economies and their distinctive public-private financial networks to furnish growth and development [START_REF] Shonfield | Modern Capitalism. The Changing Balance of Public and Private Power[END_REF][START_REF] Zysman | Governments, Markets, and Growth. Financial Systems and the Politics of Industrial Change[END_REF]. The literature on European economic governance has largely ignored their specifics, instead just noting their conflict with a liberal European order. An emerging body of literature on the role NDBs in the European political economy has pointed out that over the past two decades European neoliberal regulatory policies have constrained these banks' manoeuvrability significantly, mainly on the grounds of competition and state-aid considerations [START_REF] Volberding | National Development Banks and the Rise of Market-Based Protectionism in Europe[END_REF]). However, their role in the single market or the European financial system has generally not received scholarly attention.

The financial crisis of 2008, after which these banks moved into the spotlight again, has triggered research emphasizing the counter-cyclical role of development banks in severe downturns-cum-credit-crunches. The former EIB vice-president [START_REF] Kollatz-Ahnen | The rise of state investment banks[END_REF], for instance, has focused on state investment banks' impact on growth through the provision of venture capital, while [START_REF] Mazzucato | Beyond market failures: the market creating and shaping roles of state investment banks[END_REF] have collected evidence for development banks' importance in boosting innovation as well as furthering socioeconomic and environmental progress. While the strong advocacy stance of this literature may partly explain the recent trends around development banking in Europe, they seem less fruitful for connecting them to the European integration process.

When adding the multilateral EIB to this group of banks, one may expect the image to change. An EU institution in its own right (although legally categorized as 'body') and assigned with the task 'to contribute, by having recourse to the capital market and utilizing its own resources, to the balanced and steady development of the common market in the interest of the Community' in the 1957 Treaty of Rome (Treaty of the European Community [TEC], Art. 130), the EIB and its 'essential role in financing European integration' (Dinan 1999: 324;cf. Nugent 2006) is widely acknowledged among scholars of the European Union. However, a closer look reveals that the literature has hardly overcome Robinson's (2009: 669) description of the EIB as a 'neglected institution' that needs 'a serious programme of academic study' to understand the overall 'nature of EU policy making'. Particularly, debates over the public policy role of the EIB have been rare [START_REF] Honohan | The public policy role of the European investment bank within the EU[END_REF][START_REF] Licari | The European investment bank[END_REF], and despite the EIB having stepped up in public appearance and actual lending in recent years, with political struggles preceding a major capital increase of €10bn in 2012, scholarly work on it remains sporadic (but see [START_REF] Griffith-Jones | The European Investment Bank: Lessons for Developing Countries[END_REF] for a thorough review of EIB's activities in the EU).

The merit of both [START_REF] Honohan | The public policy role of the European investment bank within the EU[END_REF] and [START_REF] Robinson | The European investment bank: the EU's neglected institution[END_REF] work is its embedding the EIB in the framework of multilevel governance, which enables a less functional-economic but more political view on European development banking. Most importantly, this view highlights the EIB's role in the broader set of European institutions and governance, drawing attention to its relation to both the EC and member states. For instance, peculiar processes of fund implementation in regional policy involving the EIB have made it a central actor in the facilitation of EU integration objectives. As we will show in this article, the EIB's relation to other banks, particularly NDBs, is no less important than its relation to other EU decision-making bodies when seeking to understand its growing reach.

In this context, we find it promising to think about the meaning and transformation of these relations with reference to academic discussions on 'forms of state' and 'core state powers' in the European Union [START_REF] Caporaso | The European Union and forms of state: westphalian, regulatory or post-modern?[END_REF][START_REF] Genschel | More integration, less federation: the European integration of core state powers[END_REF]. These debates are usually concerned with how the evolution of the EU fits into longer-term processes of federal state-building and draw attention to the development of specific forms of authority and policy-making capabilities in relation to their member states over time (Richardson 2012). Scholarship argues that the lack of fundamental territorial powers on the EU level have led to the rise of a regulatory state, intervening in member states' core functions without developing similar institutions on the supranational level [START_REF] Majone | From the positive to the regulatory state: causes and consequences of changes in the mode of governance[END_REF]. The current crisis, however, has again sparked the debate as to what extent the EU moves beyond this description and engages in a new wave of institution building, significantly furthering the integration process [START_REF] Caporaso | Still a regulatory state? The European Union and the financial crisis[END_REF][START_REF] Schimmelfennig | European integration in the euro crisis: the limits of postfunctionalism[END_REF].

In this debate, scholars have repeatedly pointed to the underdevelopment of traditional taxing-and-spending functions at the supranational level, and its accompanying low levels of steering capacity and fiscal impact. Our study offers ways to take development banks as quasi-fiscal actors more thoroughly into account in the expansion of EU steering capacity. Clearly, the current political quest to tackle the EU's 'investment gap' creates tensions with a governance mode based on 'rule making replacing taxing and spending' [START_REF] Majone | From the positive to the regulatory state: causes and consequences of changes in the mode of governance[END_REF]. However, instead of focussing on an outright fiscal capacity on the European level, our study considers instances of EU capacity-building and policy-making that entail functional equivalences.

To this end, we draw on recent attempts defining states as 'developmental networks states' [START_REF] Block | Swimming against the current: the rise of a hidden developmental state in the United States[END_REF] or as 'entrepreneurial' [START_REF] Mazzucato | The Entrepreneurial State. Debunking Public vs. Private Sector Myths[END_REF] when they dispose over governmental agencies, including state-owned investment banks, that are 'able to take risks and create a highly networked system of actors that harness the best of the private sector for the national good over a medium-to long-term time horizon' (ibid. : 26). Such structures may not always be visible in the first place, but can emerge in a somewhat hidden fashion circumventing political opposition [START_REF] Block | Swimming against the current: the rise of a hidden developmental state in the United States[END_REF]. However, we prefer the notion of an 'investment state', which highlights the idea that polities develop a governmental infrastructure promoting investment in specific sectors in the economy either through direct spending or through financial techniques mobilizing other public or private funds. This can possibly surpass the mobilization of national powers to compensate for the lack of EU infrastructural powers, as sketched by [START_REF] Genschel | More integration, less federation: the European integration of core state powers[END_REF], and create genuine supranational capacities by allowing other policy actors to 'make use of Europe', accessing new political, institutional and budgetary resources [START_REF] Woll | Using Europe: strategic action in multi-level politics[END_REF].

Along these lines, we propose to frame the study of development banks in the European political economy. It presents a case for thinking about the gradual ways of institution building, tie-knotting and network formation in the field of economic policy-making, as well as the historical pathway to the EU's crisis responses [START_REF] Verdun | A historical institutionalist explanation of the EU's responses to the euro area financial crisis[END_REF]. More precisely, it tries to reveal the stepwise build-up of a durable governance structure over an extended period that increases the EU's power to generate and direct investment through the involvement of (supra)national development banks.

Economic governance and development banks in the 'old ' European political economy, 1957' European political economy, -1988 Considering the role of development banks in European economic governance, we can characterize a first period from the Treaty of Rome to some years before the Maastricht Treaty as one of institutionalization and relative stability. First, the EIB was mainly a member state bank and its relation to the EC rather muted. Responding to the needs of its shareholders was at the very heart of EIB governance. The board of governors, which must approve of the annual accounts and major policy proposals, consisted and still consists of the national finance ministers; and the board of directors, deciding on the operational strategy and approving all financing operations, is composed of member state delegates with one vote for each country. The European Commission appoints a single delegate to the board of directors.

Just as its focus in the founding period was to function as an infrastructure investment bank, especially for Italy, it became a crucial tool both to integrate new member states and mitigate the concerns of old member states. For instance, when Spain and Portugal were set to enter the Community in 1986, they already had received pre-accession aid and loans from the EIB, which also stepped up lending after accession to buffer established member states' concerns over regional disparities and competition (interview #9; [START_REF] Bussière | The Bank of the European Union. The EIB[END_REF]. The first three decades of EIB existence were ones of striking a balance between the statutory mandate to serve the Community goals on behalf of the member states and the bank's autonomy that allowed it to shield itself from political lending interference and enabled it to raise capital on the markets (Licari 1969: 194). Nonetheless, the EIB in this period went through some changes in terms of activities, capital increases, and strategic goals, driven both by the enlargement of the Community and the first and second oil crises [START_REF] Bussière | The Bank of the European Union. The EIB[END_REF][START_REF] Clifton | Financing utilities: how the role of the European investment bank shifted from regional development to making markets[END_REF]. Only few, however, indicate the early tensions of an unfulfilled European investment state. This is the case because the period in consideration is similarly one of institutionalization in terms of EU fiscal capacity. Most importantly, besides the common agricultural policy the subsequent establishment of structural funds became the main vehicles of discretionary spending and, thus, a fundamental pillar of economic policy-making in the EU. The European Social Fund, already enshrined in the Treaty of Rome, and the European Regional Development Fund, founded in 1975, following Britain's accession, became the largest to tackle unemployment and structural change in the Union (Streeck and Elsässer 2014: 10). But, despite several revenue-based reforms, the cost of enlargement put the EU budget and the structural funds increasingly under pressure [START_REF] Lindner | Conflict and Change in EU Budgetary Politics[END_REF], leading the EC to search for new means of funding. When investment stalled in the years after the first oil crisis, the Commission responded to the Council's call on member states with the implementation of the New Community Instrument (NCI), or 'Ortoli facility'.

The NCI, active between 1977 and 1990 and supplement to the structural funds, enabled the Commission to borrow money that could be lent to regions and member states for infrastructure and energy projects, based on Council approval. Importantly, the Commission neither borrowed the money nor managed the fund on its own, but in conjunction with the EIB (European Union 1999: 89). As far as we can see, the NCI was (only) the first episode of EC-EIB co-operation resting upon the need for more investment spending in the face of fiscal restraint, whose main precedents were ECinitiated loan applications to the EIB. The NCI co-operation, however, was little more than a one-off measure, as member states remained by and large the dominant stakeholder group, proposing most of the projects and being the main source of political influence (interview #10; cf. [START_REF] Föcking | Die Darlehenspolitik der Europäischen Investitionsbank: Eine Untersuchung des Zusammenhangs Zwischen Machtstrukturen und Mittelvergabe[END_REF][START_REF] Bussière | The Bank of the European Union. The EIB[END_REF]). 4 To promote investment, the six founding member states also had development banks at their disposal, though not necessarily on national but regional levels. While Luxembourg was the latest to found one in 1977 Société Nationale de Crédit et d'Investissement (SNCI), of the new member states in this period only Spain (re)founded its development institution Instituto de Credito Oficial (ICO). Their emerging relationship with EU level activities, and the EIB especially, was mainly one of competition in the period under observation. The fact that the EIB had larger financing possibilities and was explicitly designed to operate in the entire EU was as important as the overlap in targeting the same 'underdeveloped' regions. This animosity was particularly strong with respect to KfW, rival in size to the EIB and primus inter pares among European NDBs (interviews #2; #8; #9; Honohan 1995). From its inception, the EIB was aware of this tension and actively aimed at establishing co-operative working relationships with development banks through on-lending and occasional global loan agreements.

This was prominently achieved in Italy, where the EIBunder the auspices of two Italian presidents between 1958 and 1970became the key source of finance for the Mezzogiorno, mainly through public financial institutions such as the Cassa per il Mezzogiorno. 5 However, this sort of early co-operation was never so comprehensive that it would result into some institutionalized form of community economic governance. Rather, when the EIB and NDBs increasingly tapped the same capital markets and started to compete for funds and projects more heavily, competitive concerns loomed larger than the need to expand co-operation. In this sense, Figure 1 roughly illustrates this early web of relations centred around development banks in the European political economya rather unconnected and fragmented image with a relatively clear allocation of competences and resources.

The historical trajectory: the gradual transformation of EIB-based public policy interventions [1988][1989][1990][1991][1992][1993][1994][1995][1996][1997][1998][1999][2000][2001][2002][2003][2004][2005] In the period between 1988 and 2005, we observe a range of policy changes and institutional reforms that can be linked to the initial set-up and simultaneously lay a fundament for the post-crisis era. Several reforms and programmes were implemented in an ad hoc manner but turned out to be long-term qualitative transformations. To begin, the challenges and constraints depicted in the section above led to new initiatives for increasing the impact of the structural funds in the late 1980s. Against the background of the Single European Act, European policy-makers discussed three interwoven concerns: first, concerns over economic growth and rising unemployment; second, concerns over the community's limited own resources; and third, concerns over the efficiency of structural policy [START_REF] Endo | The Presidency of the European Commission Under Jacques Delors: The Politics of Shared Leadership[END_REF][START_REF] Stahl | Die Europäische Gemeinschaft vor einer erneuten Finanzkrise?[END_REF]. Subsequently, on the initiative of EC President Jacques Delors, the Council adopted an action plan for reforming the funds and doubling its volume within the first multiannual financial framework (MFF) between 1988 and 1992.

One of the respective regulations (EEC 2052/88) highlighted that enhanced co-operation between different funds and policies was necessary to achieve a greater impact, and mainly addressed the EIB's role in promoting the treaty objectives as overlapping with the structural funds. In its subsequent regulation, the Council then stated that 'the Commission must, where necessary, associate the EIB with the preparation of its decisions; whereas the EIB is prepared to cooperate in the implementation of this Regulation, in keeping with its own powers and responsibilities' (EEC 4253/88). In other words, the quest for a more efficient use of the investment instruments at disposal at the European level furnished initiatives to institutionalize a closer co-operation between the Commission and the EIB. Particularly the 1988 reform of structural funds laid the fundament for what we will depict below as the nucleus for an investment state, introducing new governing principles such as 'programming', 'additionality' and 'partnership' (Bachtler and Méndez 2007: 537). These included the objective to enhance long-term co-operation within a multilevel system, while entailing the use of loans next to subsidies. 6 In the early 1990s, the gradual rapprochement of EIB and EC intensified. Because of a 'European growth initiative' from 1992 and the following Edinburgh council, the EIB received a capital increase to target infrastructure investment. Importantly, an additional body was also founded to increase the financing power of the EIB (Endo 1999: 194;interview #9): the European Investment Fund (EIF). First, the EIF was constructed as a joint venture between the EIB, the European Commission, and the financial sector (mostly NDBs) so that its simple establishment foreshadowed a new period of co-operation between these actors (interview #9). Second, the EIF, set up to fill a perceived gap in the risk financing capacity in the EU, became an active participant in financial markets, employing among other things guarantees to leverage its own funds in financial transactions. As such, the EIF was from its inception linked to financial instruments, a new way of leveraging limited EU budgetary resources.

Introduced into the EU Budget in 1993, financial instruments were first used in the MFF of 1994-1999. The idea underlying these instruments was and is to transform EU resources (e.g. within the structural funds) into financial products (loans, guarantees, equity, etc.) which are then used to support projects promoting EU policies (European Court of Auditors 2016: 11). The crucial difference to grants and subsidies is that they can use private funds to increase leverage and, in case these projects succeed, generate a repayment which can be used for further projects (revolving funds). The main institutions administering these funds were the EIB and the EIF (DG Internal Policies 2012), a fact which brought EIB and EC closer together.

Only a few years later, the 1997 Amsterdam council carried these impulses forward. In its Resolution on Growth and Employment, it called on the EIB and the EIF 'to step up its activities … promoting investment projects consistent with sound banking principles and practices' and reach into new areas of financing, particularly education, health, urban environment and environmental protection. This led, in July 1997, to the EIB's board approving the Amsterdam Special Action Programme (ASAP), which again furthered the prominence of guarantees and risk assumptions (EIB press release, 12 Dec 1997).

While in both instances the anti-cyclical role of the EIB was very strong, it was pre-conditioned by Europe's turn to institutionalized fiscal restraint through the Stability and Growth Pact. References to balanced budgets and stable macroeconomic conditions abound in the documents and emphasize the need to mobilize new funds promoting investment across the Union. This became particularly clear with the Lisbon Agenda in which the strategy's goals would rely primarily on private sector funds and public-private partnerships. While the Union's role was explicitly said to act as a catalyst, the Council approved of a prominent role of the EIB in achieving the goals of the Agenda (Lisbon European Council, 23-24 March 2000). The EIB itself, just as some of its national counterparts, became active players in the liberalization process of the 1990s and early 2000s [START_REF] Bussière | The Bank of the European Union. The EIB[END_REF][START_REF] Clifton | Financing utilities: how the role of the European investment bank shifted from regional development to making markets[END_REF].

Interestingly, the political implications of post-socialist transition in this period were also significant for development banking in Europe at large. Besides the founding of the European Bank for Reconstruction and Development (EBRD), many Eastern European countries, such as Slovakia, Slovenia or Croatia followed the idea of public financial institutions for development and founded them in close co-operation with European development banks (cf. interview #8). 7 German Reunification also led to an intensified relationship between KfW and the EIB, with the latter providing funds for the restructuring of the East German economy.

In sum, the EIB grew considerably in importance regarding the management of structural funds, and with crises overshadowing Europe in the early 1990s could increase its capital and expand with a new organizational tool at its disposal. While most of the single measures were ad hoc in their implementation, the new strategies, products and organizational capabilities solidifiedand they provided the institutional innovation on which to build in future negotiations. This became strikingly clear when negotiations over the programming period from 2007 onwards started, further increasing the role of financial instruments and co-operation between both the EIB and the EC as well as the EIB/EIF and NDBs. Over the observation period, the programme contributions to financial instruments increased significantly. Non-existent in the first MFF, they added up to €0.57bn in the 1994-1999 framework, and increased to €1.3bn in the following framework of 2000-2006.

The proliferation and expanded use of financial instruments had several rationales. First, EU ambitions to influence structural policy were severely limited by the comparatively small size of its budget, a conundrum that financial instruments helped to overcome. In this respect, both the use of leverage as well as the possibility for the return of funds to the EU budget in case of successful project realization were attractive properties of this policy instrument. In the context of the high ambitions of the Lisbon Agenda and an EU budget decreasing in terms of gross national product (GNP), these financial instruments would substantially expand over the course of the next decade, laying further foundations for the 'Juncker Plan'.

The financial crisis, growth of NDBs and network formation 2005-2014

This third historical section considers the latest innovations and events leading up to the recent Investment Plan for Europe from the perspective of developmentor as it was now officially termed -'promotional' banking. First, the expanded use of financial instruments would be set on a larger institutional footing with the 2007-2014 MFF, as new programmes were being designed by the EIB. Called upon by the European Council in December 2005 to 'extend its Structured Finance Facility to research, development and innovation projects and, together with the Commission, explore new ways of using Community funds as levers for EIB loans', the EIB engaged in 'particularly intensive' co-operation with the Commission to develop such instruments (European Investment Bank 2006: 55). Programmes such as 'Jaspers', 'Jeremie' and 'Jessica' signalled the move towards more financial instruments, and hence closer to the Commission; a move not uncontested within the EIB on grounds of autonomy considerations (interview #10). It reflected a slow cultural change in the self-understanding of the EIB away from the infrastructure development bank of member states towards a promotional bank aligning with the EC. This shift was embraced at the highest level of the institution in the context of the negative discourse on public banks, as it was seen as a means to demonstrate the flexibility and usefulness of the EIB as a policy tool (interview #9).

After these fundamental innovations in financial instruments in the mid-2000s, the financial crisis would provide a substantial boost to their use. Overall, the number of financial instruments supported by the multiannual financial framework would rise to 26, 14 of which were administered by the EC and/or the EIB (Núñez Ferrer and Infelise 2015: 15f). Owing to a re-dedication of EU funds, not only the number of instruments but also their volume would grow substantially. From 2011 onwards, about €7bn would be rededicated to financial instruments, eventually leading up to €16bn used during the 2007-2013 MFF instead of an envisaged 12.5bn (EC and EIB 2015: 3;European Court of Auditors 2016: 30). The growth of these measures would require a profound strengthening of inter-institutional co-ordination between the European Commission and the EIB, bringing the two institutions closer together. As stated in a Commission document: The expansion of financial instruments to be administered by not only the EIB but also NDBs now began to set a material incentive for member states to found such a bank. This incentive, in conjunction with the rediscovered role of development banks for weathering a crisis, explains the new wave of founding NDBs in Europe. So, not surprisingly, the Commission highlighted the use of financial instruments and structural funds when approving the creation of these institutions under state aid considerations (European Commission 2014b, 2016b). As the EIB's role has strengthened in the administration of European Structural and Investment Funds (ESIF) since 2007, the co-operation between EIB and NPBs has accordingly intensified, because European financial instruments involve NDBs directly, including those administered by the EIB, such as the Risk Sharing Finance Facility and Jeremie or its successors COSME and InnovFin. The principle of subsidiarity, embedded in these instruments, means that EIB/EIF is effectively dependent on NDBs and their local knowledge to implement these programmes. At the same time, NDBs feel pressure by their national governments to access these funds, moving the relation between the two from competition to co-operation (interview #8).

As in prior periods, the bleak economic conditions called for another European 'growth pact'. In June 2012, the heads of states agreed on a non-binding pact to foster investment without straining national or European budgets. At the heart of it was no 'fresh money', but a €10bn capital increase for the EIB to boost lending, a EIB-based guarantee initiative ('project bonds'), and a diffuse plan to reallocate some of the structural funds. While demeaned as 'hot air', in combination with the gradual processes of institution building, it laid the latest fundament for an arrangement tying together the trends discussed: The Investment Plan for Europe, through which the EIB expected a further boost of programme contributions to financial instruments up to €35bn.

Into the spotlight: development banks and the Juncker Plan

When the immediate financial turmoil of the sovereign debt crisis somewhat retreated, concerns about sluggish growth and low investment moved to the forefront around the European elections of 2014. Shortly after his election, Jean-Claude Juncker announced the Investment Plan for Europe and its core piece, EFSI. A compromise between those political parties seeking a strong public stimulus program funded by the EU, and those committed to limit the size of the EU budget [START_REF] Spiegel | Jean-Claude Juncker to unveil €315bn EU programme[END_REF], the plan appears as a merger of the preceding steps in governance through development banking. While it was launched jointly by the Commission and the EIB, it gave full operational control to the EIB with the EFSI steering board located within the bank. The EIB now seemed the evident choice for policy-makers to administer strategic funds: it not only had extensive experience with respect to public infrastructure projects and was entrusted with other funds by the Commission, it was also largely exempted from European state aid rules, permitting a relatively low bureaucratic burden during the implementation phase (interview #3; #9).

In terms of logic, the EFSI works very much along the lines of financial instruments. It entails guarantees of €16bn from the EU budget and €5bn from the EIB that, combined, allow the EIB and the EIF to employ €63bn of capital (leverage of 1:3). These €63bn are positioned to mobilize private and public investment of €315bn in total (leverage of 1:5). As a recent report by the EU Committee of the Regions put it, the EFSI is 'a dedicated non pre-allocated Financial Instrument mechanism to leverage investment [and] another recognition of the potential role of EU financial instruments in delivering growth-friendly expenditures' (Núñez Ferrer and Infelise 2015: 9). In other words, the EFSI opens a channel to increase investments through leveraging limited budgetary resources and combining them with the levers of the EIB and the EIFa mechanism that in our view constitutes features of an investment state through the creation of governmental infrastructures.

The Investment Plan also draws heavily on the involvement of NDBs, their technical expertise and capacity in identifying investment opportunities being singled-out by the Commission as important capabilities for the success of the plan. A largely unanticipated role would be played by NDBs when it came to increase the fund's financing capacities. In its first communique in November 2014, the Commission asked member states 'to join this initiative, including by providing further funding to the European Fund for Strategic Investments' (European Commission 2014: 16). In the following eight months, such additional financing would only be forthcoming from NDBs pledging funds to support EFSI. Beginning with the German KfW in February 2015, which pledged €8bn, overall eight development banks would pledge about €40bn in total. NDBs became particularly more active once it became clear that member states would not contribute any or any significant resources to the plan. Based upon the subsidiarity principles, however, these funds were not transferred to the EIB, but instead were lending commitments NDBs made themselves in the context of projects financed by EFSI, which allowed them to maintain control over their funds (interview #2; #3).

Through its provision of guarantees, EFSI also permitted NDBs to expand their activities and organizational capabilities. The opportunity to regain some of the momentum on the political scene by becoming pivotal actors in the process of EFSI motivated the large and well-established NDBs in Europe to act. In a joint letter to the Commission in April 2015, the large development banks of France, Germany, Italy, Poland and Spain, as well as the EIB announced that they 'are prepared to contribute to the EU Investment Plan' and 'ready to expand our activities with the complementary support of the increased EIB Group risk capacity'. 8 Such activities would include project finance, public-private partnerships for infrastructure projects as well as increasing engagement in securitization [START_REF] Bgk | Letter of European development banks to the President of the European Commission[END_REF]. However, they made these statements conditional on being safeguarded of EU regulatory interference in their activities particularly regarding state aid regulations.

In July 2015, the Commission assuaged these concerns. Encouraging the use of existing NDBs or founding new ones in the context of EFSI (European Commission 2015b), it clarified that investments by NDBs were to be largely exempted from state aid rules (ibid.: 6) and covered by block exemptions or de minimis rules (EFSI SB 2016). 9 Given that state aid rules are differently interpreted in each country, this new general framework makes co-operation between different NDBs and the EIB much easier (interview #7). Furthermore, the regulation provided by the EC in July 2015 helped to alleviate fears of the EFSI taking up business of NDBs. The Commission, aware of competition between the EIB and NDBs, stated that 'EFSI should not be a substitute for private market finance or products provided by national promotional banks or institutions but should instead act as a catalyst for private finance' (EU 2015). These concerns being soothed by the Commission, the large NDBs in Europe continued to offer their support, announcing 'further joint instruments and initiatives … [that] could be developed by joint working groups among NPBs and the EIB in connection with the EFSI' (BPI et al. 2015: 10). 10 Summarizing, the establishment of EFSI in 2014 further catalysed the integration of the activities of NDBs with the EIB and the EC. This increase resides in the reconfiguration and explicit articulation of their relationship with the aim to calm institutional rivalry (interview #2).

Considering these changes in the European economic governance framework cumulating since 1988, we can now assess the figuration of development banking in the 'new', post-2008 European political economy. Figure 2 summarizes the expanding network of relationships via specific institutional and financial innovations, showing it as much more intertwined and connected than in the 'old' European political economy. Independent of the possible material impact on European investment, one can arguably see the formation of a network based on the premise to mobilize and leverage funds, share risks, and co-operate to facilitate investment. Most importantly, and in contrast to Figure 1, co-operation is programmatic, based upon multilevel networks and coalitions, which though not eliminating competing goals and frictions, group around furthering investment more stringently than before.

These institutional ties between the EIB and the NDBs are likely to solidify owing to reforms and regulations following the Investment Plan for Europe. The increasing interaction between NDBs and the EIB through these financial instruments has been placed on a new level by the reconfiguration of structural funds into European Structural and Investment Funds in the MFF 2014-2020. 11 Encouraging the use of financial instruments that can be employed to complement projects within EFSI (European Commission 2015a, 2016), these reforms increase the areas of co-operation among NDBs and the EIB. Shared management and implementation of structural funds-based financial instruments lie at the heart of this co-operation (DG Internal Policies 2016a, 12f); a construction NDBs have actively engaged in (interview #8). In the period of 2014-2016, ESIF are supposed to account for 14 per cent of EU-wide public investment (European Commission 2015: 4). Furthermore, in September 2016 the EC proposed an extension of the Investment Plan until 2020 and a bolstering of the €16bn guarantee by 10bn. The EIB itself plans to contribute an additional 2.5bn, aiming to mobilize a total of 500bn (instead of 315bn) over the next years. The Commission has repeated here that:

In partnership with the EIB, NPBs play a key role in the implementation of the Investment Plan, including the EFSI, as their product ranges, local knowledge and geographical reach are complementary. They will remain key in the extended EFSI, including in co-financing projects with the EIB and other investors. (European Commission 2016) This statement speaks to the joint role of EIB and NDBs in bringing about the desired investment push in the European Union based on co-financing and complementarity. The multilevel network of development banks, linked through financial instruments is actively fostered by the European Commission, as their joint activities increase its governance capabilities, gradually 'unmuting' the relationship with the EIB as the 'bank of the EU'.

Conclusions: towards a hidden European investment state?

When focusing on the evolution of development banking in Europe, one can observe the stepwise transformation of European economic governance in which the European Union has developed a governmental infrastructure that aims at facilitating investment through quasi-fiscal actors. In this process, the European Commission has gradually expanded discretion over investment vehicles, including the EIB. Through channelling its limited public budget into financial instruments this development has created stronger institutional ties between the European Commission, the EIB including the EIF, and national development banks. As this analysis shows, the Investment Plan for Europe is less of a brand-new counter-cyclical plan, but the latest stage in this long-term evolution based on the idea of leveraging constrained public budgets.

While it is unclear whether the Investment Plan can really deliver the promised investment impact [START_REF] Godin | Has the Juncker Plan really boosted investment in Europe?[END_REF][START_REF] Rubio | Investment in Europe: Making the Best of the Juncker Plan[END_REF], what is pivotal in our perspective is how it has brought together rather disconnected aspects of investment vehicles into a more coherent, network-based governance framework. We call this the nucleus of a European investment state, as it provides a multilevel governmental infrastructure focused on furthering investment. Based on the principles of subsidiarity and complementarity, this structure signals an expansion of European core powers that builds onbut also holds material incentives formember states founding or engaging development banks.

Two caveats, however, should be in place. First, given that the executive powers of this investment state are development banks, its core structures remain somewhat hidden with unclear and at least variegated effects on its material impact. In this sense, second, it differs markedly from an investment state of the old Keynesian type. Through financial instruments, the EU seeks to realize a greater fiscal impact than the size of its limited budget permits. Taking the form of guarantees and equity, this investment state works based on public-private partnerships and leveraging, and therefore requires less direct state spending. In this sense, it is less an endeavour in democratic economic government, but remains in the vein of technocratic governance.

It is important to note that this network, which remains work in progress, is not organized in a hierarchical way. As we demonstrate above, the EIB (the central node combining the EC, member states and NDBs) is not under the control of a single player and furthermore pursues its own interest. National development banks, conversely, also pursue their own interests as well as those of member states, when participating in these investment schemes. These actors are making use of Europe to expand their legitimacy and their own strategic positioning in policy processes. Thus, despite the demise of state banking in traditional terms, one cannot avoid the impression that the gradual increase of importance of both the EIB and NDBs rest upon a stepwise interest alignment, crucially between the Commission and member states.

The simple reason, as occurs to us, is that development banks have continuously provided a means of economic policy making in the face of fiscal restraint. Nonetheless, it is unclear how stable or vulnerable the depicted nucleus is. Consolidating and expanding the governmental infrastructure will depend on the continued material incentives all the actors involved in the investment state derive. Should financial instruments turn out to burden state budgets, rather than relieving them, or be tainted by scandals of corruption, perceived advantages might diminish and the coherence of the nucleus wane. Most definitely, the political dynamics around European development banking will provide fruitful ground for research and debate for years to come. 3. It is worth noting that the proponents of this analysis have also criticized the EIB for not fully employing its capabilities in the crisis and lagging behind a true counter-cyclical response to the economic recession.

4. An important qualification of the view presented here, however, can be found in Article 19 (ex Art. 21) of the EIB statute. It states that a project facing opposition from the EC can only be financed when the Board of Directors overrides the EC position in a unanimous vote, giving the EC more influence on EIB policy than our assessment of this period suggests.

5. See, for instance, http://www.eib.org/infocentre/blog/all/a-drive-along-italysroads.htm?lang=-en (accessed 1 June 2017).

6.

The EIB welcomed these changes as part of their own adjustments to a changing economic and political environment, highlighting the need for the integration of loans to avoid 'poorly planned and badly managed projects' (European Investment Bank 1988: 15; see also Bussière et al. 2008: 206ff.).

7. This interaction of Western and Eastern European development banks also laid the foundation for an institutionalization of these collaborations in the Network of European Financial Institutions for SMEs founded in 1999 (interview #8).

8. These six institutions also set up the equity fund Fonds Marguerite as part of the European Economy Recovery Plan (EERP) in 2010, whose main goal is to further infrastructure investment through the involvement of private and public institutional investors. The CDC, CDP and KfW also share an office in Brussels. 9. This position seems to have been a compromise between DG Regio and other expansionary forces within the EC and DG Competition, the guardian of state aid rules (for a thorough discussion of the latter see [START_REF] Volberding | National Development Banks and the Rise of Market-Based Protectionism in Europe[END_REF]).

10. This is also an expression of the clout of the grown community of NDBs in Brus-sels, which not only intensified their co-operation with the EIB and the EIF, but also formed closer ties among each other to increase its influence upon rule making processes in the EU. While their formal co-operation was instituted in 1999 with the Network of European Financial Institutions for SMEs (NEFI), it has strongly deepened in the crisis and found new institutional venues, e.g. in the Long Term Investor Club (founded in 2009) or in its offshoot European Association of Long-Term Investors (ELTI) (interview #7).

11. This reconfiguration also involves regional development banks, which benefit directly from European regional funds, as championed by DG Regio.

Notes

1. According to EU regulation, state-owned development banks are defined as 'legal entities carrying out financial activities on a professional basis which are given a mandate by a member state or a member state's entity at central, regional or local level, to carry out development or promotional activities' (EU 2015: 10).

Figure 1 .

 1 Figure 1. Development banks in the 'old' European political economy, 1957-1988.

  the increased use[of] Financial Instruments in Cohesion Policy has required closer working relationships between the EIB and the European Commission (DG Regio). For the Commission, this has meant a steep learning curve and, to a certain extent, a reliance on EIB expertise in the development and implementation of FIs. (DG Internal Policies 2016b: 10, emphasis added)

Figure 2 .

 2 Figure 2. Development banks in the 'new' European political economy.

2.

  Calculations based on each institutions' financial report from 2008 and 2015 respectively.

Acknowledgements

An earlier version of this article was presented at the 28th European Association for Evolutionary Political Economy (EAEPE) Conference in Manchester, 3-5 November 2016, and the 'Finance for Growth and Development' Workshop at the University of Cambridge, 29 November 2016. We thank all participants as well as two anonymous reviewers for their time and their critical engagement with our argument. Sophia Spornraft has provided valuable research assistance.

Disclosure statement

No potential conflict of interest was reported by the authors.

Notes on contributors

Daniel Mertens is a postdoctoral researcher in international political economy at Goethe University, Frankfurt am Main.

Matthias Thiemann is assistant professor of European public policy at Sciences Po, Paris.

Appendix


David Basin

Cas Cremers

Jannik Dreier

Ralf Sasse

Symbolically Analyzing Security Protocols using TAMARIN

INTRODUCTION

During the last three decades, there has been considerable research devoted to the symbolic analysis of security protocols and existing tools have had considerable success both in detecting attacks on protocols and showing their absence. Nevertheless, there is still a large discrepancy between the symbolic models that one specifies on paper and the models that can be effectively analyzed by tools.

In this paper, we present the TAMARIN prover for the symbolic analysis of security protocols. TAMARIN takes as input a security protocol model, specifying the actions taken by the agents running the protocol in different roles (e.g., the protocol initiator, the responder, and the trusted key server), a specification of the adversary, and a specification of the protocol's desired properties. TAMARIN can then be used to automatically construct a proof that the protocol fulfills its specified properties, even when arbitrarily many instances of the protocol's roles are interleaved in parallel, together with the actions of the adversary.

In more detail, and as will be explained in subsequent sections, TAMARIN's execution model is that of a labeled transition system. The state space is made up of multi-sets of facts, representing the adversary's knowledge, messages on the network, and the protocol participants' state. The protocol and adversary capabilities are then specified by multi-set rewriting rules. A sequence of transitions gives rise to a trace, which is the sequence of the labels of the applied rules. Properties are specified in a guarded fragment of first-order logic that allows quantification over messages and timepoints, and formulas are interpreted over traces. Proofs are constructed using backward search with support for reasoning modulo equational theories. As practical examples, these features enable the tool to handle: protocols with non-monotonic mutable global state and complex control flow such as loops; complex security properties such as the eCK model [START_REF] Lamacchia | Stronger Security of Authenticated Key Exchange[END_REF] for key exchange protocols; and equational theories such as Diffie-Hellman, bilinear pairings, and convergent user-specified theories with the finite variant property [START_REF] Comon | The finite variant property: How to get rid of some algebraic properties[END_REF].

TAMARIN provides two ways to construct proofs. It has an efficient, fully automated mode that combines deduction and equational reasoning with heuristics to guide the proof search. If the tool's automated proof search terminates, it returns either a proof of correctness (for an unbounded number of role instances and fresh values) or a counterexample, representing an attack that violates the stated property. However, since the correctness of security protocols is an undecidable problem, the tool may not terminate on a given verification problem. Hence, users may need to resort to TAMARIN's interactive mode to explore the proof states, inspect attack graphs, and seamlessly combine manually guided proofs with automated proof search.

TAMARIN is based on a number of key ideas. Algorithmically, it builds upon and generalizes the backwards search used by the Scyther tool [START_REF] Cremers | The Scyther Tool: Verification, Falsification, and Analysis of Security Protocols[END_REF]] to enable protocol verification. Support for the theory for Diffie-Hellman exponentiation was developed in [START_REF] Schmidt | Automated Analysis of Diffie-Hellman Protocols and Advanced Security Properties[END_REF]]. In the theses of Meier [START_REF] Meier | Advancing Automated Security Protocol Verification[END_REF]] and Schmidt [START_REF] Schmidt | Formal Analysis of Key Exchange Protocols and Physical Protocols[END_REF]], the approach was extended with trace induction and with support for bilinear pairings and operators modulo associativity-commutativity (AC). Recent work [Basin et al. 2015a] has extended TAMARIN to handle equivalence properties. Tamarin now supports user-defined convergent equational theories with the finite variant property [Dreier et al. 2017a], while previously only the smaller set of subterm-convergent user defined theories was supported.

TAMARIN Resources.. The main webpage of the TAMARIN Prover is hosted at [TAMARIN team 2017] and provides links for downloading the tool, an extensive user manual, and further reading. TAMARIN's development is a collaborative effort, and we encourage contributions to the tool, the manual, and the case studies. See the webpage for details on how to contribute.

Outline.. The remainder of this paper is structured as follows. In Section 2 we provide an overview of the TAMARIN system. In Section 3, we summarize some of the more prominent applications of TAMARIN. We compare to related work in Section 4 and conclude in Section 5 with a brief discussion of future perspectives.

SYSTEM OVERVIEW

We start with an example that illustrates TAMARIN's use. Afterwards, we describe its underlying foundations and implementation.

Example: Diffie-Hellman Key Exchange

Input.. TAMARIN takes as its command-line input the name of a theory file that defines the equational theory modeling the protocol messages, the multi-set rewriting system modeling the protocol, and a set of statements specifying the protocol's desired properties. To analyze the security of a variant of the Diffie-Hellman protocol, we use a theory file that consists of the following parts. Input: Equational Theory. To specify the set of protocol messages, we write: builtins: diffie-hellman functions: mac/2, shk/0 [private] This enables support for Diffie-Hellman (DH) exponentiation and defines two additional function symbols, while the DH built-in includes constant g already. The support for DH exponentiation defines the operator ^for exponentiation, which satisfies the equation (g^x)^y=(g^y)^x, and additional operators and equations. We use the binary function symbol mac to model a message authentication code (MAC), the constant g to model the generator of a DH group, and the constant shk to model a shared secret key, which is declared as private and therefore not directly deducible by the adversary. Support for pairing and projection using < , >, fst, and snd is provided by default. Input: Protocol. Our protocol definition consists of three (labeled) multi-set rewriting rules. Each rule is a triple: sequences of facts as left-hand-sides, labels, and right-handsides. Facts are of the form F (t 1 , . . . , t k ) for a fact symbol F and terms t i . The protocol rules use the fixed unary fact symbols Fr and In in their left-hand-side to obtain fresh names (unique and unguessable constants) and messages received from the network.

To send a message to the network, they use the fixed unary fact symbol Out in their right-hand-side. Note that both participants in this exchange can send their initial message to their partner independently, unlike in the often used initiator-and-responder setup.

Our first rule models the creation of a new protocol thread tid that chooses a fresh exponent x and sends out g^x concatenated with a MAC of this value and the participants' identities:

rule Step1: [ Fr(tid:fresh), Fr(x:fresh) ] -[ ]→ [ Out(<g^(x:fresh), mac(shk, <g^(x:fresh), A:pub, B:pub>)>) , Step1(tid:fresh, A:pub, B:pub, x:fresh) ]

In this rule, we use the sort annotations fresh and pub to ensure that the corresponding variables can only be instantiated with fresh and public names. An instance of the Step1 rule rewrites the state by consuming two Fr-facts to obtain the fresh names tid and x and generating an Out-fact with the sent message and a Step1-fact denoting that the given thread has completed the first step with the given parameters. The arguments of the Step1-fact denote the thread identifier, the actor, the intended partner, and the chosen exponent. As the rule has no label it has no direct effect on the trace. However, it does change the state, thereby enabling further rules that consume the state facts in its conclusion.

Our second rule models the second step of a protocol thread:

rule Step2: [ Step1(tid, A, B, x:fresh), In(<Y, mac(shk, <Y, B, A>)>) ] -[ Accept(tid, Y^(x:fresh)) ]→ []
Here, a Step1-fact, which must have been created in an earlier Step1-step, is consumed in addition to an In-fact. The In-fact uses pattern matching to verify the MAC. The corresponding label Accept(tid, Y^(x:fresh)) denotes that the thread tid has accepted the session key Y^(x:fresh).

Our third rule models revealing the shared secret key to the adversary:

rule RevealKey: [] -[ Reveal() ]→ [ Out(shk) ]
The constant shk is output on the network and the label Reveal() ensures that the trace reflects whether and when a reveal has happened. The set of protocol traces is defined via multi-set rewriting (modulo the equational theory) with these rules and the built-in rules for fresh name creation, message reception by the adversary, message deduction, and message sending by the adversary, which is observable via facts of the form K(m). More precisely, the trace corresponding to a multi-set rewriting derivation is the sequence of the labels of the applied rules. Input: Properties. We define the desired security properties of the protocol as trace or equivalence properties. In the case of trace properties, the labels of the protocol rules must contain sufficient information to state these properties. In TAMARIN, properties are specified as so-called lemmas, which are then discharged or disproven by the tool.

lemma Accept_Secret: ∀ i j tid key. Accept(tid,key)@i & K(key)@j ⇒ ∃ n. Reveal()@n & n < i
The lemma quantifies over timepoints i, j, and n1 and messages tid and key. It uses predicates of the form F @ i to denote that the trace contains the fact F at index i and predicates of the form i < j to denote that the timepoint i is earlier than the timepoint j.

The lemma states that if a thread tid has accepted a key key at timepoint i and key is also known to the adversary, then there must be a timepoint l prior to i where the shared secret was revealed.

Since 2015 [Basin et al. 2015a], TAMARIN can also handle equivalence properties. Equivalence properties are used to represent privacy properties, including anonymity and unlinkability, but can also be used for strong secrecy as well as real-or-random secrecy. This allows analysis of protocols for voting or e-cash. Equivalence properties are specified using a special diff-operator, similar to the ProVerif tool [START_REF] Blanchet | An efficient cryptographic protocol verifier based on Prolog rules[END_REF]]. The diff-operator takes two parameters and can be used inside the terms in the protocol specification. A protocol specification gives rise to a labeled transition system. Using diff-terms creates two systems that are identical except in the values under such diffterms. TAMARIN will then try to prove that the two systems obtained by (1) replacing the diff-terms by their first parameter, and (2) replacing the diff-terms by their second parameter, are observationally equivalent.

Previously, TAMARIN only supported user-defined equational theories that are subterm-convergent, meaning their right-hand side is a strict subterm of the lefthand side. Since 2017 [Dreier et al. 2017a], TAMARIN supports a much larger set of user-defined equational theories, which must only be convergent and have the finite variant property. This larger set of supported equational theories enables modeling, e.g., blind signatures. The equational theory for blind signatures contains an equation of the form unblind( sign( blind(m,b), sk), b ) = sign(m,sk) which was not admissible before as sign(m,sk) is not a subterm of the left-hand side of the equation. Using the new version of TAMARIN, verification of both e-cash and voting protocols was completed. Output. Running TAMARIN on this input file yields the following output.

analyzed example.spthy: Accept_Secret (all-traces) verified (9 steps)

The output states that TAMARIN successfully verified that all protocol traces satisfy the formula in Accept_Secret. Alternative Input. For the trace mode only, an alternative input language, similar to the applied-pi calculus, is available. This input gets automatically translated to TAMARIN's multi-set rewriting input using a sound and complete translator [START_REF] Kremer | Automated Analysis of Security Protocols with Global State[END_REF]. This simplifies use of TAMARIN for users experienced in appliedpi calculus based tools, like ProVerif, and also enables easier reuse of already existing protocol specifications that have been written for such tools.

Theoretical Foundations

A formal treatment of TAMARIN's foundations is given in the theses of Schmidt [START_REF] Schmidt | Formal Analysis of Key Exchange Protocols and Physical Protocols[END_REF]] and Meier [START_REF] Meier | Advancing Automated Security Protocol Verification[END_REF]]. For an equational theory E, a multi-set rewriting system R defining a protocol, and a guarded formula ϕ defining a trace property, TAMARIN can either check the validity or the satisfiability of ϕ for the traces of R modulo E. As usual, validity checking is reduced to checking the satisfiability of the negated formula.

For satisfiability checking, constraint solving is used to perform an exhaustive, symbolic search for executions with satisfying traces. The states of the search space are constraint systems. For example, a constraint can express that some multi-set rewriting step occurs in an execution or that one step occurs before another step. We can also directly use formulas as constraints to express that some behavior does not occur in an execution. Applications of constraint reduction rules, such as simplifications or case distinctions, correspond to the incremental construction of a satisfying trace. If no further rules can be applied and no satisfying trace was found, then no satisfying trace exists.

For symbolic reasoning, we exploit the finite variant property [START_REF] Comon | The finite variant property: How to get rid of some algebraic properties[END_REF]] to reduce reasoning modulo E with respect to R to reasoning modulo AC with respect to the variants of R using folding variant narrowing [START_REF] Escobar | Folding variant narrowing and optimal variant termination[END_REF]]. This enables TAMARIN to deal with a very large class of equational theories and since TAMARIN's equivalence mode is documented in [Basin et al. 2015b]. In a nutshell, TAMARIN computes all possible executions of the protocol on both systems using its constraint solving, and tries to find equivalent executions on the other side by mirroring. If these mirrors exist for all executions, then equivalence holds. If at least one execution does not have a mirror, then this represents a potential attack. As the equivalence mode is sound but not complete, such an attack may be spurious.

Implementation and Interactive Mode

TAMARIN is written in the Haskell programming language. Its interactive mode is implemented as a webserver, serving HTML pages with embedded JavaScript. TAMARIN's source code is publicly available from its webpage [TAMARIN team 2017]. Figure 1 shows TAMARIN's interactive mode, which integrates automated analysis and interactive proof guidance, and provides detailed information about the current constraints or counterexample traces. Users can carry out automated analysis of parts of the search space and perform partial unfoldings of the proof tree. Fully automated proof search is available on the command-line without the need to use the interactive mode and GUI.

EXAMPLES OF APPLICATIONS

TAMARIN's flexible modeling framework and expressive property language make it suitable for analyzing a wide range of security problems. Table I shows selected results when using TAMARIN in the automated mode. These results illustrate TAMARIN's scope and effectiveness at unbounded verification and falsification. We now describe applications grouped by the features of TAMARIN they used and what was achieved. Key Exchange Protocols. We used TAMARIN to analyze many authenticated key exchange protocols with respect to their intended adversary models [START_REF] Schmidt | Automated Analysis of Diffie-Hellman Protocols and Advanced Security Properties[END_REF]]. These protocols typically include Diffie-Hellman exponentiation and are designed to satisfy complex security properties, such as the eCK model [START_REF] Lamacchia | Stronger Security of Authenticated Key Exchange[END_REF]]. Earlier works had only considered some of these protocols with respect to weaker adversaries, which cannot reveal random numbers and both short-term and long-term keys.

Loops and Mutable Global State.

We also used TAMARIN to analyze protocols with loops and non-monotonic mutable global state. Examples include the TESLA protocols, the security device and contract signing examples from [START_REF] Arapinis | StatVerif: Verification of Stateful Processes[END_REF], the keyserver protocol from [START_REF] Mödersheim | Abstraction by set-membership: verifying security protocols and web services with databases[END_REF]], and the exclusive secrets and envelope [START_REF] Schmidt | Automated Verification of Group Key Agreement Protocols[END_REF]]. The group protocols STR and GDH based on Diffie-Hellman were verified, as was BP-based Group Joux. Note that these group protocols do not limit the number of participants and were proven for an arbitrary number of participants. Furthermore, the tripartite protocol Signed Joux and TAK1 were both each falsified and verified (property/adversary-modeldependent). Additional identity-based protocols RYY, Scott, and Chen-Kudla were similarly proven, respectively falsified, showing exactly the weakest assumptions under which the protocols still satisfy their desired security properties. Details on the properties verified and automated verification time measurements are available [Schmidt et al. 2014, Table I].

Transport Layer Security (TLS). The largest case study so far in TAMARIN has been the upcoming IETF TLS 1.3 standard, which is the main foundation for Internet security and also widely used to establish secure channels in a variety of contexts. As of writing, TLS 1.3 is nearing completion. TLS comprises a complex combination of sub-protocols with intricate interactions that require loops and complex state. During the development process, TAMARIN was used to analyze different draft versions. For one of these proposals, TAMARIN found a critical attack [START_REF] Cremers | Automated Analysis and Verification of TLS 1.3: 0-RTT, Resumption and Delayed Authentication[END_REF]. TAMARIN was also used to verify the final revision of TLS 1.3 [Cremers et al. 2017b].

Non-Subterm Convergent Equational Theories. As TAMARIN supports any convergent equational theory that has the finite variant property, it can also be used to analyze protocols that use, for example, blind signatures or trapdoor commitments [Dreier et al. 2017a]. We have used it to study Chaum's digital cash protocol [START_REF] Chaum | Blind Signatures for Untraceable Payments[END_REF] which uses blind signatures and whose modeling also required the use of global state.

We have verified anonymity, untraceability, as well as unforgeability, which states that no coins can be maliciously created. We also analyzed the FOO e-voting protocol [START_REF] Fujioka | A practical secret voting scheme for large scale elections[END_REF], which relies on blind signatures. We have been able to check vote privacy (modeled as an equivalence property) and furthermore eligibility (modeled as a trace property). We additionally verified the Okamoto e-voting protocol [START_REF] Okamoto | An electronic voting scheme[END_REF]], which relies on trapdoor commitments to achieve receipt-freeness. In particular we provided the first automated proof of receipt-freeness for this protocol. Electronic Payment Protocols. [START_REF] Cortier | Designing and proving an EMV-compliant payment protocol for mobile devices[END_REF]] used TAMARIN to verify a new EMV-compliant payment protocol, which is stateful as it uses tokens and counters. They verified complex security properties including a property stating that stolen payment tokens can only be used within a limited time window.

Liveness Properties and Fair Exchange Protocols. Thanks to the flexible way that properties are specified in TAMARIN, it is possible to express and verify certain liveness properties. For example in the case of fair exchange protocols, one can study timeliness and fairness [START_REF] Backes | A Novel Approach for Reasoning about Liveness in Cryptographic Protocols and its Application to Fair Exchange[END_REF]]. This also required specifying resilient channels, i.e., channels where messages are eventually delivered, which can be accomplished using restrictions in TAMARIN. Restrictions are guarded first-order logic formulas; their use restricts TAMARIN to only consider traces that satisfy the specified restrictions.

Industrial Control Protocols

We also used TAMARIN to verify industrial control protocols such as OPC-UA and variants of MODBUS [Dreier et al. 2017b]. We studied flow integrity properties, including liveness properties ("messages will be delivered") and ordering requirements ("messages are received in the same order they were sent").

Standardization While we have successfully used TAMARIN to provide increased assurance for security protocol standards, e.g., TLS 1.3 [START_REF] Cremers | Automated Analysis and Verification of TLS 1.3: 0-RTT, Resumption and Delayed Authentication[END_REF]] and DNP3-SAv5 [Cremers et al. 2017a], such analyses are not yet routinely performed as part of the development process of standards. In [Basin et al. 2014] it is argued that the quality of security protocol standards can be improved by integrating such analyses into the standardization process. TAMARIN's expressive framework is well suited for such analyses.

RELATED WORK

There are many tools for the symbolic analysis of security protocols. We focus on those that can provide verification with respect to an unbounded number of sessions for complex properties. In general, the TAMARIN prover offers a novel combination of features that enables it to verify protocols and properties that were previously impossible to verify using other automated tools.

Like its predecessor the Scyther tool [START_REF] Cremers | The Scyther Tool: Verification, Falsification, and Analysis of Security Protocols[END_REF]], TAMARIN performs backwards reasoning. However in contrast to Scyther, it supports equational theories, modeling complex control flow and mutable global state, an expressive property specification language, and the ability to combine interactive and automated reasoning.

The Maude-NPA tool [START_REF] Escobar | A rewriting-based inference system for the NRL Protocol Analyzer and its meta-logical properties[END_REF]] supports protocols specified as linear role-scripts, properties specified as symbolic states, and equational theories with a finite variant decomposition modulo AC, ACI, or C. It is unclear if our case studies that use global state, loops, and temporal formulas can be specified in Maude-NPA. With respect to their support of equational theories, Maude-NPA and TAMARIN are incomparable. For example, Maude-NPA has been applied to XOR and TAMARIN has been applied to bilinear pairing.

The ProVerif tool [START_REF] Blanchet | An efficient cryptographic protocol verifier based on Prolog rules[END_REF]] has been extended to partially handle DH with inverses [K üsters and Truderung 2011], bilinear pairings [START_REF] Pankova | Symbolic Analysis of Cryptographic Protocols Containing Bilinear Pairings[END_REF], and mutable global state [START_REF] Arapinis | StatVerif: Verification of Stateful Processes[END_REF]. From a user perspective, TAMARIN provides a more expressive property specification language that, e. g., allows for the direct specification of temporal properties. The effectiveness of ProVerif relies largely on its focus on the adversary's knowledge. It has more difficulty dealing with properties that depend on the precise state of agent sessions and mutable global state. The extension [START_REF] Arapinis | StatVerif: Verification of Stateful Processes[END_REF] for mutable global state is subject to several restrictions and the protocol models require additional manual abstraction steps. Similarly, the DH and bilinear pairing extensions work under some restrictions, e. g., exponents in the specification must be ground.

TAMARIN's observational equivalence notion has similarities with other notions of observational equivalence considered in the literature, including trace equivalence [START_REF] Cheval | Deciding equivalence-based properties using constraint solving[END_REF], bisimulation [START_REF] Abadi | Mobile values, new names, and secure communication[END_REF], and notions based on contexts or bi-processes [START_REF] Abadi | Mobile values, new names, and secure communication[END_REF][START_REF] Cheval | Deciding equivalence-based properties using constraint solving[END_REF][START_REF] Blanchet | Automated Verification of Selected Equivalences for Security Protocols[END_REF].

Various other tools exist for verifying notions of observational equivalence but most are limited to a bounded number of sessions (e.g., [START_REF] Cheval | APTE: An Algorithm for Proving Trace Equivalence[END_REF][START_REF] Cheval | Deciding equivalence-based properties using constraint solving[END_REF][START_REF] Chadha | Automated Verification of Equivalence Properties of Cryptographic Protocols[END_REF]). ProVerif [START_REF] Blanchet | Automated Verification of Selected Equivalences for Security Protocols[END_REF] verifies observational equivalence in the applied π-calculus for an unbounded number of sessions using bi-processes, but it cannot handle mutable state [START_REF] Arapinis | StatVerif: Verification of stateful processes[END_REF], for example, a protocol that switches between the states a and b. Also, TAMARIN supports a larger set of equational theories. For example, ProVerif can only deal with a weaker Diffie-Hellman equational theory approximation [START_REF] Ralf | Using ProVerif to Analyze Protocols with Diffie-Hellman Exponentiation[END_REF], which additionally does not support observational equivalence at all.

Another multi-set rewriting-based approach that supports observational equivalence is Maude-NPA [START_REF] Santiago | A Formal Definition of Protocol Indistinguishability and Its Verification Using Maude-NPA[END_REF]. It creates the synchronous product of two very similar protocols. Their approach suffers from termination problems [START_REF] Santiago | A Formal Definition of Protocol Indistinguishability and Its Verification Using Maude-NPA[END_REF]] and thus presents only attacks.

FUTURE PERSPECTIVES FOR TAMARIN

TAMARIN's future development will include evolution along the following four axis: Improving the tool's interface, extending the framework, improving reasoning methods, and improving heuristics.

Scaling the Tool's Interface.. TAMARIN has an extensive interactive mode that has been shown to be effective on many case studies. However, as the complexity of models grows, it becomes harder for humans to inspect the resulting proof states. As TAMARIN's ability to deal with more complex models increases, it becomes increasingly important to improve its interactive mode to enable users to efficiently explore the proof states and applicable constraint rules. This may involve incorporating techniques from data visualization, filtering techniques, and heuristics to emphasize the most relevant information. This requires a substantial engineering effort (as opposed to fundamental research) that is critical to making scalable tools that can be adopted by a wide community.

Extending the Framework.. As an ongoing avenue of research, there is still plenty of scope to further support advanced equational theories. The need to support new equational theories is driven by more detailed modeling of modern cryptographic primitives. As support for equational theories grows, more primitives can be incorporated. Conversely, as more cryptographic primitives are developed by cryptographers, the corresponding symbolic modeling generates the need to support the associated equational theories.

TAMARIN currently supports a relatively coarse form of induction over protocol rule instances. However, there is no support for more fine-grained induction over all rule instances, in particular including the adversary's knowledge deduction steps. This means certain proof strategies currently cannot be mechanized, such as inductive arguments about all possible terms that can be derived by an adversary. This leads to the natural question of whether we can improve support for induction in TAMARIN.

TAMARIN currently does not use any form of abstraction or over-approximation of the adversary's behavior. While this makes counterexample generation easier, there is no fundamental reason why the tool should not support abstraction if that would enable it to analyze more problems. An open research question is to determine under which conditions abstraction methods can improve TAMARIN's analysis. As a starting point, one could consider works such as [Nguyen and Sprenger 2015] that apply directly to TAMARIN's predecessor, Scyther. The reason why these methods do not trivially translate to TAMARIN is that more domain-specific specification languages (such as Scyther's) have clearly defined notions of protocols, roles, and the adversary. In TAMARIN's more expressive specification language, there are only abstract rewriting rules, which allow protocols to be modeled in many different ways. This modeling flexibility means that it is harder to reconstruct what a protocol or role is, which makes it harder to automatically determine when and how to apply domain-specific theorems.

It would be of general interest to further investigate classes of non-trace properties, including further variants of observational equivalence. This is very relevant for the security domain, as such properties also play a fundamental role in security definitions based on formalisms in the spirit of Universal Composability (UC) [START_REF] Canetti | Universally Composable Security: A New Paradigm for Cryptographic Protocols[END_REF]]. Proofs in these formalisms tend to revolve around proving simulatability with respect to so-called ideal functionalities, which in turn are processes. Even if we were to construct symbolic counterparts of these definitions, they currently can not be proven by TAMARIN, as their structural differences preclude proving TAMARIN's notion of equivalence. There are many exciting fundamental open questions in this area.

The TAMARIN framework supports the modeling of a wide range of problems, but there are several interesting cases in which it currently does not yet automatically provide either a proof or a counterexample (attack). While this fundamentally cannot be avoided, and the interactive mode means the user is not stuck, we expect that there is substantial room to improve the level of automation by introducing new constraint solving rules (i.e., reasoning methods) and improving TAMARIN's heuristics. We address these in turn.

Improving Reasoning Methods.. One of the core ingredients of TAMARIN's ability to construct proofs or find attacks is its normal form conditions. These conditions help restrict TAMARIN's search space while retaining the correctness of the analysis results. Intuitively, they help by only considering efficient proofs or attacks without redundant steps. While we have proven that TAMARIN's current normal form conditions retain correctness, it may well be possible to construct additional normal form conditions that would improve TAMARIN's efficiency and even enable automatic proofs for protocols in which TAMARIN currently requires manual intervention. However, if TAMARIN is extended with further equational theories or constraint types, some of the current normal form conditions might no longer be sound, and weaker ones might need to be developed.

The main ingredient of TAMARIN's analysis are the constraint solving rules. Intuitively, these encode specific proof methods, such as case distinctions, or drawing conclusions from combinations of constraints. As the tool is applied to more domains, different proof strategies might be needed, and we expect such case studies to drive the development of new constraint solving rules.

Improving the Heuristics.. While the previously mentioned extensions would improve TAMARIN's ability to manually construct proofs, they do not guarantee improved automation. As more constraint solving rules are introduced, it may become harder to provide heuristics that are effective and efficient in most cases: if multiple rules can be applied in a certain proof state, which one should be used? In TAMARIN, this is dealt with by the so-called heuristics: given a proof state and set of applicable constraint solving rules, they aim to select the optimal rule to apply, in the sense that it would yield the fastest termination, by either a proof or a counterexample. While the heuristic does not affect the correctness of the result, it strongly influences TAMARIN's termination and efficiency. Improving the heuristic is a long-term goal and requires domain-specific investigations and obtaining further experience in case studies.

The optimal rule to apply strongly depends on the proof state and type of protocol. Thus, it may well be possible that different approaches are better suited to different subdomains. To facilitate this, TAMARIN could employ a second type of heuristic, to detect protocol classes, mechanisms, or property types.

Putting all these improvements together should lead to a dramatic increase in TAMARIN's scope and automation. This will accelerate its inclusion in the engineering and standardization process for protocols, as seen already with IETF's TLS 1.3 standard, collaboration with the Japanese standardization body for ISO/IEC 9798, and current work with mobile communications device vendors.

Fig. 1 .

 1 Fig. 1. TAMARIN's interactive modethe last extension[Dreier et al. 2017a], user-specified equational theories only have to be convergent and ensure the finite variant property.TAMARIN's equivalence mode is documented in[Basin et al. 2015b]. In a nutshell, TAMARIN computes all possible executions of the protocol on both systems using its constraint solving, and tries to find equivalent executions on the other side by mirroring. If these mirrors exist for all executions, then equivalence holds. If at least one execution does not have a mirror, then this represents a potential attack. As the equivalence mode is sound but not complete, such an attack may be spurious.

Table I .

 I Selected results of the automated analysis of case studies included in the public TAMARIN repository. Here, KI denotes key independence.

	Protocol	Security property	Result	Time [s]	Details in
	1. KAS1	KI with Key Compromise Impersonation	proof		0.7	[Schmidt et al. 2012]
	2. NAXOS	eCK	proof		4.4	[Schmidt et al. 2012]
	3. STS-MAC	KI, adversary can register arbitrary public keys	attack		4.6	[Schmidt et al. 2012]
	4. STS-MAC-fix1	KI, adversary can register arbitrary public keys	proof		9.2	[Schmidt et al. 2012]
	5. STS-MAC-fix2	KI, adversary can register arbitrary public keys	proof		1.8	[Schmidt et al. 2012]
	6. TS1-2004	KI	attack		0.3	[Schmidt et al. 2012]
	7. TS2-2004	KI with weak Perfect Forward Secrecy	attack		0.5	[Schmidt et al. 2012]
	8. TS3-2004	KI with weak Perfect Forward Secrecy	non-termination	-	[Schmidt et al. 2012]
	9. UM	Perfect Forward Secrecy	attack		1.5	[Schmidt et al. 2012]
	10. TLS handshake	secrecy, injective agreement	proof		2.3	[Meier 2013]
	11. TESLA 1	data authenticity	proof		4.4	[Meier 2013]
	12. TESLA 2 (lossless)	data authenticity	proof	16.4	[Meier 2013]
	13. Keyserver	keys are secret or revoked	proof		0.1	[Meier 2013]
	14. Security Device	exclusivity (left or right)	proof		0.4	[Meier 2013]
	15. Contract signing protocol	exclusivity (abort or resolve)	proof		0.8	[Meier 2013]
	16. Envelope (no reboot)	denied access implies secrecy	proof	32.7	[Meier 2013]
	17. SIGJOUX (tripartite)	Perfect Forward Secrecy	proof	102.9	[Schmidt 2012]
	18. SIGJOUX (tripartite)	Perfect Forward Secrecy, ephemeral-key reveal	attack	111.5	[Schmidt 2012]
	19. RYY (ID-based)	Perfect Forward Secrecy	proof	10.3	[Schmidt 2012]
	20. RYY (ID-based)	Perfect Forward Secrecy, ephemeral-key reveal	attack	10.5	[Schmidt 2012]
	21. YubiKey (multiset)	injective authentication	proof	19.3 [K ünnemann and Steel 2012]
	22. YubiHSM (multiset)	injective authentication	proof		7.6 [K ünnemann and Steel 2012]

protocol models for TPMs from

[START_REF] Delaune | Formal Analysis of Protocols Based on TPM State Registers[END_REF]

]. In each case, our results are more general or the analysis is more efficient than previous results. Additionally, TAMARIN was successfully used to analyze the YubiKey and YubiHSM protocols

[START_REF] Robert | YubiSecure? Formal Security Analysis Results for the YubiKey and YubiHSM[END_REF]

. Protocols with Many Messages and Multiple Parties: ARPKI. We proposed a new public key infrastructure, called the Attack Resilient Public Key Infrastructure (ARPKI)

[Basin et al. 2014;[START_REF] Basin | Design, Analysis, and Implementation of ARPKI: an Attack Resilient Public-Key Infrastructure[END_REF]

. ARPKI extended classic public key infrastructures using multiple certificate authorities and log servers. ARPKI was modeled and analyzed using TAMARIN, and only possible due to the support for mutable state. Group Protocols and Bilinear Pairings. Using TAMARIN's support for bilinear pairing (BP) different group protocols were analyzed

In TAMARIN's input language, timepoint variables are prefixed with #, which we leave implicit here.