2017sacln019

M Lucca Hirschi

M David

Baelde Maître De Conférences

Professeur Gilles Barthe

M Bruno Blanchet

M Cas

Cremers Professeur

Mme Stéphanie Delaune

Thomas Jensen

Composition du

en Français

La société de l'information dans laquelle nous vivons repose notamment sur notre capacité à échanger des informations de façon sécurisée. Ces échanges sécurisés sont réalisés au moyen de protocoles cryptographiques. Ils explicitent comment les différents agents communicants doivent se comporter et exploitent des primitives cryptographiques (e.g. chiffrement, signature) pour protéger les échanges. Étant donné leur prédominance et leur importance, il est crucial de s'assurer que ces protocoles accomplissent réellement leurs objectifs. Parmi ces objectifs, on trouve de plus en plus de propriétés en lien avec la vie privée (e.g. anonymat, non-traçabilité). Malheureusement, les protocoles développés et déployés souffrent souvent de défauts de conception entraînant un cycle interminable entre découverte d'attaques et amélioration des protocoles.

Pour en sortir, nous prônons l'analyse mécanisée de ces protocoles par des méthodes formelles qui, via leurs fondements mathématiques, permettent une analyse rigoureuse apportant des garanties fortes sur la sécurité attendue. Parmi celles-ci, la vérification dans le modèle symbolique offre de grandes opportunités d'automatisation. La plupart des propriétés en lien avec la vie privée sont alors modélisées par l'équivalence entre deux systèmes. Toutefois, vérifier cette équivalence est indécidable dans le cas général. Deux approches ont alors émergé. Premièrement, pour un nombre borné de sessions d'un protocole, il est possible de symboliquement explorer toutes ses exécutions possibles et d'en déduire des procédures de décision pour l'équivalence. Deuxièmement, il existe des méthodes de semi-décision du problème dans le cas général qui exploitent des abstractions, notamment en considérant une forme forte d'équivalence.

Nous avons identifié un problème majeur pour chacune des deux méthodes de l'état de l'art qui limitent grandement leur impact en pratique. Premièrement, les méthodes et outils qui explorent symboliquement les exécutions souffrent de l'explosion combinatoire du nombre d'états, causée par la nature concurrente des systèmes étudiés. Deuxièmenent, dans le cas non borné, la forme forte d'équivalence considérée se trouve être trop imprécise pour vérifier certaines propriétés telle que la non traçabilité, rendant cette approche inopérante pour ces propriétés.

Dans cette thèse, nous proposons une solution à chacun des problèmes. Ces solutions prennent la forme de contributions théoriques, mais nous nous efforçons de les mettre en pratique via des implémentations afin de confirmer leurs impacts pratiques qui se révèlent importants.

Tout d'abord, nous développons des méthodes de réduction d'ordres partiels pour réduire

Je veux tout d'abord remercier mes directeurs de thèse David Baelde et Stéphanie Delaune qui m'ont donné l'opportunité de commencer cette thèse et par qui j'ai appris tant de choses. C'est d'abord grâce à vous que ces quelques années au LSV ont été si enrichissantes.

Je tiens aussi à remercier les deux rapporteurs de ma thèse Bruno Blanchet et Gilles Barthe pour avoir lu et commenté mon manuscrit ainsi que Cas Cremers, Thomas Jensen et Catuscia Palamidessi pour avoir accepté de faire partie de mon jury de thèse.

J'ai eu la chance de travailler dans un milieu où l'échange et le partage ont un rôle primordial.

Merci donc à tous ceux qui ont pris part à ce bouillonnement d'idées si stimulant que ça soit à Cachan ou ailleurs. Notamment, merci aux doctorants et autres membres du LSV de faire en sorte que ce bouillonement ne s'éteigne jamais.

Je veux également remercier mes amis qui m'entourent : que l'on se soit connu à Avignon, Lyon, Paris, ou ailleurs, merci à vous tous d'être toujours là. Merci à ma famille qui m'a enraciné dans ce qu'il y a de plus important. Merci à Marie-Charlotte pour m'avoir supporté ces quelques derniers mois et pour son amour ces quelques dernières années.

Formal Verification

Discussion. We may note that in presence of honest participants who follow the protocol rules, the protocol works well, and the attack scenarios described above are not possible. However, it is important to ensure that these protocols meet their security goals in any situation, especially in the presence of malicious agents that may want to take advantage of the protocol and therefore do not necessarily follow the instructions specified by the protocols. Making sure that security protocols are secure in such a hostile environment is an essential aspect which makes protocol design and verification very difficult tasks.

drastiquement le nombre d'états à explorer tout en s'assurant que l'on ne perd pas d'attaques. Nos méthodes sont conçues pour le cadre exigeant de la sécurité et sont prouvées correctes et complètes vis-à-vis de l'équivalence. Nous montrons comment elles peuvent s'intégrer naturellement dans les outils existants. Nous prouvons la correction de cette intégration dans un outil et proposons une implémentation complète. Finalement, nous mesurons le gain significatif en efficacité ainsi obtenu et nous en déduisons que nos méthodes permettent l'analyse d'un plus grand nombre de protocoles.

Ensuite, pour résoudre le problème de précision dans le cas non-borné, nous proposons une nouvelle démarche qui consiste à assurer la vie privée via des conditions suffisantes. Nous définissons deux propriétés qui impliquent systématiquement la non-traçabilité et l'anonymat et qui sont facilement vérifiables via les outils existants (e.g. ProVerif). Nous avons implémenté un nouvel outil qui met en pratique cette méthode résolvant le problème de précision de l'état de l'art pour une large classe de protocoles. Cette nouvelle approche a permis les premières analyses de plusieurs protocoles industriels incluant des protocoles largement déployés, ainsi que la découverte de nouvelles attaques.

Abstract

The information society we belong to heavily relies on secure information exchanges. To exchange information securely, one should use security protocols that specify how communicating agents should behave notably by using cryptographic primitives (e.g. encryption, signature). Given their ubiquitous and critical nature, we need to reach an extremely high level of confidence that they actually meet their goals. Those goals can be various and depend on the usage context but, more and more often, they include privacy properties (e.g. anonymity, unlinkability). Unfortunately, designed and deployed security protocols are often flawed and critical attacks are regularly disclosed, even on protocols of utmost importance, leading to the never-ending cycle between attack and fix.

To break the present stalemate, we advocate the use of formal methods providing rigorous, mathematical frameworks and techniques to analyse security protocols. One such method allowing for a very high level of automation consists in analysing security protocols in the symbolic model and modelling privacy properties as equivalences between two systems. Unfortunately, deciding such equivalences is actually undecidable in the general case. To circumvent undecidability, two main approaches have emerged. First, for a bounded number of agents and sessions of the security protocol to analyse, it is possible to symbolically explore all possible executions yielding decision procedures for equivalence between systems. Second, for the general case, one can semi-decide the problem leveraging dedicated abstractions, notably relying on a strong form of equivalence (i.e. diff-equivalence).

The two approaches, i.e. decision for the bounded case or semi-decision for the unbounded case, suffer from two different problems that significantly limit their practical impact. First, (symbolically) exploring all possible executions leads to the so-called states space explosion problem caused by the concurrency nature of security protocols. Concerning the unbounded case, diff-equivalence is actually too imprecise to meaningfully analyse some privacy properties such as unlinkability, nullifying methods and tools relying on it for such cases.

In the present thesis, we address those two problems, going back and forth between theory and practice. Practical aspects motivate our work but our solutions actually take the form of theoretical developments. Moreover, we make the effort to confirm practical relevance of our solutions by putting them into practice (implementations) on real-world case studies (analysis of real-world security protocols).

First, we have developed new partial order reduction techniques in order to dramatically reduce the number of states to explore without loosing any attack. We design them to be compatible with equivalence verification and such that they can be nicely integrated in frameworks on which existing procedures and tools are based. We formally prove the soundness of such an integration in a tool and provide a full implementation. We are thus able to provide benchmarks showing dramatic speedups brought by our techniques and conclude that more protocols can henceforth be analysed.

Second, to solve the precision issue for the unbounded case, we propose a new methodology based on the idea to ensure privacy via sufficient conditions. We present two conditions that always imply unlinkability and anonymity that can be verified using existing tools (e.g. ProVerif). We implement a tool that puts this methodology into practice, hence solving the precision issue for a large class of protocols. This novel approach allows us to conduct the first formal analysis of some real-world protocols (some of them being widely deployed) and to discover some novel attacks. Chapter 1

General Introduction 1.1 General Context

Historically, cryptography exclusively belonged to the military and diplomatic domain: from the ancient Greeks using scytales1 to the Enigma machine notably used by nazi Germany before and during World War II and broken by Alan Turing et al. The context has changed during the last century with the rise of the information society replacing the previously in place industrial society. Since the -commonly termed -information revolution, information is at the heart of our society, be it in our economy (e.g. tertiary industry gradually replacing primary industry, emergence and rise of quaternary industry2 ), political or cultural activities. As the main tool to secure exchanges and storage of information, cryptography has, very naturally, flood into our everyday life. It is now so ubiquitous that it appears to be one of the most critical piece of technology in our society's foundations alongside other Information Technologies (ITs).

Security Protocols. More specifically, to secure exchanges of information, one should use security protocols (also called cryptographic protocols). As all communication protocols, security 1. General Introduction protocols specify how different agents may exchange information through a communication channel (e.g. the Internet, the air) via a set of rules. However, security protocols additionally make use of cryptographic primitives, such as encryption or signature for example, to protect exchanged messages. To illustrate the wide range of contexts where security protocols are critical, we now give a short selection of concrete examples (see also illustrations in Figure 1.2).

Figure 1.2 Some modern manifestations of cryptography

Obviously, one can find a tremendous amount of security protocols aiming at securing the Internet. For instance, the Transport Layer Security (TLS) protocol which is mainly used by websites (e.g. bank websites) to secure all communications (i.e. HTTPS traffic) between their servers and web browsers, which then display a green lock in the address bar. As announced recently [EFF16], more than half of page loads in Firefox and in Chrome are now secured with TLS making this protocol one of the most popular ones. Security protocols are also intensely used to secure services accessible through the Internet. For instance, Single Sign-On (SSO) protocols enable users of companies such as Facebook or Google to sign in just once to their respective websites and yet are able to access other (often third-party) services without signing in again. Such a protocol is notably used by Google to share users' credentials across all Google Applications. However, security protocols are not confined to the Internet. For instance, mobile phones also heavily rely on them. The 3rd Generation Partnership Project (3GPP) has notably standardised stacks of security protocols protecting 2G, 3G and 4G wireless mobile telecommunication technologies. For example, 3GPP designed the Authentication and Key Agreement (AKA) protocol -equipping all 3G and 4G-capable mobile phones -which aims at establishing a secure channel 1.1. General Context between a mobile phone and an antenna (i.e. serving network) for subsequent communications (e.g. calls, SMSs).

More recently, came to the market a wide range of wireless devices such as radio-frequency identification (RFID) tags embedded in goods in supermarkets, RFID chips in credit cards enabling wireless payments, wireless keys for opening cars or garage doors, RFID chips embedded in e-passport for improving its security. Not to mention the rise of the Internet of Things (IoT), from the smart lights and heating systems at home, to cars connected to the Internet. Examples of security protocols used in those devices are countless. Let us go a bit more into the details of two examples mentioned above. First, the International Civil Aviation Organisation has designed the Basic Access Control (BAC) protocol which now equips all biometric passports in the world. Similarly to AKA, the purpose of the BAC protocol is to establish a secure link between an epassport and an authorised reading device (e.g. in customs offices at airports). Second, distance bounding protocols are used e.g. in wireless keys and rely on mechanisms to measure the delay between an emission and a reception to bound the physical distance between the key and the door to open.

Maybe more surprisingly, we also find security protocols at the heart of e-voting systems and notably in end-to-end voter verifiable systems. Such systems should obviously protect the vote privacy but also must achieve an antagonist goal: every manipulation should be verifiable by all voters in order to completely relocate the trust from the different agents and the architecture to the protocol itself. One example of such protocols is Helios [ADMP + 09] which has been used in real elections by the International Association of Cryptologic Research [START_REF] Benaloh | Final report of iacr electronic voting committee[END_REF], the Princeton University [hel], and the Catholic University of Louvain [START_REF] Pereira | Bringing open audit elections into practice: Real world uses of Helios[END_REF]. A more recent example is Du-Vote [START_REF] Gurchetan | Duvote: Remote electronic voting with untrusted computers[END_REF] that has been designed to be used securely even from an infected laptop thanks to an additional hardware token.

Security Goals. As shown by the previous examples, security protocols are used in a wide range of contexts. Naturally, they also have to achieve various requirements that we call security goals. For instance, when a customer using his bank account online sees the green lock in his web browser's address bar, he expects that the TLS protocol ensures that all his HTTP traffic (e.g. credentials, account balances) remains private from anybody but the bank account's web server (excluding e.g. his Internet service provider, the host of the Wi-Fi hot-spot, anybody sniffing Wi-Fi traffic around). This high-level requirement actually involves at least two security goals. First, the traffic encrypted by TLS should remain secret. Secrecy is maybe the most common security goal but ensuring it is already not that trivial. For instance, a bad management of encryption keys may be exploited by an attacker to break the secrecy of some messages. Furthermore, secrecy is not sufficient in general. Indeed, if able to impersonate the bank's web server, an attacker could fake the bank's website to get customer's credentials. Hence, the customer's web browsers must make sure that the server it is communicating with is indeed the bank's web server.

Conversely, the bank's web server has to be convinced that it is indeed communicating with the expected customer. Otherwise, an attacker could access to e.g. customers' account balances. This security goal is called mutual authentication: each party is able to correctly authenticate 1. General Introduction the other party. Similarly for the wireless keys example, the underlying distance bounding protocols shall achieve authentication of the key: i.e. the door opens only when requested by genuine authorised keys.

More recently, privacy-related security goals (we shall call them privacy goals) are becoming more and more predominant and critical. This could be explained by a combination of different factors. First, as a consequence of the information revolution, the gigantic quantity of private information created routinely (deliberately or not) and its continuing circulation (e.g. with advent of wireless devices) understandably raises privacy concerns. Second, citizens and customers are now more and more aware of privacy issues maybe because of the above, the countless recent hacks, revelations about state-scale surveillance and GAFAM's3 monopoly. Last but not least, and surely with causal links with the previous, regulatory requirements about privacy protection are becoming increasingly strict. For instance, the general data protection regulation (GDPR), taking effect on May 25 2018 in EU and its partner states, will impose strong privacy requirements on companies that control sensitive personal information [GDP]. In France, the "commission nationale de l'informatique et des libertés" (CNIL) (i.e. the national data protection authority) will have authority, once the GDPR takes effect, to impose fines to companies that can reach 20 millions of euros or 4% of their annual worldwide turnovers.

Let us illustrate some privacy goals previous examples shall meet. For instance, the AKA protocol implemented in mobile phones must not enable ill-intentioned people to trace specific mobile phones by wirelessly communicating with them 4 . Similarly, we expect to not be traceable just because we carry on an e-passport implementing the BAC protocol. This privacy goal is called unlinkability (or untraceability). Another example of privacy goal naturally arises in evoting systems, where vote privacy is one of the most essential property such systems must achieve. We will discuss later on other privacy goals such as anonymity, coercion-resistance, etc. Critical Attacks. Given the sensitivity of the exchanged data, security protocols' societal and economical 5 significance, we need to reach an extremely high level of confidence that security protocols actually meet their security goals. Given this context and despite the appropriate care taken in designing those protocols, it is astonishing to regularly observe the contrary: highly critical attacks on security protocols of utmost importance are regularly found, disclosed and sometimes exploited. Let us discuss some of them which have broken the aforementioned security protocols.

The TLS protocol has been repeatedly broken. The recently disclosed LogJam [ABD + 15, log] attacks notably rely on a downgrade attack: a Man-In-The-Middle (MITM) attacker is able to force a client and a web server to negotiate the use of weak cipher suites which can then be broken online. Indeed, many web servers continue to propose weak cipher suites designed in the 1.1. General Context 90s when regulation standards in the U.S. were limiting the size of the keys. As a result, such an attacker can completely impersonate a web server to a client (e.g. fake a bank website despite the reassuring green lock). Another attack on deployed TLS versions, called 3SHAKE [BLF + 14, 3sh], has been disclosed one year earlier. It enables an attacker to impersonate a client to a server breaking also the mutual authentication security goal. This could be used to steal credentials from users and use them later e.g. on a bank website. A similar attack has been found [START_REF] Cremers | Automated analysis and verification of TLS 1.3: 0-RTT, resumption and delayed authentication[END_REF] in proposals for the next versions of TLS (i.e. TLS 1.3) which is currently being designed by the TLS working group.

Transport layer protocols are not the only components that put the Internet at risk. Indeed, web-services themselves are also often flawed. For instance, the SAML-based SSO protocol deployed in Google Applications has also been broken [ACC + 08]. Researchers have shown how a malicious third-party service could use credentials whose purpose was supposed to be limited to this service to impersonate users to other services (e.g. Google Gmail).

The situation does not improve when it comes to mobile phones security. The AKA protocol (still) suffers from several different traceability attacks: from the well-known IMSI catcher attacks [SSB + 16, vdBVdR15] to a more elaborate attack [START_REF] Arapinis | Analysing unlinkability and anonymity using the applied pi calculus[END_REF] where leaks of error messages can be exploited by an attacker to trace people who carry mobile phones.

RFID devices also often suffer from traceability attacks. For instance, researchers [START_REF] Arapinis | Analysing unlinkability and anonymity using the applied pi calculus[END_REF] have shown that the BAC protocol could be exploited by ill-intentioned people to trace citizens who carry their e-passport by wirelessly communicating with the RFID chips they contain without the victims being able to notice anything. In the next section, we will go into more details of this protocol and its attacks. Distance bounding protocols have also been broken. We could for example cite several distance hijacking attacks [START_REF] Cremers | Distance Hijacking Attacks on Distance Bounding Protocols[END_REF] (i.e. when an attacker is able to pretend to be physically close by exploiting honest users) on several distance bounding protocols.

Finally, despite the highly sensitive nature of e-voting protocols, attacks are also found there.

Hence, several critical attacks [K + 16] have been disclosed on the Du-Vote e-voting system and Helios has been shown [START_REF] Cortier | Attacking and fixing Helios: An analysis of ballot secrecy[END_REF] to fail to entirely meet vote privacy, one of its most essential security goal.

All those attacks, as many others we do not cite, break the protocols' specifications themselves and do not rely on the attacker being able to break or exploit flaws in cryptographic primitives (e.g. fake a signature, decrypt a ciphertext without knowing the decryption key). Such attacks neither rely on bad hardware or bad implementation of the protocol's specification. They rather rely on possible interactions of the different parties (but not the ones one would expect from normal usages of the protocol). We say that they are logical attacks. Interestingly, any implementation and any deployment on any hardware of a protocol whose specification suffers from a logical attack would be broken in practice as well. With this in mind, we now state the following natural question: How to explain that such critical logical attacks are regularly found on specifications of security protocols of utmost importance despite the high care given to their design ?

General Introduction

An important part of the answer is that designing protocols which actually achieve the required security goals is a tremendously complex task. In this thesis, we are interested in improving this current distressing situation by enhancing rigorous mathematical frameworks to analyse security protocols and ease their design.

The rest of the introduction is organised as follows. In the next section, we explain more precisely what are security protocols and logical attacks. Thanks to those additional details, we will then be able to answer the above question in Section 1.3 by giving the reasons why the security setting is particularly complex. This will motivate the need for rigorous, formal methods to model and analyse security protocols. Next, the state-of-the-art of such methods will be given in Section 1. 4. Finally, we show that this state-of-the-art suffers from two main limitations in Section 1.5 before explaining how our contributions address them in Section 1.6. We conclude with the outline of the rest of this thesis in Section 1.7.

Security Protocols

A security protocol can be seen as a set of rules that participants have to follow in order to achieve specific security goals. Those rules specify emissions and receptions of messages as well as tests performed by the participants of the protocols called agents. Security protocols use as basic building blocks cryptographic primitives such as symmetric and asymmetric encryptions, signatures, and hash functions. For a long time, it was believed that designing a strong encryption scheme was sufficient to ensure secure message exchanges. Starting from the 80's, researchers understood that even with perfect encryption schemes, message exchanges were still not necessarily secure: indeed protocols are still subject to logical attacks such as the ones discussed before. We will conclude this section with in-depth descriptions of two such logical attacks, but we first briefly explain the most standard cryptographic primitives together with their fundamental properties.

Cryptographic Primitives

We list below the most standard cryptographic primitives. Obviously this list is not exhaustive, and modern protocols often rely on less standard cryptographic primitives, such as blind signature, homomorphic encryption, trapdoor bit commitment, zero-knowledge proofs, etc.

Symmetric encryption. Symmetric cryptography refers to encryption methods in which both

the sender and the receiver share the same key. For instance, the Data Encryption Standard (DES) and the Advanced Encryption Standard (AES) are symmetric encryption schemes which have been designated cryptography standards by the US government in 1976 and 2002 respectively. The scytale (see Figure 1.1) is an example of primitive symmetric encryption scheme.

A significant disadvantage of symmetric ciphers is the key management necessary to use them securely. Each distinct pair of agents must share a different key. Therefore, the number of required keys increases as the square of the number of agents, which very quickly requires complex key management schemes to keep them all straight and secret. The difficulty of securely 1.2. Security Protocols establishing a secret key between two agents, when a secure channel does not already exist between them, also presents a chicken-and-egg problem which is a considerable practical obstacle for the use of symmetric cryptography in the real world. This is why the recourse to asymmetric cryptography is so popular for key establishment protocols that aim to establish a fresh symmetric key between two parties. Asymmetric encryption. In 1976, Diffie and Hellman proposed the notion of public key cryptography, in which two different but mathematically related keys are used -a public key and a private key. A public key system is constructed, in such a way that calculation of the private key is computationally infeasible from the public key, even though they are necessarily related. In public key cryptosystems, the public key may be freely distributed, while its associated private key must remain secret. The public key is typically used for encryption, while the private key is used for decryption. Diffie and Hellman showed that public key cryptography was possible6 by presenting the Diffie-Hellman key exchange protocol [START_REF] Diffie | New directions in cryptography[END_REF] in 1976. In 1978, Rivest, Shamir, and Adleman invented RSA, another public key cryptosystem [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF] which has established itself as the main standard.

Digital signature. Over the same period, signature schemes have also been proposed. A digital signature is a mathematical scheme for demonstrating the authenticity of a digital message or of a document. It gives the recipient a reason to believe that the message was created by a known sender, that the sender cannot deny having sent the message (authentication and nonrepudiation), and that the message was not altered while in transit (integrity). Digital signatures are commonly used for software distribution, key management, financial transactions, etc.

Hash function.

A hash function takes a message of any length as input, and outputs a short, fixed length digest of this message. Hash functions have many security applications, notably in digital signatures, message authentication codes (MACs), and other forms of authentication. They can also be used as checksums to detect accidental data corruption. For good hash functions, an attacker cannot find two messages that produce the same hash. MACs are much like hash functions, except that a secret key can be used to authenticate the hash value upon receipt.

The Example of the BAC Protocol

For the purpose of illustration, we go into the details of the already mentioned BAC protocol used in e-passports. An e-passport is a paper passport with a RFID chip that stores the critical information printed on the passport in order to increase its security (e.g. anti-cloning, integrity).

The International Civil Aviation Organisation (ICAO) standard specifies the communication protocols that are used to access this information [START_REF]PKI for machine readable travel documents offering ICC read-only access[END_REF]. We do not plan to describe all the protocols that are specified in the standard. Instead, we shall focus only on the BAC protocol following the modelling proposed in [START_REF] Arapinis | Analysing unlinkability and anonymity using the applied pi calculus[END_REF].

General Introduction

The information stored in the chip is organised in data groups (dg 1 to dg 19 ). For example, dg 5 contains a JPEG copy of the displayed picture, and dg 7 contains the displayed signature. The verification key vk(sk P ) of the e-passport, together with its certificate sign(vk(sk P ), sk DS ) issued by the Document Signer Authority, is stored in dg 15 . The corresponding signing key sk P is stored in a tamper resistant memory, and cannot be read or copied. For authentication purposes, a hash of all the data groups, together with a signature on this hash value issued by the Document Signer Authority, are stored in a separate file, the Security Object Document: sod def = ⟨sign(h(dg 1 , . . . , dg 19 ), sk DS ), h(dg 1 , . . . , dg 19 )⟩.

The ICAO standard specifies several protocols through which this information can be accessed. In particular, read access to the data on the e-passport is protected by the BAC protocol. The BAC protocol is a password-based authenticated key exchange (PAKE) protocol whose security relies on two master keys, namely ke and km, which are derived from a password of low entropy (see Figure 1.3) optically retrieved from the e-passport by the reader before executing the protocol. Through the BAC protocol, the reader and the e-passport agree on a key seed xkseed that is then used to generate an encryption session key as well as a MAC session key for the next protocols. Following the description given in Figure 1.4, the protocol works as follows:

1. The reader sends a request get_Challenge to the e-passport that will answer by generating a nonce, i.e. a fresh random number.

2. Once the reader receives this nonce n T , it will generate its own nonce n R , as well as a key k R that will be used later on to derive session keys. The reader encrypts the nonce n T , its own nonce n R as well as the key k R with the (long-term) symmetric encryption key ke. This message senc(⟨n R , ⟨n T , k R ⟩⟩, ke) is sent to the e-passport together with the associated MAC (with key km) to ensure that the encryption will be correctly transmitted to the e-passport.

3. The e-passport performs some checks not shown in Figure 1. 4. In particular, it checks that the MAC has been computed using the right key km, and that the nonce n T it has generated at the first step of the protocol is part of the plaintext inside the encryption.

Security Protocols

Once these checks have been performed, the e-passport sends to the reader a message similar to the one it has received using its own contribution k T .

4. Again, the reader will perform the necessary checks before accepting the message, and in case of success two session keys will be generated from the value xkseed obtained by applying the exclusive or operator on k R and k T .

Passport Tag These two session keys are used to provide confidentiality, integrity, and authentication in subsequent communications. In particular, they are used to encrypt and MAC the messages exchanged during the execution of the Passive and Active Authentication protocols in order to ensure that only parties with physical access to the e-passport7 can read the data. The aim of establishing fresh session keys (instead of reusing ke and km at each session) is to notably make the e-passport unlinkable, a property that will be discussed in Section 1.2.3.

Some Logical Attacks on the BAC Protocol

Now, we describe two possible attacks. These attacks are purely logical in the sense that they do not require to break any cryptographic primitives.

General Introduction

Authentication issue (for a weakened version). First, we would like to pinpoint the fact that the order in which the nonces n R and n T have been placed inside both encryptions is relevant. The careful reader will have noticed that the nonces have been swapped: the reader encrypts ⟨n R , ⟨n T , k R ⟩⟩ whereas the e-passport encrypts ⟨n T , ⟨n R , k T ⟩⟩. The purpose of this design is to avoid a replay attack. Indeed, without such a swap, a malicious user (who does not know the keys ke and km) would be able to simply replay the message he received from the reader without decrypting it and performing the checks. Such a message will be accepted by the reader and pass all checks performed by the reader. This means that the reader will end its session thinking (s)he has talked with the e-passport identified by ke and km, whereas this e-passport will not have really taken part to the protocol. Moreover, the key seed computed at the end will be k R ⊕ k R = 0 and thus very different from the one that is supposed to be computed during a normal execution.

Unlinkability issue. Following the specification provided by the ICAO, each nation has implemented its own version of the BAC protocol. Unfortunately, as the specification is not completely comprehensive, each nation's e-passport has subtle differences. In particular, the standard specifies that the e-passport must reply with an error message to every ill formed or incorrect message from the reader, but it does not specify what the error message should be.

For example, in the French implementation of e-passports issued before 2010, the e-passport replies different error messages [START_REF] Arapinis | Analysing unlinkability and anonymity using the applied pi calculus[END_REF] depending on whether the nonce in xenc is not n T (i.e. nonce error) or xmac is not a correct MAC w.r.t. the key km (i.e. MAC error). An attacker who does not know the keys ke and km could then trace an e-passport in the following way:

1. He eavesdrops a session between an authentic reader and an e-passport P Alice (with keys ke and km) and stores m = ⟨xenc, xmac⟩.

2. In a different session, he sends the message m and waits for the e-passport's answer.

3. Then, we distinguish two cases: a) if he receives a nonce error then he knows that the e-passport succeeded to check the MAC and so this e-passport is P Alice ; b) if he receives a MAC error then he knows that the e-passport is not the one with keys km (and ke), and therefore it is not P Alice .

This attack makes it possible to detect when a particular e-passport comes into the range of a reader, which could be, for instance, placed by a doorway, in order to monitor when a target enters or leaves a particular building8 . To avoid the information leakage of these error messages, the specification should prescribe that, in case of failure, the e-passport yields the same message in both situations (as it is done for instance in e-passports from the UK).

Formal Verification

Now that we better grasp what are security protocols and logical attacks, we go back to our initial question and try to answer it.

Why is designing good security protocols so hard ? Compared to critical or embedded software, that we routinely rely on (e.g. for flying planes), making sure that security protocols actually meet their goals is more involved for several reasons.

First, as illustrated by logical attacks from the previous section, it is necessary to make sure that security protocols are able to cope with malicious agents that do not necessarily follow the expected instructions. In particular, security protocols have to be resistant to MITM attackers who can actively exploit the insecure network on which agents are trying to exchange messages.

Already in 1978, this was considered the most reasonable threat model on the network as acknowledged by Needham and Schroeder [START_REF] Roger | Using encryption for authentication in large networks of computers[END_REF] (for the case of authentication protocols): "We assume that the intruder can interpose a computer in all communication paths, and thus can alter or copy parts of messages, replay messages, or emit false material. While this may seem an extreme view, it is the only safe one when designing authentication protocols." This complex threat model also explains why fuzzing or testing are not powerful enough for this setting: even a very unlikely corner case that will most likely be missed by those approaches could be exploited systematically by a clever attacker to break a security goal.

Second, security protocols are essentially distributed programs. Indeed, the different agent's programs are running concurrently. This makes the set of possible interactions very large since one needs to examine all possible interleavings of agents' actions. Indeed, expected security goals must hold for any interleaving. Otherwise, the attacker may force agents to follow the specific scheduling enabling the attack for instance by delaying some receptions of messages.

To sum up, we face a very intricate problem here: we shall achieve rather complex security goals using security protocols that will be executed concurrently by all the different agents involved. Moreover, those agents will exchange messages through an insecure network that should be considered to be entirely controlled by the attacker.

The combination of all those features makes potential attacks very subtle and extremely hard to find. Furthermore, there are so many possible interactions with potential hidden corner cases to 1. General Introduction analyse that security researchers and engineers will most likely miss some of them yielding potential disastrous attacks. To break the present stalemate, we advocate the use of formal methods providing rigorous, mathematical frameworks and techniques to analyse security protocols. The security community (academics but not only) now agrees upon the importance of formal methods also as a guide for designing security protocols. For instance, the TLS Working Group is following an "analysis-before-deployment" design paradigm for drafting TLS 1.3 [START_REF] Kenneth | Reactive and proactive standardisation of TLS[END_REF]. We hope to find in the future more examples of such proactive standardisation processes. We also stress the importance of automation we shall obtain from those verification techniques. While the number of corner cases to examine is often too large to be examined by humans, we hope for automated methods to conduct exhaustive analyses. Automated methods are also motivated by the large number of security protocols and their variations to be verified.

Two main distinct approaches have emerged, starting with the early 1980's attempt of [START_REF] Dolev | On the security of public key protocols[END_REF], to ground security analysis of security protocols on formal methods. These two approaches are known as the computational approach and the symbolic approach. They essentially capture the same threat model on the network (i.e. they both consider that the attacker entirely controls the network) but differ in the threat model on the cryptographic primitives (i.e. what an attacker can do with them).

Computational Approach

In the computational model, the attacker can do anything he wants -including trying to break cryptographic primitives -as long as the overall amount of time and computational power he needs is bounded (the bound may polynomially depend on security parameters such as key length). More formally, messages are modelled as bit strings and agents and the attacker as probabilistic polynomial time Turing machines. Then, security goals are defined using games played by the attacker who has to be able to distinguish the protocol from an idealised version of it (with a non negligible probability). Finally, proofs are done via reductions (or hops) between successive games starting with the one we are interested in and ending with games expressing computational assumptions on cryptographic primitives. It is generally acknowledged that security proofs in this model offer powerful security guarantees. Indeed, such a model captures logical attacks as well as cryptographic design flaws. The latter rely on one or several flaws in cryptographic primitives. Note that this model does not capture attacks at lower levels such as implementation and hardware attacks. A serious downside of this approach, however, is that even for small protocols, proofs are usually difficult, tedious, and highly error prone. Moreover, due to the high complexity of such a model, automating such proofs is a very intricate problem that is still in its infancy (e.g. CryptoVerif [START_REF] Blanchet | A computationally sound mechanized prover for security protocols[END_REF]). Finally, computer-aided verification allows for only a low level of automation even though a lot of efforts have been put in developing computer-aided cryptographic verifiers (e.g. CertiCrypt [START_REF] Barthe | Formal certification of code-based cryptographic proofs[END_REF], EasyCrypt [START_REF] Barthe | Computer-aided security proofs for the working cryptographer[END_REF], FCF [START_REF] Beringer | Verified correctness and security of OpenSSL HMAC[END_REF][START_REF] Petcher | The foundational cryptography framework[END_REF], F * [BFG + 14]).

Symbolic Approach

By contrast, the symbolic approach, which is the one targeted by this thesis, makes strong assumptions on cryptographic primitives (i.e. perfect primitives) but fully models agents' interactions and algebraic properties of these primitives. Compared to the computational approach where cryptographic primitives are modelled via computational assumptions expressing operations the attacker cannot do, the symbolic approach models cryptographic primitives in a term algebra expressing what the attacker can do, that is exploiting expected algebraic properties of primitives. For instance, symmetric encryption and decryption are modelled as function symbols enc and dec along with the equation dec(enc(m, k), k) = m. This means that, without the corresponding key k, it is simply impossible to get back the plaintext m from the ciphertext enc(m, k). As already explained, this does not mean however that protocols relying on these primitives are necessarily secure as logical attacks may remain (e.g. see Subsection 1.2.3 and Section 1.1).

Although more abstract, the symbolic approach benefits from automation (through decision or semi-decision procedures) and can thus target more complex protocols than those analysed using the computational approach. It can also be used sooner in the protocol design process as only little effort needs to be put into verification. We target automatic verification for rather complex protocols and thus choose to follow this symbolic approach.

Symbolic Models

The first symbolic model has been described by Dolev and Yao [START_REF] Dolev | On the security of public key protocols[END_REF] and several other models have been proposed since then. Verifying security protocols following the symbolic approach mainly involves three-level models: messages, protocols and security goals.

Messages. First, one has to model messages and cryptographic primitives. Whereas messages are bit strings in the real-world (and in the computational approach as well), they are modelled using first-order terms within the symbolic model. Atoms can be for instance nonces, keys, or agent identities. Examples of function symbols are concatenation, asymmetric and symmetric encryptions or digital signatures. Next, the algebraic relations of cryptographic primitives are modelled by reduction rules or equational theories on terms. For instance, as said before, one may model the expected relation for the symmetric decryption by the equation dec(enc(m, k), k) = m.

To conduct automatic analysis, existing approaches often consider fixed sets of primitives or user-defined primitives satisfying some properties.

Security Protocols. Second, we need to model protocols themselves. The model thus needs to capture the concurrent nature of security protocols. Therefore, process algebras are very natural solutions. Derivatives of π-calculus have thus been proposed for this purpose: first the spi-calculus [START_REF] Abadi | A calculus for cryptographic protocols: The spi calculus[END_REF] and then the applied-pi calculus [START_REF] Abadi | Mobile values, new names, and secure communication[END_REF]. The key difference between the two concerns the way in which cryptographic primitives are handled. The spi-calculus has a fixed set of built-in primitives (namely, symmetric and asymmetric key encryption), while the applied-pi calculus allows a wide variety of primitives to be defined by means of an equational theory. Process algebras are not the only way to model protocols. We may at least mention the multiset rewriting (MSR) model that has been introduced in [CDL + 99], and the strand space 1. General Introduction model [START_REF] Thayer Fabrega | Strand spaces: Proving security protocols correct[END_REF] that comes with an appealing graphical representation, and some dedicated proof techniques.

Security Goals. Third, in order to model security goals, one use either reachability properties or equivalence properties. Both kinds of properties capture different security goals. We describe both of them next.

Reachability Properties. Until the early 2000s, most works from the symbolic approach were focusing on reachability properties (also called trace properties), that is, statements that something bad never occurs on any execution trace of a protocol. Secrecy and authentication are typical examples of reachability properties.

(Weak) secrecy concerns a message used by the protocol. This is typically a nonce or a secret key that should not become public. Even for this quite simple security property, several definitions have been proposed in the literature. When considering the notion of (weak) secrecy, a public message is a message that can be learnt by the attacker.

Authentication. Many security protocols aim at authenticating one agent to another: one agent should become sure of the identity of the other. There are also several variants of authentication. A taxonomy of these has been proposed by Lowe in [START_REF] Lowe | A hierarchy of authentication specifications[END_REF].

Equivalence Properties. However, many other security goals and notably privacy goals (e.g. anonymity, unlinkability) are not of this type but are defined relying on a notion of indistinguishability. Intuitively, two protocols are indistinguishable if it is not possible for an attacker to decide whether (s)he is interacting with one or the other. This notion of indistinguishability is also used for defining a stronger notion of secrecy, and we may also rely on this notion of indistinguishability to compare a protocol with an idealised version of it. Now, we list some examples of such equivalence-based security goals. We will see later how indistinguishability is formalised in our setting most appropriately via the notion of trace equivalence. Below, we simply list some security goals that can be formalised relying on such a notion.

Strong secrecy is stronger than (weak) secrecy, and related to the concept of indistinguishability. Intuitively, strong secrecy means that an adversary cannot see any difference when the value of the secret changes [START_REF] Abadi | Secrecy by typing in security protocols[END_REF][START_REF] Blanchet | Automatic proof of strong secrecy for security protocols[END_REF][START_REF] Abadi | A calculus for cryptographic protocols: The spi calculus[END_REF].

Anonymity. Frequently, communication between two agents reveals their identities and presence to third parties. Indeed, anonymity is in general not one of the explicit goals of common authentication protocols. However, as already discussed, we may want protocols that achieve this privacy goal. It has been informally defined in the ISO/IEC 15408-2 standard as follows: "[Anonymity] ensures that users may use a [protocol] without disclosing their identity." It is usually formally defined (see [START_REF] Arapinis | Untraceability in the applied pi-calculus[END_REF][START_REF] Schneider | CSP and anonymity[END_REF][START_REF] Chothia | Analysing the mute anonymous file-sharing system using the picalculus[END_REF]) as the fact that an observer cannot distinguish two scenarios where the same protocol is executed by different users.

Unlinkability. Protocols that keep the identity of their users secure may still allow an attacker to identify particular sessions as having involved the same agent. Such linkability attacks may, for instance, make it possible for an attacker to trace the movements of someone carrying an RFID tag without him being able to notice anything (as the attacks on the AKA and the BAC protocol 1.4. State of the Art: Methods and Tools previously mentioned). Intuitively, protocols are said to provide unlinkability (or untraceability) according to the ISO/IEC 15408-2 standard, if they "[...] ensure that a user may make multiple uses of [them] without others being able to link these uses together." Formally, this is often defined as the fact that an attacker should not be able to distinguish a scenario in which the same agent (i.e. the user) is involved in many sessions from one that involved different agents in each session. Following this intuition, slightly different definitions have been proposed (see e.g. [ACRR09, ACRR10, BCDH10, VDMR08]). A comparison between these definitions may be found in [START_REF] Brusó | Linking unlinkability[END_REF]. We will also come back to this notion in this thesis.

Vote Privacy. In the context of e-voting, privacy means that the vote of a particular voter is not revealed to anyone. This is one of the fundamental security properties that an e-voting system has to satisfy. Vote privacy is typically defined (see e.g. [START_REF] Kremer | Analysis of an electronic voting protocol in the applied pi-calculus[END_REF][START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF]) by the fact that an observer should not observe when two voters swap their votes, i.e. distinguish between a situation where Alice votes yes and Bob votes no and a situation where these two voters have voted the other way around. Some stronger forms of vote-privacy have also been proposed such as receipt-freeness and coercion-resistance [START_REF] Delaune | Coercion-resistance and receipt-freeness in electronic voting[END_REF][START_REF] Backes | Automated verification of remote electronic voting protocols in the applied pi-calculus[END_REF].

Linking Computational and Symbolic Approaches

Note that a line of work known as computational soundness aims at spanning the gap between these two approaches by establishing that, in some cases, security guarantees in the symbolic model imply security guarantees in the computational one. This line has been initiated by Abadi and Rogaway [START_REF] Abadi | Reconciling two views of cryptography (the computational soundness of formal encryption)[END_REF] and has received much attention since then (see [START_REF] Cortier | A survey of symbolic methods in computational analysis of cryptographic systems[END_REF] for a survey on computational soundness).

State of the Art: Methods and Tools

In this thesis, we are interested in automatic verification in the symbolic model with a strong focus on equivalence-based properties (defined using trace equivalence) such as many privacy goals. This section is dedicated to the state-of-the-art of such symbolic verification methods and tools for equivalence.

How to circumvent undecidability? Modelling security protocols using the symbolic approach allows one to benefit from machine support through the use of various existing techniques, ranging from model-checking to resolution and rewriting techniques. As already pointed out, aiming at machine support is really relevant since manual proofs are error-prone, tedious and hard to verify. Moreover, new protocols are developed quite frequently and need to be verified quickly.

Nevertheless, verifying a security goal in such a setting (and especially those expressed using equivalence properties) is actually undecidable in the general case [START_REF] Hüttel | Deciding framed bisimilarity[END_REF][START_REF] Chrétien | From security protocols to pushdown automata[END_REF]. Two main options are possible then: either recover decidability by only considering a bounded number of sessions (and thus a bounded number of agents as well), or only semi-decide the problem for the unbounded case.

General Introduction

Apte [START_REF] Cheval | Apte: an algorithm for proving trace equivalence[END_REF] Akiss

Decision for a Bounded Number of Sessions

To design decision procedures, a reasonable assumption is to bound the number of protocol sessions to consider (i.e. by forbidding replication) thereby limiting the length of execution traces. Under such an assumption, the first decision procedure towards automatic verification of a notion of equivalence between protocols dates back to [START_REF] Hüttel | Deciding framed bisimilarity[END_REF], where a fragment of the spi-calculus (no replication, no branching on conditional) is considered. Note that, even under this assumption, infinitely many execution traces remain, since each input may be fed infinitely many different messages (chosen by the attacker). This issue has been tackled in various ways using forms of symbolic execution and the development of dedicated procedures. Obtaining a symbolic semantics to avoid potentially infinite branching of execution trees is often a first step towards automation of equivalence. Depending on the expressivity of the calculus and the way its semantics is given, this task can be quite cumbersome (e.g. for applied-pi calculus [START_REF] Delaune | Symbolic bisimulation for the applied pi calculus[END_REF], spi-calculus [START_REF] Durante | Automatic testing equivalence verification of spi calculus specifications[END_REF][START_REF] Borgström | A complete symbolic bisimilarity for an extended spi calculus[END_REF], psi calculus [START_REF] Borgström | The psi-calculi workbench: A generic tool for applied process calculi[END_REF]) and sometimes only leads to incomplete procedures.

A table summarising the main features of existing tools dedicated to the bounded case is given in Table 1.1.

Constraint solving approaches. Some pioneering works paved the way for existing tools but have not been implemented due to their practicality (that was not their focus). For instance, Baudet designed [Bau05] a decision procedure for verifying indistinguishability from a passive attacker (i.e. who can only eavesdrop output messages) point of view. The latter boils down to verifying the indistinguishability between two sequences of open messages (i.e. messages with some unknown parts constrained with some deducibility and equality constraints). The main novelty of this work was to design a constraint solving procedure that is not only able to solve satisfiability problems (sufficient for reachability properties) but also to establish equivalences 1.4. State of the Art: Methods and Tools (i.e. two systems have the same sets of solutions), which are needed when one wants to verify equivalence-based security goals. This is done for a user-defined equational theory given in the form of a sub-term convergent rewriting system (i.e. convergent and such that the right-hand side of each rewriting rule is actually a syntactic sub-term of the left-hand side). As shown in [START_REF] Cheval | Deciding equivalencebased properties using constraint solving[END_REF], this yields a procedure deciding trace equivalence of a restricted class of protocols for many primitives. A shorter proof of the result by Baudet is given in [START_REF] Chevalier | Decidability of symbolic equivalence of derivations[END_REF]. It is shown that if two protocols are not equivalent, then there must exist a small witness of non-equivalence, and a decision procedure can be derived by checking every possible small witness. However, as said above, those decision procedures have not been implemented.

A decision procedure for a stronger notion of trace equivalence (namely open bisimulation) has been proposed in [START_REF] Tiu | Automating open bisimulation checking for the spi calculus[END_REF] and implemented in the tool Spec9 . The procedure deals with a fixed set of cryptographic primitives, namely symmetric encryption and pairs, and protocols modelled as linear roles with filtering (i.e. each agent has to be modelled by a sequence of output and inputs with possibly expected patterns for the received messages). The procedure is sound and complete w.r.t. open bisimulation (a notion that is strictly stronger than trace equivalence [START_REF] Tiu | A trace based bisimulation for the spi calculus[END_REF]) and its termination is proved. The attacker's deductive ability is modelled as logical rules in sequent calculus, and procedures deciding message deduction and message indistinguishability are defined as proof-search strategies. Finally, the proposed procedure iteratively builds an open bisimulation from the two initial protocols by symbolically executing them and checking that possible instantiations are coherent on both sides.

For a fixed but richer set of cryptographic primitives (i.e. symmetric/asymmetric encryptions, signature, pair, and hash functions), a different procedure, presented in [START_REF] Cheval | Trace equivalence decision: Negative tests and non-determinism[END_REF] (improved version of [START_REF] Cheval | Automating security analysis: symbolic equivalence of constraint systems[END_REF]), allows to decide equivalence of two sets of constraint systems that may also feature disequality tests. Dealing with disequality tests and sets of constraint systems is needed in the presence of protocols that can branch on conditionals (i.e. with proper else branches) since different symbolic executions may then be associated to a single symbolic trace. This procedure explores all possible symbolic traces and computes all possible resulting symbolic constraint systems on both sides. This forward symbolic exploration of two protocols is finite since all symbolic traces have a bounded length and the exploration is finitely branching since inputs are abstracted away by variables and constraints. The procedure then checks the symbolic equivalence of all the resulting pairs of sets of constraint systems. Recently (subsequent to the start of this thesis), this procedure has been further extended to deal with some forms of sidechannel attacks regarding the length of messages [START_REF] Cheval | Lengths may break privacy -or how to check for equivalences with length[END_REF], and the computation time [START_REF] Cheval | Timing attacks in security protocols: symbolic framework and proof techniques[END_REF]. This procedure and its extensions have been implemented in the tool Apte [START_REF] Cheval | Apte: an algorithm for proving trace equivalence[END_REF].

Resolution-based approaches. The procedure described in [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocols[END_REF] deals with rich userdefined term algebras provided that they can be defined using a convergent rewriting system enjoying the finite variant property [START_REF] Comon | The finite variant property: How to get rid of some algebraic properties[END_REF]. This property basically requires that it is possible to finitely pre-compute possible normal forms of terms with variables. This in particular includes 1. General Introduction all sub-term convergent equational theories. In the setting of [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocols[END_REF], protocols are modelled as linear roles with equality tests (i.e. each agent has to be modelled by a sequence of inputs, outputs and equality tests). Further, the authors of [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocols[END_REF] use first-order Horn clauses to model all possible instantiations of symbolic traces, and they rely on a saturation procedure to put all clauses into solved forms. Finally, this finite description of all possible concrete executions is used to decide equivalence between the two protocols under study. This procedure is actually able to check an over-approximation and an under approximation of trace equivalence, and it has been shown that the former over-approximation actually coincides with trace equivalence for a large class of protocols. This procedure has been implemented in the tool Akiss10 . After the beginning of this thesis, termination of the procedure has been established for sub-term convergent theories [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocol[END_REF].

Semi-Decision for an Unbounded Number of Sessions

The decidability results mentioned so far analyse equivalence for a bounded number of sessions and agents only, that is assuming that protocols are executed a limited number of times. This is of course a strong limitation. Even if no flaw is found when a protocol is executed n times, there is absolutely no guarantee that the protocol remains secure when it is executed n + 1 times. Therefore, despite the difficulty of the problem in the general case, several solutions have been proposed in order to deal with the unbounded case. To circumvent the undecidability of the problem in that case, many works aim at developing procedures (not necessarily completely automatic) that are sound w.r.t. trace equivalence but not complete. One source of incompleteness is non-termination, another one is the over-approximation of trace equivalence by a stronger form of equivalence. Indeed, in order to make those procedures deal with a form of equivalence, the main idea is to merge the two protocols under study into a so-called bi-process, and to consider a strong form of equivalence, namely diff-equivalence. This method has first been presented in [START_REF] Blanchet | Automated Verification of Selected Equivalences for Security Protocols[END_REF] and implemented in the ProVerif tool. After the start of this thesis, this technique has been integrated into the verification tools Tamarin [START_REF] Basin | Automated symbolic proofs of observational equivalence[END_REF] and Maude-NPA [START_REF] Santiago | A formal definition of protocol indistinguishability and its verification using maudenpa[END_REF] that have been extended to deal with equivalence properties. A table summarising the main features of existing tools dealing with an unbounded number of sessions is given in Table 1.2.

The method presented in [START_REF] Blanchet | Automated verification of selected equivalences for security protocols[END_REF] and implemented in the most established tool ProVerif11 represents bi-processes that are given in input using Horn clauses (performing some well-chosen approximations, and thus losing completeness). Then, a dedicated resolution algorithm tries to derive a logical contradiction from those Horn clauses. Cryptographic primitives (that can be user-defined) are decomposed into: reduction rules and a union of linear equational theories (i.e. each equation has the same variables on both sides) and convergent theories (i.e. terminating and confluent) that must have the finite variant property. This formalism is flexible enough to model for instance different flavours of encryptions (e.g. symmetric, asymmetric, randomised), signature, and blind signature, but excludes exclusive or, and more generally associative and After the start of this thesis, the approach behind the Tamarin verification tool [START_REF] Meier | The Tamarin Prover for the Symbolic Analysis of Security Protocols[END_REF] has been extended to deal with diff-equivalence. In this approach, protocols are modelled as multiset rewriting (MSR) systems. This allows one to model a rich class of protocols that may branch on conditionals (i.e. featuring proper else branches) and allow the storage of some data from one session to another (i.e. stateful protocols). The framework supports a rich term algebra including user-defined convergent equational theories that have the finite variant property (thanks to recent efforts [START_REF] Dreier | Beyond Subterm-Convergent Equational Theories in Automated Verification of Stateful Protocols[END_REF]), and Diffie-Hellman exponentiation. The proposed algorithm exploits the finite variant property [START_REF] Comon | The finite variant property: How to get rid of some algebraic properties[END_REF] to get rid of some equations, and it builds on ideas from strands spaces and proof normal forms. It basically performs a backward search from attack states. Tamarin provides two ways of constructing proofs: an efficient, fully automated mode that uses heuristics to guide proof search, and an interactive mode. The interactive mode enables the user to explore the proof states using a graphical interface. The Tamarin tool has been used to analyse different security properties on many protocols. However, regarding equivalence, the tool is less mature and has only been used on a few examples; the main one being a stateful TPM protocol (namely the TPM envelope protocol) on which a strong secrecy property has been established.

The Maude-NPA tool has also been extended [START_REF] Santiago | A formal definition of protocol indistinguishability and its verification using maudenpa[END_REF] (after the beginning of this thesis) to deal with bi-processes (that they call synchronous product) and diff-equivalence. Their semidecision procedure is able to deal with a very large class of term algebras as long as they are convergent modulo AC (associative and commmutative) and have the finite variant property (modulo AC) as defined in [START_REF] Escobar | Folding variant narrowing and optimal variant termination[END_REF], such as Abelian groups, exclusive or, and exponentiation. However, it can only be applied to linear role scripts with filtering over inputs (and therefore does not handle protocols with else branches). Regarding equivalence, only a few case studies have been carried out. Moreover, the approach of [START_REF] Santiago | A formal definition of protocol indistinguishability and its verification using maudenpa[END_REF] suffers from termination problems, especially when considering primitives such as exclusive or.

General Introduction

Other Results

Besides those two main approaches to the verification problem, a different recent line of work aims at proving the decidability of trace equivalence verification for the unbounded case but for constrained classes of protocols and cryptographic primitives. For examples, such results were shown (after the beginning of this thesis) for ping-pong protocols [START_REF] Chrétien | From security protocols to pushdown automata[END_REF][START_REF] Chrétien | From security protocols to pushdown automata[END_REF] (i.e. having at most one variable per protocol rule) that are determinate (i.e. agents in parallel are using different channel names), and for type-compliant (generalising the idea of tagged protocols [START_REF] Blanchet | Verification of cryptographic protocols: Tagging enforces termination[END_REF]) and acyclic (roughly protocols without loops in their well-typed executions) protocols [START_REF] Chrétien | Decidability of trace equivalence for protocols with nonces[END_REF] for a fixed set of primitives (namely pairs, and symmetric encryption only). However, the constraints imposed by the restricted classes of primitives and protocols make those results still too impractical and no usable tool resulted from those decidability results.

Problems

The two approaches, i.e. decision for the bounded case or semi-decision for the unbounded case, suffer from two different problems that significantly limit their practical impact: state space explosion problem for the former and lack of precision when it comes to verifying privacy goals for the latter. We describe those two limitations respectively in the two next sections. We aim at addressing those two problems in this thesis.

Main Limitation for the Bounded Case: State Space Explosion

As shown in Subsection 1.4.1, all methods and tools (i.e. Apte, Spec and Akiss), which decide trace equivalence (or an approximation of it) for a bounded number of sessions, symbolically explore all possible execution traces. However, due to the highly concurrent nature of security protocols, there are too many interleavings of concurrent actions to consider. This well-known problem in concurrency and model-checking is called state space explosion problem. This problem seriously limits the practical impact of existing tools in that category. Indeed, in practice, this translates to really bad scaling. For instance, at the time of the beginning of this thesis, anonymity in the Private Authentication protocol could be established in less than 0.1 second for a simple scenario with only one session of each role whereas it takes respectively an hour and more than 2 days as soon as we want to consider respectively 2 and 3 sessions of each role.

In standard model-checking approaches for concurrent systems, this is handled using partial order reduction (POR) techniques [START_REF] Peled | Ten years of partial order reduction[END_REF]. For instance, the order of execution of two independent (parallel) actions is typically irrelevant for checking reachability. The theory of POR is well developed in the context of reactive systems verification (e.g. [Pel98, BK08, GvLH + 96]). However, as pointed out by E. Clarke et al. in [START_REF] Clarke | Efficient verification of security protocols using partial-order reductions[END_REF], POR techniques from traditional modelchecking cannot be directly applied in the context of security protocol verification. Indeed, the application to security requires one to keep track of the knowledge of the attacker, and to refer to this knowledge in a meaningful way (in particular to know which messages can be forged at 1.5. Problems some point to feed some input). Furthermore, security protocol analysis does not rely on the internal reduction of a protocol, but has to consider arbitrary execution contexts (representing interactions with arbitrary, active attackers). Thus, any input may depend on any output, since the attacker has the liberty of constructing arbitrary messages from past outputs. This results in a dependency relation which is a priori very large, rendering traditional POR arguments suboptimal, and calling for domain-specific techniques. Things become even more complex when working with a symbolic semantics: the states obtained from the interleaving of parallel actions will differ, but the sets of concrete states that they represent will have a significant overlap.

Finally, POR techniques are usually devised for reachability properties verification while we are rather interested in trace equivalence verification. Hence, extra precautions have to be taken before discarding a particular interleaving: we have to ensure that this is done in both sides of the equivalence in a similar fashion.

Hence, there is a need for new POR techniques for trace equivalence that are compatible with the security setting and which can be nicely integrated in existing methods and tools.

Main Limitations for the Unbounded Case: Lack of Precision

We now turn to methods & tools that semi-decide trace equivalence (i.e. ProVerif, Tamarin and Maude-NPA). As said before in Subsection 1.4.2, existing tools in that category all rely on a stronger notion of equivalence instead (i.e. diff-equivalence) that greatly over-approximates trace equivalence. Basically, diff-equivalence requires that the two protocols initially share the same structure and that they can be executed exactly in the same way, notably for internal rules (e.g. conditional evaluations), whereas the attacker cannot observe such details. This problem has been partially addressed in [START_REF] Cheval | Proving more observational equivalences with ProVerif[END_REF] for ProVerif by pushing away the evaluation of some conditionals into terms. Nevertheless, the problem remains in general (e.g. for generic conditionals, indistinguishable actions in parallel 12 ). This gap between trace equivalence and diff-equivalence may not be a problem when verifying some properties such as strong-secrecy. However, it is definitely a problem for the verification of some privacy goals such as unlinkability for instance. Thus, considering the well-established formal definition of strong unlinkability of [START_REF] Arapinis | Analysing unlinkability and anonymity using the applied pi calculus[END_REF], we end up verifying an equivalence between two protocols that do not share the same structure. Worse, even after merging the two protocols to be proved equivalent using some encodings, the two protocols can mimic each other but cannot do so while keeping exactly the same structure. Therefore, verifying this notion using the unrealistically strong notion of diff-equivalence systematically leads to false attacks. The deep reason is the lack of precision of the over-approximation made by diff-equivalence over trace equivalence. In practice, it means that tools verifying diff-equivalence instead of trace equivalence (i.e. ProVerif, Tamarin, Maude-NPA) still cannot be used off-the-shelf to establish 1. General Introduction unlinkability for many security protocols such as13 : the BAC protocol, PACE protocol that should replace BAC in e-passports, RFID protocols such as Feldhofer, Hash-Lock, LAK. Similar problems arise also in the e-voting context where vote-privacy cannot be established using diffequivalence for many protocols despite recent efforts trying to address this particular precision issue [START_REF] Blanchet | Automated reasoning for equivalences in the applied pi calculus with barriers[END_REF].

Targeting the automation of diff-equivalence is often not enough to obtain verification of privacy. We thus need new methods for verifying privacy in the unbounded case that do not suffer from this lack of precision.

Contributions

We identified in the previous section two important problems, one for each approach of the state-of-the-art, that negatively impact a lot the existing methods and tools. We describe how our contributions respectively address those two problems in subsections 1.6.1 and 1.6.2. Finally, Subsection 1.6.3 focuses on contributions taking the form of software implementations and security protocol modellings and analyses.

POR Techniques for the Bounded Case

In this thesis, we develop new POR techniques for trace equivalence checking of security protocols. Besides the already mentioned extra complexity brought by the security setting and trace equivalence, another important challenge is to do it in a way that is compatible with symbolic execution: we should provide a reduction that is effective when messages remain unknown, but leverages information about messages when it is inferred by the constraint solver.

We devise our POR techniques by refining interleaving semantics in two steps, gradually eliminating redundant traces. The first refinement, called compression, uses a notion of polarity over processes to impose a simple strategy for the exploration of traces. It does not rely on data analysis at all but only on syntactical information about current available processes. This first technique can thus easily be used as a replacement for the usual semantics in verification algorithms. The second one, called reduction, takes data into account and achieves optimality in eliminating redundant traces. In theory, the reduction step can be implemented in an approximated fashion, through an extension of constraint resolution procedures by leveraging information about messages as soon as available. For each refined semantics, we show that it captures essentially the same reachability properties and more importantly that it captures the same trace equivalence notion.

We also formally explain how to integrate such techniques into symbolic semantics with constraint solving. We lift those refined semantics to refined, symbolic semantics and prove that reachability and trace equivalence are preserved. Next, we put those techniques into practice in the tool Apte: from the theoretical aspects of this integration to the implementation in the 1.6. Contributions distributed code of Apte. Hence, we axiomatize the building blocks of the tool Apte in order to prove the correctness of the tool Apte using our refined semantics (instead of the regular, unoptimised semantics). We also present extensive benchmarks of Apte showing that our theoretical results do translate to dramatic speedups.

We claim that our POR techniques -at least compression -and the significant optimisations they allow are generic enough to be applicable to other verification methods as long as they perform forward symbolic executions. In addition to the integration in Apte we will extensively discuss, we also have successfully done so in Spec [Hirb]. Furthermore, parts of POR techniques have been independently integrated and implemented in the distributed version of Akiss14 .

Verifying Privacy via Sufficient Conditions for the Unbounded Case

Solutions to the previously mentioned precision issue often consists in improving the tools and the notion of diff-equivalence they verify to get closer to trace equivalence [START_REF] Cheval | Proving more observational equivalences with ProVerif[END_REF][START_REF] Blanchet | Automated reasoning for equivalences in the applied pi calculus with barriers[END_REF]. We believe that targeting trace equivalence verification for the unbounded case is looking at a too general problem. We thus approach the problem differently: by focusing on a class of protocols and some privacy goals we would like to verify on them, we are able to precisely characterise when those goals are met via sufficient conditions. While we believe our overall methodology is generic enough to be used in various contexts, in this thesis, we fully develop our methodology for the case of unlinkability and anonymity on 2-party protocols.

We proceed as follows. We carefully analyse reasons for having attacks on unlinkability or anonymity for 2-party protocols. In light of that analysis, we define two conditions preventing two generic kinds of attacks. In a nutshell, our first condition avoids attacks based on control-flow leaks that may be observed through data or nature of actions while our second condition avoids attacks based on data leaks taking the form of relations between outputs. Our main theorem states that these two conditions are actually always sufficient to ensure both unlinkability and anonymity. This is relevant in practice since our two conditions are fundamentally simpler and are in the scope of existing verification tools like ProVerif. They can be precisely verified via diff-equivalence without the previous systematic precision issue. We thus obtain a sound method for automatically checking unlinkability and anonymity. We have implemented a tool called UKano that automatically generates models to verify our two conditions. It suffices to feed this tool with the specification of a security protocol written in a ProVerif model and it will build a model for each condition and call ProVerif on them in order to verify the conditions.

The resulting method and tool is obviously not complete but we show that it is precise enough to conclude on many case studies. We notably establish the first proof of unlinkability for the ABCDH protocol [START_REF] Alpár | A secure channel for attribute-based credentials[END_REF] and the BAC protocol followed by the Passive Authentication (PA) and Active Authentication (AA) protocols used in e-passports. We also report on an attack that we found on the PACE protocol (that should replace BAC in e-passports), and another one that we found on the LAK protocol whereas it was claimed untraceable. Furthermore, our method also enables us to conduct the first automatic analysis of unlinkability for many security protocols 1. General Introduction (e.g. PACE, Feldhofer, Hash-Lock, LAK). Note that it happens that our conditions are rather tight: for all our case studies, we provide an attack every time one of them is not satisfied. Finally, our method is generic enough to verify different flavors of unlinkability and anonymity. We build on previous definitions (that we compare briefly) to propose different variations of unlinkability and anonymity. We show that those variations capture different threat models or practical scenarios and provide examples that distinguish all of them. Finally, we believe that the underlying methodology is of interest in itself as it may be used to devise new methods for verifying other types of complex privacy goals for other classes of security protocols addressing the precision issue more broadly (e.g. as done for the e-voting setting in [START_REF] Cremers | Improving automatic symbolic analysis for e-voting protocols: Sufficient conditions for ballot secrecy[END_REF]).

Developed Software and Models

We now focus on our implementation and modelling efforts.

As already discussed in Subsection 1.6.1, our POR techniques have been implemented in the distributed version of Apte. We stress the fact that Apte is a rather big software of more than 14k OCaml LoC based on a highly complex algorithm: description and proofs of the underlying algorithm are available in a long and technical appendix (more than 100 pages) from [START_REF] Cheval | Automatic verification of cryptographic protocols: privacy-type properties[END_REF].

The implementation of our POR techniques involved about 3k LoC modifications. We have also carried out extensive benchmarks to test our optimisations on several security protocols. More details about this implementation and the benchmarks can be found at http://www.lsv. ens-cachan.fr/~hirschi/apte_por. We have also implemented a preliminary version of our POR techniques in the tool Spec and carried out benchmarks to measure speedups. More details about this implementation are given at http://www.lsv.ens-cachan.fr/~hirschi/spec.

We have built the tool UKano briefly presented in Subsection 1.6.2 by modifying the tool ProVerif. We only re-used the lexer, parser and AST of ProVerif and build upon those a generator and translator of ProVerif models. Our tool is able to verify that a given protocol lies in our class of 2-party protocols. It then leverages several heuristics to automatically generate ProVerif models to verify our sufficient conditions. This effort represents more than 2k OCaml LoC. We applied our tool on many real-world case studies. Some of those case studies were never symbolically analysed before. Therefore, we also provide first symbolic models for several security protocols (e.g. ABCDH, PACE, Hash-Lock). More details are given on the the official page of UKano at http://projects.lsv.ens-cachan.fr/ukano/.

Organisation of the Thesis

The present thesis is divided into three main parts.

Part A. The first part is dedicated to the symbolic model and the common security notions that will be used in this thesis. We define a generic symbolic model in Chapter 2 on which all subsequent parts build upon. Then, in Chapter 3, we define trace equivalence before giving a 1.7. Organisation of the Thesis comparisons with other behavioural equivalences. We also explain how to model some privacy goals using this notion. Finally, we show in Chapter 4 how to derive variations of models (that will be used in subsequent parts) from our generic symbolic model and prove that all those variations capture the same security notions (and threat models) and most notably the same notion of trace equivalence.

Part B.

Our POR techniques addressing the state space explosion problem are described in the second part. In Chapter 5, we define our POR techniques in the most generic setting. We then show how to lift those techniques to symbolic semantics and prove the correctness of the tool Apte optimised with our POR techniques in Chapter 6. We also show and discuss benchmarks.

Finally, we give comprehensive comparisons with related works in Chapter 7.

Part C. The final part of this thesis is dedicated to our new method to verify privacy in the unbounded case. In Chapter 8, we define the class of security protocols we will deal with. We also define unlinkability and anonymity for the unbounded case and propose variations of the most-established definitions. We then define in Chapter 9 our two conditions and prove our main theorem stating that they always imply unlinkability and anonymity. Finally, Chapter 10

shows the practical relevance of our method: we explain how to precisely verify the two sufficient conditions and how our tool UKano automates this task. We also discuss an extensive list of case studies.

Finally, we close the thesis with conclusive remarks and avenues for future work in Chapter 12.

Publications and Other Contributions

Most of the results presented in this thesis have been previously published sometimes in a weaker form and always for specific semantics (thus lacking a uniform symbolic model). Some material from this introduction comes from [START_REF] Delaune | A survey of symbolic methods for establishing equivalence-based properties in cryptographic protocols[END_REF]. Part B describes contributions first published at several places [START_REF] Baelde | A reduced semantics for deciding trace equivalence using constraint systems[END_REF][START_REF] Baelde | Partial order reduction for security protocols[END_REF][START_REF] Baelde | A reduced semantics for deciding trace equivalence[END_REF]. Part C describes enhanced and extended results based on [START_REF] Hirschi | A method for verifying privacy-type properties: the unbounded case[END_REF] (and a journal version in progress).

However, in the interest of uniformity, several other results have not been included in this thesis. Therefore, for the sake of completeness, we list all the publications of the author on the next page.

Publications by the Author

Part A

Model

Table of Contents of the Part

Introduction

This part is dedicated to the model we use to represent security protocols and security goals. As already discussed, we target a symbolic model abstracting cryptographic primitives but considering a strong attacker who is controlling all the network: he may eavesdrop messages, inject messages and use cryptographic primitives. As mentioned in the general introduction, several symbolic models have been proposed. The first one has been described by Dolev and Yao [START_REF] Dolev | On the security of public key protocols[END_REF] and several other models in the same flavor have been proposed since then. Unfortunately, there is currently no unified, consensual such model. The reason for having several popular symbolic models probably comes from the fact that they have to achieve two antagonistic goals. On the one hand, models have to be as fine grained and expressive as possible to capture a large range of applications. One the other hand, models have to remain relatively simple in order to allow simple proofs and the design of verification procedures.

In this thesis, we shall work with a variant of the widespread dialect of Blanchet, Abadi & Fournet [START_REF] Blanchet | Automated verification of selected equivalences for security protocols[END_REF] on which the tool ProVerif is based. This model is inspired from cryptographic calculi and is pretty close to the applied π-calculus [START_REF] Abadi | Mobile values, new names, and secure communication[END_REF]. More importantly, the framework we define in this part is generic enough to be instantiated in different ways. We will notably be able to instantiate it in the models on which the tools we eventually leverage in this thesis are based (i.e. ProVerif and Apte). In this part, we also define trace equivalence for our symbolic model and explain how some privacy goals can be defined relying on this notion.

We stress the fact that some of our subsequent developments, that will be built upon our uniform and generic symbolic model, have different requirements w.r.t. the way the semantics of security protocols is defined. This is often the case and, as already mentioned, partly explains the diversity of symbolic models that have been proposed in the literature. However, in this thesis, we put effort into defining a generic semantics that can be parametrised in different ways in order to meet different requirements and expose different levels of details. More importantly, we prove that all variations of our symbolic model one can thus obtain capture the same security notions. More precisely, we prove that the induced reachability properties and more importantly trace equivalence coincide for all of them.

Introduction

Outline. First, we formally define the process algebra we shall use to model security protocols in Chapter 2. We notably define a generic semantics describing the processes' behaviours.

We also describe different ways to model cryptographic primitives and their algebraic relations.

In Chapter 3, we formally define trace equivalence. We also compare this notion with other behavioural equivalences. We conclude this chapter with illustrations of privacy goals modelled using trace equivalence. Finally, in Chapter 4, we show how one can derive variants of the generic semantics defined before, all capturing the same security notions. Those variants have different technical features and we shall use one or the other depending on our needs in subsequent developments.

Chapter 2

Modelling Security Protocols

In this chapter, we define the generic model of security protocols we shall use in this thesis. This model is a variant of the dialect of Blanchet, Abadi & Fournet [START_REF] Blanchet | Automated verification of selected equivalences for security protocols[END_REF] based on the applied π-calculus [START_REF] Abadi | Mobile values, new names, and secure communication[END_REF].

Messages exchanged by agents taking part in the protocol are represented using a term algebra. In such a term algebra, the algebraic properties of the data structures and the cryptographic primitives are modelled through an equational theory and a computation relation (generalizing reduction rules). We define a generic notion of such term algebras and give some examples in Section 2.1.

Agents of a protocol are modelled as processes in a process algebra describing all their possible behaviours. The semantics of that process algebra specifies how processes can interact with each other by sending and receiving messages through an insecure network totally controlled by an attacker. We define the syntax and the semantics of that process algebra in Section 2.2.

Further, we show in Section 2.3 different ways to realise instances of the generic notion of term algebra we defined notably corresponding to the tools we eventually leverage in this thesis: ProVerif and Apte.

Term Algebra

We now present term algebras, which will be used to model messages built and manipulated using various cryptographic primitives and data structures. We consider an infinite set N of names (denoted k, n) which are used to represent keys or nonces and two infinite and disjoint sets of variables X and W. Members of X are denoted x, y, z and are typically used to refer to unknown parts of messages expected by participants, while variables in W, denoted w and called handles, are used to store messages learned by the attacker. We assume a signature Σ, i.e. a set of function symbols together with their arity. The elements of Σ are split into constructor and destructor symbols, i.e. Σ = Σ c ⊔ Σ d . On the one hand, destructors are meant to model computations that may fail; and such a failure can be observed. Signature and MAC verification are examples of this kind. On the other hand, constructors can be used to model total functions

Modelling Security Protocols

possibly satisfying some algebraic properties. For instance, exclusive or and Diffie-Hellmann exponentiation would be modelled using constructors.

Given a signature Σ, and a set of atoms A, we denote by T (Σ, A) the set of terms built from elements of A by applying function symbols in Σ. We shall call terms the elements of T (Σ, N ∪X ) and note them t, s. Terms in T (Σ c , N ∪ X ) will be called constructor terms. We denote vars(t) the set of variables that occur in a term t. A message is a constructor term u that is ground, i.e. such that vars(u) = ∅. We let u, v range over messages. Messages are the only terms that can be exchanged through the network while terms shall be executed yielding either a message or a failure. Executions of terms are described by the computation relation we define in Section 2.1.2.

We denote by x, n, t a (possibly empty) sequence of variables, names, and terms respectively. The application of a substitution σ to a term u is written uσ, and we denote dom(σ) the domain of σ. The positions of a term and the notion of contexts (i.e. terms with holes) are defined as usual. We write subTerms(t) to denote the set of syntactic sub-terms of a term t.

Example 1. Consider the signature:

Σ = {senc, sdec, ⟨ ⟩, π 1 , π 2 , ⊕, 0, eq, neq, ok}.
The symbols senc(•, •) and sdec(•, •) of arity 2 represent symmetric encryption and decryption. Pairing is modelled using ⟨•, •⟩ of arity 2, whereas projection functions are denoted π 1 (•) and π 2 (•), both of arity 1. The function symbol • ⊕ • of arity 2 and the constant 0 are used to model the exclusive or operator. Finally, we consider the symbol • eq • of arity 2 to model equality test, as well as the constant symbol ok. This signature is split into two parts: Σ c = {senc, ⟨ ⟩, ⊕, 0, ok}, and Σ d = {sdec, π 1 , π 2 , eq, neq}.

Semantics of Messages: Equational Theory

Messages are given a semantics through an equational theory. This has proved very useful for modelling algebraic properties of cryptographic primitives (see e.g. [START_REF] Cortier | A survey of algebraic properties used in cryptographic protocols[END_REF] for a survey). Formally, we consider a relation E : T (Σ c , X ) × T (Σ c , X ) describing a set of equations modelling each an algebraic relation satisfied by constructor symbols. This induces a congruence relation generated from those equations as defined next. Note that, by definition, = E is closed under bijective renaming. The equational theory is meant to be transparent from the point of view of participants and the attacker; i.e. all representatives of a given equivalent class of = E are indistinguishable for them since they model the same piece of data. The semantics of protocols itself will be stable by = E .

Definition 1. Let E : T (Σ c , X ) × T (Σ c , X )
Note that we assume that E is chosen such that = E is not degenerate, i.e. there exist two messages u, v such that u ̸ = E v.

Term Algebra

Example 2. To reflect the algebraic properties of the exclusive or operator, we may consider the equational theory generated by the following equations:

x ⊕ 0 = x (x ⊕ y) ⊕ z = x ⊕ (y ⊕ z) x ⊕ x = 0 (x ⊕ y) = (y ⊕ x)
In such a case, we have that senc(a

⊕ (b ⊕ a), k) = E senc(b, k).

Semantics of Terms: Computation Relation

We now give a semantics to terms through a computation relation which describes how terms can be executed yielding either a message or a failure.

Contrary to equational theories, computation relations allow to model computations that may fail. For example, when modelling symmetric encryption as in Example 3, decryption never fails even if keys do not match: it always returns a message. With a computation relation, it is possible to express a failure in such a case. For instance, contrary to the Example 3, the destructor symbol sdec introduced in Example 1 shall be given a semantics corresponding to a partial function that may fail when the given keys do not match: sdec(senc(u, k), k ′ ) would fail while sdec(senc(ok, k), k) would not fail and would compute the message ok.

We now give a generic definition of computation relations. We prefer axiomatizing computation relations with all requirements they must satisfy rather than giving operational ways to obtain them (we list some of them later on in Section 2.3). There are many requirements for such computation relations mainly because its interactions with the equational theory have to fulfil expected properties. For example, when two messages u, v are equal modulo = E , replacing u by v in a term t should not impact the computation of t since u and v represent the same piece of data. We describe in Section 2.

u 1 = E u 2 ; • if t[] is a context built from Σ and N , u 1 , u 2 are messages such that u 1 = E u 2 , and, t[u 1 ] ⇓ v 1 for some message v 1 , then t[u 2 ] ⇓ v 2 for some message v 2 such that v 1 = E v 2 .
The relation ⇓ associates, to any ground term t, at most one message up to the equational theory = E . When no such message exists, we say that the computation fails; this is noted t ¡ ¡ ⇓.

Remark that the fifth requirement implies that ⇓ associates to each term either a failure or an equivalence class of = E . As a slight abuse of notation, we may sometimes use directly t ⇓ as a message, when we know that the computation succeeds and the choice of representative is irrelevant.

Example 4. We precisely define later in Section 2.

Attacker's Knowledge: Recipes & Frames

For modelling purposes, we split the signature Σ into two parts, namely Σ pub and Σ priv . This is orthogonal to the splitting into Σ c , Σ d : it allows to consider some function symbols as private

forbidding

Process Algebra

We now define the syntax and semantics of the process algebra we use to model security protocols.

Syntax

We consider an infinite set C of channel names such that C ∩ N = ∅ and an infinite set χ of recursive variables such that χ ∩ X = ∅. Agents of protocols are modelled through ground processes using the grammar in Figure 2.1. Grammar. For a multiset2 S of processes, Π S denotes the parallel composition of all processes in S. When S contains only two processes, we use the notation

P, Q := Π S parallel composition | in(c,
P 1 | P 2 def = Π {P 1 , P 2 } # . This
is how parallel composition is usually defined. However, we prefer our definition because of the precise analysis of the structure of processes we carry on later in the thesis (in Chapter 5). When S is empty, the parallel composition describes the null process that does nothing and that we note Binding and conventions. The construct recX.P binds X in P , the construct in(c, x).P and respectively let x = v in P else Q bind x and respectively all variables in x in P and νn.P binds n in P . Finally, in the process νc out ch (a, c).P , channel names in c are bound in P . We use α-renaming and capture-avoiding substitution as is standard. We call ground a process having no free variable from X or χ . We denote by fc(P ) and bc(P ) the set of free and bound channels of P . For brevity, we sometimes omit "else 0" and null processes at the end of processes. We often write P ∪ P instead of {P } ∪ P.

0 def = Π ∅. Input
Example 6. We consider the RFID protocol due to Feldhofer et al. as described in [START_REF] Feldhofer | Strong authentication for RFID systems using the AES algorithm[END_REF].

This protocol aims to mutually authenticate an RFID tag with a reader device. The protocol is between an initiator I (the reader) and a responder R (the tag) that share a symmetric key k. It can be presented using Alice & Bob notation as follows (we note {m} k the symmetric encryption of a message m with a key k):

1. I → R : n I 2. R → I : {n I , n R } k 3. I → R : {n R , n I } k
We consider the term algebra introduced in Example 4. The protocol is modelled by the parallel composition of the processes P I and P R , corresponding respectively to the roles I and R.

P Fh def = νk. (νn I .P I | νn R .P R )
where P I and P R are defined as follows:

P I def = out(c I , n I ). in(c I , x 1 ). let x 2 , x 3 = eq(n I , π 1 (sdec(x 1 , k))), π 2 (sdec(x 1 , k)) in out(c I , senc(⟨x 3 , n I ⟩, k)) P R def = in(c R , y 1 ). out(c R , senc(⟨y 1 , n R ⟩, k)). in(c R , y 2 ). let y 3 = eq(y 2 , senc(⟨n R , y 1 ⟩, k)) in 0
Note that, the final null process 0 in P R may be replaced by the next protocol to be executed after the Feldhofer protocol.

Remark 1 (Replication vs. Recursive Processes). Recursive processes are standard in π-calculus and are equi-expressive to replication in the full π-calculus [START_REF] Sangiorgi | The pi-calculus: a Theory of Mobile Processes[END_REF]. This is also the case in the full applied π-calculus notably including private channels and internal communication, where a wellknown translation can be used to encode recursive processes into non-recursive processes featuring replications and private channels. However, when internal communication is not allowed as it is the case in our calculus, recursivity is actually strictly more expressive than replication.

Even though replication could be encoded using recursive processes ( !P would be encoded as recX.(P | X)), we keep the two constructs because we eventually carry out a precise analysis on processes structure that would behave differently on replicated processes than on replicated processes encoded as recursive processes.

Configurations. The configurations (denoted by G, H, K, A, B) are pairs (P; Φ) where: P is a multiset of ground processes describing a parallel composition of processes ready to be executed and Φ is a frame denoting the set of messages the attacker currently knows. Intuitively, P describes the internal state of the protocol while Φ describes the state of the environment which coincides with the attacker. Given a configuration K, Φ(K) denotes its second component. We may consider processes as configurations. In such cases, the corresponding frame is ∅.

Note that free names in configurations represent fresh, private, data. Thus, two configurations G and H equal up to a bijection of names essentially represent the same object. Correspondingly, all security notions we define in Chapter 3 are invariant by bijection of names.

Example 7 (Resuming Example 6). The configuration ({P Fh }; ∅) represents a reader and a tag ready to execute one session of the Feldhofer protocol in presence of an attacker with no prior knowledge.

Internal Reduction

Processes are subject to an internal reduction3 R parametrized by a basic relation R. Formally, we assume a relation R over multisets of processes. The choice of R gives us enough flexibility to consider some actions to be executed greedily without producing any explicit action at the semantical level (to be defined). For instance, R could break parallel composition:

(P ⊎ {ΠS}) R (P ⊎ S) yielding an internal reduction breaking all parallel compositions occurring 2. Modelling Security Protocols at top level. In Chapter 4, we eventually define a generic class of relations R one may use but, for the moment and for the sake of clarity, one can fix an empty relation R = ∅.

Once a relation R has been chosen (e.g. R = ∅), the induced internal relation R applies R under parallel compositions and reorganises the structure of parallel compositions as formally defined next. Definition 3. The relation R is the least relation over multisets of processes containing R such that:

• for any multisets of processes P, S, S ′ , it holds that P ⊎{Π(S ⊎{ΠS ′ })} R P ⊎{Π(S ⊎S ′ )} (nested parallel compositions collapse);

• for any multiset of processes P, any process P , it holds that P ⊎ {Π{P }} R P ⊎ {P } (no parallel composition of a single process);

• for any multisets of processes P, S, S ′ , if S R S ′ then P ⊎ {ΠS} R P ⊎ {ΠS ′ } (congruence w.r.t. parallel composition).

We lift R over configurations by applying it on the first component only. We assume that R is chosen in such a way that the induced relation R is terminating (i.e. no infinite chain decreasing w.r.t. R ) and confluent (i.e. if P R Q 1 and P R Q 2 then there exists

Q such that Q 1 R Q, Q 2 R Q).
In Chapter 4, we define a generic class of relations R (including the empty relation) and prove that such relations always yield internal reductions that are terminating and confluent. The internal reduction thus yields normal forms: for any multiset of processes P, there exists a unique Q that we note NF R (Q) such that P * R Q and there is no Q ′ such that Q R Q ′ . We now only consider configurations and multisets of processes in normal forms by implicitly reducing multisets of processes.

Remark 2. Note that for any process P = ΠS in a configuration K in normal form, no process in S is a parallel composition ( i.e. of the form ΠS ′ ). Remark that as a sub-case of the first item of Definition 3, we also have that P ⊎ {Π(S ⊎ {0})} R P ⊎ {ΠS} (0 is the identity element of Π) independently of R.

Example 8. For instance, one could reduce

P = {Π{Π{Q, 0, 0}, 0}} ∅ {Π {Π{Q}}} ∅ {Q}. Moreover if Q is not a parallel composition, it holds that NF ∅ (P) = {Q}.

Semantics

The operational semantics of processes is given by a labelled transition system (LTS) over configurations in normal forms (w.r.t. R ). The semantics is given in Figure 2.2. This labelled operational semantics allows one to avoid the quantification over all contexts when analysing a protocol in presence of an arbitrary attacker and is therefore more amenable to automation.

The Out rule allows to trigger an output provided that the computation of the outputted term does not fail. Note that the resulting outputted message is added to the current frame modelling the fact that the attacker can eavesdrop all outputted messages. used to trigger an input for a recipe built on the current frame. The inputted message injected into the process that performed that action is given by the computation of the recipe on the current frame. The latter models the injection capabilities of the attacker. Overall, observe that this semantics models an attacker controlling all the network. Finally, note that the guard condition of the rule New (i.e. names n must be fresh) is never blocking since it is always possible to α-rename n.

All τ actions (i.e. τ Π , τ ν , τ ! , τ then , τ else , τ r ) are unobservable actions from the attacker's point of view. They represent progress of the internal control points of the different agents involved in the protocol that have no observable effect. We still label them precisely because of the annotations we eventually equip the semantics with.

As usual, the relation α 1 . . . . .α n -----→ between configurations (where α 1 . . . . .α n is a trace, i.e. a sequence of actions) is defined as the (labelled) reflexive and transitive closure of α -→. We denote by bc(tr) the bound channels of a trace tr, i.e. all the channels that occur in second argument of an action νc out ch (a, c) in tr, and we consider traces where channels are bound at most once.

Example 9. Continuing Example 7. We have that: ({P Fh }; ∅) tr -→ ({0, 0} # ; Φ 0 ) where tr and Φ 0 are as follows, for fresh names

k ′ , n ′ I , n ′ R ∈ N : tr = τ ν .τ Π .τ ν .τ ν .out(c I , w 1 ).in(c R , w 1 ).out(c R , w 2 ).in(c I , w 2 ).τ then .out(c I , w 3 ).in(c R , w 3 ).τ then Φ 0 = {w 1 → n ′ I , w 2 → senc(⟨n ′ I , n ′ R ⟩, k ′ ), w 3 → senc(⟨n ′ R , n ′ I ⟩, k ′ )}.
This execution corresponds to a normal execution of one session of the protocol.

We prove in Chapter 4 that the choice of R (from which stems the induced internal reduction R ) has no impact on the induced security notions providing that it only reduces processes

Modelling Security Protocols

as executing τ -actions would do. We will provide a generic class of such choices of R.

Instances of Term Algebras

We show in this section two means to operationally define computation relations corresponding to the ways it is done in respectively ProVerif and Apte. In ProVerif, this is done through rewriting systems over terms while in Apte this is done thanks to equations over terms equipped with a validity predicate.

Computation Relation Through Rewriting Systems

A computation relation can be obtained from a rewriting system which describes basic rules specifying how destructors affect their arguments. Definition 4. A rewriting system is an ordered set of rewriting rules of the form g(u 1 , . . . , u n ) → u where g ∈ Σ d , and u, u 1 , . . . , u n are constructors terms ( i.e. in T (Σ c , X )).

A ground term t can be rewritten into t ′ (noted t t ′ ) if there is a position p in t, a rewriting rule g(u 1 , . . . , u n ) → u and a substitution θ from variables to messages such that

t| p = g(v 1 , . . . , v n ), v 1 = E u 1 θ, . . . , v n = E u n θ,
) → u such that t| p = g(v 1 , . . . , v n ), v 1 = E u 1 θ, . . . , v n = E u n θ
for some substitution θ, t ′ = t[uθ] p , and, for all i, u i θ is a message. We let

v ′ i = v i ρ and θ ′ = ρ • θ. It holds that (tρ)| p = g(v ′ 1 , . . . , v ′ n ) and v ′ 1 = E u 1 θ ′ , . . . , v ′ n = E u n θ ′ ,
i (u 1 i , . . . , u ni i ) → u i in the rewriting system such that t i|p i = g i (v 1 i , v 2 i , . . . , v ni i ), v j i = u j i θ i , t ′ i = t i [u i θ i ] pi .
We distinguish two cases whether p 1 = p 2 or not. If p 1 = p 2 then t 1 ≡ E t 2 implies g 1 = g 2 and v j 1 = E v j 2 for all j. Moreover, the same reduction rule is applied on t 1 and t 2 . Indeed, the former implies that the same rules can be applied on t 1|p 1 and t 2|p 2 but, by definition of , the first one occurring in the ordered set of reduction rules was actually applied to t 1 and t 2 . We thus have u 1 θ 1 = E u 2 θ 2 . Therefore, it holds that t ′

1 ≡ E t ′ 2 concluding the proof. Otherwise, it must be the case that p 1 is not a prefix of p 2 nor the converse. Indeed, strict-sub terms below the positions where the rules are applied must be messages. Additionally, since t i has a destructor symbol g i at position p i and t 1 ≡ E t 2 , then, t i has also a destructor symbol g 2-i at position p 2-i and its arguments are equal modulo = E . Therefore, t ′ * v 1 and the reduction rule is applied to a position that is not above nor below u 1 . Indeed, u 1 is a message and has thus no destructor symbol. Hence, no reduction rule can be applied on u 1 . We thus have some term with hole t ′′

t 1 ≡ E t 2 implies (t i [u i θ i ]) |p2-i ≡ E g i (v 1 2-i , v 2 2-i , . . . , v n2-i 2-i ).

Computation Relation Through an Equational Theory

Another way to obtain computation relations is based on an equational theory over terms extending = E . We consider a set of equations given as a relation over terms and consider the induced extended equational theory as shown below. Proof. We prove all requirements separately:

Definition 5. Let E d : T (Σ, X ) × T (Σ,
• Consider n ∈ N . Since ≡ E d is reflexive, one has n ≡ E d n. We conclude from subTerms(n) = {n} and valid(n). • f(t 1 , . . . , t k ) ⇓ f(u 1 , . . . , u k ) for f ∈ Σ c of arity k and t i ⇓ u i for all 1 ≤ i ≤ k follows from the stability of ≡ E d by application of function symbols in Σ c ⊆ Σ.
• We prove by structural induction on the term t that if t ⇓ u for some message u and ρ : N → N is a bijective mapping then tρ ⇓ uρ. Since t ⇓ u, it holds that t ≡ E d u and valid(t). We trivially have that ≡ E d is stable by bijection of name; hence tρ ≡ E d uρ. Since u is a message and ρ is a bijection of names, we have that uρ is a message. Consider now a strict sub-term t ′ of t. Since valid(t), there must be a message u ′ such that t ′ ≡ E d u ′ . Hence t ′ ⇓ u ′ . By inductive hypothesis, it holds that t ′ ρ ⇓ u ′ ρ and u ′ ρ is a message. Since any strict sub-term of tρ is a strict sub-term of t on which ρ is applied, we have shown that tρ is valid. Therefore, tρ ⇓ uρ.

[t] ≡ E d t ′ s [u] ≡ E d v ′ for some message v ′ .
• Consider a term t and messages

u 1 , u 2 such that t ⇓ u 1 . If u 1 = E u 2 , t ⇓ u 2 follows from = E ⊆≡ E d . If t ⇓ u 2 , then u 1 = E u 2 is implied by the fact that ≡ E d is a conservative extension of = E .
• Let t[] be a context built from Σ and N , u 1 , u 2 be messages. We assume u 1 = E u 2 , and, Example 12 (Apte's Term Algebra). We now define the fixed term algebra used in the tool Apte.

t[u 1 ] ⇓ v 1 for some message v 1 . Let us prove that t[u 2 ] ⇓ v 2 for some message v 2 such that v 1 = E v 2 .
The signature used in Apte is Σ = Σ c ∪ Σ d with:

Σ c = Σ 0 ∪ {aenc, pk, enc, hash, sign, vk, ⟨⟩} Σ d = {adec, dec, check, π 1 , π 2 }
where Σ 0 may contain some additional user-defined constants ( i.e. constructor symbols of arity 0) and attacker's nonces. The equational theory is generated from no equation E = ∅. We thus have u = E v if, and only if, u = v. To take into account the properties of the destructor symbols, we consider the equational theory ≡ E d generated by the following equations over terms:

adec(aenc(x, pk(y)), y) E d x π 1 (⟨x 1 , x 2 ⟩) E d x 1 π 2 (⟨x 1 , x 2 ⟩) E d x 2 sdec(senc(x, y), y) E d x check(sign(x, y), vk(y)) E d x
It is easy to see that the induced ≡ E d is a conservative extension of = E for the same reason given in the previous example ( i.e. Example 11). By Proposition 2, we thus have that E d induces a computation relation. For instance, we have π 2 (adec(aenc(⟨n, pk(ska)⟩, pk(skb)), skb)) ⇓ pk(ska). We also have that π

1 (⟨ok, sdec(senc(a, k), k ′ )⟩) ¡ ¡ ⇓ since it is not valid (because sdec(senc(a, k), k ′ ) ¡ ¡ ⇓).
Chapter 3

Modelling Security Goals

Security goals are expressed as predicates over executions or sets of executions. Some can be expressed as the reachability of some given states; we describe them informally in Section 3.1.

However, this thesis focuses on privacy goals that are often modelled based on a more complex notion called behavioural equivalence. There are different variants of behavioural equivalence modelling more or less precisely attacker's capabilities. In Section 3.2, we define the most appropriate one to model and automatically verify security goals, which is called trace equivalence, and discuss its relations with other behavioural equivalences. Further, we explain how to model some privacy goals using trace equivalence in Section 3.3.

Reachability Properties

Reachability properties (also called trace properties) are statements that something bad never occurs on any execution trace of a protocol. Such properties are usually defined through predicates over configurations and sometimes over executions. We informally define below some well-known reachability properties. Obviously, there is a flurry of other reachability properties but we do not list them since we rather focus on equivalence-based properties.

Secrecy. This property (also called confidentiality) concerns a message used by the protocol and essentially models the fact that this message remains secret (i.e. not known by the attacker).

For instance, considering a configuration K and a message u, we say that K keeps u secret if for any execution of K, the attacker is not able to deduce u: i.e. for any K tr -→ K ′ , there is no recipe R over Φ(K ′ ) such that RΦ(K ′ ) ⇓ u. Example 13. For example, the configuration ({out(c, senc(s, k))}; {w 0 → k}) for some k, s ∈ N does not keep s secrect.

Authentication. Many security protocols aim at authenticating one agent to another: one agent should become sure of the identity of the other. As already said in the general introduction, there are several variants of authentication and a taxonomy of these has been proposed by Lowe

Modelling Security Goals

in [START_REF] Lowe | A hierarchy of authentication specifications[END_REF]. Let us informally describe such a property. For a configuration K made of two agents modelled by processes P and Q communicating respectively on channel c P and c Q , we say that K guarantees to P a weak agreement with Q if for any execution of K, if P has finished (all actions on channel c p have been triggered) then Q has finished (all actions on channel c q have been triggered). Sometimes, processes and the semantics are equipped with additional annotations in order to define other aspects of authentication (e.g. P and Q really exchanged messages, P and Q agreed on some value). Example 14. For example, the configuration ({P Fh }; ∅) from Example 7 guarantees to P I a weak agreement with P R . Establishing this property is not easy but can be automated using e.g. ProVerif.

Behavioural Equivalences

Reachability properties are useful to model many security goals. However, privacy goals such as anonymity or unlinkability cannot be defined (or cannot be naturally defined) as reachability predicates. They are rather defined relying on a notion of behavioural equivalence relating configurations that are indistinguishable. Discussion. Intuitively, two configurations are indistinguishable if an attacker has no way to tell them apart even when he is actively trying to do so. A natural starting point is to say that configurations A and B are indistinguishable if they can output on the same channels, no matter the context in which they are placed. Such a notion (called may-testing equivalence [START_REF] Cheval | Deciding equivalencebased properties using constraint solving[END_REF]) thus represents the attacker as a context and would represent behaviours of the protocol in presence of this attacker through a reduction semantics (that would not produce labels). Yet, the quantification over contexts makes this definition hard to use in practice. Therefore, indistinguishability notions based on a LTS (as the one presented in Chapter 2) have been proposed. For such LTS's, executions model all behaviours of the protocol that may interact with an environment that represents an arbitrary attacker. The attacker's behaviour is described by the trace associated to the execution. Intuitively, the indistinguishability notion can now be expressed as the fact that two configurations produce the same set of traces and frames (we define below trace equivalence that formalises this notion). Such a definition is more suitable for both manual and automatic reasoning since it avoids the quantification over contexts required when using a reduction semantics.

Actually linking these two semantics (LTS vs. reduction semantics) and their associated notions of equivalence (trace equivalence vs. may-testing) is not an easy task. Starting with the pioneering work of Milner and Sangiorgi [START_REF] Milner | Barbed bisimulation[END_REF], this problem has been addressed for different calculi and different notions of equivalences in several works (e.g. π-calculus, spi-calculus [AG98, MNP02], applied-pi calculus [START_REF] Abadi | Mobile values, new names, and secure communication[END_REF], and psi-calculus [START_REF] Bengtson | Psicalculi: a framework for mobile processes with nominal data and logic[END_REF]). Usually, the two notions of equivalence coincide but that is not the case for the applied-pi calculus. Indeed, it has been proved [START_REF] Cheval | Deciding equivalencebased properties using constraint solving[END_REF] that trace equivalence always implies may-testing equivalence and that maytesting equivalence implies trace equivalence only for image-finite configurations; i.e. for any 3.2. Behavioural Equivalences trace, there are only finitely many resulting frames modulo an indistinguishability notion over frames (i.e. static equivalence defined below). Note that, all configurations according to our definitions are necessarily image-finite since our model does not feature internal communication (i.e. communication that does not produce any visible action for the attacker). In our setting, trace equivalence is thus the most appropriate notion.

Static Equivalence. Before formally defining trace equivalence, we first introduce a notion of equivalence between frames, called static equivalence.

Definition 8 (Static equivalence).

A frame Φ is statically included in Ψ when dom(Φ) = dom(Ψ), and

• for any recipe R such that RΦ ⇓ u for some message u, there exists some message u ′ such that RΨ ⇓ u ′ ;

• for any recipes R 1 , R 2 such that R 1 Φ ⇓ u 1 for some message u 1 and R 2 Φ ⇓ u 2 for some message u 2 = E u 1 , there exist v 1 , v 2 such that R 1 Ψ ⇓ v 1 , R 2 Ψ ⇓ v 2 , and v 1 = E v 2 .
Two frames Φ and Ψ are in static equivalence, written Φ ∼ Ψ, if the two static inclusions hold.

Intuitively, an attacker can distinguish two frames if he is able to perform some computation or a test of equality that succeeds in Φ and fails in Ψ (or the converse).

Example 15. Consider the following frame (given in Example 9):

ϕ 0 = {w 1 → n ′ I , w 2 → senc(⟨n ′ I , n ′ R ⟩, k ′ ), w 3 → senc(⟨n ′ R , n ′ I ⟩, k ′ )}.
We have that

ϕ 0 ⊔ {w 4 → k ′ } ̸ ∼ ϕ 0 ⊔ {w 4 → k ′′ }. Indeed, the attacker may observe that the computation R = sdec(w 2 , w 4 ) succeeds in ϕ ⊔ {w 4 → k ′ } but fails in ϕ ⊔ {w 4 → k ′′ }.

Trace Equivalence

Then, trace equivalence is the active counterpart of static equivalence taking into account the fact that the attacker may interfere during the execution in order to distinguish between the two configurations. However, we require from the attacker to behave similarly for the two configurations. In other words, the attacker can choose an experiment represented by a trace of observable actions and then, he has to distinguish the frames resulting from the two configurations for this trace. For this, we define for a trace tr the trace obs(tr) to be the subsequence of tr obtained by erasing all unobservable actions; i.e. the τ actions: τ Π , τ ν , τ ! , τ then , τ else , τ r .

Definition 9 (Trace equivalence). Let K 1 and K 2 be two configurations. We say that

K 1 ⊑ K 2 when, for any K 1 tr 1 -→ K ′ 1 such that bc(tr 1 ) ∩ fc(K 2 ) = ∅, there exists K 2 tr 2 -→ K ′ 2 such that obs(tr 1 ) = obs(tr 2 ) and Φ(K ′ 1 ) ∼ Φ(K ′ 2 ). They are trace equivalent, written K 1 ≈ K 2 , when K 1 ⊑ K 2 and K 2 ⊑ K 1 .
Example 16 (Continuing Example 7). Consider the process Q = νn I .P I | νn R .P R modelling two parties of identity k ready to execute one session of the Feldhofer protocol. We may be interested in checking whether K = ({Π{νk.Q, νk.Q} # }; ∅) and K ′ = ({νk.Π{Q, Q} # }; ∅) are in trace equivalence. Intuitively, this equivalence models the fact that two sessions of P Fh are unlinkable: i.e. two sessions of the protocol performed by the same tag and reader ( i.e. having the same symmetric key k) modelled by K ′ appear to an attacker as if they have been initiated by two different tags ( i.e. having two different fresh keys) modelled by K. This equivalence actually holds. It is non-trivial to establish though. Moreover, we will discuss in Section 3.3 a stronger notion of unlinkability taking into account an unbounded number of sessions of the protocol.

Other Behavioural Equivalences

Showing trace equivalence properties is a very difficult task notably because of its forall-exists structure: for any execution of one configuration, one has to find an indistinguishable execution of the other configuration. For this reason, other notions of equivalence are sometimes considered in order to under-approximate trace equivalence: they consider strictly less pairs of configurations as equivalent.

Labelled bisimilarity. In the security setting, the notion of labelled bisimilarity has first been introduced to approximate trace equivalence [START_REF] Abadi | A calculus for cryptographic protocols: The spi calculus[END_REF] for the spi-calculus. We only informally define this notion here since we do not use it in later developments. The labelled bisimilarity is defined as the largest symmetric relation on configurations that: (i) relate only statically equivalent configurations, and, (ii) that relate configurations which can execute the same observable actions and such that their continuations remain related. The fact that labelled bisimilarity is based on a notion of step-by-step simulation between configurations makes this notion sometimes easier to establish directly.

It is well-known that labelled bisimilarity implies trace equivalence whereas the converse is false in general. However, it has been proved in [START_REF] Cheval | Deciding equivalencebased properties using constraint solving[END_REF] that these two notions coincide for a large class of configurations that includes in particular the class of simple processes that essentially contains linear processes (only input, conditional and output) in parallel playing each on pairwise distinct channels (we formally define this class later on in Chapter 6).

Diff-equivalence. Another notion of equivalence that has been extensively used in verification

tools is the notion of diff-equivalence. Such a notion is defined on bi-configurations that are pairs of configurations that have the same structure and differ only in the choice of terms they use.

The syntax is similar to the one introduced in Chapter 2 but each term u has to be replaced by a bi-term written choice[u 1 , u 2 ] (using ProVerif syntax). Given a bi-process P , the process fst(P ) is obtained by replacing all occurrences of choice[u 1 , u 2 ] with u 1 . Similarly, snd(P ) is obtained by replacing choice[u 1 , u 2 ] with u 2 . These notations are also used for bi-configurations and bi-frames.

Examples of Privacy Goals Modelling

Then ({let choice[x 1 , x 2 ] = choice[t 1 , t 2 ] in P else Q} ⊎ P; Φ) τ then --→bi ({P {choice[x 1 , x 2 ] → choice[u 1 , u 2 ]} ⊎ P; Φ) when t 1 ⇓ u 1 and t 2 ⇓ u 2 Else ({let choice[x 1 , x 2 ] = choice[t 1 , t 2 ] in P else Q} ⊎ P; Φ) τ else --→bi ({Q ⊎ P; Φ)
when t 1 ¡ ¡ ⇓ and t 2 ¡ ¡ ⇓ The semantics of bi-configurations is defined as expected via a relation that expresses when and how a bi-configuration may evolve. A bi-process reduces if, and only if, both sides of the bi-process reduce in the same way; i.e. exactly the same semantical rule (from Figure 2.2) should be applied on both sides. For instance a conditional has to be evaluated in the same way on both sides as shown by the rules in Figure 3.1. When the two sides of the bi-process reduce in different ways, the bi-process blocks. This leads us to the following notion of diff-equivalence. Definition 10. An initial bi-configuration K 0 satisfies diff-equivalence if for every bi-configuration K = (P; ϕ) such that K 0 tr -→bi K for some trace tr, we have that:

• fst(ϕ) ∼ snd(ϕ); • if fst(K) α -→ K ′ L then there exists a bi-configuration K ′ such that K α -→bi K ′ and fst(K ′ ) = K ′
L (and similarly for snd).

As expected, this notion of diff-equivalence is actually stronger than the usual notion of labelled bisimilarity, and thus trace equivalence. Indeed, it may be the case that the two sides of the bi-process reduce in different ways (e.g. taking two different branches in a conditional) but still produce the same observable actions. This strong notion of diff-equivalence happens to be sufficient to establish some interesting equivalence-based properties such as strong secrecy.

It can be automatically verified using the tools ProVerif,Tamarin and Maude-NPA. However, as already discussed in the general introduction, this notion is actually too strong to establish for example vote privacy for many interesting e-voting protocols [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF], or unlinkability as defined in [START_REF] Arapinis | Analysing unlinkability and anonymity using the applied pi calculus[END_REF]. We come back to this problem in Subsection 3.3.1 and address it for a rich class of protocols in Part C.

Examples of Privacy Goals Modelling

We now give two examples of privacy goals defined using trace equivalence: unlinkability property on the Feldhofer protocol in Subsection 3.

Unlinkability of Feldhofer

We informally explain how to model unlinkability of the Feldhofer protocol for an unbounded number of sessions and users. Note that there are other definitions of unlinkability corresponding to different modellings, scenarios or threat models. We will come back to those definitions in Chapter 8.

We iterate from Example 16 where a definition of unlinkability for two sessions was given and now seek for a definition of unlinkability considering an unbounded number of users and sessions. In Example 16, unlinkability was defined by comparing a "real scenario" where two sessions were performed by the same tag and reader with an "ideal scenario" where two sessions are performed by two different pairs of tags and readers. For the unbounded case, the "real scenario" models now an unbounded number of pairs of tags and readers playing each an unbounded number of sessions while the "ideal scenario" models an unbounded number of pairs of tags and readers playing each at most one session. The former and the latter are respectively modelled by K r = ({!νk!Q}; ∅) and K i = ({!νk.Q}; ∅). The trace equivalence between K r and K i models the fact that P Fh is unlinkable for an unbounded number of users and sessions: each session of the protocol appears to an attacker as if it has been initiated by a different tag, since a given tag can perform at most one session in the idealised scenario K i . This equivalence actually holds.

The trace equivalence between K r and K i is non-trivial to establish. Actually, no tool is able to verify it directly. Indeed, the only existing tools that can verify a notion of behavioural equivalence for unbounded sessions (i.e. ProVerif,Tamarin or Maude-NPA) all verify diffequivalence rather than trace equivalence. But the above equivalence cannot be established via diff-equivalence because the underlying bi-process (i.e.

({!νk l !νk r .let k = choice[k l , k r ] in Q}; ∅))
is not diff-equivalent while K i and K r are trace equivalent. Unfortunately, this is not an isolated problem: unlinkability as defined above is often incompatible with diff-equivalence because the two processes to be verified do not share the same structure. To put in other words: diffequivalence considers an over-approximation of the Dolev-Yao attacker by giving him the internal structure of the two processes to be verified, the attacker is thus able to observe from which replication a given thread originates often breaking unlinkability by construction. We detail at greater length the reasons explaining the above in the introduction of Part C.

In order to address this problem, we devise sufficient conditions that imply unlinkability and anonymity and that can be verified using such existing tools without the aforementioned precision issue. We describe those conditions and the overall methodology in Part C.

Anonymity of the Private Authentication Protocol

We consider the Private Authentication protocol given in [START_REF] Abadi | Private authentication[END_REF] designed for authenticating an agent with another one without revealing their identities to other participants.

Private Authentication Protocol. In this protocol, A is willing to engage in communication

with B and wants to be sure that she is indeed talking to B and not to an attacker who is trying to impersonate B. However, A wants to protect her privacy and expects that her identity is not Relying on the signature and equational theory introduced in Example 12 (in Section 2.1), a session of role A played by agent a (with private key ska) with b (with public key pkb) can be modelled as follows:

Examples of Privacy Goals Modelling disclosed except to B. The protocol specifies the following interactions between participants A and B (in Alice & Bob notations):

A → B : {N a , pub A } pub B B → A : {N a , N b , pub B } pub A
P (ska, pkb) def = out(c A , aenc(⟨n a , pk(ska)⟩, pkb)). in(c A , x). let z = neq(⟨π 1 (adec(x, ska)), π 2 (π 2 (adec(x, ska)))⟩, ⟨n a , pkb⟩) in 0 else 0
Here, we are only considering the authentication protocol. A more comprehensive model should include the access to an application in case of a success (i.e. replacing the null process in the then branch by a process modelling the continuation in case of success). Similarly, a session of role B played by agent b with a can be modelled by the following process, where u = adec(y, skb).

Q(skb, pka) def = in(c B , y). let z = neq(π 2 (u), pka) in out(c B , aenc(⟨π 1 (u), ⟨n b , pk(skb)⟩⟩, pka)) else out(c B , aenc(n b , pk(skb)))
To model a scenario with one session of each role (played by the agents a and b), we may consider the configuration (P; Φ 0 ) where:

• P = {P (ska, pk(skb)), Q(skb, pk(ska))}, and

• Φ 0 = {w 0 → pk(ska ′ ), w 1 → pk(ska), w 2 → pk(skb)}.
The purpose of pk(ska ′ ) will be clear later on. It allows us to consider the existence of another agent a ′ whose public key pk(ska ′ ) is known by the attacker.

Anonymity. Intuitively, the private authentication protocol preserves anonymity of the role

A for one session if an attacker cannot distinguish between the two following scenarios (provided a, a ′ and b are honest participants):

• a and b who is willing to talk to a play a session of the protocol (represented by the processes P a = P = {P (ska, pk(skb)), Q(skb, pk(ska))}) or

Modelling Security Goals

• a ′ and b who is willing to talk to a ′ play a session of the protocol (represented by the processes

P a ′ = {P (ska ′ , pk(skb)), Q(skb, pk(ska ′ ))}).
This can be expressed relying on the following equivalence:

(P a ; Φ 0 ) ? ≈ (P a ′ ; Φ 0 ).
Note that we define anonymity more formally and for an unbounded number of sessions and users in Chapter 8.

For illustration purposes, we also consider a variant of the process Q, denoted Q 0 , where its else branch has been replaced by 0 (i.e. the null process). We note P a 0 = {P (ska, pk(skb)), Q 0 (skb, pk(ska))} and correspondingly for P a ′ 0 . We will see that the "decoy" message plays a crucial role to ensure privacy. We have that:

(P a 0 ; Φ 0 ) in(c B , aenc(⟨w 1 , w 1 ⟩, w 2 )).τ then .out(c B , w 3 ) -----------------------→ ({P (ska, pk(skb)), 0}; Φ)
where Φ = Φ 0 ⊎ {w 3 → aenc(⟨pk(ska), ⟨n b , pk(skb)⟩⟩, pk(ska))}. This trace has no counterpart involving the same observable actions in (P a ′ 0 ; Φ 0 ). Indeed, we have that:

(P a ′ 0 ; Φ 0 ) in(c B , aenc(⟨w 1 , w 1 ⟩, w 2 )).τ else ----------------→ ({P (ska ′ , pk(skb)), 0}; Φ 0 ).
Hence, it holds that (P a 0 ; Φ 0 ) ̸ ≈ (P a ′ 0 ; Φ 0 ). However, it is the case that (P a ; Φ 0 ) ≈ (P a ′ ; Φ 0 ) meaning that the Private Authentication protocol with the decoy message ensures the anonymity of the role A for one session. This equivalence can be checked using the tool Apte [APTa] in less than 0.1 second for a simple scenario as the one considered here, and that takes few minutes/days as soon as we want to consider 2/3 sessions of each role. As already mentioned in the introduction this is not an isolated problem. The fundamental reason behind this is the state space explosion problem stemming from the concurrent nature of the problem leading to too many interleavings to explore.

In Part B, we show how to address this problem through dedicated Partial Order Reduction Techniques.

Chapter 4

Variations of the Semantics

In the different chapters of this thesis, we need different levels of precision on the processes' structure and on the unobservable actions (e.g. τ -actions). For instance, in Chapter 5, our analysis heavily relies on the internal structure of processes, notably on the structure of parallel compositions. Moreover, evaluations of conditionals do not take part to our analysis while replication should be executed lazily (i.e. only if the unfolded process is then immediately executed). By contrast, in Part C, evaluations of conditionals have to produce (unobservable) actions and replications are not constrained. Furthermore, parallel compositions are unimportant as our analysis focuses on the underlying multiset of (non-parallel) processes.

In this chapter, we show that, thanks to the flexibility of our framework, one can refine the semantics by forcing a subset of non observable actions to be executed as soon as possible (i.e. in a greedy way) and others as late as possible (i.e. in a lazy way) without impacting the different notions of security properties. The two types of refinements are presented respectively in Section 4.1 and Section 4.2. The semantics one can obtain in such a way do not capture different threat models or yield different security notions but only correspond to different definition flavors of the same notion that are captured by the same unified, generic framework we defined in previous chapters. We formally prove the latter in Section 4.3.

Executing Unobservable Actions Greedily

There are two ways to define semantics executing unobservable actions greedily. First, one can achieve this goal by choosing appropriate relations R on which the internal reduction R is built. However, this cannot tackle the creation of names since, on the one hand, the New rule non-deterministically chooses a fresh name, while, on the other hand, the relation R must yield a confluent internal reduction. Hence the need for a dedicated notion covering the ν case.

Internal Reduction: Conditional, Parallel Composition and Blocked Output

We first define a generic relation R containing all reductions we might use in this thesis. Variations of the semantics can then be obtained using a sub-relation of this generic relation and the

Variations of the Semantics

resulting class of relations one may use will be called conform.

One of the reductions we need is the evaluation of conditionals. For instance if for some term t there exists u such that t ⇓ u then we would like to reduce P t = let x = t in P else Q to P {x → u}. However, remind that the internal reduction must be confluent and that there may be more than one message v satisfying t ⇓ v. Fortunately, we know by Definition 2 that all such messages are in the same equivalence class of = E . In order to achieve convergence, we thus introduce an arbitrary fixed selection function selec :

T (Σ c , N ) → T (Σ c , N ) such that: (i) for any messages u = E v, it holds that selec(u) = selec(v)
, and, (ii) for any message u, it holds that selec(u) = E u. Definition 11. We first define 3 types of reductions R test , R par , R out as the least relations satisfying the following:

• (evaluation of conditionals) for any process of the form

P t = let t = v in P else Q, -if t ⇓ u for some u then {P t } ⊎ P R test {P {x → selec(u)}} ⊎ P -if t ¡ ¡ ⇓ then {P t } ⊎ P R test {Q} ⊎ P
• (breaking parallel composition and removal of 0) for any multiset of process S, then {ΠS}⊎ P R par S ⊎ P.

• (removal of blocked outputs) for any term t and process P = out(c, t).P ′ such that t ¡ ¡ ⇓, then

{P } ⊎ P R out P.
Further, R r is the reunion of relations defined above; i.e.

R r = R test ∪ R par ∪ R out . A relation R is said to be conform when R ⊆ R r and R par ∩ R ̸ = ∅ implies R par ⊆ R.
The second condition on the class of conform relations is needed to achieve confluence of the induced R . For instance, a relation R that would collapse parallel compositions of size two only would not be confluent (and thus not convergent).

Proposition 3. For any conform relation R, the internal reduction R is terminating and confluent.

Proof. (Termination) For R r , the sum of the structural sizes of processes (i.e. number of nodes of the productions of the grammar defining processes) in the multiset strictly decreases. This is thus also the case for R. Further, this also applies to R . Note that in the case of the collapse of parallel compositions, the modified process has one less parallel composition Π so its size decreases by 1.

(Confluence) Since R has been proved terminating, it suffices to prove its local confluence to obtain its confluence (by Newman's lemma). It is easy to see that R test and R out cannot break the local confluence since those reductions (i) modify processes that cannot be modified by other rules and (ii) modify only one process independently from the rest of the processes in the multiset and thus do not induce any critical pair. Moreover, critical pairs involving collapse of parallel compositions or removal of parallel compositions of single processes can easily be 4.2. Executing Unobservable Actions Lazily shown convergent. Therefore, one can deduce the local confluence of R when R par ∩ R = ∅. Otherwise, it holds that R par is entirely included in R. In that case, it suffices to remark that R always removes top-level parallel compositions by merging underneath processes into the multiset of processes.

Example 17. Consider R test (that is conform). The semantics induced by Rtest evaluates conditionals as soon as possible, even under parallel composition, without producing any action. For instance, we would have {Π{out(d, ok), let eq(ok, no) in out(c, ok) else 0}} Rtest {out(d, ok)}.

ν-greedy Executions: Creation of Names

As argued in the beginning of the chapter, a dedicated notion is needed to execute name creations greedily. The following definition essentially states that as soon as a process in the current configuration is ready to create a name, it is actually executed and before all other types of actions.

Definition 12. We say that an execution G tr

-→ H = (Q; Ψ) is ν-greedy if (i) H does not contain any ν-process ( i.e. there is no process of the form νn.Q in Q) and (ii) for any prefix of the former execution of the form G tr 0 -→ ({νn.P } ⊎ P; Φ) α -→ K, the action α is τ ν .

Remark that we could have defined similar notions for conditionals and parallel compositions but we prefer to use internal reduction to deal with those cases since the latter allows to avoid producing spurious unobservable actions that will not get in the way of our analysis. Moreover, using internal reductions allows to simplify reasoning on configurations since, then, normal forms do not feature some constructs.

Example 18. Consider the configuration K = (Π{P, P } # ; ∅) where P = νn.out(c, n). The ex-

ecution K τ Π -→ ({P, P } # ; ∅) = K 1 is not ν-greedy and nor is K τ Π .τ ν .out(c, w) --------→({P, 0} # ; {w → n}) = K 2 .
Indeed, the resulting configurations K 1 and K 2 contain some ν-processes. However, the following execution is ν-greedy:

K τ Π .τ ν .τ ν .out(c, w).out(c, w ′ ) ---------------→ ({0, 0} # ; {w → n, w ′ → n ′ }).

Executing Unobservable Actions Lazily

In this thesis, we are only interested in replication to be lazily executed and thus limit our definitions to this case but note that we could have dealt similarly with recursion, conditionals, creation of names and parallel compositions.

Definition 13. We say that an execution K tr -→ K ′ is !-lazy if for any of its prefix of the form

K tr 0 -→ ({!P } ⊎ P; Φ) τ ! -→ (S ⊎ {!P } ⊎ P; Φ)
where S is the normal form (w.r.t. the internal reduction) of P , one of the processes in S is executed (producing at least one action) in the execution under consideration immediately after this prefix.

Example 19. Consider the configuration K = ({P }; ∅) where P =!out(c, ok). The execution

K ν ! -→ ({out(c, ok), P }; ∅) is not !-lazy and nor is K ν ! .ν ! .out(c, w).out(c, w ′ ) -------------→ ({0, 0, P } # ; {w → ok, w ′ → ok}).
Indeed, the resulting replicated processes are not immediately executed after their replication.

However, K ν ! .out(c, w) ------→ ({0, P } # ; {w → ok}) or K ν ! .out(c, w).ν ! .out(c, w ′ ) -------------→ ({0, 0, P } # ; {w → ok, w ′ → ok}) are both !-lazy.

Stability of the Security Notions

We now turn to the proofs that all possible variations one can derive using previous definitions capture essentially the same security notions. To put in other words, those choices actually do not impact security notions. To that end, we need to introduce some notations to distinguish the different notions of semantics and induced trace equivalence.

For a relation R ⊆ R r over multisets of processes, we note • -→R the semantics equipped with R . Further, we note • -→ ν R the semantics exploring only ν-greedy executions. Similarly, we consider

• - → ! R (!-lazy) and • - → ν,!
R (!-lazy and ν-greedy). Finally, ≈ α R refers to the trace equivalence notion induced by the semantics

• -→ α R (i.e. replace - → by - → α R in Definition 9).
Reachability. We first show that the choice of a conform internal reduction and the choice of executing ν greedily or/and ! lazily does not impact reachable states and observable actions necessary to reach them. This is formalised by the two following easy properties.

Proposition 4. For any conform relation P, R, and for any execution A tr -→ P B there exists a trace tr ′ and a configuration B ′ such that

A tr ′ -→ R B ′ , Φ(B) = Φ(B ′
) and obs(tr) = obs(tr ′ ).

Proof. It suffices to show the result for (i) P = ∅ (which is conform) and an arbitrary conform R and (ii) for an arbitrary conform relation P and R = ∅.

Both results can be established easily by remarking that all reductions of R (resp. P ) made available by a conform non-empty R (resp. P) can be exactly mimicked by applying semantical rules producing unobservable actions. The only exception being the blocked outputs (i.e. processes of the form out(c, t).P such that t ¡ ¡ ⇓) that may be removed by reduction rules when present in configurations. Fortunately, those outputs cannot be triggered (since t ¡ ¡ ⇓) so removing them as soon as they appear in a given execution does not alter this execution.

Proposition 5. For any conform relation R, α ⊆ {ν, !} and execution

A tr -→ R G there exists a trace tr ′ and a configuration K such that A tr ′ -→ α R K, Φ(G) = Φ(K) and obs(tr) = obs(tr ′ ).
Proof. Firstly, in case ν ∈ α and G contains ν-processes, it is easy to complete the former execution with all available τ ν actions until the resulting process does not contain any ν-process any more. We can thus assume the former w.l.o.g.. Now, we prove the result by induction on the number of prefixes of A tr -→ G that violate one of the α condition(s). When there is no such prefix, the resulting execution can be played by

• -→ α R . Otherwise, consider a prefix A tr 0 -→ B β -→ C 4.

Stability of the Security Notions

of A tr -→ G of minimal length that violates at least one α condition(s). If β breaks a ν-greedy condition only then tr 0 produces at least a process starting with a creation of names. In that case, the prefix is of the following form: A tr 0 -→ ({νn.P } ⊎ P; Φ) β -→ C and β is not τ ν . If νn.P is never executed in the rest of the execution then it suffices to execute it (and all its next creation of names if any) by completing the execution by adding unobservable actions τ ν . Otherwise, it suffices to move existing τ ν actions towards the end of this prefix. The resulting prefix no longer violates the condition and the extra actions we added do not introduce extra prefixes that violate α condition(s).

If β breaks a !-lazy condition only then β must follow a τ ! action and β is not performed by the replicated processes. The prefix is thus the form:

A tr ′ 0 -→ ({!P } ⊎ P; Φ) τ ! -→ (S ⊎ {!P } ⊎ P; Φ) β
-→ C such that β does not come from the execution of a process in S. If process(es) in S are never executed, then one can remove the above τ ! action from the execution without impacting the executability, the observable part of the trace nor the resulting frame. By doing so, we remove one prefix violating a condition in α. Otherwise, it suffices to move τ ! just before the first action performed by a process in S. The new prefix it thus creates (replacing the old one) now satisfies the conditions in α. Moreover, this does not create new prefixes that could violate one of the α condition(s).

If β breaks both ν-greedy and !-lazy condition then the prefix is of the form

A tr ′ 0 -→ ({!P } ⊎ P; Φ) τ ! -→ ((S ⊎ {νn.Q}) ⊎ {!P } ⊎ P; Φ) β
-→ C such that β does not come from the execution of a process in (S ⊎ {νn.Q}). Dealing with this case as we did for the !-lazy condition removes two prefixes violating α conditions and creates at most one prefix violating α condition (when the first following action on (S ⊎ {νn.Q}) is not a τ ν ); hence strictly decreasing the number of prefixes violating α conditions. Therefore, reachability properties expressed as predicates over reachable configurations (and observable actions necessary to reach them) are not impacted by those choices. The two previous propositions are also key ingredients for the trace equivalence case we tackle next.

Equivalence. Now, we shall prove that the notion of trace equivalence neither depends on the ν-greedy and !-lazy status of the semantics nor on R as long as it is conform.

Proposition 6. For any conform R, the trace equivalences induced by R with any combination of ν-greedy and !-lazy constraints coincides with

≈ ( i.e. for any α ⊆ {ν, !}, it holds that ≈ α R =≈ ∅ ) Proof. (≈ α R ⊆≈ ∅ ) Consider an execution A tr A --→ A ′ .

Applying Proposition 4 and then Proposition 5, we obtain an execution A tr

′ A --→ α R A ′′ such that Φ(A ′′ ) = Φ(A ′ ) and obs(tr A ) = obs(tr ′ A )
. By hypothesis, there must be some

B tr ′ B --→ α R B ′′ such that Φ(A ′′ ) ∼ Φ(B ′′ ) and obs(tr ′ A ) = obs(tr ′ B ).
Trivially, this execution is also valid without any greedy or lazy constraints: it holds that

B tr ′ B --→ R B ′′ . Applying Proposition 4, we obtain an execution B tr B --→ B ′ such that Φ(B ′′ ) = Φ(B ′ ) and obs(tr B ) = obs(tr ′ B ) concluding the proof (by symmetry of ≈ ∅ ). (≈ α R ⊇≈ ∅ ) Consider an execution A tr A --→ α R A ′ .
This execution is obviously valid as well without any greedy or lazy constraint: it holds that A tr A --→ R A ′ . We now apply Proposition 4

Variations of the Semantics and obtain an execution

A tr ′ A --→ A ′′ such that Φ(A ′′ ) = Φ(A ′
) and obs(tr A ) = obs(tr ′ A ). By hypothesis, there must be some

B tr ′ B --→ B ′′ such that Φ(A ′′ ) ∼ Φ(B ′′ )

and obs(tr ′

A ) = obs(tr ′ B ). Applying Proposition 4 and then Proposition 5, we obtain an execution

B tr B --→ α R B ′ such that Φ(B ′ ) = Φ(B ′′ ) and obs(tr B ) = obs(tr ′ B ) concluding the proof (by symmetry of ≈ α R ).
In the different chapters of this thesis, depending on our needs, we may use one or the other such variant of the semantics. The results we eventually establish there thus concern the same semantics and the same model as shown by propositions 4 to 6.

Introduction

Problem. As already discussed in the general introduction, one approach to the automatic decision of trace equivalence for bounded number of sessions consists in using symbolic execution and dedicated constraint solving procedures. Unfortunately, the state-of-the-art procedures and tools for deciding equivalence have a limited practical impact because they scale very badly.

Take for example the Private Authentication protocol: verifying anonymity for that protocol as explained in Subsection 3.3.2 (in Part A) can be carried out using the tool Apte [APTa] within few seconds for a simple scenario with only one session of each role whereas it takes few minutes/days as soon as we want to consider 2/3 sessions of each role. We later conduct comprehensive benchmarks (Chapter 6) showing the same limitations. This is thus not an isolated problem and greatly impacts negatively the usefulness of those methods and tools. This is not surprising since those tools treat concurrency in a very naive way, exploring all possible (symbolic) interleavings of concurrent actions. As a consequence, those tools suffer from the so-called state explosion problem caused by the too many interleavings to consider.

Our goal. In standard model-checking approaches for concurrent systems, the interleaving problem is handled using partial order reduction (POR) techniques [START_REF] Peled | Ten years of partial order reduction[END_REF]. In a nutshell, these techniques aim to effectively exploit the fact that the order of execution of two independent (parallel) actions is irrelevant when checking reachability.

In the general introduction (Subsection 1.5.1), we already have briefly explained why the extensive state-of-the-art of POR in model-checking cannot be efficiently leveraged for our setting. Note that we describe this state-of-the-art into much more details and argue much further in a dedicated related-work chapter (Chapter 7). We thus seek for new POR techniques that are dedicated to our demanding security framework. Additionally to the previously discussed acknowledged difficulties of combining POR with the security framework, we shall address two major challenges.

First, we shall devise POR techniques that can be used to verify not only reachability properties but also trace equivalence. Contrary to what happens for reachability-based properties, trace equivalence cannot be decided relying only on the reachable states. The sequence of actions that leads to this state plays a role. Hence, if a specific interleaving is identified as redundant because it allows to reach states that are already reachable (from other interleavings) then it cannot be simply discarded (i.e. not explored at all). Indeed, this interleaving might be the only witness of inequivalence so discarding it might make us lose completeness w.r.t. trace equivalence.

Second, in order to improve existing verification tools for security protocols, one has to design POR techniques that integrate nicely with symbolic execution. In particular, we shall seek for reductions that are effective when messages remain unknown, but leverage information about messages when it is inferred by the constraint solver. This is necessary to precisely deal with infinite, structured data. In this task, we get some inspiration from Mödersheim et al. [START_REF] Mödersheim | Constraint differentiation: Search-space reduction for the constraint-based analysis of security protocols[END_REF], who design a partial order reduction technique that blends well with symbolic execution in the context of security protocols verification. However, we shall see that their key insight is not fully exploited, and yields only a quite limited partial order reduction. Moreover, they only consider reachability properties (like all previous work on POR for security protocol verification) while we seek an approach that is adequate for model-checking equivalence properties.

Contributions. We develop POR techniques for trace equivalence checking for a rich class of processes. We achieve this by refining interleaving semantics in two steps leveraging two techniques, eliminating more and more redundant interleavings and traces.

The first refinement, called compression, aims at discarding redundant interleavings that can be detected only by looking at the nature of actions. For instance, one may remark that when an output and an input are both available, performing the output first and then the input is sufficient for being able to explore all reachable states. Intuitively, we do not lose states by performing the output in priority since it boils down to give outputted messages to the attacker as soon as they are available. This idea (quite trivial for the reachability case) only relies on the nature of available actions in order to constrain the way the semantics is explored. In other words, it imposes a syntactically-based strategy of exploration. Our compression technique is based on several other ideas of this kind (e.g. inputs must be executed in a row, focus on replicated processes) yielding an highly constrained strategy of exploration. It does not rely on data analysis at all and can easily be used as a replacement for the usual semantics in verification algorithms.

The second refinement, called reduction, builds upon compression by taking data into account and achieves optimality in eliminating redundant traces. Intuitively, this technique discards traces when the underlying choices of recipes allow one to reorganise the trace into another trace leading to the same state and following an interleaving that has been already explored. We define a predicate that operationally detects when a trace can be reorganised as above and shall be discarded for this reason.

For each of our optimised semantics, we prove that the induced, optimised trace equivalence coincides with the regular trace equivalence for a rich class of processes called action-deterministic. Essentially, this class enforces that two processes in parallel must always use distinct channels. This common assumption in POR techniques [START_REF] Baier | Principles of Model Checking (Representation and Mind Series[END_REF] is also reasonable in the context of security protocols, where the attacker knows with whom he is communicating. We also show that reachability properties are preserved by our POR techniques without assumption on processes.

On the practical side, we show how to integrate our reductions into a symbolic framework consisting of a symbolic semantics and a constraint solving procedure. We also explain how we integrated our partial order reduction into the state-of-the art tool Apte [START_REF] Cheval | Trace equivalence decision: Negative tests and non-determinism[END_REF], prove the correctness of this integration, and provide experimental results showing that our theoretical results do translate to dramatic improvements.

We stress that our presentation is generic enough to be easily adapted for other tools provided that they are based on a forward symbolic exploration of traces combined with a constraint solving procedure. This is supported by our preliminary implementation of our techniques in Spec and the independent implementation of our compression technique in Akiss (see Section 6.5).

Organisation of this part. In Chapter 5, we focus on the theoretical aspects of our POR techniques. We define the compressed and the reduced semantics, which refine the regular semantics. We do so for a rich class of processes notably featuring replication, parallel composition and conditionals with else branches. For all of our optimised semantics, we first show that they preserve reachable states and then prove that, for action-deterministic processes, they induce the same trace equivalence.

In Chapter 6, we explain how to put those optimised semantics into practice by adapting them for the symbolic framework. We define symbolic variants of our compressed and reduced semantics for the class of simple processes, which is roughly a sub-class of action-deterministic

-→c - → c -→ -→ r = ⇒ -→r -→ A c -→a -→ A r Regular Compression Reduction Regular Symbolic Apte ≈=≈ c Theorem 2 ≈=≈ r Theorem 3 [Bau05]/Prop. 16 ≈=≈ s Theorem 4 ≈ c =≈ s c Theorem 5 ≈ r =≈ s r [CCD13a]/Prop. 22 ≈ s =≈ A Theorem 6 ≈ s c =≈ A c Theorem 7 ≈ s r =≈ A r
Chapter 5 -for action-deterministic processes Chapter 6 -for simple processes

Introduction

processes based on a simple syntactical criterion. We also define the semantics that the tool Apte is exploring and show how to adapt this tool to implement our reductions. Finally, we prove the soundness of this implementation and discuss conclusive benchmarks.

An overview of the different semantics we define in chapters 5 and 6 and the results relating them is depicted in Figure 4.1.

Finally, we conduct a comprehensive analysis of related works in Chapter 7.

Chapter 5

A Reduced Semantics: Theory

In this chapter, we define our POR techniques by iteratively refining the regular semantics. In Section 5.1, we first define the instantiation of the model we shall work with and the class of processes we will deal with in this chapter. We notably define the action-deterministic class. We give in Section 5.2 an annotated semantics that will facilitate the next technical developments.

We then define our compressed semantics in Section 5.3 and our reduced semantics in Section 5.4. In both sections, we first restrict the transition system, then show that the restriction is adequate for checking trace equivalence under the action-determinism condition. Our main result is given in Section 5.5 with some concluding remarks.

Instantiation of the Model and Class of Processes

The POR techniques we develop in this chapter are defined in a rather generic setting. We present in this section the instantiation of the semantics we shall work with and the class of configurations we deal with. Term Algebra. We consider an arbitrary term algebra made of an arbitrary signature Σ, equational theory = E and computation relation ⇓ as defined in Chapter 2, Section 2.1. Definition 11 in Chapter 4). Remind that this internal reduction evaluates conditionals (R test ) and removes blocked outputs (R out ) greedily. We consider a !-lazy and ν-greedy semantics based on this internal reduction (see definitions 12 and 13 in Chapter 4). The semantics thus executes creation of names actions as soon as possible and unfolds replications only if the unfolded process is then immediately executed. As already argued (see Proposition 6 in Chapter 4), this is not a restriction on the semantics or the threat model but a technical tool that facilitates the development.

Semantics. We shall consider the internal reduction

R induced by the relation R = R test ∪ R out (see

Par

({Π S} ⊎ P; Φ) τ Π -→ (P ⊎ S; Φ)

In ({in(c, x).P } ⊎ P; Φ) in(c, R) ----→ ({P {x → u}} ⊎ P; Φ) where R is a recipe such that RΦ ⇓ u Out ({out(c, t).P } ⊎ P; Φ) out(c, w) -----→ ({P } ⊎ P; Φ ⊎ {w → u})
where w is a fresh variable and t ⇓ u

Repl ({! a c,n P } ⊎ P; Φ) sess(a, c) -----→ ({P ; ! a c,n P } ⊎ P; Φ) c, n fresh Class of Processes. In this chapter, for parts of our results, we eventually impose an actiondeterminism condition which essentially requires that processes we are dealing with have always at most one way to execute a given observable action. This is a priori incompatible with replication (i.e. construct !) since it introduces an unbounded number of equal processes in parallel ready to execute the same action (on the same channel). However, action-determinism would not forbid a constrained form of replication where different sessions coming from the same replication use different public channels. For this reason, we introduce a new construct as syntactic sugar combining replication with channel and name restriction.

Notation 1. For a process P , a non-empty sequence of channels c and sequence of names n, we note ! a c,n P the process !νc out ch (a, c).νn.P . We also note sess(a, c) the sequence of actions τ ! .outch(a, c).τ ν that such a process may produce.

Intuitively, such a process always advertises on the public channel a any new copy of the replicated process. At the same time, it makes public the new channels c on which the copy may operate -but not the new names n. Moreover, we do not consider recursive processes in this chapter. There are fundamental reasons for that which will be made explicit in Section 5.5. Since our class forbids recursion and only considers the above constrained form of replication which bundles the generation of new (private) names as part of the construct, we can, without loss of expressiveness, forbid creation of names in other places. Indeed, we can always anticipate the generation of these names and pull them until reaching a replication or the top of the process (in that case, those names can be transformed into private constants).

Hypothesis 1 (Class of Processes). In this chapter, we only consider the class of processes without recursion, creation of names, creation of channels and replication except ones in constructs

! a c,n P .
Remind that we consider in this chapter the variation of the semantics executing replication lazily and creation of names greedily. We thus only consider executions where processes of the form ! a c,n P def = !νc out ch (a, c).νn.P are fully executed up to P , always producing at once a sequence of actions of the form τ ! .outch(a, c).τ ν (noted sess(a, c)). Hence, we are allowed to consider the new rule Repl defined in Figure 5.1, which can be seen as the concatenation of the original rules Repl,Out ch ,New, as a replacement of the original rule for replication. Finally, the only remaining 5.2. Annotated Semantics needed rules are Par, In and Out since configurations in normal form from the considered class do not feature conditional, creation of channels, recursion or creation of names. In the end, for the class of processes under consideration, the variation of the semantics we are dealing with in this chapter is depicted in Figure 5.1. We also remark that processes in the above class remain in the class throughout executions.

In order to lift our optimised semantics to trace equivalence, we will require configurations to be action-deterministic. Definition 14. A configuration K is action-deterministic if whenever K tr -→ (P; Φ), and P, Q are two processes in P, we have that P and Q cannot perform an observable action of the same nature (in, out, or sess) on the same channel ( i.e. if both actions are of same nature, their first argument has to differ).

Note that action-deterministic processes remain action-deterministic throughout executions. The problem of deciding whether a configuration is action-deterministic or not is undecidable (it suffices to reduce from one of the numerous existing undecidability results e.g. [START_REF] Mitchell | Undecidability of bounded security protocols[END_REF] for secrecy). However, it is easy to under-approximate this class with syntactical criteria easily checkable. A simple such criterion is given in Section 6.1 (i.e. class of simple processes).

Annotated Semantics

Our goal in this section is to define an intermediate semantics that uses extra annotations on produced actions. We prove that those annotations can be used to transform executions by permuting some actions and are useful to ensure deep symmetries on executions when proving trace equivalence: we will show a strong symmetry lemma stating that the same swaps can be done for trace equivalent action-deterministic processes. Later on, we build our optimised semantics on this intermediate one and use its properties as stepping stones.

Annotations and Semantics

The annotated actions notably feature labels indicating from which concurrent processes and unfoldings of replication they originate.

Definition 15 (Labels). A label (ranges over

ℓ, ℓ ′ ) is an element of (N ∪ C ∪ { }) * .
We shall label actions and processes. Intuitively, a label on a process represents the history of that process and reflects how it has been obtained from an initial process through the execution. We will see that is added to the current label of a process when it performs an input or an output. An integer is used to keep track of the position the current process has among all subprocesses when breaking a parallel composition. Finally, channels are used to refer to a specific unfolding when performing a replication.

A labelled action is written [α] ℓ where α is an action and ℓ is a label. Similarly, a labelled process is written [P ] ℓ . One of the roles of the annotated semantics we define next is to add those labels to produced actions and processes throughout executions.

A Reduced Semantics: Theory

In ({[in(c, x).Q] ℓ } ⊎ P; Φ) [in(c,R)] ℓ -------→ a ({[Q{x → u}] ℓ• } ⊎ P; Φ) where R is a recipe such that RΦ ⇓ u Out ({[out(c, t).Q] ℓ } ⊎ P; Φ) [out(c,w)] ℓ -------→ a ({[Q] ℓ• } ⊎ P; Φ ∪ {w → u})
where w is a fresh variable and t ⇓ u Example 20. We will see that the process P resulting from the execution

Repl ({[! a c,n P ] ℓ } ⊎ P; Φ) [sess(a,c)] ℓ•c --------→ a ({[P ] ℓ•c , [! a c,n P 0 ] ℓ } ⊎ P; Φ) c, n fresh Par ({[ΠS] ℓ } ⊎ P; Φ) [par(σ1;...;σn)] ℓ ----------→ a ({[P 1 ] ℓ•1 , . . . , [P n ] ℓ•n } ⊎ P; Φ) n > 1, S = {P 1 , . . . , P n } # , σ i = sk(P i ) and σ 1 ≤ . . . ≤ σ n Zero ({[0] ℓ } ⊎ P; Φ) [zero] ℓ ----→ a (P; Φ)
([in(a, x).! a (c1,c2),∅ Π{out(c 1 , ok), out(c 2 , ok).P }] ℓ0 ; ∅) tr -→ ({[P ] ℓ , [! a (c1,c2),∅ Π{out(c 1 , ok), out(c 2 , ok).P }] ℓ0• }; Φ)
where tr = in(a, ok).sess(a, (c

1 , c 2 )).τ Π .out(c 1 , w 1 ).out(c 2 , w 2 ) may be given a label ℓ = ℓ 0 • • c 1 • c 2 • 2 • .
When reasoning about trace equivalence between two configurations, it will be crucial to maintain a consistent labelling between configurations along the execution. In order to do so, we define skeletons of observable actions. Definition 16 (Skeletons). Skeletons of observable actions are of the form in c , out c or ! a where a, c ∈ C. Any process in a configuration in normal form that is neither 0 nor a parallel composition induces a skeleton corresponding to its toplevel connective, and we denote it by sk(P ). We consider an (arbitrary) total ordering over those skeletons, denoted < with ≤ being its reflexive closure.

Example 21. For instance, one has sk(in(c, x).0) = in c .

Next, we define in Figure 5.2 the annotated semantics -→ a over configurations whose processes are labelled. In rule Par, note that sk(P i ) is well defined as P i cannot be 0 nor a parallel composition since it would not be a normal form for the internal reduction R otherwise (remind that the internal reduction collapses nested parallel compositions as specified in Section 2.2, Definition 3). Note that the annotated transition system does not restrict the executions of a process but simply annotates them with labels, and replaces τ actions by more descriptive actions (e.g. par(•), zero). Further, remark that Zero is a special case of the parallel composition rule in the regular semantics for null processes (remind that 0 = Π∅) producing a distinguished action zero. We distinguish this special case because the exploration strategies which we eventually define behave differently when executing a null process or a "true" parallel composition. Finally, note that the label produced by the Repl rule is different from the label of the process that is executed. We will see that this is necessary to eventually be able to swap two unfoldings of the same replicated process.

Skeletons are notably used to annotate actions produced when disassembling a parallel composition or unfolding a replication making more explicit, through the produced action, what processes are thus made available. Essentially, the action produced when disassembling Π{P i } 1≤i≤n is par(sk(P 1 ) . . . sk(P n )) making explicit that we break a parallel composition and make all skeletons of P i 's available. Besides, processes P i are ordered in increasing order (according to skeletons and <) in order to make the labelling consistent1 when applied to two different (but equivalent) configurations.

We extend obs(•) to annotated actions as follows: obs([α] ℓ ) = α. We thus make observable the actions zero and par(•) that replaced the unobservable τ -action τ Π . We will show that for action-deterministic configurations, those extra information given to the attacker does not modify the resulting notion of trace equivalence.

Action Dependencies

We now define how to extract dependencies from annotated traces, which will allow us to analyse concurrency in an execution without referring to configurations. We obtain sequential dependencies from labels, in a way that is similar, e.g. to the use of causal relations in CCS [START_REF] Degano | A partial ordering semantics for ccs[END_REF].

We also define recipe dependencies which are a sort of data dependencies reflecting our specific setting, where we consider an arbitrary attacker who may interact with the process, relying on (maybe several) previously outputted messages to derive input messages.

Definition 17 (Sequential Dependency). Two labels ℓ, ℓ ′ are independent if ℓ is not a prefix of ℓ ′ and vice versa. They are dependent otherwise.

Example 22. For instance, ℓ • • c 1 • c 2 • 2 • is dependent with ℓ but is independent with ℓ • • c 1 • c 2 • 1 (were in parallel), ℓ • • c ′ 1 • c ′ 2 • 2 • (come from different unfoldings).
Definition 18 (Dependency). We say that the labelled actions α and β are sequentially dependent when their labels are dependent, and recipe dependent when {α, β}

= {[in(c, M )] ℓ , [out(c ′ , w)] ℓ ′ } with w occurring in M .
They are dependent when they are sequentially or recipe dependent. Otherwise, they are independent.

Our goal with action dependency is to characterise actions that can be swapped; i.e. (i) actions that do not use data of each other and (ii) actions that are performed by processes in parallel or resulting from two unfoldings of the same replicated process. However, (ii) can only be achieved when the initial configuration is well-labelled as defined next (e.g. Remark that any two processes in a well-labelled configuration always produce sequentially independent actions. Obviously, any unlabelled configuration may be well labelled. Further, it is easy to see that well labelling is preserved by -→ a as shown next.

Proposition 7. Well labelling is preserved by -→ a ; i.e. if K is well labelled and K tr -→ a K ′ for some configuration K ′ then K ′ is well labelled.

Proof. By induction on tr, it suffices to prove that well labelling is preserved by the execution of a single action. We reason by case analysis on this action. Consider a Par transition, represented below (where S = {P i } # 1≤i≤n such that σ i = σ(P i ) are well ordered):

({[{ΠS}] ℓ } ⊎ Q; Φ) [par(σ 1 , . . . , σ n )] ℓ ---------→ a ({[P 1 ] ℓ•1 , . . . , [P n ] ℓ•n } ⊎ Q; Φ)
We first check that labels of all pairs of non-replicated processes are independent. This is obviously the case between new labels ℓ • i. Let us now consider a label ℓ ′ from a non-replicated process in Q and show that it is independent from any ℓ • i. For the sake of the contradiction, if ℓ • i is a prefix of ℓ ′ then ℓ is also a prefix of ℓ ′ which contradicts the well labelling of the initial configuration. Similarly, if ℓ ′ is a prefix of ℓ • i then either ℓ ′ = ℓ • i or ℓ ′ is a prefix of ℓ. In both cases, we infer a contradiction. We now verify the second requirement of well labelling. If a process [P i ] ℓ•i is a replicated process, we already have proven above that ℓ • i is independent with the label of any non-replicated process in Q which thus cannot be a prefix of the former.

Next, consider a replicated process [P ] ℓ ′ in Q. We have that no label ℓ • i is a prefix of ℓ ′ . Indeed, since the initial configuration was well labelled and ΠS is a non-replicated process, one has that ℓ is not a prefix of ℓ ′ . Next, consider a Repl transition, represented below:

({[! a c,n P ] ℓ } ⊎ Q; Φ) [sess(a, c)] ℓ•c -------→ a ({[P ] ℓ•c , [! a c,n P ] ℓ } ⊎ Q; Φ)
We first check that labels of all pairs of non-replicated processes are independent. Let us consider a label ℓ ′ from a non-replicated process in Q and show that it is independent from ℓ • c. For the sake of the contradiction, assume that ℓ ′ is a prefix of ℓ • c. Remark that since c are fresh names and ℓ ′ was present in the initial configuration, it holds that ℓ ′ ̸ = ℓ • c implying that ℓ ′ is also a prefix of ℓ. This contradicts the well labelling of the initial configuration since a replicated process labelled ℓ was present. Conversely, if ℓ • c is a prefix of ℓ ′ then ℓ ′ contains the names c which contradicts the freshness condition of c since ℓ ′ was initially present. We now verify the second requirement of well labelling. If the [P ] ℓ•c is itself a replicated process, we already have proven above that ℓ • c is independent with the label of any non-replicated process in Q which 5.2. Annotated Semantics thus cannot be a prefix of the former. Next, consider a replicated process [P ] ℓ ′ in Q. We have that the label ℓ • c cannot be a prefix of ℓ ′ by the freshness condition for c since ℓ ′ was present in the initial configuration.

The cases of all other transitions are similar to the case of a Par transition.

Thus, we shall implicitly assume to be working with well labelled configurations in the rest of the chapter. Under this assumption, we obtain the following fundamental lemma.

Lemma 1 (Permutation Lemma).

Let A be a (well labelled) configuration, α and β be two independent labelled actions. We have

A α.β --→ a A ′ if, and only if, A β.α --→ a A ′ .
Proof. By symmetry it is sufficient to show one implication. Assuming ℓ 1 and ℓ 2 to be independent, we consider a transition labelled α = [α ′ ] ℓ1 followed by one labelled β = [β ′ ] ℓ2 . We distinguish two cases whether α and β are two unfoldings of the same replicated process or not.

(If α ′ = sess(a, c 1 ) and β ′ = sess(a, c 2 ).) The considered execution is thus of the form (for some annotated processes P α , P β ):

A = (Q ⊎ {[! a c,n P ] ℓ }; Φ) [α ′ ] ℓ•c1 ---→ a (Q ⊎ {[! a c,n P ] ℓ , P α }; Φ) [β ′ ] ℓ•c2 ---→ a (Q ⊎ {[! a c,n P ] ℓ , P α , P β }; Φ)
The freshness condition implies that elements of c 1 (resp. n 1 ) do not occur in A and elements of c 2 (resp. n 2 ) do not occur in the configuration in the middle. We thus deduce that c 2 (resp. n 2 )

do not occur in A and executing β from A would not introduce channels from c 1 or names from n 1 . Therefore, one can easily swap the two actions α and β in the execution under scrutiny. (Otherwise.) We now deal with other cases; i.e. α ′ and β ′ are not two unfoldings of the same replicated process. Let us prove that ℓ 2 was already present in A by showing that the process resulting from the action α cannot produce the action [β ′ ] ℓ2 . For the sake of the contradiction, assume the contrary. If α ′ is an input or an output action then we necessarily have that ℓ 2 = ℓ 1 • (the resulting process is non-replicated) or ℓ 2 = ℓ 1 • • c (otherwise). Both cases contradict the independence of ℓ 1 and ℓ 2 . If α ′ is a par(•) action then the same contradiction can be deduced.

If α ′ = zero then no process results from α. Finally, consider the case α ′ = sess(a, c) implying ℓ 1 = ℓ 0 • c. If β is executed by the unfolded process then ℓ 2 = ℓ 1 (when the unfolded process is a non-replicated) or ℓ 2 = ℓ 1 • d (otherwise). Both cases contradict the independence of ℓ 1 and ℓ 2 . Finally, if β ′ is executed by the replicated process that performed the action α then β ′ = sess(a, d) which contradicts our hypothesis. Therefore, ℓ 2 must be present in the original configuration and our execution is of the following form, where we write P α (resp. P β ) instead of

[P α ] ℓ1 (resp. [P β ] ℓ2 ): A = (Q ⊎ {P α , P β }; Φ) [α ′ ] ℓ1 ---→ a (Q ⊎ Q α ⊎ {P β }; Φ α ) [β ′ ] ℓ2 ---→ a (Q ⊎ Q α ⊎ Q β ; Φ β )
It remains to check that β can be performed by P β in the original configuration, and that doing so would not prevent the α transition to happen next. The only thing that could prevent β from being performed is that the frames Φ and Φ α may be different, in the case where α is an input. In that case, the recipe independence hypothesis guarantees that β does not rely on the new handle introduced by α and can thus be played with only Φ. Finally, performing α after β 5. A Reduced Semantics: Theory is easy. We also perform corresponding internal reductions that were applied after β and α on the corresponding resulting processes. We only detail the case where β ′ = out(c, w) and α ′ is an input of recipe M . In that case we have Φ α = Φ, Φ β = Φ α ⊎{w → m}, and M ∈ T (Σ pub , dom(Φ)).

We observe that M ∈ T (Σ pub , dom(Φ β )) and we construct the execution:

A = (Q ⊎ {[P α ] ℓ1 , [P β ] ℓ2 }; Φ) [β ′ ] ℓ2 ---→ a (Q ⊎ Q β ⊎ {[P α ] ℓ1 }; Φ β ) [α ′ ] ℓ1 ---→ a (Q ⊎ Q β ⊎ Q α ; Φ β ).

Symmetries of Trace Equivalence

We will see that, when checking A ≈ B for action-deterministic configurations, it is sound to require that B can perform all traces of A in the annotated semantics (and the converse). In other words, labels and detailed unobservable actions zero and par(σ 1 . . . σ n ) can be made observable by the attacker without impacting trace equivalence. Obviously, this can only hold if A and B are (initially) labelled consistently. In order to express this, we extend sk(P ) to parallel and zero processes: we let their skeletons be the associated action in the annotated semantics. Next, we

tr = [in(a, ok)] 0 .[par({out b ; in d })] 0• .[out(b, w)] 0• •1 .[in(c, w)] 0• •1• .[in(d, w)] 0• •2
Assuming out b < in c < in d and ok ∈ Σ, we have A tr -→ a A ′ for some A ′ . However, there is no B ′ such that B tr -→ a B ′ , for two reasons. First, B cannot perform the second action since skeletons of sub-processes of its parallel composition are {out b ; in c }. Second, even if we ignored that mismatch on an unobservable action, B would not be able to perform the action in(c, w) with the right label. Such mismatches can actually be systematically used to show A ̸ ≈ B, as shown next.

Lemma 2 (Strong Symmetry). Let A and B be two action-deterministic configurations such that A ≈ B and skl(A) = skl(B). For any execution

A [α1] ℓ 1 ----→ a A 1 [α2] ℓ 2 ----→ a . . . [αn] ℓn ----→ a A n with bc(α 1 . . . . α n ) ∩ fc(B) = ∅, there exists an execution B [α1] ℓ 1 ----→ a B 1 [α2] ℓ 2 ----→ a . . . [αn] ℓn ----→ a B n such that Φ(A i ) ∼ Φ(B i ) and skl(A i ) = skl(B i ) for any 1 ≤ i ≤ n.
Before proving the previous fundamental lemma (see Subsection 5.2.4), we show that the induced trace equivalence coincides with the regular trace equivalence as stated below.

Definition 20. Let A and B be two configurations. We have that A ⊑ a B if, for every A ′ such that A tr -→ a A ′ with bc(tr)∩fc(B) = ∅, then there exists B ′ such that B tr -→ a B ′ , and

Φ(A ′ ) ∼ Φ(B ′ ). They are in annotated trace equivalence, denoted A ≈ a B, if A ⊑ a B and B ⊑ a A.
In contrast to the regular semantics, the annotated semantics requires that both A and B are able to execute the same traces including unobservable actions and annotations. Theorem 1. Let A and B be two action-deterministic configurations such that skl(A) = skl(B), it holds that:

A ≈ B if, and only if, A ≈ a B.
Proof. The direction ⇐ is trivial since any annotated execution is also a regular execution. The direction ⇒ is a direct corollary of Lemma 2.

Proof of the Strong Symmetry Lemma

This section is dedicated to the proof of Lemma 2.

First, we define a notion describing the set of all possible types of actions (i.e. skeletons) a process may exhibit maybe after some unobservable actions.

Definition 21. Given a process P , we define the set of its enabled skeletons as

enable(P ) =    {sk(P )}
if P starts with an observable action ∪ P ∈S {sk(P )} otherwise and P is thus of the form P = ΠS

In particular, note that one has enable(0) = enable(Π∅) = ∅. We may consider skeletons, labelled skeletons and enabled skeletons of a configuration by taking the multiset of the corresponding objects of all its processes.

Next, we make two trivial remarks formalised below.

Proposition 8. For any configurations A, A ′ and unobservable action α

, if A α -→ a A ′ or A τ Π -→ A ′ then enable(A) = enable(A ′ ).

Proposition 9.

Let A be an action-deterministic configuration and P , Q two of its processes.

We have that enable(P ) ∩ enable(Q) = ∅.

Further, we prove a key proposition essentially showing that an action-deterministic configuration may have different executions yielding the same sequence of observable actions but they all intuitively represent the same execution if one forgets about the precise structure of parallel compositions (captured by enable(•)).

A Reduced Semantics: Theory

Proposition 10. Let A be an action-deterministic configuration. If A tr 1

-→ A 1 and A tr 2 -→ A 2 for some traces tr 1 , tr 2 such that obs(tr 1 ) = obs(tr 2 ) then enable(A 1 ) = enable(A 2 ) and Φ(A 1 ) = Φ(A 2 ).

Proof. We first prove a stronger result when the configurations A 1 and A 2 are canonical, i.e. only contain processes that are neither 0 nor a parallel composition. Actually, in such a case, we

prove that A 1 = A 2 .
To prove this intermediate result, we proceed by induction on obs(tr 1 ). The base case is trivial. Let us show the inductive case. We assume that tr 1 = tr 0 1 .α.tr - 1 with α an observable action and tr - 1 containing only unobservable actions. Since obs(tr 1 ) = obs(tr 2 ), we have that tr 2 = tr 0 2 .α.tr - 2 with tr - 2 containing only unobservable actions and obs(tr 0 1 ) = obs(tr 0 2 ). Our given executions are thus of the form:

A tr 0 1 -→ A 0 1 α.tr - 1 ---→ A 1 and A tr 0 2 -→ A 0 2 α.tr - 2 ---→ A 2
It may be the case that A 0 1 or A 0 2 are not canonical. The idea is to reorder some unobservable actions. More precisely, we perform all available unobservable actions of A 0 1 and A 0 2 before performing α. By doing this, we do not change the observable actions of the different sub-traces and obtain

A tr 0 1 .tr - 3 ---→ A ′0 1 α.tr ′- 1 ---→ A 1 and A tr 0 2 .tr - 4 ---→ A ′0 2 α.tr ′- 2 ---→ A 2 with A ′0
1 and A ′0 2 canonical. By inductive hypothesis, we have that A ′0 1 = A ′0 2 . We now must show A 1 = A 2 . By action-determinism of A, there is only one process P that can perform α in

A ′0 1 (= A ′0 2 )
. The resulting process P ′ after performing α is thus the same in the two executions. Since A 1 and A 2 are canonical and tr ′- 1 and tr ′- 2 contain only unobservable actions,

A 1 = A 2 .
In order to be able to apply our previous result, we complete the executions with all available unobservable actions:

A tr 1 -→ A 1 tr - 1 --→ A ′ 1 and A tr 2 -→ A 2 tr - 1 --→ A ′ 2
such that A 1 and A 2 are canonical and tr - 1 and tr - 2 contain only unobservable actions. We also have that:

• Φ(A 1 ) = Φ(A ′ 1 )
and enable(A 1 ) = enable(A ′ 1 ); and

• Φ(A 2 ) = Φ(A ′ 2 ) and enable(A 2 ) = enable(A ′ 2 ).
We now conclude thanks to our previous result, and obtain A ′ 1 = A ′ 2 implying the desired equalities.

The following proposition essentially lifts the previous one to the equivalence case.

Proposition 11. Let A and B be two action-deterministic configurations such that A ≈ B.

If A tr A --→ A ′ and B tr B --→ B ′ with obs(tr A ) = obs(tr B ) then Φ(A ′ ) ∼ Φ(B ′ ) and enable(A ′ ) = enable(B ′ ).

Annotated Semantics

Proof. By hypothesis, we know that A ≈ B, and also that A tr A --→ A ′ . Moreover, the freshness conditions on channels (i.e. bc(tr A ) ∩ fc(B) = ∅) holds as B is able to perform tr B , and tr A and tr B share the same bound channels. Hence, we know that there exist tr ′ B and B ′′ such that

B tr ′ B --→ B ′′ , obs(tr A ) = obs(tr ′ B ), and Φ(A ′ ) ∼ Φ(B ′′ ).
Now, since B is an action-deterministic configuration, applying Proposition 10 on tr B and tr ′ B , we obtain that enable(B ′ ) = enable(B ′′ ) and Φ(B ′ ) = Φ(B ′′ ). This allows us to conclude that

Φ(A ′ ) ∼ Φ(B ′ ).
It remains to show that enable(A ′ ) = enable(B ′ ). By symmetry, we only show one inclusion. Let α s ∈ enable(A ′ ), we shall show that α s ∈ enable(B ′ ). We deduce from α s ∈ enable(A ′ ) that there is a trace tr ′ that is either α or τ.α (where α is an observable action whose the skeleton is

α s ) such that A tr A --→ A ′ tr ′ -→ A 0
for some A 0 . Since A ≈ B, we know that there exist tr ′ 0 , tr ′ , B ′ 0 , and B ′ such that

B tr ′ 0 -→ B ′ 0 tr ′ -→ B 0 with Φ(A 0 ) ∼ Φ(B 0
) and obs(tr A ) = obs(tr ′ 0 ) and obs(tr ′ ) = α. We have that the skeleton of α (that is α s ) is in enable(B ′′ 0 ) where B ′′ 0 is the configuration producing α in the latter execution. Since B ′′ 0 can be reached from B ′ 0 by executing τ actions, Proposition 8 implies α s ∈ enable(B ′ 0 ). Now, since B is an action-deterministic configuration, applying Proposition 10 on tr B and tr ′ 0 we obtain enable(B ′ ) = enable(B ′ 0 ), and thus α s ∈ enable(B ′ ).

The last ingredient which is essential to the Strong Symmetry Lemma (i.e. Lemma 2) allows to lift information about enable(•) to information about sk(•).

Proposition 12. Let A, B be two action-deterministic configurations and

P (resp. Q) a process of A (resp. B). If enable(P ) = enable(Q) then sk(P ) = sk(Q).
Proof. Let us show that sk(P ) = sk(Q). If enable(P ) is an empty set then P = 0 and thus from enable(Q) = ∅ we deduce that Q = 0 as well implying the required equality on skeletons. If enable(P ) is a singleton then it must be {sk(P )} -we cannot be in the case where P is a parallel composition, since, in that case there would be at least two skeletons in enable(P ) by actiondeterminism of A (and the fact a process Π{P 0 } # is reduced to P 0 ). The same goes with Q thus we have {sk(P )} = {sk(Q)}. Finally, if enable(P ) contains at least two skeletons then it must be the case that P is a parallel composition of the form ΠS, S ̸ = ∅ and enable(P

) = ∪ P ′ ∈S {sk(P ′ )}. Simi- larly, Q must be of the form ΠS Q and enable(Q) = ∪ Q ′ ∈SQ {sk(Q ′ )}. Moroever, |enable(Q)| = |S Q | and |enable(P )| = |S|.
Here, we make use of action-determinism to obtain that the number of subprocesses in parallel is the same as the cardinality of the sets of skeletons, and thus the same for P and Q: indeed, no two parallel subprocesses can have the same skeleton. Hence ⊎ Q ′ ∈S Q {sk(Q ′ )} = ⊎ P ′ ∈S {sk(P ′ )} (as multisets). We conclude that sk(P ) = par(S) where S is the ordered sequence of skeletons from ⊎ P ′ ∈S {sk(P ′ )} (which are totally ordered by 5. A Reduced Semantics: Theory action-determinacy), and sk(Q) = par(S) where S is the ordered sequence of skeletons from

⊎ Q ′ ∈S Q {sk(Q ′ )} = ⊎ P ′ ∈S {sk(P ′ )}.
Before proving Lemma 2, we state in the following corollary that requiring that initial configurations have same sets of labelled skeletons is not restrictive. Indeed, it suffices to pre-execute non-observable actions τ Π of the initial configurations. If the resulting configurations do not have the same set of skeletons then the following corollary allows to conclude that the configurations are not trace equivalent. Otherwise, it suffices to label them arbitrarily but consistently yielding configurations satisfying all necessary conditions for our developments (notably skl(A) = skl(B)).

Corollary 1. Let A, B be two action-deterministic configurations such that A ≈ B and any process in

A or B is not a parallel composition. It holds that sk(A) = sk(B).
Proof. Applying Proposition 10 for tr 1 = tr 2 = ϵ, we obtain enable(A) = enable(B). Since no process in A and B is a parallel composition, one has that enable(A) = ⊎ P ∈A enable(P ) and each enable(P ) is a singleton (similarly for B). We thus deduce from Proposition 9 a bijection m between processes in A and B such that for any P in A, one has enable(P ) = enable(m(P )). We thus conclude by applying Proposition 12:

sk(A) = ⊎ P ∈A sk(P ) = ⊎ P ∈A sk(m(P )) = ⊎ Q∈B sk(Q) = sk(B).
We now conclude with the proof of Lemma 2.

Proof of Lemma 2. We show this result by induction on the length of the derivation A tr -→ a A n . The case where tr is empty (i.e. no action even a unobservable one) is obvious. Assume that we have proved such a result for all the executions of length n, and we want to establish the result for an execution of length n + 1.

Consider an execution of

[α 1 ] ℓ1 . . . [α n ] ℓn from A to A n , followed by [α n+1 ] ℓn+1 towards A n+1 .
By induction hypothesis, we know that there exists an execution

B [α 1 ] ℓ1 ---→ a B 1 [α 2 ] ℓ2 ---→ a . . . [α n ] ℓn ---→ a B n such that Φ(A n ) ∼ Φ(B n ) and skl(A i ) = skl(B i ) for any 1 ≤ i ≤ n. It remains to establish that there exists B n+1 such that B n can perform [α n+1 ] ℓn+1 towards B n+1 , Φ(A n+1 ) ∼ Φ(B n+1 ) and skl(A n+1 ) = skl(B n+1 ).
We distinguish several cases depending on the action α n+1 .

Case α n+1 = zero. We have that [zero] ℓn+1 ∈ skl(A n ), and thus, since

skl(A n ) = skl(B n ), we have also that [zero] ℓn+1 ∈ sk(B n ). We deduce that A n = ({[0] ℓn+1 } ⊎ P 0 ; Φ 0 ), and B n = ({[0] ℓn+1 } ⊎ Q 0 ; Ψ 0 ) for some P 0 , Q 0 , Φ 0 , and Ψ 0 . Moreover, since skl(A n ) = skl(B n ), we deduce that skl(P 0 ) = skl(Q 0 ). Let B n+1 = (Q 0 ; Ψ 0 ).
We have that:

• B n = ({[0] ℓn+1 } ⊎ Q 0 ; Ψ 0 ) [zero] ℓn+1 -----→ a (Q 0 ; Ψ 0 ) = B n+1 , • Φ(A n+1 ) = Φ(A n ) ∼ Φ(B n ) = Φ(B n+1
), and

• skl(A n+1 ) = skl(P 0 ) = skl(Q 0 ) = skl(B n+1 ). 92

Annotated Semantics

Case α n+1 = par(S) for some sequence S = (β 1 , . . . , β k ). Note that this sequence is ordered according to our order < over skeletons (i.e. β 1 < . . . < β k ) and β i 's are pairwise distinct by action-determinism of A. Since A n is able to produce the action par(S), it must be of the

form A n = ({[Π ⊎ k i=1 {P i }] ℓn+1 } ⊎ P 0 ; Φ 0 )
for some P i , P 0 and Φ 0 such that ∀i, sk(P i ) = β i . It follows that [par(S)] ℓn+1 ∈ skl(A n ), and thus, since skl(A n ) = skl(B n ), we have also that

[par(S)] ℓn+1 ∈ skl(B n ). The latter implies B n = ({[ΠS Q ] ℓn+1 } ⊎ Q 0 ; Ψ 0 ) for some S Q , Q 0 and Ψ 0 such that sk(S Q ) = {β i } i . Further, we have A n+1 = (⊎ k i=1 {[P i ] ℓn+1•i } ⊎ P 0 ; Φ 0 ). Moreover, since skl(A n ) = skl(B n ), we deduce that skl(P 0 ) = skl(Q 0 ), and
{sk(Q j ) | Q j ∈ S Q } # = {sk(P i ) | 1 ≤ i ≤ k} # = {β 1 , . . . , β k }
Remark that, since P i (resp. Q j ) cannot be a zero or a parallel we have that enable

(P i ) = {sk(P i )} (resp. enable(Q i ) = {sk(Q i )}
) and those sets are singletons and |S Q | = k. Moreover, by actiondeterminism of A and B we know that all those singletons are pairwise disjoint. From this, we conclude that there exists a permutation π over

[1; k] such that ∀i, sk(Q π(i) ) = β i = sk(P i ) and thus ∀i, skl([Q π(i) ] ℓn+1•i ) = skl([P i ] ℓn+1•i )
We can finally let B n+1 be

(⊎ k i=1 {[Q π(i) ] ℓn+1•i } ⊎ Q 0 ; Ψ 0 )
and we have:

• B n = ({[Π ⊎ k i=1 Q π(i) ] ℓn+1 } ⊎ Q 0 ; Ψ 0 ) [par(S)] ℓn+1 -------→ a (⊎ k i=1 {[Q π(i) ] ℓn+1•i } ⊎ Q 0 ; Ψ 0 ) = B n+1 , • Φ(A n+1 ) = Φ(A n ) ∼ Φ(B n ) = Φ(B n+1
), and

• skl(A n+1 ) = skl(P 0 ) ⊎ ⊎ k i=1 skl([P i ] ℓn+1•i ) = skl(Q 0 ) ⊎ ⊎ k i=1 skl([Q π(i) ] ℓn+1•i ) = skl(B n+1 ).
Case α n+1 = in(c, M ) for some c, and

M with M ∈ T (Σ pub , dom(Φ(A n )). We have that [in c ] ℓn+1 ∈ skl(A n ), and thus, since skl(A n ) = skl(B n ), we have [in c ] ℓn+1 ∈ skl(B n ). We deduce that A n = ({[in(c, x A ).P ] ℓn+1 } ⊎ P 0 ; Φ 0 ), and B n = ({[in(c, x B ).Q] ℓn+1 } ⊎ Q 0 ; Ψ 0 ) for some x A , x B , P , Q, P 0 , Q 0 , Φ 0 ,
and Ψ 0 . We also deduce that there exists a message u A such that M Φ 0 ⇓ u A . Moreover, since skl(A n ) = skl(B n ), we deduce that skl(P 0 ) = skl(Q 0 ). By inductive hypothesis, we also have that

Φ 0 ∼ Ψ 0 ; hence a message u B such that M Ψ 0 ⇓ u B . Let B n+1 = ([Q{u B /x B }] ℓn+1• ⊎ Q 0 ; Ψ 0 ).
We have that:

• B n [in(c, M )] ℓn+1
--------→ a B n+1 , and

• Φ(A n+1 ) = Φ(A n ) ∼ Φ(B n ) = Φ(B n+1 ). 93

A Reduced Semantics: Theory

It remains to show that skl(A n+1 ) = skl(B n+1 ). Since we have that skl(P 0 ) = skl(Q 0 ), and the label of the new subprocess is the same (namely, ℓ n+1 • ) on both sides, we only need to show that:

sk(P {u A /x A }) = sk(Q{u B /x B })
In order to improve the readability, we will note P ′ = P {u A /x A } and Q ′ = Q{u B /x B }. We have that A and B are two action-deterministic configurations such that A ≈ B. Moreover, they perform the same trace, respectively towards A n+1 and B n+1 . Thus, thanks to Proposition 11, we deduce that enable(A n+1 ) = enable(B n+1 ). Moreover, our hypothesis skl(P 0 ) = skl(Q 0 ) implies that enable(P 0 ) = enable(Q 0 ), and thus we deduce that enable(P ′ ) = enable(Q ′ ) (recall that by action-determinism, unions of the form enable(A n+1 ) = enable(P 0 ) ∪ enable(P ′ ) are actually disjoint unions). We conclude using Proposition 12.

Case α n+1 = out(c, w) for some c and some w with w ̸ ∈ dom(Φ(A n )). This case is similar to the previous one. However, during such a step, the frame of each configuration is enriched, and thus the fact that Φ(A n+1 ) ∼ Φ(B n+1 ) is now a consequence of Proposition 11.

Case α n+1 = sess(a, c) for some a, and some c. Firstly, we show for later that c are fresh in B n . Indeed, we deduce from bc(α 1 . . . . α n+1 ) ∩ fc(B) = ∅ that c are fresh in B and we know that free channels of B n are included in fc(B) ∪ bc(α 1 . . . . α n ). Thereby, if there was a channel c i ∈ c ∩ fc(B n ) it would be in bc(α 1 . . . . α n ) but this is forbidden because of the freshness condition (in the current trace) over channels, i.e. new channels cannot be introduced twice (once in α 1 . . . . α n and once in α n+1 ).

As before, we obtain ℓ n+1 = ℓ • c and

A n = ({[! a c,nP P ] ℓ } ⊎ P 0 ; Φ 0 ) and B n = ({[! a c,nQ Q] ℓ } ⊎ Q 0 ; Ψ 0 )
for some P , Q, P 0 , Q 0 , Φ 0 , and Ψ 0 . Moreover, since skl(A n ) = skl(B n ), we deduce that skl(P 0 ) = skl(Q 0 ).

We have:

A n+1 = ({[P ] ℓn+1 , [! a c,nP P ] ℓ } ⊎ P 0 ; Φ 0 )
Accordingly, let us pose

B n+1 = ({[Q] ℓn+1 , [! a c,nQ Q] ℓ } ⊎ Q 0 ; Ψ 0 ).
We have that:

• B n [sess(a, c)] ℓn+1 --------→ a B n+1 ; and • Φ(A n+1 ) = Φ(A n ) ∼ Φ(B n ) = Φ(B n+1 ).
It remains to show that skl(A n+1 ) = skl(B n+1 ). Since we have that skl(P 0 ) = skl(Q 0 ), and since the labels of corresponding subprocesses are the same on both sides, we only need to show that:

• sk(P ) = sk(Q) and

• sk(! a c,nP P ) = sk(! a c,nQ Q)
As in the previous case, thanks to Proposition 11, we know that enable(A n+1 ) = enable(B n+1 ), and we deduce that enable(P ) = enable(Q) and enable(! a c,nP P ) = enable(! a c,nQ Q), which allows us to conclude using Proposition 12.

Compression

Our first refinement of the semantics, which we call compression, is closely related to focusing from proof theory [And92]: we will assign a polarity to processes and constrain the shape of executed traces based on those polarities. This will provide a first significant reduction of the number of traces to consider when checking reachability-based properties such as secrecy, and more importantly, equivalence-based properties in the action-deterministic case. We illustrate below one of the aspect of the compressed semantics.

Example 24. Consider the process (P; Φ) with P = {in(c 1 , x).P 1 , out(c 2 , b).P 2 }. In order to reach ({P 1 {x → u}, P 2 }; Φ ∪ {w → b}), we have to execute the action in(c 1 , x) (using a recipe M that allows one to deduce u) and the action out(c 2 , b) (giving us a label of the form out(c 2 , w)).

In case of reachability properties, the execution order of these actions only matters if M uses w.

Thus we can safely perform the outputs in priority. It turns out that, when one has such choices, executing outputs in priority is always a complete strategy; i.e. all reachable states are actually explored.

The situation is more complex when considering trace equivalence. In that case, we are concerned not only with reachable states, but also with how those states are reached. Quite simply, traces matter. Thus, if we want to discard the trace in(c 1 , M ).out(c 2 , w) when studying processes P and consider only its permutation out(c 2 , w).in(c 1 , M ), we have to make sure that the same permutation is available on the other process. The key to ensure that identical permutations will be available on both sides of the equivalence is the action-deterministic assumption and the Strong Symmetry Lemma ( i.e. Lemma 2).

Compressed Strategy

The semantics we shall define is based on syntactical criteria over processes and configurations as formalised next.

Definition 22 (Polarity assignment). A process P is positive if it is of the form in(c, x).Q, and is negative otherwise. A multiset of processes P is initial if it contains only positive or replicated processes ( i.e. of the form ! a c,n Q).

The compressed semantics (see Figure 5.3) is built upon the annotated semantics. It constrains the traces to follow a particular strategy, alternating between negative and positive phases.

It uses enriched configurations of the form (P; F ; Φ) where (P; Φ) is a labelled configuration and F is either a process (signalling which process is under focus in the positive phase) or ∅ (in the negative phase). The negative phase lasts until the configuration is initial (i.e. unfocused with an initial underlying multiset of processes) and in that phase we perform actions that decompose ------→ c (P; P ′ ; Φ)

Neg (P ; Φ) α -→ a (P ′ ; Φ ′ ) (P ⊎ {P }; ∅; Φ) α --→ c (P ⊎ P ′ ; ∅; Φ ′ ) α ∈ {par(•), zero, out(•, •)} Release (P; [P ] ℓ ; Φ) [rel] ℓ ----→ c (P ⊎ {[P ] ℓ }; ∅; Φ) when P ̸ = 0 is negative Release ⊥ (P; [0] ℓ ; Φ) [rel] ℓ .[zero] ℓ ---------→ c (∅; ∅; Φ)
Labels are implicitly set in the same way as in the annotated semantics. Neg is made nonbranching by imposing an arbitrary order on labelled skeletons of available actions. 2) and we go back to the negative phase. The active process in the positive phase is said to be under focus.

Between any two initial configurations, the compressed semantics executes a sequence of actions, called blocks, of the form foc(α).tr + .rel.tr -where tr + is a (possibly empty) sequence of input actions, whereas tr -is a non empty sequence of out, par, and zero actions. Note that, except for choosing recipes, the compressed semantics is completely non-branching when executing a block. It may branch only when choosing which block is performed.

Example 25. Consider the process P = ! a c,k in(c, x).out(c, senc(x, k)).0. We have that (omitting labels and assuming the existence of a message u i such that M i Φ ⇓ u i ):

({P }; ∅; Φ) foc(sess(a, c i )) ---------→ c ({P }; {in(c i , x).out(c i , senc(x, k i )).0}; Φ) in(c i , M i ).rel --------→ c ({P, out(c i , senc(u i , k i )).0}; ∅; Φ) out(c i , w i ).zero ---------→ c ({P }; ∅; Φ ′ ).
Once a replication is performed, the resulting process is under focus and must be executed in priority until the end. Note that, after executing the input, the resulting process is negative and, thus, still has priority. Thus, on this example, the compressed semantics only explores executions that are made of blocks of the form sess(a, c i ).in(c i , M i ).out(c i , w i ) and discards all other interleavings ( e.g. the one that unfolds two sessions, executes the two available inputs and then executes the two available outputs).

Remark 4. It is clear why disassembling parallel compositions and erasing zeros take part to the semantics instead of the internal reduction. Indeed, if one had chosen to add R par to the relation on which the internal reduction is based then the induced internal reduction R would always break parallel compositions at top level. Consequently, the semantics would never have access to the parallel composition structure because it only handles configurations in normal form. However, it is now clear that the compressed semantics needs to have access to the configuration's structure details. For example, this is needed to decide to stop the current focus because new processes in parallel have just been made available.

Improper Blocks and Release ⊥ Rule

Note that blocks of the form foc(α).tr + .rel.zero that we call improper blocks do not bring any new information to the attacker. One could argue that it is then useless to explore such blocks. However, when checking trace equivalence, how to make sure then that both configurations can exhibit exactly the same kinds of improper blocks? Moreover, how can one predict, when choosing a focus, that the initiated block will be improper2 in order to not explore it ?

While it would be incorrect to fully ignore such improper blocks, it is in fact sufficient to only consider them at the end of traces. This is implemented by the rule Release ⊥ : if the current block is released improperly (i.e. the produced block is improper) then the semantics stops exploring (i.e. the multiset of processes is set to ∅). We give intuitions explaining why this does not break completeness (w.r.t. trace equivalence) in the next example. We call proper the blocks that are not improper and proper trace a trace made of proper blocks.

Example 26. Consider P = {in(c, x).in(c, y), in(c ′ , x ′ )}. Its compressed traces are of the form foc(in(c, M )).in(c, N ).rel.zero and foc(in(c ′ , M ′ )).rel.zero. The concatenation of those two improper traces cannot be executed in the compressed semantics. Intuitively, we do not lose anything for trace equivalence, because if a process can exhibit those two improper blocks they must be in parallel (by action-determinacy) and hence considering their combination is redundant.

Finally, in order to ease the presentation and the structure of future proofs, we introduce a variant of the compressed semantics which does not make any distinction between proper and improper blocks. To that end, we define the semi-compressed semantics (noted • -→ sc ) similarly to the compressed semantics based on the rules from Figure 5.3 except Release and Release ⊥ that are replaced by the single following rule:

Release s (P; [P ] ℓ ; Φ) [rel] ℓ ----→ sc (P ⊎ {[P ] ℓ }; ∅; Φ) when P is negative
Remark 5 (Relation with Focusing). The reader familiar with focused proof systems will have recognised the strong similarities: the phases of the compressed semantics are the same as those of focused proof systems, and more deeply, the choice of polarities for each process construction can actually be derived from encoding our process algebra into linear logic in such a way that 5. A Reduced Semantics: Theory proof search corresponds to executions.While this encoding provides an intuitive guide, it would not be obvious to obtain directly our results from the completeness of focusing in linear logic -for instance, internal reduction would not naturally fit in. We give below (Lemma 4) a direct proof of completeness ( i.e. all reachable states are explored by the compressed strategy) using the idea of the positive trunk argument of [START_REF] Miller | From proofs to focused proofs: A modular proof of focalization in linear logic[END_REF]. Besides being self-contained, this has the advantage of setting the stage for the next section, where we go beyond what focusing actually allows, but still exploit the positive trunk argument to carry out our analysis. In Section 7.3, we discuss at greater length related work in proof theory.

Reachability

We now formalise the relationship between traces of the compressed and annotated semantics.

In order to do so, we translate between configurations and enriched configurations as follows:

⌈(P; Φ)⌉ = (P; ∅; Φ), ⌊(P; ∅; Φ)⌋ = (P; Φ) and ⌊(P; P ; Φ)⌋ = (P ⊎ {P }; Φ).

Similarly, we map compressed traces to annotated ones: ⌊ϵ⌋ = ϵ, ⌊foc(α).tr⌋ = α.⌊tr⌋, ⌊rel.tr⌋ = ⌊tr⌋, and ⌊α.tr⌋ = α.⌊tr⌋ otherwise.

We observe that we can map any execution in the compressed semantics to an execution in the annotated semantics. Indeed, a compressed execution that does not use Release ⊥ is simply an annotated execution with some extra annotations (i.e. foc and rel) indicating positive/negative phase changes. Moreover, even with possibly a rule Release ⊥ at the end, we obtain same reachable frames with -→ a .

Lemma 3. Let A, B be configurations and tr c be a trace such that

A tr c -→ c B. If tr c is proper then ⌊A⌋ ⌊trc⌋ ---→ a ⌊B⌋. Otherwise, there exists a configuration B ′ such that ⌊A⌋ ⌊trc⌋ ---→ a B ′ with Φ(B ′ ) = Φ(B).
Going in the opposite direction is more involved. In general, mapping annotated executions to compressed ones requires to reorder actions. Compressed executions also force negative actions to be performed unconditionally and blocks to be fully executed. One way to handle this is to consider complete executions of a configuration, i.e. executions after which no more action can be performed except possibly the ones that consist in unfolding a replication (i.e. rule Repl).

Last but not least, compressed executions stop exploring when reaching an improper block while annotated semantics is able to continue. We first prove a completeness result for the semi-compressed semantics -→ sc for which all complete, annotated, executions can be mapped to one compressed execution after permutations of independent actions. Second, we extend the first completeness result for the full compressed semantics. However, instead of mapping an annotated execution to a compressed execution, we only map an annotated execution to (possibly many) compressed executions each exploring a different improper block at the end.

Inspired by the positive trunk argument of [START_REF] Miller | From proofs to focused proofs: A modular proof of focalization in linear logic[END_REF], we show the first completeness lemma.

Compression

Lemma 4. Let A, A ′ be two configurations, tr a trace and A tr -→ a A ′ a complete, annotated execution. There exists a trace tr c , such that ⌊tr c ⌋ can be obtained from tr by swapping independent labelled actions, and ⌈A⌉ tr c -→ sc ⌈A ′ ⌉.

Proof. Let A = (P; Φ) be a configuration and (P; Φ) tr -→ a A ′ a complete execution. We proceed by induction on the length of tr, distinguishing two cases.

Case 1. We first consider the case where there is at least one process in P that is negative and non-replicated. Since we are considering a complete execution, at least one negative action α is performed on this process in tr. This action may be an output, the decomposition of a parallel composition, or the removal of a zero. If there are more than one such action, we choose the one that can be performed using Neg, i.e. the one that is minimal according to our arbitrary order on labelled skeletons. Since our action can be performed initially by our process, and by welllabelling, the label of the action is independent with all labels of previously executed actions in tr. Moreover, there cannot be any second-order dependency between α and one of those actions. Indeed, if α is an output, no input performed before α is able to use the handle of α. It can thus be swapped before all the others by using Lemma 1, obtaining an execution of trace α.tr ′ ending in the same configuration A ′ . The rule Neg can be performed in the compressed semantics to trigger the action α, and by induction hypothesis on tr ′ we can complete our compressed execution towards A ′ . Case 2. Otherwise, when P contains only positive or replicated processes, we must choose one process to focus on, start a positive phase and execute all its actions until we can finally release the focus. As long as all processes are positive or replicated, only input or session actions can be performed. In either case, the action yields a new process (the continuation of the input, or the new session) which may be negative or positive. We define the positive prefix of our execution as the prefix of actions for which all but the last transition yield a positive process. It is guaranteed to exist because A ′ contains only negative processes.

The positive prefix is composed only of input and replication actions. Because session actions are performed by negative processes, and no new negative process is created in the positive prefix, session actions can be permuted at the beginning of the prefix thanks to Lemma 1. Thus, we assume without loss of generality that the prefix is composed of session actions, followed by input actions: we write tr = tr ! .tr in .tr 0 . Note that actions in tr ! are pairwise independent since they correspond to unfoldings of replicated processes that were initially present in P. In the portion of the execution where inputs of tr in are performed, there is an obvious bijective mapping between the processes of any configuration and its successor, allowing us to follow execution threads, and to freely permute inputs pertaining to different threads. Such permutations are made possible by Lemma 1. Indeed, they concern actions that are (i) sequentially independent (i.e. labels are independent) since two different threads involve actions performed by processes in parallel and (ii) recipe independent since there is no output action in tr in .

The last action of the positive prefix releases a negative process P -. Let P be its antecedent (through its corresponding thread) in the configuration obtained after the execution of tr ! . We

A Reduced Semantics: Theory

have that: A = (P; Φ) tr ! -→ a (P 1 ⊎ {P }; Φ) tr in --→ a (P 2 ⊎ {P -}; Φ) tr 0 -→ a A ′
Now we can write P = P 0 ⊎ {P f } where P f is either P or a replicated process that gives rise to P in one transition. By permuting actions pertaining to P f before all others thanks to Lemma 1 and previous remarks, we obtain an execution of the form

A = (P 0 ⊎ {P f }; Φ) tr 1 -→ a (P ′ 0 ⊎ {P -}; Φ) tr 2 -→ a (P 2 ⊎ {P -}; Φ) tr 0 -→ a A ′
where tr 1 .tr 2 .tr 0 can be obtained from tr by swapping independent labelled actions, tr 1 = [α] ℓ .tr ′ 1 , and P ′ 0 = P 0 when P f = P , and P ′ 0 = P 0 ⊎ {P f } otherwise. In the compressed semantics, if we initiate a focus on P f , we can execute the actions of tr 1 and release the focus when reaching P -(using the rule Release s ), i.e. we have that:

(P; ∅; Φ) [foc(α)] ℓ -----→ sc tr ′ 1 -→ sc (P ′ 0 ; P -; Φ) [rel] ℓ ′ ---→ sc (P ′ 0 ⊎ {P -}; ∅; Φ)
where ℓ ′ is the label of P -. We can conclude by induction hypothesis on tr 2 .tr 0 .

Next, we show the second completeness result covering the full compressed semantics. We say that two blocks b 1 and b 2 are independent when the actions from one and the other are independent.

Lemma 5. Let A, A ′ be two configurations, tr be a trace and A tr -→ a A ′ be a complete, annotated, execution. There exists a configuration A 0 , a proper trace tr c and a (possibly empty) sequence of pairwise independent improper blocks b 1 , . . . , b k , such that ⌊tr c .b 1 . . . . .b k ⌋ can be obtained from tr by swapping independent labelled actions, and for all 1 ≤ i ≤ k, there exists a configuration A i and a compressed execution

⌈A⌉ tr c -→ c A 0 b i -→ c A i such that Φ(A i ) = Φ(A ′ ) = Φ(A 0 ).
Proof. Applying Lemma 4, we obtain a trace tr ′ , such that ⌊tr ′ ⌋ can be obtained from tr by swapping independent labelled actions, and ⌈A⌉ tr ′ -→ sc ⌈A ′ ⌉. Let b 1 , . . . , b k be the improper blocks that occur in tr ′ . We argue that all those blocks are pairwise independent and each block b i is independent with all actions occurring after b i in tr ′ . Both claims follow from (i) the absence of recipe dependencies since blocks b i do not feature outputs and (ii) the fact that each block b i gives rise to a null process that disappears from the multiset along with the label it carried out preventing sequential dependencies.

Hence a proper trace tr c such that tr c .b 1 . . . . .b k can be obtained from tr by swapping independent blocks. Those swaps can also be made along the former semi-compressed execution since before starting a new block, the semi-compressed semantics allows to choose any positive process to start a focus. We thus have an execution ⌈A⌉ tr c .b 1 . . . . .b k ------→ sc ⌈A ′ ⌉. Since blocks b i are pairwise independent, there exist initial configurations A 0 , A 1 , . . . , A k such that ⌈A⌉ tr c -→ sc A 0 , and

A 0 b 1 -→ sc A 1 , A 0 b 2 -→ sc A 2 , . . . , A 0 b k -→ sc A k .
Since tr c is a proper trace, the execution ⌈A⌉ tr c -→ sc A 0 can easily be translated into a compressed execution ⌈A⌉ tr c -→ c A 0 using rule Release instead of Release s . Finally, remark that all executions 100

Compression

A 0 b i -→ sc A i can be done using the compressed execution instead of the semi-compressed execution: it suffices to trigger rule Release ⊥ instead of Release s . We thus obtain executions A 0

b i -→ c (∅; ∅; Φ(A i )) for all 1 ≤ i ≤ k.
Remark 6 (Reachability properties verified with the compressed semantics). When checking a security property that can be decided by looking only at reachable frames obtained through complete executions ( e.g. secrecy properties), lemmas 3 to 5 show that the semi-compressed semantics or the compressed semantics can be used instead of the regular one. More generally, the semi-compressed semantics is sound and complete for reachable predicates that are:

• monotone ( i.e. if an execution A tr -→ (P; Φ) satisfies the predicate then so does A tr.tr ′ --→ (Q; Φ ∪ Ψ)), and,

• invariant by permutations of actions ( i.e. if A tr -→ B satisfies the predicate then so does any execution A tr ′ -→ B as long as tr ′ equals tr up to a permutation of actions).

For instance, secrecy is monotone and invariant by permutations.

While this is already useful to reduce the search space, we will go much further in the following sections. Most importantly, our final goal is to go beyond reachability properties, and to deal with trace equivalence, which is addressed in the next subsection.

Equivalence

We now define the compressed trace equivalence (≈ c ) and prove that it coincides with the regular trace equivalence (≈).

Definition 23. Let A and B be two configurations. We say that A ⊑ c B when, for any A tr -→ c A ′ such that bc(tr)∩fc(B) = ∅, there exists

B tr -→ c B ′ such that Φ(A ′ ) ∼ Φ(B ′ ). They are compressed trace equivalent, denoted A ≈ c B, if A ⊑ c B and B ⊑ c A.
Compressed trace equivalence can be more efficiently checked than regular trace equivalence.

Obviously, it explores fewer interleavings by relying on -→ c rather than -→. It also requires that traces of one process can be played exactly by the other, including details such as unobservable actions, labels, and focusing annotations. The subtleties shown in Example 23 are crucial for the completeness of compressed equivalence w.r.t. regular equivalence. Since the compressed semantics forces to perform available outputs before e.g. input actions, some non-equivalences are only detected thanks to the labels and detailed unobservable actions of our annotated semantics (as illustrated by Example 23). -→ a A ′ where tr is a proper trace. We first observe that it suffices to consider only complete executions there. This allows us to get a compressed execution ⌈A⌉ tr c -→ c ⌈A ′ ⌉ by Lemma 4. Since ⌈A⌉ ≈ c ⌈B⌉, there exists

B ′ such that ⌈B⌉ tr c -→ c B ′ with Φ(⌈A ′ ⌉) ∼ Φ(B ′ ). Thus we have B ⌊tr c ⌋ --→ a ⌊B ′ ⌋ but also B tr -→ a ⌊B ′ ⌋ thanks to Lemma 1.
When tr is not proper, we invoke Lemma 5 and obtain executions

⌈A⌉ tr c -→ c A 0 b i -→ c A i for 1 ≤ i ≤ k.
Following similar arguments as above, we obtain executions

B tr c -→ a B 0 b i -→ a B i for 1 ≤ i ≤ k such that Φ(B i ) = Φ(B 0 ) ∼ Φ(A 0 ) = Φ(A i ).
We then exploit independencies of blocks

b i to construct B tr c -→ a B 0 b 1 . . . . .b k -----→ a B ′ with Φ(B ′ ) = Φ(B 0 ) and then B tr -→ a B ′ .
Remark 7. Note that the trace inclusions of the regular semantics ( i.e. ⊑) and the compressed semantics ( i.e. ⊑ c ) do not coincide as witnessed by the following example. Let P = {in(c, x)} and Q = {in(c, x).out(c, n)} accompanied with an arbitrary frame Φ. We have

(P; Φ) ⊑ (Q; Φ) but (P; Φ) ̸ ⊑ c (Q; Φ) since (Q; Φ)
is not able to produce the trace foc(in(c, M )).rel.zero in the compressed semantics. But we have (Q; Φ) ̸ ⊑ (P; Φ) and thus (P; Φ) ̸ ≈ (Q; Φ).

Proof of Theorem 2

We prove below the two implications of Theorem 2, dealing first with soundness and then with the more involved completeness result. Soundness can be established for both the semi-compressed and the compressed trace equivalence. Even though the semi-compressed semantics is weaker that the compressed semantics, we still introduce the semi-compressed trace equivalence and prove that it coincides with the regular trace equivalence for future proofs. Indeed, for the compressed (and the reduced semantics we eventually define in Section 5.4), we prove the completeness of the optimised trace equivalence w.r.t. regular trace equivalence in two steps: first the semi-optimised w.r.t. the regular one and then the optimised one w.r.t. the semi-optimised one.

Definition 24. Let A and B be two configurations. We say that A ⊑ sc B when, for any

A tr -→ sc A ′ such that bc(tr) ∩ fc(B) = ∅, there exists B tr -→ sc B ′ such that Φ(A ′ ) ∼ Φ(B ′ ). They are semi-compressed trace equivalent, denoted A ≈ sc B, if A ⊑ sc B and B ⊑ sc A.
Lemma 6 (Soundness). Let A and B be action-deterministic configurations such that skl(A) = skl(B). We have that A ≈ B implies ⌈A⌉ ≈ c ⌈B⌉ (and ⌈A⌉ ≈ sc ⌈B⌉ as well).

Proof. We only deal with the compressed trace equivalence, the case of the semi-compressed trace equivalence is identical. By symmetry it suffices to show ⌈A⌉ ⊑ c ⌈B⌉. Consider an execution ⌈A⌉ tr -→ c A ′ such that bc(tr) ∩ fc(B) = ∅. Thanks to Lemma 3, we know that

A ⌊tr⌋ --→ a K A with Φ(K A ) = Φ(A ′ ). Let ⌊tr⌋ = [α 1 ] ℓ1 . . . [α n
] ℓn , and we denote A 1 , . . . , A n the intermediate configurations that are reached during this execution. We have that:

A 0 = A [α 1 ] ℓ1 ---→ a A 1 [α 2 ] ℓ2 ---→ a . . . [α n ] ℓn ---→ a A n = K A = (P; Φ A ).

Compression

Applying Lemma 2, we deduce that B can perform a very similar execution (same labels, same actions), i.e.

B 0 = B [α 1 ] ℓ1 ---→ a B 1 [α 2 ] ℓ2 ---→ a . . . [α n ] ℓn ---→ a B n = (Q; Φ B ). with Φ(A i ) ∼ Φ(B i ) and skl(A i ) = skl(B i ) for 0 ≤ i ≤ n.
As a consequence of the equalities skl(A i ) = skl(B i ) and the fact that B produces the same labelled actions as A does, we are sure that ⌈B⌉ will be able to do this execution in the compressed semantics as well. In particular, the fact that a given configuration B i can start a positive phase or has to release the focus is determined by the set skl(B i ) = skl(A i ) and the actions 1 and the fact that it can keep the focus on a specific process while performing positive actions can be deduced from labels of tr. Finally, we have shown that if A i can execute an action α using Neg rule then B i can as well. The only missing part is about the fact that Neg has been made non-branching using an arbitrary order on labelled skeletons. Let us say we can use Neg only for actions whose skeleton is minimal among others skeletons of available, negative actions. Using skl(A i ) = skl(B i ), we easily show that this is symmetric for A i and B i . This way, we obtain an execution ⌈B⌉ tr -→ c B ′ with Φ(B ′ ) = Φ(B n ) (we do not necessarily have ⌊B ′ ⌋ = B n because tr may end with an improper block). Finally, we have

[α 1 ] ℓ1 , . . . , [α i-1 ] ℓi-
Φ(B ′ ) = Φ B ∼ Φ A = Φ(A ′ ).
One key ingredient of the completeness is the fact that exploring complete executions only is actually sufficient to establish annotated trace equivalence.

Lemma 7. Let A and B be two action-deterministic configurations. If for any complete execution

A tr -→ a A ′ with bc(tr) ∩ fc(B) = ∅, there exists a trace tr ′ and an execution

B tr ′ -→ a B ′ such that Φ(A ′ ) ∼ Φ(B ′ ), then A ⊑ a B.
Proof. Let A tr 0 -→ a A 0 be an execution of A with bc(tr 0 ) ∩ fc(B) = ∅. Firstly, we complete the latter execution in an arbitrary way A tr 0 .tr 1 ---→ a A ′ such that any process of A ′ is replicated and bc(tr 0 .tr 1 ) ∩ fc(B) = ∅ (it suffices to choose fresh channels for B as well). By hypothesis, there exists an execution

B tr 0 .tr 1 ---→ a B ′ such that Φ(A ′ ) ∼ Φ(B ′ ). The latter execution of B is thus of the form B tr 0 -→ a B 0 tr 1 -→ a B ′ . It remains to show that Φ(A 0 ) ∼ Φ(B 0 ).
For the sake of contradiction, we assume that Φ(B 0 ) ̸ ∼ Φ(A 0 ). In other words, there is a test of equality or a computation test over dom(Φ(B 0 )) that holds for Φ(A 0 ) and does not for Φ(B 0 ) (or the converse).

Since dom(Φ(B 0 )) ⊆ dom(Φ(B ′ )) = dom(Φ(A ′ )), this same test can be used to conclude that Φ(A ′ ) ̸ ∼ Φ(B ′ ) leading to a contradiction. Finally, we prove the completeness of the compressed semantics w.r.t. trace equivalence in two steps. First (Lemma 8), we show the completeness for the semi-compressed trace equivalence defined above (see Definition 24). Second (Corollary 3), we show that both the full and the semi-compressed trace equivalence coincide.

Lemma 8. Let A and B be two action-deterministic configurations satisfying skl(A) = skl(B).

Then ⌈A⌉ ≈ sc ⌈B⌉ implies A ≈ B. Let A tr -→ a A ′ be a complete execution with bc(tr) ∩ fc(B) = ∅. We thus have that A ′ is initial. Applying the Lemma 4, we obtain a trace tr c such that ⌈A⌉ tr c -→ sc ⌈A ′ ⌉ and ⌊tr c ⌋ can be obtained from tr by swapping independent actions. Since we have ⌈A⌉ ≈ sc ⌈B⌉, we deduce that Proof. Assume that A ⊑ c B. Let A ′ be such that A tr -→ sc A ′ for some tr such that bc(tr)∩fc(B) = ∅. Let b 1 , . . . , b k be the improper blocks that occur in tr. We argue that all those blocks are pairwise independent and each block b i is independent with all actions occurring after b i in tr ′ . Both claims follow from (i) the absence of recipe dependencies since blocks b i do not feature outputs and (ii) the fact that each block b i gives rise to a null process that disappears from the multiset along with the label it carried out preventing sequential dependencies.

⌈B⌉ tr c -→ sc ⌈B ′ ⌉ with Φ(A ′ ) ∼ Φ(B ′ ).
Hence a proper trace tr c such that tr c .b 1 . . . . .b k can be obtained from tr by swapping independent blocks. Those swaps can also be made along the former semi-compressed execution since before starting a new block, the semi-compressed semantics allows to choose any positive process to start a focus. We thus have an execution

A tr c .b 1 . . . . .b k ------→ sc ⌈A ′ ⌉.
Since blocks b i are pairwise independent, there exist initial configurations A 0 , A 1 , . . . , A k such that A tr c -→ sc A 0 , and

A 0 b 1 -→ sc A 1 , A 0 b 2 -→ sc A 2 , . . . , A 0 b k -→ sc A k .
Since tr c is a proper trace, the execution ⌈A⌉ tr c -→ sc A 0 can easily be translated into a compressed execution ⌈A⌉ tr c -→ c A 0 using rule Release instead of Release s . Finally, remark that all executions A 0 b i -→ sc A i can be done using the compressed execution instead of the semi-compressed execution: it suffices to trigger rule Release ⊥ instead of Release s . We thus obtain executions

A 0 b i -→ c (∅; ∅; Φ(A i )) for all 1 ≤ i ≤ k.
Thanks to our hypothesis, we deduce that there exist configurations B 0 , B 1 , . . . , B k such that

B tr c -→ c B 0 with Φ(A 0 ) ∼ Φ(B 0 ), and
B tr c .b 1 ---→ c B 1 , B tr c .b 2 ---→ c B 2 , . . . , B 0 tr c .b k ---→ c B k . 104 5.4. Reduction
Those executions can now be mapped back to semi-compressed executions: there exists B tr c -→ sc B 0 (because tr c is proper) and there exist

B tr c .b i ---→ sc B ′ i with Φ(B ′ i ) = Φ(B i ) = Φ(B 0 ) (because the block b i is improper). Since blocks b 1 , . . . , b k are pairwise independent, we deduce that there exists B ′ such that B tr c -→ sc B 0 b 1 , . . . , b k -----→ c B ′ with Φ(B ′ ) = Φ(B 0 ).
Then, permutations of blocks can be undone to retrieve tr (since swaps have been done between independent blocks).

Finally, combining lemmas 8 and 9 yields the following corollary.

Corollary 3 (Completeness). Let A and B be two action-deterministic configurations satisfying

skl(A) = skl(B). Then ⌈A⌉ ≈ c ⌈B⌉ implies A ≈ B.
Theorem 2 follows from Corollary 3 and Lemma 6.

Reduction

The compressed semantics cuts down interleavings by using a simple focused strategy. However, this semantics does not analyse data dependency that happens when an input depends on an output, and is thus unable to exploit the independency of blocks to reduce interleavings as partly illustrated in the next example. We tackle this problem with the reduced semantics which we define in this section. 4 Resuming Example 27, we informally depict two possible interleavings abstracting away recipes (i.e. X1, X2, Y1, Y2). A node in this tree represents all reachable states (from A using the compressed semantics) that can be reached using the corresponding interleaving of actions and choosing recipes for X1, X2 (or Y1, Y2). We represent two of those sets of states (i.e. s1 and s2) by the hatch circles. The intersection of those circles illustrates to set of reachable states that can be reached by both interleavings.

• • • • • • • • • s 2 s 1 in(c 1 , X 1 ) out(c 1 , w 1 ) in(c 2 , X 2 ) out(c 2 , w 2 ) in(c 2 , Y 2 ) out(c 2 , w 2 ) in(c 1 , Y 1 ) out(c 1 , w 1 ) Figure 5.
Example 27. For i ∈ {1, 2}, let P i = in(c i , x i ).out(c i , n i ).P ′ i for some name n i ∈ N and positive process P ′ i . We consider the configuration A = ({P 1 , P 2 }; ∅) and two types of interleavings of actions that the compressed semantics may explore. Essentially, the compressed semantics has two choices: either it starts to focus on process P 1 producing a block b 1 = foc(in(c 1 , M 1 )).rel.out(c 1 , w 1 ) for some recipe M 1 or on process One could argue at this point that exploring those two traces may be redundant. For instance, if M 1 = M 2 = ok ∈ Σ c ( i.e. a constant), then both traces essentially lead to the same state and are thus redundant. Further, it seems that one can choose a priority order ( e.g. P 1 has priority over P 2 ) and, when the compressed semantics has to choose a focus, it has to choose the process with highest priority. However, when recipes depend on previous blocks ( e.g. M 1 = w 2 in tr 2 ), both traces do not lead to the same state and must be explored separately. A diagram informally illustrating those two interleavings, the sets of reachable configurations following one or the other interleaving and the overlap ( i.e. reachable states that can be reached using both interleavings) is depicted in Figure 5.4. This is the crux of the problem: some interleavings explored by the compressed semantics are mostly redundant but they cannot be simply discarded because some specific traces following those interleavings actually exploit the specific ordering that violates the pre-defined priority order. Moreover, distinguishing those traces from redundant ones calls for a notion of necessity based on (strong) data-dependencies: "Is it the case that executing block b 2 before b 1 is really necessary to be able to execute block b 1 in a given way ?". Intuitively, the necessity notion expresses the necessity (for the environment) to execute a certain block after a certain trace for not losing completeness; i.e. still exploring all reachable states.

Strong Independence

Before formally defining our reduction technique, we characterise the kind of independencies over which we seek to eliminate redundancy in the compressed semantics. Obviously, Lemma 1 tells us that independent blocks can be permuted in a trace without affecting the executability and the result of executing that trace. But this notion is not very strong and does not well match the notion of necessity we need since it considers fixed recipes, which are irrelevant (in the end, only the derived messages matter) and can easily introduce spurious dependencies. We now consider A ′ = ({P 1 , P 2 }; Φ 0 ) where Φ 0 = {w → ⟨n 1 , n 2 ⟩}. Intuitively, we give to the attacker the two names n 1 , n 2 that P 1 and P 2 may output. Let M 3 = w 2 in the block b 3 = foc(in(c 1 , M 3 )).rel.out(c 1 , w 1 ) and M 4 = ok in the block b 4 = foc(in(c 2 , M 4 )).rel.out(c 2 , w 2 ), we obtain two blocks that are also dependent ( i.e. b 3 ⇌ b 4 ). However, it is not a necessity to execute one block before the other since one can replace M 3 by M ′ 3 = π 2 (w) whilst preserving executability and resulting frame. As for the previous example, replacing M 3 by M ′ 3 also makes the previous dependency disappear.

Example 28 (Resuming Example 27). Let

M 1 = π 1 (⟨ok, w 2 ⟩) in the block b 1 = foc(in(c 1 , M 1 )).
This calls for a stronger notion of equivalence over traces, which allows permutations of independent blocks but also changes of recipes that preserve messages. During these permutations, we will also require that traces remain plausible, which is defined as follows: tr is plausible if for any input in(c, M ) such that tr = tr 0 .in(c, M ).tr 2 then M ∈ T (Σ pub , W 0 ) where W 0 is the set of all handles occurring in tr 0 . Given a block b, i.e. a sequence of the form foc(α).tr + .rel.tr -, we denote by b + (resp. b -) the part of b corresponding to the positive (resp. negative) phase, i.e. b + = α.tr + (resp. b -= tr -). We note

(b 1 = E b 2 )Φ when b + 1 Φ = E b + 2 Φ and b - 1 = b - 2 .
Definition

Φ = {w 1 → n 1 , w 2 → n 2 }): A b 2 .b 1 --→ c ({P ′ 1 {x 1 → ok}, P ′ 2 {x 2 → ok}}; Φ)
The two blocks we defined were dependent ( i.e. Along the same lines as the proof of Lemma 1, we prove the following result. Lemma 10. Let A and A ′ be two initial configurations such that A tr -→ sc A ′ . We have that A tr ′ -→ sc A ′ for any tr ′ ≡ Φ(A ′ ) tr.

b 1 ⇌ b 2 ) but b 2 .b 1 ≡ Φ b 2 .b ′ 1 ≡ Φ b ′ 1 .b 2
Proof. Thanks to Lemma 3, we have that ⌊A⌋ ⌊tr⌋ --→ a (P; Φ). We first prove that tr ′ can be performed using -→ a . For this, it suffices to establish the implication for each of the two generators of ≡ Φ . The first case is given by Lemma 1. The second one is a common property of (derivatives of) the applied π-calculus that follows from a simple observation of the transition rules; i.e. executions rules and computations (⇓) are insensitive to the choice of representative in = E -equivalence classes. Finally, we must prove that tr ′ can be played using -→ sc . Thanks to initiality of A and (P; ∅; Φ) we know that each block of tr starts when the configuration is initial and after performing it we get another initial configuration. This is still true in ⌊A⌋ ⌊tr ′ ⌋ --→ a (P; Φ). Finally, labels of blocks of tr ′ ensure that a single process is used in a positive part of any block.

A Reduced Semantics: Theory

Having proved those two facts, we can easily show that each block of tr ′ can be performed using

- → sc .
Note that a similar lemma based on the compressed semantics (instead of the semi-compressed semantics) would not hold since ≡ Φ notably allows to swap an improper block that was at the end to another position whereas the compressed semantics allows improper blocks to be executed at the end only.

Priority Order And Necessity

We now turn to defining our reduced semantics, which will achieve the elimination of redundancies identified above by only executing specific representatives in equivalence classes modulo ≡ Φ .

More precisely, we shall only execute minimal traces according to some order, which we introduce next.

Definition 27. We consider an arbitrary order ≺ on blocks that is insensitive to recipes and handles, and such that independent blocks are always strictly ordered in one way or the other. We finally define ≺ lex on compressed traces as the lexicographic extension of ≺ on blocks.

In order to incrementally build representatives that are minimal with respect to ≺ lex , we define a predicate that expresses whether a block b should be authorised after a given trace tr. Intuitively, this is the case only when, for any block b ′ ≻ b in tr (that is to say, executing b would violate the priority order), dependencies forbid to move b before b ′ (meaning that violating the priority order is a necessity). We define this with recipe dependencies first, then quantify over all recipes to capture message dependencies.

Definition 28 (Weak and Strong Authorization).

(b ′ = E b)Φ.
The strong authorised predicate is the formal counterpart of the intuitive notion of necessity we sketched before.

Example 30 (Resuming Example 29). Assuming that b

1 ≺ b 2 , one has (b 1 , Φ) ▶ b 2 but (b 2 , Φ) ̸ ▶ b 1 because b 2 ̸ ▷ b ′ 1 and (b 1 = E b ′ 1 )Φ.
In other words, b 2 .b 1 is considered redundant and will not be explored by the reduced semantics since b 1 .b 2 has priority over the other interleaving and leads to the same state.

Reduced Semantics

We finally define -→ r as the least relation such that:

Init A ϵ -→ r A Block A tr -→ r (P; ∅; Φ) (P; ∅; Φ) b -→ c A ′ A tr.b --→ r A ′ if (tr, Φ) ▶ b

Reduction

Our reduced semantics only applies to initial configurations: otherwise, no block can be performed. This is not restrictive since we can, without loss of generality, pre-execute unobservable and output actions that may occur at top level.

Similarly to compression, we also introduce the semi-reduced semantics noted • -→ sr that is defined as the reduced semantics but based on the semi-compressed semantics • -→ sc instead of the compressed semantics • -→ c .

Example 31 (Resuming Example 27). We now consider the configuration A = ({P 1 , P 2 , P 3 }; ∅)

(remind that P i = in(c i , x i ).out(c i , n i ).P ′ i and P i 's are positive). We assume that blocks using only channel c i are smaller w.r.t. ≺ than blocks using only channel c j when j > i. We now illustrate and characterise the redundant traces that are not explored by the reduced semantics but that are explored by the (semi-)compressed semantics. To conduct this analysis, we shall group traces together depending on the interleaving of the first blocks of P 1 , P 2 , P 3 they follow.

We note those blocks b 1 , b 2 , b 3 where b i = foc(in(c i , M i )).rel.out(c i , w i ). There are 6 possible interleavings of those 3 blocks that are depicted in Figure 5.5. Note that many different traces can follow a given single interleaving since many different recipes can be chosen for M 1 , M 2 and M 3 . Moreover, all those traces will be explored by the (semi-)compressed semantics. We now illustrate that, thanks to the authorised predicate (•, •) ▶ •, a strict subset of those traces are actually explored by the reduced semantics. Overall, the reduced semantics imposes many such conditions and does not explore the many traces violating them. 109

• • • • • • • • • • • • • • • • b 1 b 2 b 3 b 2 b 3 b 1 b 3 b 1 b 2 b 3 b 2 b 3 b 1 b 2 b 1

A Reduced Semantics: Theory

Example 32. We consider processes R i := in(c i , x).if x = ok then out(c i , ok) where ok is a public constant, and then consider a parallel composition of n such processes: P n := Π{R i } # 1≤i≤n . Thanks to compression, we will only consider traces made of blocks, and obtain a first exponential reduction of the state space. However, contrary to the case of a replicated process (see Example 25 in Subsection 5.3.1), we still have many interleavings to consider -blocks can be interleaved in all the possible ways. Our reduced semantics also cuts down these interleavings on this example. Assume that our order ≺ prioritises blocks on c i over those on c j when i < j, and consider a trace starting with foc(in(c j , M j )).rel.out(c j , w j ). Trying to continue the exploration with a block on c i with i < j, the authorisation predicate (•, •) ▶ • will impose that there is a dependency between the block on c i and the previous one on c j . In this case it must be a data dependency: the recipe of the message passed as input on c i must make use of the previous output to derive ok. Since ok is a public constant, it is possible to derive it without using any previous output and thus the block on c i cannot be authorised by (•, •) ▶ •. Thus, on this simple example, the reduced semantics will not explore any trace where a block on c i is performed after one on c j with i < j.

If one forgets about branching due to choices of recipes, there are (2n)!/2 n different interleavings of size 2n (i.e., containing 2n observable actions) in the regular semantics. In the compressed semantics this number goes down to n!. Finally, in the reduced semantics, there is only one trace of size 2n.

Reachability

An easy induction on the compressed trace tr allows us to map an execution w.r.t. the reduced semantics to an execution w.r.t. the compressed semantics.

Lemma 11. For any configurations A and A

′ , A tr -→ r A ′ implies A tr -→ c A ′ and A tr -→ sr A ′ implies A tr -→ sc A ′ .
Next, we show that our reduced semantics only explores specific representatives. Given a frame Φ, a plausible trace tr is Φ-minimal if it is minimal (w.r.t. ≺ lex ) in its equivalence class modulo ≡ Φ .

Lemma 12.

Let A be an initial configuration and A ′ = (P; ∅; Φ) be a configuration such that

A tr -→ c A ′ (resp. A tr -→ sc A ′ ). We have that tr is Φ-minimal if, and only if, A tr -→ r A ′ (resp. A tr -→ sr A ′ ).
Proof. We first deal with the semi-compressed and semi-reduced semantics case and then show that the compressed and reduced case follows from the former.

(Semi-compressed and semi-reduced case) Let A and (P; ∅; Φ) be two configurations such that A tr -→ sc (P; ∅; Φ).

(⇒) We first show that if tr is Φ-minimal, then A tr -→ sr (P; ∅; Φ) by induction on the trace tr. The base case, i.e. tr = ϵ is straightforward. Now, assume that tr = tr 0 .b for some block b and A tr 0 -→ sc (P 0 ; ∅; Φ 0 ) b -→ sc A ′ . Since tr is Φ-minimal, we also have that tr 0 is Φ 0 -minimal and thus we obtain by induction hypothesis that A tr 0 -→ sr (P 0 ; ∅; Φ 0 ). To conclude, it remains to show that (⇐) Now, we assume that tr is not Φ-minimal, and we want to establish that tr cannot be executed in the semi-reduced semantics. Let tr m be a Φ-minimal trace of the equivalence class of tr. We have in particular tr m ≡ Φ tr and tr m ≺ lex tr. Now, we let tr s m (resp. tr s ) be the "trace of labelled skeletons" associated to tr m (resp. tr). Let tr s 0 be the longest common prefix of tr s m and tr s , and tr 0 (resp. tr ′ 0 ) be the corresponding prefix of tr (resp. tr m ). We have a decomposition of the form tr = tr (Compressed and reduced case) We consider an execution A tr -→ c (P; Φ) = A ′ . (⇒) We suppose that tr is Φ-minimal. Even if it means modifying the resulting multiset, we also have an execution A tr ′ -→ sc (Q; Φ) = A ′ s for some Q. Indeed, it suffices to replace the final potential rule Release ⊥ by Release s followed by Neg (for removing the released null process).

Applying the above result, we obtain an execution A tr ′ -→ sr A ′ s . Now it suffices to revert the potential replacement made above yielding A tr -→ r A ′ . (⇐) We suppose that A tr -→ r A ′ . Applying the same modification explained above, we obtain an execution A tr ′ -→ sr (Q; Φ) for some Q. Invoking the above result, we deduce that tr is Φminimal.

A Reduced Semantics: Theory

Remark 8 (Reachability properties verified with the reduced semantics). We now characterise reachability predicates that are preserved by the reduced semantics the same way it was done for the compressed semantics (see Remark 6). The semi-reduced semantics is sound and complete for reachable predicates that are:

• monotone ( i.e. if an execution A tr -→ (P; Φ) satisfies the predicate then so does A tr.tr ′ --→ (Q; Φ ∪ Ψ)), and,

• stable by = E ( i.e. if A tr -→ (P; Φ) satisfies the predicate then so does

A tr ′ -→ (Q; Φ ′ ) if trΦ = E tr ′ Φ ′ ),
• invariant by permutations of actions ( i.e. if A tr -→ B satisfies the predicate for some configurations A, B and a trace tr then for any trace tr ′ equals to tr up to a permutation of actions, any execution A tr ′ -→ B must satisfy the predicate).

The above simply follows from lemmas 11 and 12.

For instance, secrecy is monotone, stable by = E , and, invariant by permutations.

Equivalence

The reduced semantics induces an equivalence ≈ r that we define similarly to the compressed one, and we then establish its soundness and completeness w.r. We first prove that semi-reduced trace equivalence coincides with the semi-compressed trace equivalence. To do so, we first show that ≡ Φ is stable by static equivalence as stated and proved next. Then we need to show that the the semi-compressed trace equivalence restricted to complete executions actually coincides with the semi-compressed trace equivalence.

Lemma 13. Let A and B be two action-deterministic configurations. If for any complete execution of the form A tr

-→ sc (P; ∅; Φ) with bc(tr)∩fc(B) = ∅, there exists an execution B tr -→ sc (Q; ∅; Ψ) such that Φ ∼ Ψ, then A ⊑ sc B.

Reduction

Proof. Let A and B be two action-deterministic configurations, and assume that for any complete execution A tr -→ sc (P; ∅; Φ) with bc(tr) ∩ fc(B) = ∅, there exists an execution B tr -→ sc (Q; ∅; Ψ) such that Φ ∼ Ψ. Now, we have to establish that A ⊑ sc B.

Let (P ′ ; ∅; Φ ′ ) be a configuration such that A tr ′ -→ sc (P ′ ; ∅; Φ ′ ). First, we can complete this execution to reach a process (P; ∅; Φ) such that each process P ∈ P is replicated, i.e.

A tr ′

-→ sc (P ′ ; ∅; Φ ′ ) tr + --→ sc (P; ∅; Φ) is a complete execution.

Without loss of generality, we can choose tr + so that it satisfies bc(tr + )∩fc(B) = ∅. By hypothesis, we know that there exists an execution B tr ′ tr + ---→ sc (Q; ∅; Ψ) such that Φ ∼ Ψ. Let B ′ be the configuration reached along this execution after the execution of tr ′ and Ψ ′ its frame. Similarly to the proof of Lemma 7, we prove that Φ ∼ Ψ implies Φ ′ ∼ Ψ ′ .

Lemma 14. Let A and B be two initial, action-deterministic configurations.

A ≈ sc B if, and only if, A ≈ sr B Proof. We prove the two directions separately.

(⇒) A ⊑ sc B implies A ⊑ sr B. Consider an execution of the form A tr -→ sr (P; ∅; Φ) with bc(tr) ∩ fc(B) = ∅. Using Lemma 11, we know that A tr -→ sc (P; ∅; Φ), and Lemma 12 tells us that tr is Φ-minimal. Since A ⊑ sc B, we deduce that there exists (Q; ∅; Ψ) such that:

B tr -→ sc (Q; ∅; Ψ) and Φ ∼ Ψ.
Now, by Proposition 13 we obtain that tr is also Ψ-minimal, and so Lemma 12 tells us that the execution of tr by B can also be performed in the semi-reduced semantics.

(⇐) A ⊑ sr B implies A ⊑ sc B. Relying on Lemma 13, it is actually sufficient to show that for any complete execution A tr -→ sc (P; ∅; Φ) with bc(tr)∩fc(B) = ∅, there exists an execution of the form B tr -→ sc (Q; ∅; Ψ) such that Φ ∼ Ψ. We thus consider a complete execution A tr -→ sc (P; ∅; Φ) = A ′ such that bc(tr) ∩ fc(B) = ∅. Note that since the given execution is complete, we have that A ′ is initial (this will be crucial to invoke Lemma 12). Let tr ′ be a Φ-minimal trace in the equivalence class of tr. Applying the Lemma 12, we obtain an execution A tr ′ -→ sr A ′ . By hypothesis, there must be some B ′ such that:

B tr ′ -→ sr B ′ and Φ(B ′ ) ∼ Φ.
Using Lemma 11, we obtain the same execution in the semi-compressed semantics. Finally, by Proposition 13 we obtain tr ′ ≡ Φ(B ′ ) tr, and by Lemma 10 we obtain:

B tr -→ sc B ′ and Φ(B ′ ) ∼ Φ concluding the proof.
Finally, we prove that the reduced trace equivalence coincides with the semi-reduced trace equivalence implying, as a corollary (stated in Section 5.5), that the reduced trace equivalence coincides with the regular trace equivalence.

A Reduced Semantics: Theory

Lemma 15. Let A and B be two initial action-deterministic configurations.

A ≈ sr B if, and only, if, A ≈ r B Proof. The direction (⇒) is easy: it suffices to distinguish the case of proper executions from improper ones and directly apply the hypothesis. We focus on (⇐). Assume that A ⊑ r B. Let Because (i) tr i are proper traces, (ii) there are no dependencies between b i and tr j for i < j, and (iii) the b i do not have any output, we have that A tr 0 .tr 1 . . . . .tr k -------→ r A 0 , and also that:

A tr 0 .b 1 ---→ r A 1 , A tr 0 .tr 1 .b 2 -----→ r A 2 , . . ., A tr 0 .tr 1 . . . . .tr k-1 .b k ----------→ r A k .
Thanks to our hypothesis, we deduce that there exist B 0 , B 1 , . . . , B k such that B tr 0 .tr 1 . . . . .tr k -------→ r B 0 with Φ(A 0 ) ∼ Φ(B 0 ), and also that:

B tr 0 .b 1 ---→ r B 1 , B tr 0 .tr 1 .b 2 -----→ r B 2 , . . ., B tr 0 .tr 1 . . . . .tr k-1 .b k ----------→ r B k .
We deduce that there exists B ′ such that B tr 0 .tr 1 . . . .tr k .b 1 . . . . .b k ------------→ sc B ′ . Next, we observe that

Φ(A ′ ) = Φ(A 0 ) ∼ Φ(B 0 ) = Φ(B ′ ).

Main Result and Discussions

The main theorem of this chapter states that the -highly optimised-reduced semantics can be used instead of the regular semantics to verify trace equivalence between action-deterministic configurations. In other words, we finally obtain that the reduced trace equivalence coincides with the trace equivalence for action-deterministic configurations having same skeletons. The practical implications of this theorem are addressed in Chapter 6. In the remaining of this section, we discuss some theoretical aspects of the refined semantics we developed in this chapter and some possible future work.

Theorem 3. Let A and B be two initial action-deterministic configurations such that skl(A) = skl(B). It holds that:

A ≈ B if,

Main Result and Discussions

Discussion on Compression vs. Recursion. We did not consider recursive processes in this chapter. There are fundamental reasons for that which we explain now.

First, remark that considering the unfolding of recursive processes as part of the internal reduction is not an option. Indeed, in such a case, infinite executions induced by recursive processes could make the compression get stuck in a negative phase (e.g. with recX.out(c, ok).X) or a positive phase (e.g. with recX.in(c, ok).X) without the ability to explore other processes in the multiset and thus losing completeness for reachability (e.g. losing Lemma 4). Therefore, recursive processes shall be given an action (not necessarily observable) and thus a skeleton.

Such a skeleton should be different from the already defined ones since the compression rule for recursive processes (to be defined) must be different from the others (otherwise, the above problem arises again). But then, as stated by the Strong Symmetry Lemma (i.e. Lemma 2), the attacker should be able to deduce skeletons of active processes from initial skeletons and performed observable actions. This cannot be enforced in the general case; for instance, the attacker has no way to distinguish P = recX.out(c, ok).X from out(c, ok).P (essentially because he has no way to distinguish out(c, ok).0 from recX.out(c, ok).0). One could come up with restrictions on the class of processes we deal with to avoid this problem. However, in our opinion, those classes are really restrictive and would not reflect typical uses of recursion mainly because those classes would make the unfoldings of recursion observable to the attacker.

Towards dropping the action-deterministic assumption. It would be interesting to support processes that are not action-deterministic, which are commonplace when analysing e.g. anonymity or unlinkability scenarios. We tried to adapt our POR techniques towards this goal but encountered very difficult challenges that we explain now. We leave the task of addressing those challenges for future work.

For this discussion, we focus on the compression since challenges already arise for this first technique and we leave aside the design choices and the proof technique we followed in this chapter (e.g. annotations, the Strong Symmetry Lemma). What we seek for is a class of swaps of actions that can systematically be done for executions of processes that are not necessarily action-deterministic. The next step would be to design an exploration strategy in the flavor of the compression strategy that could then be proved complete thanks to those swaps.

Let us illustrate problems one encounters when seeking for possible swaps between output and input. We start with a minimal example abstracting away data to focus on the action's nature:

P l 1 = in c | out e .
}; ∅) ̸ ≈ ({P r 1 }; ∅)
) and a trace witnessing this would be in c (or in d ). However, if one imposes a strategy exploring outputs in priority, as the compression does, one would only explore traces starting by the output out e . But there is no witness of non-equivalence starting with out e since after this output the two processes are structurally equal (i.e. in c | in d ).

One could argue that there is a more direct way to detect the non-equivalence in the former example; indeed the immediately available actions are not the same in P l 1 and P r 1 . However, the same problem arises for slightly more complex witnesses that require to "violate" the simple strategy of prioritising outputs for many actions. For instance, consider the following processes 5. A Reduced Semantics: Theory P l 2 = in α .A | out e .in α .B and P r 2 = in α .B | out e .in α .A such that A and B are not equivalent but for "long" witnesses; e.g. A made of k inputs (k can be chosen arbitrarily) followed by out f while B made of the same inputs but followed by out g . Again, P l 2 and P r 2 are not trace equivalent. This example shows that even when one verifies that the actions immediately enabled are the same on both sides, some witnesses can be found only by violating the simple strategy aforementioned for an arbitrary long time (because k can be chosen arbitrary large).

The crux of the problem is that the backward swap (i.e. moving towards the beginning) of the action out e with the other actions (i.e. in c , in e in the first example and in α in the second example) do not violate any sequential dependency nor data dependency but are nevertheless impossible for a reason that only arises in the non-deterministic case. This novel reason is that performing the action out e makes available an action that is related to the actions to be swapped (either they are dependent or, worse, they are equal). Note that there actually are other kinds of interactions preventing swaps that we do not describe here. Those new entangled interactions between actions to be swapped caused by the non-determinism are hard to predict and analyse. In such cases, the strategy cannot impose any specific ordering since it is not certain that all the necessary swaps, which are needed in order to prove that we do not lose completeness by not exploring other interleavings, are all possible and not prevented by one of the above reasons.

Other Directions for Future Work. First, we could investigate the role of the particular choice of the order ≺, to determine heuristics for maximising the impact of reduction. In particular, it could be chosen on a case-by-case basis after having analysed the shape of the processes to be verified.

Further, one may adapt our treatment of replication to bounded replication to obtain a first symmetry elimination scheme, which should provide a significant optimisation when studying security protocols with several (but finitely many) sessions. More precisely, if one wants to analyse n sessions of a process P , he may consider the bounded replication ! a c,n [n] P that intuitively represents a standard replication ! a c,n P that can be unfolded at most n times. The benefit stems from the fact that such a bounded replication will be better optimised using our POR techniques than the parallel composition Π 1≤i≤n P . Finally, it is certainly possible to leverage our POR techniques for processes that are not fully action-deterministic but that feature phases, some of them being action-deterministic. This is certainly useful e.g. for improving the verification of e-voting protocols. For instance, in presence of strong phases (or synchronisation barriers) as defined in [START_REF] Blanchet | Automated reasoning for equivalences in the applied pi calculus with barriers[END_REF], we conjecture that our POR techniques can be leveraged inside action-deterministic phases without losing completeness. We claim that the same can be achieved with weak phases (e.g. defined in [START_REF] Delaune | Automatic verification of privacy properties in the applied pi-calculus[END_REF]) provided that the semantics considers actions produced when moving to next phases as observable for the attacker.

Chapter 6

Putting Reduced Semantics into Practice and Integration in Apte

In the previous chapter, we devised optimised semantics that only explore a selection of interleavings according to some execution strategy (i.e. compression, reduction). We notably defined the reduced semantics (see Subsection 5.4.3) combining our two POR techniques: compression and reduction. We eventually obtained the main theorem of the previous chapter (i.e. Theorem 3) that states that this reduced semantics can be used instead of the regular semantics to verify the trace equivalence of action-deterministic configurations.

We now seek to put this reduced semantics into practice. Since we target methods and tools dealing with bounded number of sessions only, we must restrict the class of configurations (by comparison with the previous chapter). We have chosen to work with simple configurations that lie in a strict sub-class of action-deterministic configurations (without replication) satisfying syntactical constraints that are easy to verify. We define this class and the instance of the model we shall work with in Section 6.1.

Then, we show how the compressed and the reduced semantics can be combined with constraint solving-based methods (Section 6.2). We shall define a (classic) symbolic semantics, restrict it to follow the compressed strategy and finally show how to refine it further by translating the authorised predicate into a new type of constraints. We also prove that the soundness and completeness results on the induced trace equivalences can be lifted to the symbolic setting easily. All those steps involve a high level of technicalities but do not represent a key contribution in themselves. However, the fact that it is possible to translate quite easily our POR techniques from a regular, concrete semantics to a symbolic semantics validates our design choices.

Next, we show how we followed this approach to integrate our POR techniques in the tool Apte (Section 6.3). More interestingly, we also prove the soundness of our integration; i.e. we show that the modified version of Apte that uses our optimised semantics still decides trace equivalence for simple processes. Finally, we provide benchmarks showing dramatic speedups brought by our optimised semantics (Section 6.4) before concluding with future works (Section 6.5).

Instantiation of the Model and Class of Processes

In this chapter, we work with a strict sub-class of action-deterministic processes we considered in the previous chapter (see Hypothesis 1). We also consider an instantiation of the term-algebra and the semantics we used in the previous chapter. We now formally define those instantiations and the class of processes we shall work with.

Term Algebra. We consider an arbitrary term-algebra made of an arbitrary signature Σ and an equational theory = E . However, contrary to the previous chapter, we need to restrict the computation relations • ⇓ • we can deal with to be computation relations induced by an extension ≡ E d of = E as defined in Chapter 2, Subsection 2.3.2. Remind that such computation relations are induced by equational theories ≡ E d over terms: a term t computes a messages u (i.e. t ⇓ u) when t ≡ E d u and t is valid (i.e. for all all sub-term t ′ of t, there exists a message u ′ such that t ′ ≡ E d u ′ ). We note valid(t) when t is valid. This restriction is imposed by the constraint solving approach where computations (whether it leads to a success or a failure) shall be modelled by (dis)equality constraints. Obviously this is in line with the theory behind the tool Apte we will discuss later in Section 6.3.

Semantics.

Similarly to the previous chapter, we consider the internal reduction induced by the relation R = R test ∪ R out (see Definition 11 in Section 4.1). Remind that this internal reduction evaluates conditionals (R test ) and removes blocked outputs (R out ) greedily.

Class of Configurations.

In this chapter, we eventually define a symbolic semantics based on the constraint solving framework notably featuring deducibility and (dis)equality constraints. While this will be sufficient to represent equality over terms, it does not allow to describe arbitrary computations in let constructs (e.g. let x = sdec(y, z); in . . .). For this reason, we must restrict ourselves to use conditionals (i.e. let constructs) containing only computations corresponding to equality tests (e.g. let x = eq(y, z) in . . .). We thus introduce the following notation to ease the readability of the further developments. Notation 2. For some processes P, Q with x / ∈ vars(P ), and terms t 1 , t 2 , we note if t 1 = t 2 then P else Q the process let x = eq(t 1 , t 2 ) in P else Q where eq is described in Example 11 (in Subsection 2.3.2).

In the class of processes we eventually define, we shall only consider conditionals of the form if t 1 = t 2 then P else Q. This is in line with restrictions made in the tool Apte that we eventually leverage.

We consider the fragment of simple processes without replication and recursion built on basic processes following [START_REF] Cheval | Deciding equivalencebased properties using constraint solving[END_REF]. A basic process represents a party in a protocol, which may sequentially perform actions such as waiting for a message, checking equality between terms (using the construct introduced above), or outputting a message. Then, a simple process is a parallel 6.2. Combining Compression and Reduction with Constraint Solving composition of such basic processes playing on distinct channels. The simple configurations form a sub-class of action-deterministic configurations based on a simple syntactic criterion.

Definition 30 (Class of configurations). The set of basic processes on c ∈ C is defined using the following grammar (where t, t 1 , t 2 ∈ T (Σ, N ∪ X ) and x ∈ X ):

P, Q := 0 null | if t 1 = t 2 then P else Q conditional | in(c, x).P input | out(c,
P (sk A , pk(skb)), Q(sk B , pk(sk A )), Q 0 (sk B , pk(sk A ))
are basic processes, P is a simple process and (P; Φ 0 ) is a simple configuration.

We do not consider recursion and replication since the constraint solving approach is not compatible with unbounded executions. Additionally, we dot not consider creation of names. The latter is without loss of generality though, because they can be replaced by private constants as already explained in Section 5.1. We do not consider parallel composition either to ease the presentation and the (already) complex proofs. We let the extension of our results to a larger class of processes featuring parallel compositions as future work.

Altogether, the instance of the semantics for the class of configurations under consideration (see Definition 30) is depicted in Figure 6.1. Note that it can be seen as an instantiation of the semantics we considered in the previous chapter (see Section 5.1) for a sub-class of configurations.

In ({in(c, x).P } ⊎ P

; Φ) in(c, R) ----→ ({P {x → u}} ⊎ P; Φ) where R is a recipe such that RΦ ⇓ u Out ({out(c, t).P } ⊎ P; Φ) out(c, w) -----→ ({P } ⊎ P; Φ ⊎ {w → u})
where w is a fresh variable and t ⇓ u

Combining Compression and Reduction with Constraint Solving

In this section, we propose a symbolic semantics that we iteratively refine in order to embed our two POR techniques.

Symbolic Semantics

We define a symbolic semantics following, e.g. [START_REF] Millen | Constraint solving for bounded-process cryptographic protocol analysis[END_REF][START_REF] Baudet | Deciding security of protocols against off-line guessing attacks[END_REF]. Such a symbolic semantics avoids potentially infinite branching of concrete semantics due to inputs from the environment. Correctness is maintained by associating with each process a set of constraints on terms.

Constraint systems

Following the notations of [START_REF] Baudet | Deciding security of protocols against off-line guessing attacks[END_REF], we consider a new set X 2 of second-order variables, denoted by X, Y , etc. We shall use those variables to abstract over recipes. We denote by vars 2 (o)

the set of free second-order variables of an object o, typically a constraint system. To prevent ambiguities, we shall use vars 1 (•) instead of vars(•) for free first-order variables.

Definition 31 (constraint system). We consider three kinds of constraints:

D ⊢ ? X x u = ? v u ̸ = ? v
where D ⊆ W, X ∈ X 2 , x ∈ X and u, v ∈ T (Σ, N ∪ X ). We call symbolic frame (noted Φ, Ψ) substitutions from W to terms. A constraint system C = (Φ; S) consists of a symbolic frame Φ, and a set of constraints S.

The first kind of constraint expresses that a second-order variable X has to be instantiated by a recipe that uses only variables from a certain set D, and that the obtained term should be x. The handles in D represent terms that have been previously outputted by the process.

We are not interested in general constraint systems, but only consider constraint systems that are well-formed. Given a constraint system C, we define a dependency order on first-order variables in vars 1 (C) ∩ X by declaring that x depends on y if, and only if, S contains a deduction constraint D ⊢ ? X x with y ∈ vars 1 (Φ(D)). A constraint system C is well-formed if:

• the dependency relationship is acyclic, and

• for every x ∈ vars 1 (C) ∩ X (resp. X ∈ vars 2 (C)) there is a unique constraint D ⊢ ? X x in S.
For X ∈ vars 2 (C), we write D C (X) for the domain D ⊆ W of the deduction constraint D ⊢ ? X x associated to X in C.

Example 34 (Continuing Example 33). Let Φ = Φ 0 ⊎{w 3 → aenc(⟨π 2 (N ), ⟨n b , pk(skb)⟩⟩, pk(ska))} with N = adec(y, skb), and S be a set containing two constraints:

{w 0 , w 1 , w 2 } ⊢ ?
Y y and π 2 (N ) = ? pk(ska).

We have that C = (Φ; S) is a well-formed constraint system. There is only one first-order variable y ∈ vars 1 (C) ∩ X , and it does not occur in vars 1 (Φ({w 0 , w 1 , w 2 })), which is empty. Moreover, there is indeed a unique constraint that introduces y.

Our notion of well-formed constraint systems is in line with what is used, e.g. in [START_REF] Millen | Constraint solving for bounded-process cryptographic protocol analysis[END_REF][START_REF] Baudet | Deciding security of protocols against off-line guessing attacks[END_REF]. We use a simpler variant here that is sufficient for our purpose.

Combining Compression and Reduction with Constraint Solving

Definition 32 (solution). A solution of a constraint system C = (Φ; S) is a substitution θ such that dom(θ) = vars 2 (C), and Xθ ∈ T (Σ pub , D C (X)) for any X ∈ dom(θ). Moreover, we require that there exists a ground substitution λ : vars 1 (C) → T (Σ c , N ) such that:

• for every D ⊢ ? X x in S, we have (Xθ)(Φλ) ⇓ xλ;

• for every u = ? v in S, we have uλ ≡ E d vλ, valid(uλ), and valid(vλ); and

• for every u ̸ = ? v in S, we have uλ ̸ ≡ E d vλ, or ¬valid(uλ), or ¬valid(vλ).

Moreover, we require that all the terms occurring in Φλ are valid. The set of solutions of a constraint system C is denoted Sol(C). Since we consider constraint systems that are well-formed, the substitution λ is unique modulo = E given θ ∈ Sol(C). We denote it by λ θ when C is clear from the context.

The validity condition on Φλ ensures that all outputted terms actually compute messages. Indeed, we have by definition of ⇓ (see Section 6.1) that for any term t, t ⇓ u for some u implies that t must be valid. Similarly, an equality test holds only when it relates terms that compute the same message implying that the related terms must be valid as well.

Example 35. Consider again the constraint system C given in Example 34. We have that θ = {Y → aenc(⟨w 1 , w 1 ⟩, w 2 )} is a solution of C. Its associated first-order solution is λ θ = {y → aenc(⟨pk(ska), pk(ska)⟩, pk(skb))}.

Symbolic processes: syntax and semantics

Given a simple configuration (P; Φ), we compute the constraint systems capturing its possible executions, starting from the symbolic configuration (P; Φ; ∅). Note that we are now manipulating processes that are not ground anymore, but may contain free variables. For this reason, symbolic configurations are no longer subject to the internal reduction R . Indeed, symbolic configurations represent different (concrete) configurations that could trigger different internal reduction rules. The semantics we eventually define features additional rules for conditionals and blocked outputs. They are the counterpart of internal reductions.

Definition 33 (Symbolic Configuration).

A symbolic configuration is a tuple (P; Φ; S) where (Φ; S) is a constraint system, vars 1 (P) ⊆ (vars 1 (S) ∩ X ) and P is a simple process.

When considering a symbolic configuration (P; Φ; S) and one of its solutions θ, we may write A = (Pθ; Φλ θ ⇓) the (concrete) configuration associated that is not necessarily in normal form w.r.t. R . The notation Φλ θ ⇓ denotes a frame Ψ (we may also note Φλ ⇓ Ψ) that is formally defined as follows: Ψ = {w → u | w ∈ dom(Φ), wΦ ⇓ u}. Note that computations never fail by definition of a solution (i.e. terms in Φλ must be valid). Remark also that there may be more than one frame Ψ such that Φλ ⇓ Ψ but they all are statically equivalent because equal modulo = E . When the choice of representative in ∼-equivalence class or in = E -class is unimportant, we We give in Figure 6.2 the symbolic semantics for symbolic configurations. Remark the one-toone mapping from symbolic rules (Figure 6.2) on one hand and concrete rules (Figure 6.1) and R test , R out reduction rules (Definition 11 in Subsection 4.1.1) on the other hand. The additional rules Then,Else and Blocked-Out play the role of the internal reduction rules of R test , R out . Notably, Blocked-Out allows to symbolically remove blocked outputs adding a constraint (i.e. t ̸ = ? t) making sure that any instantiation of this output cannot be triggered because the underlying term do not reduce to a message or equivalently is not valid). Note that for a process out(c, t).P in a symbolic configuration, the rules Out and Blocked-Out cover mutually exclusive concrete executions: the former cover all instantiations for which t is valid (since Φλ θ must contain only valid terms) and the latter cover all instantiations for which t is not valid (since t ̸ = ? t holds iff t is not valid).

The operator obs(•) is extended to symbolic actions straightforwardly; i.e. it just removes all τ actions.

Example 36 (Resuming Example 34). We have that ({Q 0 (sk B , pk(sk A ))}; Φ 0 ; ∅) tr = = ⇒ (∅; Φ; S) where:

• tr = in(c B , Y ).τ then .out(c B , w 3 ), and • C = (Φ; S) is the constraint system defined in Example 34.

We are now able to define the notion of equivalence associated to the symbolic semantics, namely symbolic trace equivalence (denoted ≈ s ). Definition 34. Let A = (P; Φ) and B = (Q; Ψ) be two simple configurations. We have that A ⊑ s B when, for every trace tr such that (P; Φ; ∅) tr = = ⇒ (P ′ ; Φ ′ ; S A ), for every θ ∈ Sol(Φ ′ ; S A ), we have that:

• (Q; Ψ; ∅) tr ′ = = ⇒ (Q ′ ; Ψ ′ ; S B )
where obs(tr ′ ) = obs(tr) with θ ∈ Sol(Ψ ′ ; S B ), and 122

Combining Compression and Reduction with Constraint Solving

• Φ ′ λ A θ ⇓ ∼ Ψ ′ λ B θ ⇓ where λ A θ (resp. λ B θ ) is the substitution associated to θ w.r.t. (Φ ′ ; S A ) (resp. (Ψ ′ ; S B )).
We have that A and B are in trace equivalence w.r.t. = ⇒, denoted A ≈ s B, if A ⊑ s B and B ⊑ s A.

Example 37. We have that ({Q 0 (sk B , pk(sk A ))}; Φ 0 ) ̸ ⊑ s ({Q 0 (sk B , pk(sk ′ A ))}; Φ 0 ). Continuing Example 36, we have seen that:

• ({Q 0 (sk B , pk(sk A ))}; Φ 0 ; ∅) tr = = ⇒ (∅; Φ; S), and

• θ = {Y → aenc(⟨w 1 , w 1 ⟩, w 2 )} ∈ Sol(Φ; S) (

see examples 34 and 35).

The only symbolic process that is reachable from ({Q 0 (sk B , pk(sk ′ A ))}; Φ 0 ; ∅) using tr (up to obs(•)) is (∅; Φ ′ ; S ′ ) with:

• Φ ′ = Φ 0 ⊎ {w 3 → aenc(⟨π 2 (N )
, ⟨n b , pk(skb)⟩⟩, pk(ska ′ ))}, and

• S ′ = { {w 0 , w 1 , w 2 } ⊢ ? Y y, π 2 (N ) = ? pk(ska ′ ) } .
One can check that θ is not a solution of (Φ ′ ; S ′ ).

For processes without replication, the symbolic transition system induced by = ⇒ is essentially finite. Indeed, the choice of fresh names for handles and second-order variables does not matter, and therefore the relation = ⇒ is essentially finitely branching. Moreover, the length of traces of a simple configuration is obviously bounded. Thus, deciding (symbolic) trace equivalence between processes boils down to the problem of deciding a notion of equivalence between sets of constraint systems. This problem is well-studied and several procedures already exist [START_REF] Baudet | Deciding security of protocols against off-line guessing attacks[END_REF][START_REF] Chevalier | Decidability of symbolic equivalence of derivations[END_REF], e.g. Apte [START_REF] Cheval | Trace equivalence decision: Negative tests and non-determinism[END_REF] (see Section 6.3).

Soundness and completeness

It is well-known that such symbolic semantics are sound and complete w.r.t. concrete semantics, and therefore that they capture the same notion of trace equivalence. This has been proved for instance in [START_REF] Baudet | Deciding security of protocols against off-line guessing attacks[END_REF][START_REF] Cheval | Deciding equivalencebased properties using constraint solving[END_REF]. Using the same approach, we can show soundness and completeness of the symbolic semantics (Figure 6.2) w.r.t. the concrete semantics (Figure 6.1). We have:

• Soundness: each transition in the symbolic semantics represents a set of transitions that can be done in the concrete semantics.

• Completeness: each transition in the concrete semantics can be matched by a transition in the symbolic semantics.

These results are formally expressed in propositions 14 and 15 below. Note that the mapping between the two semantics is up to R and computations on frames. 123 6. Putting Reduced Semantics into Practice and Integration in Apte Proposition 14. Let (P; Φ) be a simple configuration such that (P; Φ; ∅) tr = ⇒ (P s ; Φ s ; S s ), and θ ∈ Sol(Φ s ; S s ). We have that (P; Φ) obs(trθ)

----→ (NF R (P s λ); Φ ′ ) where Φ s λ ⇓ Φ ′ for λ the first-order solution of (P s ; Φ s ; S s ) associated to θ.

Proof. We proceed by induction on tr. If tr = ϵ, then we immediately conclude because θ = λ = ∅, P s = P and Φ ′ = Φ so an empty concrete execution suits. If tr = tr 0 .α, then we have (P; Φ; ∅)

tr 0 = = ⇒ (P 0 s ; Φ 0 s ; S 0 ) α = ⇒ (P s ; Φ s ; S)
with θ ∈ Sol(Φ s ; S). We note λ the associated first-order solution. We also have that θ 0 = θ |vars 2 (S 0 ) ∈ Sol(Φ 0 s ; S 0 ) with λ 0 = λ |vars 1 (S 0 ) the associated first-order solution. By inductive hypothesis, we thus obtain an execution (P; Φ) obs(tr 0 θ 0 ) -----→ (NF R (P 0 s λ 0 ); Φ 0 ) where Φ 0 s λ 0 ⇓ Φ 0 and λ 0 is the first-order solution of (P 0 s ; Φ 0 s ; S 0 s ) associated to θ 0 . We now reason by case analysis on α.

Case α = out(c, w). Then, there exists a process P s = out(c, t).P ′ ∈ P 0 s . More precisely, we have that P 0 s = {P s } ⊎ P ′ s , P s = {P ′ } ⊎ P ′ s , and Φ s = Φ 0 s ⊎ {w → t}. Since θ 0 is a solution with λ 0 as the associated first-order solution, it holds that tλ 0 is valid and thus P s λ 0 ∈ P 0 s λ 0 is not "blocked" and cannot be removed by the internal reduction. Hence P s λ 0 ∈ NF R (P 0 s λ 0 ). We thus have a decomposition NF R (P 0 s λ 0 ) = NF R ({P ′ s λ 0 }) ⊎ {P s λ 0 }. By validity, there must be a message u such that tλ 0 ⇓ u. Finally, we can construct an execution

(NF R (P 0 s λ 0 ); Φ 0 ) out(c, w) -----→ (NF R ({P ′ λ 0 }) ⊎ NF R (P ′ s λ 0 ); Φ 0 ⊎ {w → u}).
This can be done using λ instead of λ 0 and one can easily verify that the resulting concrete execution satisfies all requirements.

Case α = in(c, X). This case can be proved similarly to the output case. Case α is unobservable. In such cases, we remark that NF R (P s λ) = NF R (P 0 s λ) and Φ s = Φ 0 s . Thus, the execution given by the inductive hypothesis allows to conclude. Proposition 15. Let (P; Φ) be a simple configuration such that (P; Φ) tr -→ (P ′ ; Φ ′ ). There exists a symbolic configuration (P s ; Φ s ; S), a solution θ ∈ Sol(Φ s ; S), and a sequence tr s such that:

• (P; Φ; ∅) trs = = ⇒ (P s ; Φ s ; S);

• P ′ = P s λ, Φ s λ ⇓ Φ ′ ; and • tr = obs(tr s θ)
where λ is the first-order solution of (P s ; Φ s ; S) associated to θ.

Proof. We proceed by induction on tr. If tr = ϵ then we we immediately conclude by letting θ = λ = ∅, P s = P, tr s = ϵ, Φ s = Φ, and, S = ∅. If tr = tr 0 .α then we have (P; Φ) tr 0 -→ (P 0 ; Φ 0 ) α -→ (P ′ ; Φ ′ ). By inductive hypothesis, there must be a symbolic configuration (P 0 s ; Φ 0 s ; S 0 ) and a solution θ 0 ∈ Sol(Φ s ; S 0 ) (with λ 0 the associated first-order solution) such that (P; Φ; ∅)

tr 0 s = = ⇒ (P 0 s ; Φ 0 s ; S 0 ), P 0 = P 0 s λ 0 , Φ 0 s λ 0 ⇓ Φ ′ ,
and, obs(tr 0 s θ 0 ) = tr 0 . We now reason by case analysis on α.

If α = out(c, w). In that case, there must be a process P = out(c, t).P ′ ∈ P 0 and t must be valid. We thus also have a process P s = out(c, t s ).P ′ s ∈ P 0 s and t s λ 0 is valid. More precisely, one has the following decomposition: P 0 s = {P s } ⊎ P ′ s . It is thus possible to extend the given symbolic execution:

(P 0 s ; Φ 0 s ; S 0 ) out(c,w) =====⇒ ({P ′ } ⊎ P ′ s ; Φ 0 s ⊎ {w → t s }; S 0 ) = K s .
Remark that θ 0 (along with λ 0 ) is also a solution of K s since t s λ 0 is valid. Further, we need to mimic the internal reduction by executing τ -actions from K s (indeed, we do not necessarily have that P ′ = ({P ′ } ⊎ P ′ s )λ 0 ). More precisely, we trigger all available Then, Else, Blocked-Out rules as long as they produce new constraint systems of which θ 0 is still a solution. One can easily prove that the resulting execution satisfies all requirements.

If α = in(c, X). This case can be proved similarly to the previous case.

Finally, relying on these two results, we can establish that symbolic trace equivalence (≈ s ) exactly captures trace equivalence (≈). Actually, both inclusions can be established separately.

Proposition 16. For any simple configurations A and B, we have that:

A ⊑ B ⇐⇒ A ⊑ s B.
Proof. We consider two simple configurations A = (P; Φ) and B = (Q; Ψ). We prove the two directions separately.

(⇒) Let (P; Φ; ∅) trs = = ⇒ (P s ; Φ s ; S s ) and θ ∈ Sol(Φ s ; S s ). Applying Proposition 14, we obtain an execution A obs(tr s θ)

-----→ (P ′ ; Φ ′ ) for some

Φ ′ such that Φ s λ ⇓ Φ ′ . By hypothesis, we deduce B obs(tr s θ) -----→ (Q ′ ; Ψ ′ ) with Ψ ′ ∼ Φ ′ ∼ Φ s λ ⇓. Now, Proposition 15 implies an execution (Q; Ψ; ∅) tr ′ s = = ⇒ (Q s ; Ψ s ; S B s ) and a solution θ B ∈ Sol(Ψ s ; S B s ) such that obs(tr s θ) = obs(tr ′ s θ B ) and Ψ s λ B ⇓ Ψ ′ (
where λ B is the first-order solution associated to θ B and (Ψ s , S B s )). Remark that, since the choice of fresh second-order variable is irrelevant, we can w.l.o.g. and up to a bijection of second-order variables choose the ones in tr ′ s in such a way that obs(tr ′ s ) = obs(tr s ) (remind that obs(tr s θ) = obs(tr ′ s θ B ) so they may differ only on the second order variables). A quick inspection at the notion of solutions and at the only rule from the symbolic semantics which add second-order-variables to set of constraints shows that

dom(θ B ) = vars 2 ((S B s ; Ψ s )) = vars 2 (tr ′ s ) = vars 2 (tr s ) = vars 2 ((S s ; Φ s )) = dom(θ).
Further, for each X ∈ dom(θ), Xθ can be found as a recipe in obs(tr s θ). Since obs(tr s θ) = obs(tr ′ s θ B ), it holds that Xθ = Xθ B and thus θ = θ B concluding the proof of this direction. (⇐) Let (P; Φ) tr -→ (P ′ ; Φ ′ ). Applying Proposition 15, we obtain a symbolic execution (P; Φ; ∅) trs = = ⇒ (P s ; Φ s ; S s ) and θ ∈ Sol(Φ s ; S s ) such that Φ s λ ⇓ Φ ′ and obs(tr s θ) = tr. By hypothesis, we obtain an execution (Q; Ψ; ∅)

tr ′ s = = ⇒ (Q s ; Ψ s ; S B s ) such that obs(tr s ) = obs(tr ′ s ), θ ∈ Sol(Ψ S , S B s ) and Ψ s λ B θ ⇓ ∼ Φ s λ ⇓.
Next, we apply Proposition 14 and obtain B obs(tr

′ s θ) -----→ (Q ′ ; Ψ ′ ) for some Ψ ′ such that Ψ s λ B θ ⇓ Ψ ′ . We thus have Ψ ′ ∼ Ψ s λ B θ ⇓ ∼ Φ s λ ⇓ ∼ Φ ′ .
Finally, remark that obs(tr ′ s θ) = obs(tr ′ s )θ = obs(tr s )θ = obs(tr s θ) = tr.

Embedding Compression into Symbolic Semantics

In order to define the symbolic, compressed semantics, we proceed as we did for the concrete semantics in Chapter 5. There is no fundamental difficulty in doing so since compression only leverages syntactical information (i.e. nature of available observable actions) that is similarly

Putting Reduced Semantics into Practice and Integration in Apte

available at the symbolic level. The only technical difficulty arises from unobservable actions that were treated using internal reduction and are now treated using unobservable actions. We shall start with the symbolic semantics with unobservable actions. Formally, we define

• -→ as follows: A tr -→ B when A tr ′ = = ⇒ B and obs(tr ′ ) = tr. We shall state parts of the next results only for configurations with no conditional at top-level as they can be evaluated transparently with • -→. We formally define such configurations below.

Definition 35.

A basic process P is said to be quiescent when it starts with either an input ( i.e. P = in(c, x) for some c, x, P ) or with an output ( i.e. P = out(c, t).Q for some c, t, Q).

A simple process is said to be quiescent when all of its processes are quiescent. This is lifted to symbolic configurations in the obvious way.

Annotated Symbolic Semantics

One can define the annotated semantics by building on • -→ as it was defined by building on

• -→ in Chapter 5. The notions of skeletons and annotations are extended straightforwardly to respectively symbolic, quiescent processes and symbolic actions of • -→ (i.e. of the form in(c, X), out(c, w)). Note that we do not define skeletons for processes of the form if t 1 = t 2 then P else Q (i.e. non-quiescent processes) as we will require that such conditionals are executed before other observable actions.

We now equip the symbolic semantics (Figure 6.2) with annotations as it was done in Chapter 5 (see Figure 5.2). However, doing so for the symbolic configurations is simpler since they do not feature parallel composition nor replication. Labels are thus just handed over and extended with a from processes to their continuations. The resulting semantics is depicted in Figure 6.3.

Labels on processes of the form if t 1 = t 2 then P else Q are handed over to P or Q when evaluating the conditional.

Act α ({P }; Φ; S) α -→ ({P ′ }; Φ ′ ; S ′ ) ({[P ] ℓ } ⊎ P; Φ; S) [α] ℓ --→a ({[P ′ ] ℓ• } ⊎ P; Φ ′ ; S ′ ) α ∈ {in(•, •), out(•, •)}
Zero ({[0] ℓ } ⊎ P; Φ; S) [zero] ℓ ----→a (P; Φ; S)

Compression Strategy

As done before for configurations, we enrich symbolic configurations with a focus position.

The symbolic, compressed semantics deals with enriched symbolic configurations of the form (P; F ; Φ; S) that denotes a symbolic configuration (P ′ ; Φ; S) (where P ′ = P ⊎ {F } when F is a process and P ′ = P otherwise) with (possibly) a distinguished process F that is said to be under focus. We may write Sol(A) for an enriched symbolic configuration A = (P; F ; Φ; S) to denote the set Sol(Φ; S). Operators ⌈•⌉ and ⌊•⌋ are lifted in the obvious way:

⌈(P; Φ; S)⌉ = (P; ∅; Φ; S), ⌊(P; ∅; Φ; S)⌋ = (P; Φ; S) and ⌊(P; F ; Φ; S)⌋ = (P ⊎ {F }; Φ; S).

Combining Compression and Reduction with Constraint Solving

Start/In P is initial (P ; Φ; S) in(c, M ) -----→a (P ′ ; Φ; S ′ ) (P ⊎ {P }; ∅; Φ; S) foc(in(c, M ))

--------→c (P; P ′ ; Φ; S ′ ) Pos/In (P ; Φ; S) in(c, M ) -----→a (P ′ ; Φ; S ′ ) (P; P ; Φ; S) in(c, M ) -----→c (P; P ′ ; Φ; S ′ ) Neg P, P are quiescent (P ; Φ; S) α -→a (P ′ ; Φ ′ ; S ′ ) (P ⊎ {P }; ∅; Φ; S) α -→c (P ⊎ P ′ ; ∅;

Φ ′ ; S ′ ) α ∈ {zero, out(•, •)} Release (P; [out(c, t).P ] ℓ ; Φ; S) [rel] ℓ ----→c ({[out(c, t).P ] ℓ } ⊎ P; ∅; Φ; S ⊎ {t = ? t}) Release ⊥ (P; [0] ℓ ; Φ; S) [rel] ℓ .[zero] ℓ --------→c (∅; ∅; Φ; S)
Labels are implicitly set in the same way as in the annotated semantics. Neg is made nonbranching by imposing an arbitrary order on labelled skeletons of available actions. Definitions of positive processes and initial configurations are lifted to symbolic processes and symbolic multiset of processes straightforwardly. In particular, non-quiescent processes are not positive (conditionals at top level shall be executed in the next negative phase) and nonquiescent multisets of symbolic processes are not initial. We can now derive the compressed symbolic semantics tr -→c following the same pattern as for the concrete semantics leading to the rules depicted in Figure 6.4. The only differences are in rules Neg and Release. In Neg, we explicitly require that the underlying configuration is quiescent. This is in line with the concrete, compressed semantics for which configurations are necessarily quiescent since they are in normal form. This guard condition (i.e. the configuration should be quiescent) is needed to make the Neg rule non-branching based on an arbitrary order on labelled skeletons of available actions. In Release, we make sure that the output that popped out in the focused position is not blocked by adding the t = ? t constraint. By doing so, we are sure that the two ways to release a focus through rules Release and Release ⊥ are mutually exclusive: either the negative process in the focused position is a non-blocked output (that can be triggered using Release) or it is a blocked output (it can be triggered using the rules Blocked-Out and then Release ⊥ ) or it is a null process (it can directly be triggered using Release).

We derive similarly the notion of trace equivalence induced by -→c. We do not have to take care of the τ actions since they are performed implicitly in the compressed semantics. Definition 36. Let A = (P; F A ; Φ) and B = (Q; F B ; Ψ) be two simple configurations. We have that A ⊑ s c B when, for every trace tr such that (P; F A ; Φ; ∅) tr -→c A ′ , for every θ ∈ Sol(A ′ ), we have that:

• (Q; F B ; Ψ; ∅) tr -→c B ′ with θ ∈ Sol(B ′ ), and
• Φ(A ′ )λ A θ ⇓ ∼ Φ(B ′ )λ B θ ⇓ where λ A θ (resp. λ B θ )
• ({Q 0 (sk B , pk(sk A ))}; ∅; Φ 0 ; ∅) tr c
--→c (∅; ∅; Φ; S) where obs(tr c ) = obs(tr), and

• θ ∈ Sol(Φ; S) (see Example 34).
The only symbolic process that is reachable from ({Q 0 (sk B , pk(sk ′ A ))}; ∅; Φ 0 ; ∅) using obs(tr) is (∅; ∅; Φ ′ ; S ′ ) with:

• Φ ′ = Φ 0 ⊎ {w 3 → aenc(⟨π 2 (N )
, ⟨n b , pk(skb)⟩⟩, pk(ska ′ ))}, and

• S ′ = { {w 0 , w 1 , w 2 } ⊢ ? Y y; π 2 (N ) = ? pk(ska ′ ) } .
One can check that θ is not a solution of (Φ ′ ; S ′ ).

Soundness and Completeness

To prove that the symbolic, compressed trace equivalence coincides with the trace equivalence, we follow the same proof technique as the one developed in Section 6.2 when proving that the trace equivalence coincides with the symbolic trace equivalence (Proposition 16).

Thus, we show below (Theorem 4) that the compressed trace equivalence coincides with the compressed trace equivalence relying on the mappings between the symbolic, compressed semantics and the compressed semantics. Both directions of this mapping (propositions 17 and 18) follow from the already established mappings between symbolic executions and concrete executions (see propositions 14 and 15) and the fact that the compressed, symbolic strategy corresponds exactly to the compressed strategy (both exploration strategies are identical and both rely on syntactical information about processes equally available at the symbolic level or at the regular level). Proposition 17. Let (P; Φ) be a simple configuration such that ⌈(P; Φ; ∅)⌉ tr -→c (P s ; F A ; Φ s ; S s ), and θ ∈ Sol(Φ s ; S s ). We have that ⌈(P; Φ)⌉ trθ -→ c (NF R (P s λ); F ′ ; Φ ′ ) where F ′ = NF R (F λ) if F is a process and F ′ = ∅ otherwise, λ is the first-order solution of (Φ s ; S s ) associated to θ, and,

Φ ′ is such that Φ s λ ⇓ Φ ′ .
Proposition 18. Let (P; Φ) be a simple configuration such that ⌈(P; Φ)⌉ tr -→ c (P ′ ; F ′ ; Φ ′ ). There exists a symbolic configuration (P s ; F s ; Φ s ; S), a solution θ ∈ Sol(Φ s ; S), and a sequence tr s such that:

• ⌈(P; Φ; ∅)⌉ tr s -→c (P s ; F s ; Φ s ; S);

• P ′ = P s λ, F ′ = F s λ, Φ s λ ⇓ Φ ′ ; and • tr = tr s θ
where λ is the first-order solution of (Φ s ; S) associated to θ.

Combining Compression and Reduction with Constraint Solving

Applying exactly the same proof of Proposition 16 but invoking propositions 17 and 18 instead of propositions 14 and 15, we obtain the following theorem. Theorem 4. For any simple configurations A and B, we have that:

⌈A⌉ ⊑ c ⌈B⌉ ⇐⇒ ⌈A⌉ ⊑ s c ⌈B⌉.
As an immediate consequence of theorems 2 and 4, we obtain that the relations ≈ and ≈ s c coincide.

Corollary 4. For any simple processes A and B such that skl(A) = skl(B), we have that:

A ≈ B ⇐⇒ ⌈A⌉ ≈ s c ⌈B⌉.

Embedding Reduction into Symbolic Semantics

Unlike compression, which is essentially based on the input/output nature of actions, the reduction takes into account the exchanged messages and considers the notion of necessity introduced in Section 5.4. Remind that the reduced semantics can be seen as the compressed semantics with an additional constraint on the explored blocks: a block b can be explored after a trace tr only if, each block b ′ in tr that has less priority over b (violating the priority order), strong data dependencies forbid us to swap b before b ′ (to comply with that priority order). Formally, this is when b is authorised after tr (see Definition 28). The idea for lifting this to the symbolic semantics consists in replacing the authorised predicate by some additional constraints.

Priority Order

Remind that, in Section 5.4, we defined the priority order < as an order over blocks that is insensitive to recipes and handles. Since, we only deal with simple (symbolic) configurations in this chapter, we can refine this notion and let < be an order over channels. This is lifted to blocks by comparing the (single) channel of each block.

Example 39. We consider the symbolic version of Example 27. Let us consider the configuration A = ({P 1 , P 2 }; ∅; Φ 0 ; ∅) where Φ 0 = {w 0 → n} and P i are defined in Example 27. We consider a priority order such that c 1 < c 2 ( i.e. blocks produced by P 1 have priority over blocks produced by P 2 ). We now examine the two following symbolic, compressed traces:

tr 1 = b 1 .b 2 and tr 2 = b 2 .b 1 where b 1 = foc(in(c 1 , X 1 )).rel.out(c 1 , w 1 ) and b 2 = foc(in(c 2 , X 2 )).rel.out(c 2 , w 2 )
for some second-order variables X 1 , X 2 . The two symbolic configurations resulting from the compressed executions of tr 1 and tr 2 are of the form

({P ′ 1 , P ′ 2 }; ∅; Φ; S i ) where Φ = Φ 0 ∪ {w 1 → n 1 , w 2 → n 2 }, S 1 = { {w 0 } ⊢ ? X1 x 1 ; {w 0 , w 1 } ⊢ ? X2 x 2 } , and S 2 = { {w 0 } ⊢ ? X2 x 2 ; {w 0 , w 2 } ⊢ ? X1 x 1 } .
Remind that the sets of concrete processes that these two symbolic processes represent are different and some deeply rely on the specific order of blocks, which means that we cannot discard any of 6. Putting Reduced Semantics into Practice and Integration in Apte those symbolic, compressed traces. However, these sets have a significant overlap corresponding to concrete instances of the interleaved blocks that are actually independent, i.e. where the output of one block is not necessary to obtain the input of the next block. This problem has been discussed in Example 27 and depicted in Figure 5.4 (both in Section 5.4). In order to avoid considering such concrete processes twice, we may add a dependency constraint "X 1 ⋉w 2 " in C 2 , whose purpose is to discard all solutions θ such that the message x 1 λ θ can be derived without using w 2 → n 2 .

For instance, the concrete trace foc(in(c 2 , w 0 )).rel.out(c 2 , w 2 ).foc(in(c 1 , w 0 )).rel.out(c 1 , w 1 ) would be discarded thanks to this new constraint. The constraint "X 1 ⋉w 2 " would be the symbolic counterpart of the conditions imposed by the authorised predicate (b 2 , Φ) ▶ b 1 .

Dependency Constraints

We now introduce a new kind of constraints that we call dependency constraints. They will be used to represent the authorised predicate at the symbolic level.

Definition 37. A dependency constraint is a constraint of the form X⋉w where X is a vector of second-order variables in X 2 , and w is a vector of handles, i.e. variables in W.

Given a constraint system C = (Φ; S), a set S D of dependency constraints, and θ ∈ Sol(C). We write θ |= (Φ;S) S D when θ also satisfies the dependency constraints in S D , i.e. when:

for each X⋉w ∈ S D there is some X i ∈ X such that for any recipe M ∈ T (Σ pub , D C (X i )) satisfying M (Φλ θ ⇓) ⇓ = E (X i θ)(Φλ θ ⇓) ⇓ and valid(M (Φλ θ ⇓)), we have vars 1 (M ) ∩ w ̸ = ∅
where λ θ is the substitution associated to θ w.r.t. (Φ; S).

Intuitively, a dependency constraint X⋉w is satisfied as soon as at least one message among those in (Xθ)(Φλ θ ⇓) can only be deduced by using at least a message stored in w even when one allows to modify recipes (as long as it is still a solution yielding same messages). Note that the representative Φ ′ such that Φλ θ ⇓ Φ ′ is unimportant since the validity predicate is stable by = E .

Example 40. Continuing Example 39, assume that n 1 = n 2 = n and let θ = {X 1 → w 2 ; X 2 → w 0 }. We have that θ ∈ Sol(C 2 ) and the substitution associated to θ w.r.t. C 2 is λ 2 θ = {x 1 → n; x 2 → n}. However, θ does not satisfy the dependency constraint X 1 ⋉w 2 . Indeed, we have that

w 0 (Φλ 2 θ ) = (X 1 θ)(Φλ 2 θ ) = n and valid(w 0 (Φλ 2 θ )) whereas {w 0 } ∩ {w 2 } = ∅.
Intuitively, this means that there is no good reason to postpone the execution of the block on channel c 1 if the output on c 2 is not useful to build the message used in input on c 1 .

We shall now define formally how dependency constraints will be added to our constraint systems. Below, we define a function Deps(•) that takes a compressed symbolic trace as input and returns necessary dependency constraints making sure that all concrete instantiations satisfy the authorised predicates for any prefix of the trace. To simplify the presentation, for some X = (X 1 , . . . , X ℓ ) and w = (w 1 , . . . , w k ), we use the notation io c (X, w) as a shortcut for foc(in(c, X 1 )).in(c, X 2 ) . . . in(c, X ℓ ).rel.out(c, w 1 ) . . . out(c, w k ) when w ̸ = ∅ and for foc(in(c, X 1 )).in(c, X 2 ) . . . in(c, X ℓ ).rel.0 otherwise.

Combining Compression and Reduction with Constraint Solving

Definition 38 (Generation of dependency constraints). Let c be a channel, and tr = io c1 (X 1 , w 1 ). . . . .io cn (X n , w n ) be a symbolic, compressed trace. If there exists a rank k ≤ n For instance, after executing the symbolic, compressed trace io 1 .io 2 .io 3 , a dependency constraint of the form X 2 ⋉w 3 (represented by the left-most arrow in Figure 5.5) is generated. Further, on the symbolic, compressed trace io 3 .io 1 .io 2 we add X 1 ⋉w 3 after the second transition, and X 2 ⋉{w 3 , w 1 } (represented by the dashed 2-arrow in Figure 5.5) after the third transition.

such that c ≺ c k and c i ≺ c for all k < i ≤ n, then dep(tr, c) = { w | w ∈ w i with k ≤ i ≤ n}.

Symbolic Reduced Semantics

Dependency constraints give rise to a new notion of trace equivalence based on a symbolic, reduced semantics, which is the symbolic counterpart of the reduced semantics ( • -→ r ) where Deps(•) plays the role of (•, •) ▶ •. Intuitively, the symbolic, reduced semantics explores all symbolic executions but is equipped with the stronger notion of solution taking • |= (•;•) Deps(•) into account. We prefer directly defining the reduced trace equivalence below.

Definition 39 (reduced trace equivalence). Let A = (P; Φ) and B = (Q; Ψ) be two extended simple processes. We have that A ⊑ s r B when, for every sequence tr such that (P; Φ; ∅) tr -→c (P ′ ; Φ ′ ; S A ), for every θ ∈ Sol(Φ ′ ; S A ) such that θ |= (Φ ′ ;SA) Deps(tr), we have that:

• (Q; Ψ; ∅) tr -→c (Q ′ ; Ψ ′ ; S B ) with θ ∈ Sol(Ψ ′ ; S B
), and θ |= (Ψ ′ ;SB ) Deps(tr);

• Φ ′ λ A θ ⇓ ∼ Ψ ′ λ B θ ⇓ where λ A θ (resp. λ B θ ) is the substitution associated to θ w.r.t. (Φ ′ ; S A ) (resp. (Ψ ′ ; S B )).
We have that A and B are in reduced trace equivalence,

denoted A ≈ s r B, if A ⊑ s r B and B ⊑ s r A.

Soundness and Completeness

We first prove that the constraints generated by the Deps(•) operator plays exactly the same role as the authorised predicate of the reduced semantics (•, •) ▶ •.

Proposition 19. Let A be an initial, symbolic configuration, A tr -→c (P; F ; Φ; S) be a symbolic, compressed execution, and, θ ∈ Sol(Φ, S) a solution of the resulting symbolic configuration. It

Putting Reduced Semantics into Practice and Integration in Apte

holds that θ |= (Φ;S) Deps(tr) if, and only if, (tr 0 θ, Ψ) ▶ bθ for any prefix tr 0 .b of tr and some frame Ψ such that Φλ ⇓ Ψ.

Proof. We proceed by induction on the number of blocks in tr. If tr = ϵ then S ′ = ∅, Deps(tr) = ∅ and there is no prefix of tr of the form tr 0 .b. The equivalence is thus trivial. Otherwise, tr = tr 0 .b.

We let c be the channel of the block b and X its second-order variables. We distinguish two cases whether dep(tr 0 , c) is empty or not. If it is empty, then either tr 0 = ϵ or the last blocks of tr 0 on channels different from c are lower (w.r.t. ≺) than b. In both cases, we trivially have (tr 0 θ, Ψ) ▶ bθ for any Ψ such that Φλ ⇓ Ψ and conclude by inductive hypothesis. Otherwise, dep(tr 0 , c) = W 0 . By inductive hypothesis, it suffices to show the following:

(i) θ |= (Φ;S) X⋉W 0 if, and only if, (ii) (tr 0 θ, Ψ) ▶ bθ for some frame Ψ such that Φλ ⇓ Ψ.

Firstly, we remark that the choice of Ψ such that Φλ ⇓ Ψ is irrelevant since (•, •) ▶ • is stable by = E on the second argument. We thus fix such a Ψ. We note b i (for i from 0 to n) the successive blocks of tr 0 and note c i their respective channels. Since dep(tr 0 , c) ̸ = ∅, there exists a rank k < n such that c ≺ b k and c i ≺ c for all k < i ≤ n. We now prove the two implications separately.

((i) ⇒ (ii)) For the sake of the contradiction, we assume that (tr 0 θ, Ψ) ▶ bθ does not hold. Hence a block b ′ such that (b ′ = E bθ)Ψ and tr 0 θ ▷ b ′ does not hold. Since b i ≺ b ′ for all k < i and b ′ ≺ c k , the block b ′ must be independent of all blocks b k , . . . , b n . We now prove that it contradicts θ |= (Φ;S) X⋉W 0 . The latter implies the existence of some X i ∈ X such that one has for any recipe

M ∈ T (Σ pub , D C (X i )) such that M (Φλ θ ⇓) ⇓ = E (X i θ)(Φλ θ ⇓) ⇓ and valid(M (Φλ θ ⇓)), it holds that vars 1 (M ) ∩ W 0 ̸ = ∅. However, since (b ′ = E bθ)Ψ, one has a recipe M (counterpart of Xθ in b ′ ) such that M (Φλ θ ⇓) ⇓ = E (X i θ)(Φλ θ ⇓) ⇓ (remind that Φλ θ ⇓ Ψ).
But since b ′ and b i are independent, vars 1 (M ) ∩ W 0 = ∅ which is absurd.

((ii) ⇒ (i)) By (i) and c i ≺ c ≺ c k for all i such that k < i, we have that any block b ′ such that (b ′ = E b)Ψ must be recipe-dependent with at least a block b j for some k ≤ j ≤ n. For the sake of the contradiction, we assume that θ ̸ |= (Φ;S) X⋉W 0 . Hence, for any X i ∈ X, there exists a recipe M i computing the same message as X i θ for Φλ ⇓ such that vars 1 (M i ) ∩ W 0 = ∅. By replacing X i by M i in the block bθ we thus obtain a block b ′ such that (b ′ = E bθ)Ψ and vars 1 (b ′ ) ∩ W 0 = ∅ which contradicts the fact that b ′ must be recipe-dependent with at least a block b j for some k ≤ j ≤ n.

To prove that the symbolic, reduced trace equivalence coincides with the reduced trace equivalence, we now follow the same proof technique as the one developed for the compressed symbolic trace equivalence (w.r.t. compressed trace equivalence) in Subsection 6.2.2 and for the symbolic trace equivalence (w.r.t. trace equivalence) in Subsection 6. Proposition 20. Let (P; Φ) be an initial simple configuration such that ⌈(P; Φ; ∅)⌉ tr -→r (P s ; F A ; Φ s ; S s ), and θ ∈ Sol(Φ s ; S s ). We have that ⌈(P; Φ)⌉ trθ -→ r (NF R (P s λ); F ′ ; Φ ′ ) where

F ′ = NF R (F λ) if
F is a process and F ′ = ∅ otherwise, λ is the first-order solution of (Φ s ; S s ) associated to θ, and, Φ ′ is such that Φ s λ ⇓ Φ ′ .

Proposition 21. Let (P; Φ) be an initial, simple configuration such that ⌈(P; Φ)⌉ tr -→ r (P ′ ; F ′ ; Φ ′ ). There exists a symbolic configuration (P s ; F s ; Φ s ; S), a solution θ ∈ Sol(Φ s ; S), and a sequence tr s such that:

• ⌈(P; Φ; ∅)⌉ tr s -→r (P s ; F s ; Φ s ; S);

• P ′ = P s λ, F ′ = F s λ, Φ s λ ⇓ Φ ′ ; and • tr = tr s θ
where λ is the first-order solution of (Φ s ; S) associated to θ.

As already argued in Subsection 6.2.2, the two propositions above (propositions 20 and 21) are the two only ingredients necessary to obtain the theorem below (exactly the same proof of Proposition 16 applies).

Theorem 5. For any initial, simple configurations A and B, we have that:

⌈A⌉ ⊑ r ⌈B⌉ ⇐⇒ ⌈A⌉ ⊑ s r ⌈B⌉.
Proof. Same proof as the one of Proposition 16.

As an immediate consequence of theorems 3 and 5, we obtain that the relations ≈ and ≈ s r coincide.

Corollary 5. For any initial, simple processes

A and B such that skl(A) = skl(B), we have that:

A ≈ B ⇐⇒ ⌈A⌉ ≈ s r ⌈B⌉.

Integration in Apte

We validate our approach by integrating our refined semantics in the Apte tool. As already mentioned, Apte is a tool deciding trace equivalence for a fixed set of cryptographic primitives (i.e. "standard primitives") and bounded processes (no replication, no recursion).

As we shall see, the compressed semantics can easily be used as a replacement for the usual semantics in verification algorithms. However, exploiting the reduced semantics is not trivial, and requires to adapt the constraint resolution procedure. Fortunately, this can be done in a relatively superficial way, which avoids having to enter into the complex details of Apte's algorithm.

It is beyond the scope of this thesis to provide a detailed summary of how the verification tool Apte actually works. A paper of 50 pages long describing solely the constraint resolution procedure implemented in Apte (the part of the procedure corresponding to -→ A2 in our presentation) is now available [START_REF] Cheval | A procedure for deciding symbolic equivalence between sets of constraint systems[END_REF]. Detailed proofs of the soundness, completeness and termination of this algorithm are available in a long and technical appendix (more than 100 pages).

Putting Reduced Semantics into Practice and Integration in Apte

In order to show how our reduced semantics have been integrated in the constraint solving procedure of Apte, we choose to provide a high-level axiomatic presentation of the Apte's algorithm. This allows us to prove that our integration is correct in a relatively superficial way, which avoids having to enter into the complex details of Apte's algorithm (which manipulates matrices of constraint systems and additional kinds of constraints). These statements are consequences of results stated and proved in [START_REF] Cheval | Automatic verification of cryptographic protocols: privacy-type properties[END_REF] and have been written in concertation with Vincent Cheval (developer of Apte). However, due to some changes in the presentation, proving them will require to adapt most of the proofs. It is therefore beyond the scope of this thesis to provide formal proofs of these axioms.

In Subsection 6.3.1, we start with a high-level presentation of Apte's algorithm, following the original procedure [START_REF] Cheval | Trace equivalence decision: Negative tests and non-determinism[END_REF] but assuming public channels only. The purpose of this presentation is to provide the reader enough details about Apte to explain him how our optimisations have been integrated, leaving out unimportant details. We axiomatize the procedure in Subsection 6.3.2 and prove it correct w.r.t. trace equivalence in Subsection 6.3.3. Then we explain how compressed semantics can be used to enhance the procedure (Section 6.3.4). We finally describe how our reduction technique can be integrated (Section 6.3.5).

Apte in a Nutshell

Apte has been designed for a fixed equational theory E apte (formally defined in Example 12 from

Chapter 2) containing standard cryptographic primitives whose the signatutre is recalled next (where Σ 0 is a user-defined set of constants not involved in any equation):

Σ c = Σ 0 ∪ {aenc, pk, enc, hash, sign, vk, ⟨⟩}

Σ d = {adec, dec, check, π 1 , π 2 }.
We now give a high-level description of the algorithm that is implemented in Apte. The main idea is to perform all possible symbolic executions of the processes, keeping together the processes that can be reached using the same sequence of symbolic actions. Then, at each step of this symbolic execution, the procedure checks that for every solution of every process on one side, there is a corresponding solution for some process on the other side so that the resulting frames are in static equivalence. This check for symbolic equivalence is not obviously decidable. To achieve it, Apte's procedure relies on a set of rules for simplifying sets of constraint systems. These rules are used to put constraint systems in a solved form that enables the efficient verification of symbolic equivalence.

The symbolic execution used in Apte is essentially the same as

• = ⇒ described in Section 6.2.
However, Apte's constraint resolution procedure introduces new kinds of constraints. Fortunately, we do not need to enter into the details of those constraints and how they are manipulated. Instead, we treat them axiomatically.

Definition 40 (extended constraint system/symbolic process). An extended constraint system C + = (Φ; S; S + ) consists of a constraint system C = (Φ; S) together with an additional set S + of extended constraints. We treat this latter set abstractly, only assuming an associated We shall denote extended constraint systems by S + , S + 1 , etc. Extended symbolic processes will be denoted by A + , B + , etc. Sets of extended symbolic processes will simply be denoted by A, B, etc. For convenience, we extend Sol and Sol + to symbolic processes and extended symbolic processes in the natural way: Sol(P; Φ; S) = Sol(Φ; S) and Sol + (P; Φ; S; S + ) = Sol + (Φ; S; S + ).

We may also use the following notation to translate back and forth between symbolic processes and extended symbolic processes: (P; Φ; S) = (P; Φ; S; ∅) and (P; Φ; S; S + ) = (P; Φ; S).

We can now introduce the key notion of symbolic equivalence between sets of extended symbolic processes, or more precisely between their underlying extended constraint systems.

Definition 41 (symbolic equivalence). Given two sets of extended symbolic processes A and B, we have that A ≺ + B if for every A + = (P

A ; Φ A ; S A ; S + A ) ∈ A, for every θ ∈ Sol + (A + ), there exists B + = (P B ; Φ B ; S B ; S + B ) ∈ B such that θ ∈ Sol + (B + ) and Φ A λ A θ ∼ Φ B λ B θ where λ A θ (resp. λ B θ ) is the substitution associated to θ w.r.t. (Φ A ; S A ) (resp. (Φ B ; S B )).
We say that A and B are in symbolic equivalence, denoted by A ∼ + B, if A ≺ + B and B ≺ + A.

The whole trace equivalence procedure can finally be abstractly described by means of a transition system -→ A on pairs of sets of extended symbolic processes, labelled by observable symbolic actions. Informally, the intent is that a pair of processes is in trace equivalence iff only symbolically equivalent pairs may be reached from the initial pair using -→ A .

We now define -→ A formally. A transition (A; B) -→ A can take place iff A and B are in symbolic equivalence 1 .

Each transition for some observable action α consists of two steps, i.e.

(A; B) α -→ A (A ′′ ; B ′′ ) iff (A; B) α -→ A1 (A ′ ; B ′ ) and (A ′ ; B ′ ) - → A2 (A ′′ ; B ′′ ),
where the latter transitions are described below:

1. The first part of the transition consists in performing an observable symbolic action α (either in(c, X) or out(c, w)) followed by all available unobservable (τ ) actions. This is done for each extended symbolic process that occurs in the pair of sets, and each possible transition of one such process generates a new element in the target set. Formally, we have

(A; B) α -→ A1 (A ′ ; B ′ ) if A ′ = ∪ (P;Φ;S;S + )∈A { (P ′ ; Φ ′ ; S ′ ; S + ) | (P; Φ; S) α.τ * = == ⇒ (P ′ ; Φ ′ ; S ′ ) ̸ τ = ⇒ } ,
and correspondingly for B ′ . Note that elements of (A; B) that cannot perform α are simply discarded, and that the constraint systems of individual processes are enriched according to their own transitions whereas the extended part of constraint systems are left unchanged.

For a fixed symbolic action α, the α -→ A1 transition is deterministic. The choice of names for handles and second-order variables does not matter, and therefore the relation -→ A1 is also finitely branching.

2. The second part consists in simplifying the constraint systems of (A ′ ; B ′ ) until reaching solved forms. This part of the transition is non-deterministic, i.e. several different (A ′′ ; B ′′ ) may be reached depending on various choices, e.g. whether a message is derived by using a function symbol or one of the available handles. Although branching, this part of the transition is finitely branching. Moreover, only extended constraints may change: for any (P; Φ; S; S + 1 ) ∈ A ′′ there must be a S + 0 such that (P; Φ; S; S + 0 ) ∈ A ′ , and similarly for B ′′ .

An important invariant of this construction is that all the processes occurring in any of the two sets of processes have constraint systems that share a common structure. More precisely the transitions maintain that for any (P 1 ; Φ 1 ; S 1 ; S + 1 ), (P 2 ; Φ 2 ; S 2 ; S + 2 ) ∈ A∪B, vars 2 (S 1 ) = vars 2 (S 2 ) and D ⊢ ? X x occurs in S 1 iff it occurs in S 2 .

Example 42. Consider the simple basic processes

R i = in(c i , x i ).if x i = ok then out(c i , n i ) for i ∈ N, x i ∈ X , n i ∈ N , ok a public constant.
We illustrate the roles of -→ A1 and -→ A2 on the pair ({Q 0 }; {Q 0 }) where Q 0 = ({R 1 , R 2 }; ∅; ∅; ∅). We have that

({Q 0 }; {Q 0 }) in(c 2 , X 2 ) -----→ A1 ({Q t 0 , Q e 0 }; {Q t 0 , Q e 0 })
where Q t 0 and Q e 0 are the two symbolic processes one may obtain by executing the observable action in(c 2 , X 2 ), depending on the conditional after that input. Specifically, we have:

• Q t 0 = ({R 1 , out(c 2 , n 2 )}; ∅; {∅ ⊢ ? X2 x 2 , x 2 = ? ok}; ∅) • Q e 0 = ({R 1 }; ∅; {∅ ⊢ ? X2 x 2 , x 2 ̸ = ? ok}; ∅)
After this first step, -→ A2 is going to non-deterministically solve the constraint systems. From the latter pair, it will produce only two alternatives. Indeed, if x 2 = ? ok holds then Apte infers that the only recipe that it needs to consider is the recipe R = ok. In that case, the only considered solution is {X 2 → ok}. Otherwise, x 2 ̸ = ? ok holds but, at this point, no more information is inferred on X 2 . Formally,

({Q t 0 , Q e 0 }; {Q t 0 , Q e 0 }) -→ A2 ({Q t 1 }; {Q t 1 }) ({Q t 0 , Q e 0 }; {Q t 0 , Q e 0 }) -→ A2 ({Q e 1 }; {Q e 1 })
where

• Q t 1 = ({R 1 , out(c 2 , n 2 )}; ∅; {∅ ⊢ ? X2 x 2 , x 2 = ? ok}; S t 1 ) and Sol + (Q t 1 ) = {θ t 1 } where θ t 1 = {X 2 → ok}; • Q e 1 = ({R 1 }; ∅; {∅ ⊢ ? X2 x 2 , x 2 ̸ = ? ok}; S e 1 ). 136

Integration in Apte

The content of S t 1 and S e 1 is not important. Note that after -→ A2 , only one alternative remains in this example ( i.e. there is only one extended symbolic process on each side of the resulting pair) because only one of the two processes Q t 0 , Q e 0 complies with the choices made in each branch.

Definition 42 (≈ A ). Let A = (P A ; Φ A ) and B = (P B ; Φ B ) be two processes. We say that A ≈ A B when A ∼ + B for any pair (A; B) such that ((P A ; Φ A ; ∅; ∅); (P B ; Φ B ; ∅; ∅)) tr -→ A (A; B).

As announced above, we expect ≈ A to coincide with trace equivalence. We shall actually prove it (see Section 6.3.3), after having introduced a few axioms (Section 6.3.2). We note, however, that this can only hold under some minor assumptions on processes. In practice, Apte does not need those assumptions but they allow for a more concise presentation.

Definition 43. A simple process (resp. symbolic process) A is said to be quiescent when

A ̸ τ -→ (resp. A ̸ τ = ⇒). An extended symbolic process A + is quiescent when A + ̸ τ = ⇒.
In α -→ A1 transitions, processes must start by executing an observable action α and possibly some τ actions after that. Hence, it does not make sense to consider -→ A transitions on processes that can still perform τ actions. We shall thus establish that ≈ A and ≈ s coincide only on quiescent processes, which is not a significant restriction since it is always possible to pre-execute all available τ -actions before testing equivalences.

Specification of the Procedure

We now list and comment the specification satisfied by the exploration performed by Apte. These statements are consequences of results stated and proved in [START_REF] Cheval | Automatic verification of cryptographic protocols: privacy-type properties[END_REF] and it is beyond the scope of this thesis to prove them.

Soundness and completeness of constraint resolution.

The -→ A2 step, corresponding to Apte's constraint resolution procedure, only makes sense under some assumptions on the (common) structure of the processes that are part of the pairs of sets under consideration. Rather than precisely formulating these conditions (which would be at odds with the abstract treatment of extended constraint systems) we start by defining an over-approximation of the set of pairs on which we may apply -→ A2 at some point. We choose this over-approximation sufficiently large to cover pairs produced by the compressed semantics, and we then formulate our specifications in that domain. This over-approximation have to cover two things:

1. we have to consider additional disequalities of the form t ̸ = ? t in constraint systems since they are eventually added by our compressed symbolic semantics (see Figure 6.4);

2. we have to allow the removal of some extended symbolic process from the original sets since they are eventually discarded by our compressed (resp. reduced) symbolic semantics.

Given an extended symbolic process A + = (P; Φ; S; S + ), we denote by add(A + ) the set of extended symbolic processes obtained from A + by adding into S a number of disequalities of 6. Putting Reduced Semantics into Practice and Integration in Apte the form u ̸ = ? u with vars 1 (u) ⊆ vars 1 (S). This is then extended to sets of extended symbolic processes as follows:

add({A + 1 , . . . , A + n }) = {{B + 1 , . . . , B + n } | B + i ∈ add(A + i )}.
Definition 44 (valid and intermediate valid pairs). The set of valid pairs is the least set such that:

• For all quiescent, symbolic processes A = (P; Φ; ∅) and B = (Q; Ψ; ∅),

({ A }; { B }) is valid. • If (A; B) is valid and A ∼ + B, (A; B) α -→ A1 (A 1 ; B 1 ), A 2 ⊆ A 1 , B 2 ⊆ B 1 , A 3 ∈ add(A 2 ), B 3 ∈ add(B 2 ), and (A 3 ; B 3 ) -→ A2 (A ′ ; B ′ ) then (A ′ ; B ′ ) is valid.
In that case, the pair

(A 3 ; B 3 ) is called an intermediate valid pair.

It immediately follows that ({ A }; { B }) tr

-→ A (A; B) implies that (A; B) is valid and only made of quiescent, extended symbolic processes. But the notion of validity accommodates more pairs: it will cover pairs accessible under refinements of -→ A based on subset restrictions of -→ A1 . We may note that these pairs are actually pairs that would have been explored by Apte when starting with another pair of processes (e.g. a process that makes explicit the use of trivial conditionals of the form let u = t in P else Q ). Therefore, those pairs do not cause any trouble when they have to be handled by Apte.

Axiom 1 (soundness of constraint resolution). Let (A

′ ; B ′ ) be an intermediate valid pair such that (A ′ ; B ′ ) -→ A2 (A ′′ ; B ′′ ). Then, for all A ′′ ∈ A ′′ (resp. B ′′ ∈ B ′′ ) there exists some A ′ ∈ A ′ (resp. B ′ ∈ B ′ ) such that A ′ = A ′′ (resp. B ′ = B ′′ ) and Sol + (A ′′ ) ⊆ Sol + (A ′ ) (resp. Sol + (B ′′ ) ⊆ Sol + (B ′ )).
Apte almost treats symmetrically the two components of the pair of sets on which transitions take place. This is reflected by the fact that axioms concern both sides and are completely symmetric as in Axiom 1. In order to make the following specifications more concise and readable, we may state properties only for one of the two sets and consider "symmetrically" as well.

The completeness specification is in two parts: it first states that no first-order solution is lost in the constraint resolution process, and then that the branching of -→ A2 corresponds to different second-order solutions.

Axiom 2 (first-order completeness of constraint resolution). Let (A; B) be an intermediate valid pair. For all

A + ∈ A and θ ∈ Sol(A + ) there exists (A; B) -→ A2 (A 2 ; B 2 ), A + 2 ∈ A 2 and θ + ∈ Sol + (A + 2 ) such that A + 2 = A + and λ A θ = E λ A θ + , where λ A θ (resp. λ A θ + ) is the substitution associated to θ (resp. to θ + ) w.r.t. A + . Symmetrically for B + ∈ B.
To express that the branching of -→ A2 corresponds to different second-order solutions, we state in the next Axiom that if a branch of -→ A2 keeps a second-order solution for one process then it keeps it uniformly for all processes.

Axiom 3 (second-order consistency of constraint resolution). Let (A; B) be an intermediate valid pair such that (

A; B) -→ A2 (A 2 ; B 2 ), θ ∈ Sol + (A + ) for some A + ∈ A and θ ∈ Sol + (C + 2 ) 138 6.3. Integration in Apte for some C + 2 ∈ A 2 ∪ B 2 . Then there exists some A + 2 ∈ A 2 such that A + = A + 2 and θ ∈ Sol + (A + 2 ). Symmetrically for B + ∈ B.

Partial solution.

In order to avoid performing some explorations when dependency constraints of our reduced semantics are not satisfied, we shall be interested in knowing when all solutions of a given constraint system assign a given recipe to some variable. Such information is generally available in the solved forms computed by Apte, but not always in a complete fashion. We reflect this by introducing an abstract function that represents the information that can effectively be inferred by the procedure.

Definition 45 (partial solution). We assume a partial solution2 function ps which maps sets of extended constraints S + to a substitution, such that for any θ ∈ Sol + (P; Φ; S; S + ), there exists θ ′ such that θ = ps(S + )⊔θ ′ . We extend ps to extended symbolic processes: ps(P; Φ; S; S + ) = ps(S + ).

Intuitively, given an extended constraint system, the function ps returns the value of some of its second-order variables (those for which their instantiation is already completely determined).

Our specification of the partial solution shall postulate that the partial solution returned by Apte is the same for each extended symbolic process occurring in a pair (A; B) reached during the exploration. Moreover, there is a monotonicity property that ensures that this partial solution becomes more precise along the exploration.

({Q 0 }; {Q 0 }) in(c 2 , X 2 ) -----→ A ({Q t 1 }; {Q t 1 }) covers all executions of the form Q 0 in(c2,X2).τ then =========⇒ Q t
1 going to the then branch even though the only solution of

Q t 1 is θ t 1 . Indeed, if θ ∈ Sol( Q t 1 )
then the message computed by X 2 θ should be equal to ok and thus no first-order solution is lost as stated by Axiom 2. Moreover, because the value of X 2 is already known in Q t 1 , we may have ps(Q t 1 ) = ps(S + 1 ) = {X 2 → ok}.

Proof of the Original Procedure

The procedure, axiomatized as above, can be proved correct w.r.t the regular symbolic semantics = ⇒ and its induced trace equivalence ≈ s as defined in Section 6.2.1. Of course, Axiom 4 is unused in this first result. It will be used later on when implementing our reduced semantics. We

Putting Reduced Semantics into Practice and Integration in Apte

first start by establishing that all the explorations performed by Apte correspond to symbolic executions. This result is not new and has been established from scratch (i.e. without relying on the axioms stated in the previous section) in [START_REF] Cheval | Automatic verification of cryptographic protocols: privacy-type properties[END_REF]. Nevertheless, we found it useful to establish that our axioms are sufficient to prove correctness of the original Apte procedure. The proofs provided in the following sections to establish correctness of our optimised procedure follow the same lines as the ones presented below.

Lemma 16. Let (A; B) be a valid pair such that

(A; B) tr -→ A (A ′ ; B ′ ). Then, for all A ′ ∈ A ′ there is some A ∈ A such that A tr ′ = = ⇒ A ′
for some tr ′ with obs(tr ′ ) = tr. Symmetrically for

B ′ ∈ B ′ .
Proof. We proceed by induction on tr. When tr is empty, we have that (A; B) = (A ′ ; B ′ ), and the result trivially holds. Otherwise we have that:

(A; B) α -→ A1 (A 1 ; B 1 ) -→ A2 (A 2 ; B 2 ) tr 0 -→ A (A ′ ; B ′ ) with tr = α.tr 0 .
Let A ′ be a process of A ′ . By induction hypothesis we have some

A 2 ∈ A 2 such that A 2 tr ′ 0 = = ⇒ A ′ with obs(tr ′ 0 ) = tr 0 . By Axiom 1 there is some A 1 ∈ A 1 such that A 1 = A 2 ,

and by definition of -→ A1 we finally find some

A ∈ A such that A α.τ k = == ⇒ A 1 . To sum up, we have A ∈ A such that A tr = ⇒ A ′ with obs(tr ′ ) = tr.
We now turn to completeness results. Assuming that processes under study are in equivalence ≈ A (so that Apte will not stop its exploration prematurely), we are able to show that any valid symbolic execution (i.e. a symbolic execution with a solution in its resulting constraint system) is captured by an exploration performed by Apte. Actually, since Apte discards some second-order solution during its exploration, we can only assume that another second-order solution with the same associated first-order solution will be found. We prove the former in the next lemma. Lemma 17. Let A = (P; Φ; ∅), B = (Q; Ψ; ∅) and A ′ = (P ′ ; Φ ′ ; S ′ ) be three quiescent, symbolic processes such that (P; Φ) ≈ A (Q; Ψ), A tr = ⇒ A ′ , and θ ∈ Sol(A ′ ). Then there exists an Apte

exploration ({ A }; { B }) tr o -→ A (A ′ ; B ′ ) and some A + ∈ A ′ , θ + ∈ Sol + (A + ) such that obs(tr) = tr o , A + = A ′ and λ θ = E λ θ + , where λ θ (resp. λ θ + ) is the substitution associated to θ (resp. to θ + ) with respect to (Φ ′ ; S ′ ). Symmetrically for B tr = ⇒ B ′ .
Proof. By hypothesis, we have that A tr = ⇒ A ′ . We will first reorganise this derivation to ensure that τ actions are always performed as soon as possible. Then, we proceed by induction on obs(tr). When obs(tr) is empty, we have that

A ′ = A since A is quiescent. Let (A ′ ; B ′ ) = ({ A }; { B }), A + = A , θ + = θ.
We have that θ ∈ Sol(A) and therefore θ ∈ Sol + ( A ), i.e. θ + = θ ∈ Sol + (A + ). We easily conclude.

Otherwise, consider

A tr0 = = ⇒ A 1 α.τ k = == ⇒ A ′ with θ ∈ Sol(A ′ ). Let A ′ = (P ′ ; Φ ′ ; S ′ ) and A 1 = (P 1 ; Φ 1 ; S 1
). We have that S 1 ⊆ S ′ . Since θ ∈ Sol(A ′ ), we also have θ| V ∈ Sol(A 1 ) where V = vars 2 (S 1 ). Therefore, we apply our induction hypothesis and we obtain that there exists an Apte exploration

({ A }; { B }) tr ′ 0 -→ A (A 1 ; B 1 ) and some A + 1 ∈ A 1 , θ + 1 ∈ Sol + (A + 1 ) such that 140 6.3. Integration in Apte obs(tr 0 ) = tr ′ 0 , A + 1 = A 1
, and the first-order substitutions associated to θ| V and θ + 1 with respect to (Φ 1 ; S 1 ) are identical. By hypothesis we have (P; Φ) ≈ A (Q; Ψ), thus A 1 ∼ + B 1 . Hence a -→ A1 transition can take place on that pair. By definition of -→ A1 and since

A + 1 = A 1 α.τ k = == ⇒ A ′ with A ′ quiescent, there must be some (A 1 ; B 1 ) α -→ A1 (A 2 ; B 2 ) with A + 2 ∈ A 2 , A + 2 = A ′ .
Thus θ ∈ Sol(A + 2 ) and we can apply Axiom 2. There exists

(A 2 ; B 2 ) -→ A2 (A ′ ; B ′ ), A + ∈ A ′ , A + = A + 2 and θ + ∈ Sol + (A + ) such that A + 2 = A + ,
and the substitutions associated to θ (resp. θ + ) w.r.t. (Φ ′ ; S ′ ) coincide. To sum up, the exploration

({ A }; { B }) tr ′ 0 -→ A (A 1 ; B 1 ) α -→ A1 (A 2 ; B 2 ) - → A2 (A ′ ; B ′ )
together with A + ∈ A ′ , and θ + ∈ Sol + (A + ) satisfy all the hypotheses.

We now prove that Apte discards the same second-order solutions in a given exploration. To put in other words, if an execution with an associated second-order solution θ is captured by an exploration and θ is not discarded by this exploration (possibly for another execution) then the former is captured by the latter with this θ.

Lemma 18. Let A, B, A ′ be quiescent symbolic processes such that

A tr = ⇒ A ′ = (P ′ ; Φ ′ ; S ′ ), θ ∈ Sol(A ′ ) and ({ A }; { B }) tr o -→ A (A ′ ; B ′ ) with obs(tr) = tr o and θ ∈ Sol + (C) for some C ∈ A ′ ∪ B ′ . Then there exists some A + ∈ A ′ such that A + = A ′ and θ ∈ Sol + (A + ). Symmetrically for B tr = ⇒ B ′ .
Proof. We proceed by induction on tr o . When tr o is empty, we have that A ′ = A (because A is quiescent), A ′ = { A }, and B ′ = { B }. Let A + be A = A ′ . We deduce that θ ∈ Sol + (A + ) from the fact that θ ∈ Sol(A) and A + = A .

We consider now the case of a non-empty execution:

({ A }; { B }) tr o -→ A (A 1 ; B 1 ) α -→ A1 (A 2 ; B 2 ) -→ A2 (A 3 ; B 3 ) and A tr = ⇒ A 1 α.τ k = == ⇒ A 3 .
Note that, by reordering τ actions, we can assume A 1 to be quiescent. By assumption we have θ ∈ Sol(A 3 ), obs(tr) = tr o and θ ∈ Sol + (C 3 ) for some C 3 ∈ A 3 ∪ B 3 . By Axiom 1, there exists some

C 2 ∈ A 2 ∪ B 2 such that θ ∈ Sol + (C 2 ). By definition of -→ A1 we obtain C 1 ∈ A 1 ∪ B 1 such that C 1 α.τ k = == ⇒ C 2 and S + (C 1 ) = S + (C 2 ) (i.
e. the sets of extended constraints of C 1 and C 2 coincide). The first fact implies θ| V ∈ Sol(C 1 ) by monotonicity (where V = vars 2 (S(C 1 )), i.e. second-order variables that occur in the set of non-extended constraints of C 1 ), and the second allows us to conclude more strongly that θ| V ∈ Sol + (C 1 ). Since we also have θ| V ∈ Sol(A 1 ) by monotonicity, the induction hypothesis applies and we obtain some

A + 1 ∈ A 1 with A + 1 = A 1 and θ| V ∈ Sol + (A + 1 )
. By definition of -→ A1 , and since

A + 1 α.τ k = == ⇒ A 3 ̸ τ = ⇒ (A 3 is quiescent by hypothesis), we have A + 2 ∈ A 2 such that A + 2 = A 3 and S + (A + 1 ) = S + (A + 2 )
. Therefore, we have that θ ∈ Sol( A + 2 ), and the fact that S + (A + 1 ) = S + (A + 2 ) allows us to say that θ ∈ Sol + (A + 2 ). We can finally apply Axiom 3 to obtain some A + 3 such that

A + 3 = A + 2 = A 3 and θ ∈ Sol + (A + 3 ).

Putting Reduced Semantics into Practice and Integration in Apte

Lemmas 16 to 18 are the only ingredients needed to show that Apte computes the trace equivalence as shown next.

Proposition 22. For any quiescent extended simple processes, we have that:

A ≈ s B if, and only if, A ≈ A B.
Proof. Let A 0 = (P; Φ), B 0 = (P ′ ; Φ ′ ), A 0 = {(P; Φ; ∅; ∅)} and B 0 = {(P ′ ; Φ ′ ; ∅; ∅)}. We prove the two directions separately.

(⇒) Assume A 0 ≈ s B 0 and consider some exploration (A 0 ; B 0 ) tr o -→ A (A; B). We shall establish that A ≺ + B. Let A + = (P A ; Φ A ; S A ; S + A ) be in A and θ ∈ Sol + (A + ). By Lemma 16, we have (P; Φ; ∅) tr = ⇒ A + such that obs(tr) = tr o . By hypothesis, there exists B = (P B ; Φ B ; S B ) such that (P ′ ; Φ ′ ; ∅)

tr ′ = = ⇒ B, obs(tr ′ ) = obs(tr) = tr o , θ ∈ Sol(B) and Φ B λ B θ ∼ Φ A λ A θ .
We can finally apply Lemma 18, which tells us that there must be some

B + ∈ B such that B + = B and θ ∈ Sol + (B + ). (⇐) We now establish A 0 ⊑ s B 0 assuming A 0 ≈ A B 0 . Consider (P; Φ; ∅) tr = ⇒ A and θ ∈ Sol(A). If A is not quiescent, it
is easy to complete the latter execution into (P; Φ; ∅) For any X ∈ vars 2 (S B ) = vars 2 (S A ), we have valid((Xθ)(Φ A λ θ + )), valid((Xθ + )(Φ A λ θ + )), and

tr.τ k = == ⇒ A ′ = (P A ; Φ A ; S A ) and θ ∈ Sol(A ′ ) such that A ′ is quiescent. By Lemma 17 we know that (A 0 ; B 0 ) tr o -→ A (A; B) with obs(tr) = tr o , A + ∈ A, θ + ∈ Sol + (A + ) with A ′ = A + and λ θ = E λ θ + where λ θ (resp. λ θ + )
(Xθ)(Φ A λ θ + ) ≡ E d (Xθ)(Φ A λ θ ) ≡ E d x A λ θ ≡ E d x A λ θ + ≡ E d (Xθ + )(Φ A λ θ + ) where x A is the first-order variable associated to X in S A . Since Φ A λ θ + ∼ Φ B λ B θ + , we deduce that (Xθ)(Φ B λ B θ + ) ≡ E d (Xθ + )(Φ B λ B θ + ), valid((Xθ)(Φ B λ B θ + )
) and therefore θ ∈ Sol( B ), and its associated substitution λ B θ w.r.t. (Φ B ; S B ) coincides with λ B θ + , and therefore

Φ A λ θ ∼ Φ B λ B θ is a direct consequence of Φ B λ B θ + ∼ Φ A λ θ + and λ θ = E λ θ + .

Integrating Compression

We now discuss the integration of the symbolic compressed semantics of Section 6.2.2 as a replacement for the regular symbolic semantics in Apte. Since the symbolic compressed semantics does not interact with exchanged data, we are able to simply adapt • -→ A1 c to reflect the compressed strategy.

Putting Reduced Semantics into Practice and Integration in Apte

Theorem 6. For any quiescent extended simple processes, we have that:

⌈A⌉ ≈ s c ⌈B⌉ if, and only if, A ≈ A c B.

Integrating Dependency Constraints

We now define a final variant of Apte explorations, which integrates the reduction strategy to further reduce redundant explorations. We can obviously generate dependency constraints in Apte, just like we did in Section 6.2.3, but the real difficulty is to exploit them in constraint resolution to prune some branches of the exploration performed by Apte. Roughly, we shall simply stop the exploration when reaching a state for which we know that all of its solutions violate dependency constraints. To do that, we rely on the notion of partial solution introduced in Section 6.3.1. In other words, we do not modify Apte's constraint resolution, but simply rely on information that it already provides to know when dependency constraints become unsatisfiable.

As we shall see in Section 6.4, this simple strategy is very satisfying in practice.

Definition 47. We define -→ A r as the greatest relation contained in -→ A c and such that, for any symbolic processes A and B with empty constraint sets,

({ A }; { B }) tr -→ A r (A ′ ; B ′ ) implies that there is no X⋉w ∈ Deps(tr) such that for all X i ∈ X we have X i ∈ dom(ps(A ′ ; B ′ )), and w ∩ vars 1 (X i ps(A ′ ; B ′ )) = ∅.
Finally, given two simple extended process A = (P A ; Φ A ) and B = (P B ; Φ B ), we say that A ≈ A r B when A ∼ + B for any pair (A; B) such that ((P A ; Φ A ; ∅; ∅);

(P B ; Φ B ; ∅; ∅)) tr -→ A r (A; B).
Example 45. Continuing Example 44, consider the following compressed exploration, where Q 3 contains the constraints ∅ ⊢ ? X2 x 2 , {w 2 } ⊢ ? X1 x 1 , x 2 = ? ok and x 1 = ? ok:

({Q 0 }; {Q 0 }) foc(in(c 2 , X 2 )) --------→ A c out(c 2 , w 2 ).rel --------→ A c ({Q 2 }; {Q 2 }) foc(in(c 1 , X 1 )) --------→ A c out(c 1 , w 1 ).rel --------→ A c ({Q 3 }; {Q 3 }).
Assuming that ps(Q 3 ) = {X 2 → ok, X 1 → ok} (which is the case in the actual Apte procedure) this compressed exploration is not explored by -→ A r because

X 1 ⋉w 2 ∈ Deps(io c2 (X 2 , w 2 ).io c1 (X 1 , w 1 )), X 1 ps(Q 3 ) = ok and {w 2 } ∩ vars 1 (ok) = ∅.
Below, we show that all reduced executions are captured by • -→ A r .

Lemma 22. Let A = (P; Φ; ∅), B = (Q; Ψ; ∅) and A ′ = (P ′ ; Φ ′ ; S ′ ) be quiescent, simple symbolic processes such that (P; Φ)

≈ A r (Q; Ψ), A tr -→c A ′ , θ ∈ Sol(A ′ ) and θ |= (Φ ′ ;S ′ ) Deps(

tr). Then there exists an exploration

({ A }; { B }) tr -→ A r (A ′ ; B ′ ) and some A + ∈ A ′ , θ + ∈ Sol + (A + ) such that A + = A ′ and λ θ = E λ θ + ,
where λ θ (resp. λ θ + ) is the substitution associated to θ (resp. to θ + ) with respect to (Φ ′ ; S ′ ). Symmetrically for B tr -→c B ′ .

Proof. We proceed by induction on tr. The empty case is easy. Otherwise, consider A tr -→c A 1 α -→c A 3 = (P 3 ; Φ 3 ; S 3 ) with θ ∈ Sol(A 3 ), A 1 , A 3 quiescent, and θ |= (Φ3;S3) Deps(tr.α). Let A 1 = (P 1 ; Φ 1 ; S 1 ) and V 1 = vars 2 (S 1 ). We also have θ| V1 ∈ Sol(A 1 ) and θ| V1 |= (Φ1;S1) Deps(tr),

Putting Reduced Semantics into Practice and Integration in Apte

Implementation and Benchmarks

The POR techniques we presented in this part have been implemented, following the above approach, in the official version of Apte [aptb]. We discuss the implementation in Subsection 6.4.1 and provide and comment on benchmarks in Subsection 6.4.2.

Implementation

In practice, many processes enjoy a nice property that allows one to ensure that blocking outputs will never occur: it is often the case that enough tests are performed before outputting a term to ensure its validity.

Example 46. Consider the following process, where k ′ is assumed to be valid ( e.g. because it is a pure constructor term):

in(c, x).if sdec(x, k) = hash(u) then out(c, senc(sdec(x, k), k ′ ))
The term outputted during an execution is necessarily valid thanks to the test that is performed just before this output.

We exploit this property in order to avoid adding additional disequalities when integrating compression in Apte. Therefore, in this section, we will restrict ourselves to simple processes that are non-blocking as defined below. Definition 48. Let (P; Φ) be a simple process. We say that (P; Φ) is non-blocking if u is valid

for any tr, c, u, Q ′ , Q, Ψ such that (P; Φ) tr -→ ({out(c, u).Q ′ } ∪ Q; Ψ).
This condition may be hard to check in general, but it is actually quite easy to see that it is satisfied on all of our examples. Roughly, enough tests are performed before any output action, and this ensures the validity of the term when the output action becomes reachable as in Example 46.

We implemented •

-→ A c and • -→ A r for non-blocking processes in the main development line of the tool Apte distributed at [aptb]. Those optimisations can be enabled using an option

-with_por [compr|red] [improper].
It is thus possible to use the compressed or the reduced semantics with or without the "semi" variant that does not stop exploring after an improper block. The modifications of the code (≈ 2kloc of OCaml) are summarised at https://github.com/LCBH/APTE/compare/ref...APTE: POR. Sources and instructions for reproduction of the following benchmarks are openly available [Hira].

Benchmarks

We now report on experimental results. We ran the tool (compiled with OCaml 3.12.1) on a single 2.67GHz Xeon core with 48GO of RAM and compared three different versions:

• reference: the reference version without our optimisations (i.e. ≈ A );

• compression: using only the compression optimisation (i.e. ≈ A c );

• reduction: using both compression and reduction (i.e. ≈ A r ).

For reference, the version of Apte that we are using in the benchmarks below is available at https://github.com/APTE/APTE/releases/tag/bench-POR-LMCS together with all benchmark files, in subdirectory bench/protocols. More details, including instructions for reproducing our benchmarks are available at http://www.lsv.fr/~hirschi/apte_por.

We first show examples in which equivalence holds. They are the most significant, because the time spent on inequivalent processes is too sensitive to the order in which the (depth-first) exploration is performed.

Toy example. We consider a parallel composition of n roles R i as defined in Example 42:

P n := Π n i=1 R i .
When executed in the regular symbolic semantics = ⇒, the 2n actions of P n may be interleaved in (2n)!/2 n ways in a trace containing all actions. In the compressed symbolic semantics -→c, the actions of individual R i processes must be bundled in blocks, so there are only n! interleavings containing all actions. In the reduced symbolic semantics -→r, only one interleaving of that length remains: the trace cannot deviate from the priority order, since the only way to satisfy a dependency constraint would be to feed an input with a message that cannot be derived without some previously output nonce n i , but in that case the message will not be ok and the trace won't be explored further. Note that there is still an exponential number of symbolic traces in the reduced semantics when one takes into account traces with less than 2n actions. We show in Figure 6.5 the time needed to verify P n ≈ P n for n = 1 to 22 in the three versions of Apte described above: reference, compression and reduction. The results, in logarithmic scale, show that each of our optimisations brings an exponential speedup, as predicted by our theoretical analysis. Similar improvements are observed if one compares the numbers of explored pairs rather than execution times.

Denning-Sacco protocol. We ran a similar benchmark, checking that Denning-Sacco [START_REF] Denning | Timestamps in key distribution protocols[END_REF] ensures strong secrecy in various scenarios. The protocol has three roles and we added processes playing those roles in turn, starting with three processes in parallel. Strong secrecy is expressed by considering, after one of the roles B, the output of a message encrypted with the established key on one side of the equivalence, and with a fresh key on the other side. The results are plotted in Figure 6.6. The fact that we add one role out of three at each step explains the irregular growth in verification time. We still observe an exponential speedup for each optimisation. Practical impact. Finally, we illustrate how our optimisations make Apte much more useful in practice for investigating interesting scenarios. Verifying a single session of a protocol brings little assurance into its security. In order to detect replay attacks and to allow the attacker to compare messages that are exchanged, at least two sessions should be considered. This means having at least four parallel processes for two-party protocols, and six when a trusted third party is involved. This is actually beyond what the unoptimised Apte can handle in a reasonable amount of time. We show in Figure 6.7 how many parallel processes could be handled in 20 hours by Apte on various use cases of protocols, for the same three variants of Apte as before, i.e. reference, compression and reduction. We verify an anonymity property for the Passive Authentication protocol of e-passports. For other protocols, we analyse strong secrecy of established keys: for one of the roles we add, on one side of the equivalence, an output encrypted by the established We finally present the benefits of our optimisations for discovering attacks. We performed some experiments on flawed variants of protocols, shown in Figure 6.8, corresponding to example files in subdirectory bench/protocols/attacks/ of the above mentioned release. The scenario Denning-Sacco A expresses strong secrecy of the (3-party) Denning-Sacco protocol, but this time on two instances of roles at the same time (instead of one as in Figure 6.7). In Denning-Sacco B, we consider again a form of strong secrecy expressed by outputting encrypted messages but this time at the end of role B. The Needham-Schroeder pub scenario corresponds to strong secrecy of the public-key Needham-Schroder protocol. The E-Passport PA exposed experiments show that anonymity is (obviously) lost with the Passive Authentication protocol when the secret key is made public. Similarly, the Yahalom exposed experiment shows that strong secrecy of Yahalom is lost when secrets keys are revealed. Since Apte stops its exploration as soon as an attack is found, the time needed for Apte to find the attack highly depends on the order in which the depth-first exploration is performed. However, as shown in Figure 6.8, we always observe in practice dramatic improvements brought by our optimisations compared to the reference version of Apte. In some cases, our optimisations are even mandatory for Apte to find the attack using reasonable resources.

Protocol reference compression reduction Denning-Sacco A (6 proc.) OoM 0.07s 0.02s Denning-Sacco B (6 proc.) 5.83s 0.04s 0.04s Needham-Shroeder pub (7 proc.) TO 0.77s 0.67s Needham-Shroeder pub (5 proc.) 0.79s 0.21s 0.13s E-Passport PA exposed (8 proc.) TO 0.02s 0.02s E-Passport PA exposed (6 proc.) 4.37s 0.03s 0.02s Yahalom exposed (4 proc.)

7.24s 0.02s 0.02s Figure 6.8 Impact of optimisations for finding attacks ("X proc." stands for X parallel processes, OoM denotes a consumption of >32Go of RAM and TO denotes a running time of >20 hours).

Conclusion

We have successfully put our two POR techniques into practice. We have shown that compression can be easily lifted to the symbolic setting and that reduction can be embedded into the symbolic

Putting Reduced Semantics into Practice and Integration in Apte

setting by means of a new simple kind of contraints. We have fully described how we integrated those techniques in the state-of-the-art tool Apte and we have proved its correction. Finally, we have provided experimental results showing that the resulting optimised tool Apte has now much better performance. We believe that the interest of our POR techniques goes beyond the (important) speedups we were able to bring to the tool Apte. Indeed, we believe that other tools could benefit from the same important improvements by reusing the methodology developed in this chapter. We also think that our POR techniques could be adapted for other settings than the constraint solving one. We support those claims in related future work below.

Future Work. In addition to the future work we already discussed in Section 5.5, we now mention some avenues for future developments specific to the practical aspects of our POR techniques.

We first note that our compression technique should be applicable and useful in other verification tools, not necessarily based on symbolic execution or constraint solving. First, we have conducted [START_REF] Hirschi | Réduction d'entrelacements pour l'équivalence de traces[END_REF][START_REF] Hirschi | SPEC with dependency constraints[END_REF] an experimental implementation in the tool Spec [TD10] of a preliminary version of our compression and reduction techniques. But this project has been abandoned because of the drawbacks of Spec over Apte (see Subsection 1.4.1 for a comprehensive comparison with Apte) and the complexity of the correction argument.

More interestingly, it is noteworthy that our compression technique has already been independently implemented4 in the tool Akiss [CCK12] (it even is its default behavior) whereas this tool is not based on constraint solving but is rather based on a dedicated Horn clauses abstraction and a resolution procedure (see Subsection 1.4.1 for a more comprehensive description and comparison with Apte). This has been made possible because our compression technique boils down to a constrained exploration strategy taking only nature of available actions into account.

Similarly, one could seek for adapting our techniques for verification methods based on backward search where explorations start with attack states (e.g. Tamarin, Maude-NPA) instead of forward search where explorations start with the initial state as is the case in our framework. Finally, one could easily extend the class of simple processes towards action-deterministic processes; notably allowing (nested) parallel compositions and non-action-deterministic prefixes at the beginning of processes. We already have implemented those extensions in the tool Apte but we have not yet proved their correction.

Related Work

along with available transitions to disable some provably redundant transitions. Note that these two kinds of techniques are compatible, and are indeed often combined to obtain better reductions. Theoretical POR techniques [GvLH + 96] apply to transition systems which may not be explicitly available in practice, or whose explicit computation may be too costly. In such cases, POR is often applied to an approximation of the LTS that is obtained through static analysis.

Another, more recent approach is to use dynamic POR [FG05, TKL + 12, AAJS14] where the POR arguments are applied based on information that is obtained during the execution of the system.

Clearly, classical POR techniques would apply to our concrete LTS, but that would not be practically useful since this LTS is wildly infinite, taking into account all recipes that the attacker could build. Applying most classical POR techniques to the LTS from which data would have been abstracted away (as it is the case with symbolic semantics; see e.g. Section 6.2) would be ineffective: any input would be dependent on any output (since the attacker's knowledge, increased by the output, may enable new input messages). Our compression technique lies between these two extremes. It exploits a semi-commutation property: outputs can be permuted before inputs, but not the converse in general. Further, it exploits the fact that inputs do not increase the attacker's knowledge, and can thus be executed in a chained fashion, under focus. The semi-commutation is reminiscent of the asymmetrical dependency analysis enabled by the conditional stubborn set technique [GvLH + 96], and the execution of inputs under focus may be explained by means of sleep sets. While it may be possible to formally derive our compressed semantics by instantiating abstract POR techniques to our setting, we have not explored this possibility in detail1 . Concerning our reduced semantics, it may be seen as an application of the sleep set technique [GvLH + 96] (or even as a reformulation of Anisimov's and Knuth's characterisation of lexicographic normal forms [START_REF] Anisimov | Inhomogeneous sorting[END_REF]) but the real contribution with this technique is to have formulated it in such a way (see definitions 28 and 38) that it can be implemented without requiring an a priori knowledge of data dependencies: it allows us to eliminate redundant traces on-the-fly as data (in)dependency is discovered by the constraint resolution procedure (as explained in Section 6.3.5) -in this sense, it may be viewed as a case of dynamic POR.

Narrowing the discussion a bit more, we now focus on the fact that our techniques are designed for the verification of equivalence properties. This requirement turns several seemingly trivial observations into subtle technical problems. For instance, ideas akin to compression are often applied without justification (e.g. in [SA06, TKL + 12, MVB10]) because they may be obvious when one does reachability rather than equivalence checking. To understand this, it is important to distinguish between two very different ways of applying POR to equivalence checking (independently of the precise equivalence under consideration). The first approach is to reduce a system such that the reduced system and the original systems are equivalent. In 7.2. Security Applications the second approach, one only requires that two reduced systems are equivalent iff the original systems are equivalent. The first approach seems to be more common in the POR literature (where one finds, e.g. reductions that preserve LTL-satisfiability [START_REF] Baier | Principles of Model Checking (Representation and Mind Series[END_REF] or bisimilarity [START_REF] Huhn | Partial order reductions for bisimulation checking[END_REF]) though there are instances of the second approach (e.g. for Petri nets [START_REF] Godefroid | Using partial orders to improve automatic verification methods[END_REF]). In the present work, we follow the second approach: neither of our two reduction techniques preserves trace equivalence. This allows stronger reductions but requires extra care: one has to ensure that the independencies used in the reduction of one process are also meaningful for the other processes; in other words, reduction has to be symmetrical. We come back to these two different approaches later, when discussing specific POR techniques for security.

Security Applications

The idea of applying POR to the verification of security protocols dates back, at least, to the work of Clarke et al. [START_REF] Clarke | Partial order reductions for security protocol verification[END_REF][START_REF] Clarke | Efficient verification of security protocols using partial-order reductions[END_REF]. In this work, the authors remark that traditional POR techniques cannot be directly applied to security mainly because "[they] must keep track of knowledge of various agents" and "[their] logic can refer to this knowledge in a meaningful way". This led them to define a notion of semi-invisible actions (output actions, that cannot be swapped after inputs but only before them) and design a reduction that prioritises outputs and performs them in a fixed order. Compared to our work, this reduction is much weaker (even weaker than compression only), only handles a finite set of messages, and only focuses on reachability properties checking.

In [START_REF] Escobar | State space reduction in the maude-nrl protocol analyzer[END_REF], the authors develop "state space reduction" techniques for the Maude-NRL Protocol Analyzer (Maude-NPA). This tool proceeds by backwards reachability analysis and treats at the same level the exploration of protocol executions and attacker's deductions. Several reductions techniques are specific to this setting, and most are unrelated to partial order reduction in general, and to our work in particular. We note that the lazy intruder techniques from [START_REF] Escobar | State space reduction in the maude-nrl protocol analyzer[END_REF] should be compared to what is done in constraint resolution procedures (e.g. the one used in Apte) rather than to our work. A simple POR technique used in Maude-NPA is based on the observation that inputs can be executed in priority in the backwards exploration, which corresponds to the fact that we can execute outputs first in forward explorations. We note again that this is only one aspect of the focused strategy, and that it is not trivial to lift this observation from reachability to trace equivalence. Finally, a "transition subsumption" technique is described for Maude-NPA. While highly non-trivial due to the technicalities of the model, this is essentially a tabling technique rather than a partial order reduction. Though it does yield a significant state space reduction (as shown in the experiments [START_REF] Escobar | State space reduction in the maude-nrl protocol analyzer[END_REF]) it falls short of exploiting independencies fully, and has a potentially high computational cost (which is not evaluated in the benchmarks of [START_REF] Escobar | State space reduction in the maude-nrl protocol analyzer[END_REF]).

In [START_REF] Fokkink | Partial order reduction for branching security protocols[END_REF], Fokkink et al. model security protocols as labelled transition systems whose states contain the control points of different agents as well as previously outputted messages. They devise some POR technique for these transition systems, where output actions are prioritised and performed in a fixed order. In their work, the original and reduced systems are 7.3. Proof Theory Then, parallel composition and its unit are mapped to the multiplicative disjunction and its unit, and replication to the "why not" modality, all of which are negative. Finally, the behaviour of each construct in the compressed semantics corresponds to the behaviour of its translation in focused proof systems. For instance, our treatment of replication where one must initiate focus when creating a new session is a direct translation of how the "why not" modality is treated in Andreoli's system [START_REF] Andreoli | Logic programming with focusing proofs in linear logic[END_REF]. We do not provide here a fully worked-out encoding appropriate for our protocols. It is not trivial, notably due to the need to encode the attacker's knowledge, and internal reductions of protocols -both features require slight extensions of the usual linear logic framework. We have thus chosen to only take the correspondence with linear logic as an intuitive guide, and give a self-contained (and simple) proof of completeness for our compressed semantics (i.e. Lemma 4 in Section 5.3) by adapting the positive trunk argument of [START_REF] Miller | From proofs to focused proofs: A modular proof of focalization in linear logic[END_REF]. Note that the strong analogies with proof theory only hold for reachability results concerning compression, i.e. lemmas 3 and 4. It is a contribution in itself to observe that focusing (compression) makes sense beyond reachability, at the level of trace equivalence: Theorem 2 (stating that trace equivalence coincides with compressed trace equivalence for action-deterministic processes) has no analogue in the proof theoretical setting, where trace equivalence itself is meaningless.

We motivated reduction by observing that (in)dependencies between blocks of the compressed semantics should be exploited to eliminate redundant interleavings. This same observation has been done in the context of linear logic focusing, and lead to the idea of multi-focusing [CMS] where independent synthetic connectives (the analogue of our blocks) are executed simultaneously as much as possible. That work on multi-focusing is purely theoretical, and it is unclear how multifocusing could be applied effectively in proof search. It would be interesting to consider whether the gradual construction of unique representatives in our reduced semantics could be extended to the richer setting of linear logic (where proof search branches, unlike process executions).

Introduction

In this part, we turn to methods and tools for verifying equivalence properties for an unbounded number of sessions. Remind that such methods and tools all rely on diff-equivalence rather than trace equivalence. As already mentioned in the introduction (Subsection 1.6.2) and discussed further with the example of the Feldhofer protocol (Subsection 3.3.1; Part A), diff-equivalence is not precise enough to be used for the verification of some privacy goals such as unlinkability.

We now narrow down the discussion on unlinkability and anonymity. In this part, we consider the well-established definitions of strong unlinkability and anonymity as defined in [START_REF] Arapinis | Analysing unlinkability and anonymity using the applied pi calculus[END_REF]. They have notably been used to establish privacy for various protocols either by hand or using ad hoc encodings (e.g. eHealth protocol [START_REF] Dong | Formal analysis of privacy in an ehealth protocol[END_REF], mobile telephony [AMR + 12, AMRR14]). Note that we will provide a brief comparison with alternative definitions in Chapter 8 (Section 8.3) and notably conclude that other definitions (e.g. game-based definitions in the symbolic model) do not subsume our chosen definition. Intuitively, strong unlinkability and anonymity are expressed as the trace equivalence between an ideal scenario (where the privacy goal under consideration holds by construction) and a real scenario corresponding to a situation for which we are willing the prove that the privacy goal holds. Hence, for the case of unlinkability, the ideal scenario considers an unbounded number of users that can play at most one session each while the real scenario considers the same users but assume that each user can play an unbounded number of sessions. Unfortunately, as explained below, diff-equivalence is not suitable to establish such modelling of unlinkability.

Closer look at the limitation of

diff-equivalence. Formally, if (T (k, n T ) | R(k, n R )) is a
process modelling one session of a 2-party protocol (e.g. think of T as an RFID tag and R as a reader) where k is a long-term key (the same for all sessions but distinct for different users) and n T , n R are fresh nonces (distinct for each session and each user), then the real scenario would be P real = !νk. !νn T .νn R .(T (k, n T ) | R(k, n R )) while the ideal scenario would be P ideal = !νk.νn T .νn R .(T (k, n T ) | R(k, n R )). We end up with the following trace equivalence to prove: P real ≈ P ideal . If one is willing to prove this property automatically, he is left with tools such as ProVerif, Tamarin or Maude-NPA that can only deal with diff-equivalence. Thus, the first step would be to form a bi-process encoding the above equivalence. Based on the fact that two by T ′ . The tag T ′ will react by either aborting or by continuing the execution of this protocol. Depending on the reaction of the tag, the attacker will be able to infer if T and T ′ are the same tag or not.

In this example, the attacker adopts a malicious behaviour that is not detected immediately by the tag who keeps executing the protocol. The fact that the tag passes successfully a conditional reveals crucial information about the agents that are involved in the execution. Our second condition, namely well-authentication, basically requires that when an execution deviates from the honest one, the agents that are involved cannot successfully pass a conditional, thus avoiding the leak of the binary information success/failure.

Main theorem. In a nutshell, well-authentication avoids attacks based on control-flow leaks that may be observed through data or nature of actions while frame opacity avoids attacks based on data leaks taking the form of relations between outputs. Our main theorem states that these two conditions, frame opacity and well-authentication, are actually sufficient to ensure both unlinkability and anonymity. Interestingly, at the core of its proof, we must show that any execution can be transformed into another one indistinguishable from the former in which all sessions are played by distinct agents. Well-authentication is used to prove that the latter has the same control-flow as the first one. Frame opacity then ensures that the latter is indistinguishable from the former. This theorem is of interest as our two conditions are fundamentally simpler than the targeted properties: frame opacity can be expressed and established relying on diff-equivalence (without the aforementioned precision issue) and well-authentication is only a conjunction of reachability properties. In fact, they are both in the scope of existing automatic verification tools like ProVerif.

Related work.

The precision issue of diff-equivalence is well-known (acknowledged e.g. in [START_REF] Delaune | Automatic verification of privacy properties in the applied pi-calculus[END_REF][START_REF] Cheval | Proving more observational equivalences with ProVerif[END_REF][START_REF] Blanchet | Automated reasoning for equivalences in the applied pi calculus with barriers[END_REF]). So far, the main approach that has been developed to solve this issue consists in modifying the notion of diff-equivalence to get closer to trace equivalence. For instance, targeting process algebra with phases (often used for modelling e-voting protocols), the swapping technique introduced in [DRS08] allows to relax constraints imposed by diff-equivalence in specific situations (this technique has then been given formal foundations in [START_REF] Blanchet | Automated reasoning for equivalences in the applied pi calculus with barriers[END_REF]). Besides, the limitation of the diff-equivalence w.r.t. conditional evaluations has been partially addressed in [START_REF] Cheval | Proving more observational equivalences with ProVerif[END_REF] by pushing away the evaluation of some conditionals into terms. Nevertheless, the problem remains in general and the limitation described above is not addressed by those works (incidentally, it is specifically acknowledged for the case of the BAC protocol in [START_REF] Cheval | Proving more observational equivalences with ProVerif[END_REF]).

We have chosen to follow a novel approach in the same spirit as the one presented in [START_REF] Brusó | Formal verification of privacy for RFID systems[END_REF].

Nevertheless, [START_REF] Brusó | Formal verification of privacy for RFID systems[END_REF] only considers a very restricted class of protocols (single-step protocols that only use hash functions), while we target more complex protocols.

Outline

In Chapter 8, we present the class of protocols and the formal definitions of unlinkability and anonymity we woud like to verify. Our two conditions (frame opacity and wellauthentication) and our main theorem are presented in Chapter 9. We also prove their soundness;

i.e. the combination of our two conditions always imply unlinkability and anonymity. In Chapter 10, we discuss how to mechanise the verification of our conditions via systematic encodings, we describe our tool UKano mechanising those encodings and use it to analyse an extensive list of real-world case studies. We conclude with future work in Chapter 11. where P I and P R are defined as follows, with u = sdec(x 1 , k):

P I def = out(c I , n I ). in(c I , x 1 ). let x 2 , x 3 = eq(n I , proj 1 (u)), proj 2 (u) in out(c I , senc(⟨x 3 , n I ⟩, k)) P R def = in(c R , y 1 ). out(c R , senc(⟨y 1 , n R ⟩, k)). in(c R , y 2 ). let y 3 = eq(y 2 , senc(⟨n R , y 1 ⟩, k)) in 0
We have that ({P Fh }; ∅) tr -→ (∅; Φ 0 ) where tr and Φ 0 are as follows, for fresh names

k ′ , n ′ I , n ′ R ∈ N : tr = τ ν .τ ν .τ ν .out(c I , w 1 ).in(c R , w 1 ).out(c R , w 2 ).in(c I , w 2 ).τ then .out(c I , w 3 ).in(c R , w 3 ).τ then Φ 0 = {w 1 → n ′ I , w 2 → senc(⟨n ′ I , n ′ R ⟩, k ′ ), w 3 → senc(⟨n ′ R , n ′ I ⟩, k ′ )}.
This execution corresponds to a normal execution of one session of the protocol.

As already discussed in Subsection 3. In the previous example, the process !νn I .P I models an initiator having a specific long-term key k ready to execute an unbounded number of sessions of the protocol concurrently. Depending on the practical scenario we shall model, sessions of such an agent may not be run concurrently but only sequentially (i.e. one after the other). This will be the case if the initiator is played by a device like RFID tags which can execute at most one session at a time. In such cases, modellings based on replication ! might introduce unwanted behaviours possibly leading to false attacks. We thus define next the constructs P ; Q and ! P as syntactic sugar allowing to model sequential executions and "sequential replication" that we rather call repetition. Notation 3. We introduce two new constructs as syntactic sugar:

• For two processes P and Q, we note P ; Q the process P {0 → Q} ( i.e. the process one can obtain from P by replacing all null processes 0 by the process Q). We call P ; Q the sequence of P and Q.

• For a process P , we note ! P the process recX.(P ; X). We call such a process the repetition of P .

According to the semantics defined in Chapter 2, we may infer the following intuitions. The process (P ; Q) behaves like P at first, and after the complete execution of P it behaves like Q. The process ! P executes P an arbitrary number of times in sequence, intuitively corresponding to (P ; P ; P ; . . .). That is the reason why we call repetition the construct ! P . Such constructions are known to be problematic in process calculi. Our goal here is however quite modest: as it is visible in our operational semantics, our sequential composition is only meaningful for restricted processes (e.g. (!P ); Q is never able to reach Q).

Example 49. For instance, ! νn I .P I models an initiator having a specific long-term key k ready to execute an unbounded number of sessions of the protocol sequentially.

A Generic Class of Two-party Protocols

We aim to propose sufficient conditions to ensure unlinkability and anonymity for a generic class of two-party protocols. In this section, we define formally the class of protocols we are interested in. We consider two-party protocols that are therefore made of two roles called the initiator and responder role respectively. We assume a set L of labels that will be used to name output actions in these roles, allowing us to identify outputs that are performed by a same syntactic output action. These labels have no effect on the semantics. Definition 49. An initiator role is a ground process obtained using the following grammar:

P I := 0 | ℓ : out(c, u).P R
where c ∈ C, u ∈ T (Σ c , N ∪ X ), ℓ ∈ L, and P R is obtained from the grammar of responder roles:

P R := 0 | in(c, y).let x = t in P I else 0 | in(c, y).let x = t in P I else ℓ : out(c ′ , u ′ )
where c, c ′ ∈ C, y ∈ X , x (resp. t) is a (possibly empty) sequence of variables in X (resp. terms in T (Σ, N ∪ X )), u ′ ∈ T (Σ c , N ∪ X ), and ℓ ∈ L.

Intuitively, a role describes the actions performed by an agent. A responder role consists of waiting for an input and, depending on the outcome of a number of tests, the process will continue by sending a message and possibly waiting for another input, or stop possibly outputting an error message. An initiator behaves similarly but begins with an output. The grammar forces to add a conditional after each input. This is not a real restriction as it is always possible to add trivial conditionals with empty x and t. Finally, note that terms in outputs are necessarily constructor terms (i.e. in T (Σ c , N ∪ X )). Therefore, outputs are never blocked.

Example 50. Continuing our running example, P I (resp. P R ) as defined in Example 48 is an initiator (resp. responder) role, up to the addition of trivial conditionals and distinct labels ℓ 1 , ℓ 2 , and ℓ 3 to decorate output actions.

Model & Problem

Then, a protocol notably consists of an initiator role and a responder role that can interact together producing an honest trace as defined next. Definition 50. A trace tr is honest for a frame Φ if τ else / ∈ tr and obs(tr) is of the form out(_, w 0 ).in(_, R 0 ).out(_, w 1 ).in(_, R 1 ). . . . for arbitrary channel names, and such that R i Φ ⇓= E w i Φ ⇓ for any action in(_, R i ) occurring in tr.

An honest trace is a trace in which the attacker does not really interfere, and that allows the execution to progress without going into an else branch, which would intuitively correspond to a way to abort the protocol.

In addition to the pair of initiator and responder roles, more information is needed in order to meaningfully define a protocol. Among the names that occur in these two roles, we need to distinguish those that correspond to long-term data (called identity names) and those which shall be freshly generated at each session (called session names). We will require that any free name of roles (free names of a process P are denoted by fn(P )) must be either a session or an identity name.

We also need to know whether sessions (with the same identity parameters) can be executed concurrently or only sequentially. For instance, let us assume that the Feldhofer protocol is used in an access control scenario where all tags that are distributed to users have pairwise distinct identities. Assuming that tags cannot be cloned, it is probably more realistic to consider that a tag can be involved in at most one session at a particular time, i.e. a tag may run different sessions but only in sequence. Another concrete example where sessions are executed sequentially is the case of the e-passport application where a same passport cannot be involved in two different sessions concurrently. -→ (∅; Φ h ) for some frame Φ h and some trace tr h that is honest for Φ h .

The component † I (resp. † R ) describes whether the sessions of the role I (resp. R) can be executed concurrently or only sequentially. The process P Π models a single session of the protocol involving the two roles. Moreover, we require that this process can produce an honest trace.

Given a protocol Π, we also associate another process M Π that represents the situation where the protocol can be executed by an arbitrary number of identities, with the possibility of executing an arbitrary number of sessions for a given identity. The formal definition differs slightly depending on whether identity names occur in both roles or only in the role I (resp. R).

Definition 52. Given a protocol Π = (k, n I , n R , † I , † R , I, R), the process M Π is defined as follows:

• If k ∩ fn(I) ̸ = ∅ and k ∩ fn(R) ̸ = ∅, then M Π def = ! νk.( † I νn I .I | † R νn R .R); • If k ∩ fn(I) = ∅ and k ∩ fn(R) ̸ = ∅, then M Π def = † I νn I .I | ! νk. † R νn R .R)
For the sake of simplicity, in case identity names only occur in one role, we assume that this role is the responder role. The omitted case where identity names occur only in the initiator role is very much similar. In fact, swapping the initiator and responder roles can also be formally achieved by adding an exchange of a fresh nonce at the beginning of the protocol under consideration. Note that the case where both k ∩ fn(I) and k ∩ fn(R) are empty means that no identity names are involved and therefore there is no issue regarding privacy.

Example 51. Let Π Fh = (k, n I , n R , !, !, P I , P R ) with P I and P R as defined in Example 48. We have seen that P I is an initiator role whereas P R is a responder role. Let P Fh = νk.(νn I .P I | νn R .P R ). Let tr h = tr, and Φ h = Φ 0 as defined in Example 48. They satisfy the requirements stated in Definition 51, and therefore Π Fh is a protocol according to our definition. For this protocol, the identity name k occurs both in the role P I and P R , and therefore we have that

M Π Fh = ! νk.(! νn I .P I | ! νn R .P R ).
For the purpose of illustrating our method and the use of the repetition operator, we will consider a variant of the Feldhofer protocol, described next.

Example 52. We consider a variant of the RFID protocol presented in Example 48. This protocol can be presented using Alice & Bob notation as follows:

1. I → R : n I 2. R → I : n R , {n I } rR k 3. I → R : {n R } rI k
The protocol is between an initiator I (the reader) and a responder R (the tag) that share a symmetric key k. We consider here a randomised symmetric encryption scheme, and the main difference with the original Feldhofer protocol as presented in Example 48 is the fact that encryption is performed on messages that are reduced to a single nonce. We will see that this may lead to a linkability attack in case concurrent sessions are possible, but this variant is actually safe (w.r.t. unlinkability) otherwise.

We consider the computation relation induced by the empty set of equations, and the following rewriting system: rdec(renc(x, y, z), y) → x eq(x, x) → ok proj i (⟨x 1 , x 2 ⟩) → x i for i ∈ {1, 2}.

The processes P ′ I and P ′ R modelling respectively the initiator and the responder roles are in(c I , x 1 ). let x 2 , x 3 = eq(n I , rdec(proj 2 (x 1 ), k)), proj 1 (x 1 ) in out(c I , renc(x 3 , k, r I ))

P ′ R def = in(c R , y 1 ). out(c R , ⟨n R , renc(y 1 , k, r R )⟩). in(c R , y 2 ). let y 3 = eq(n R , rdec(y 2 , k)) in 0 The tuple Π ! Fh ′ def = (k, {n I , r I }, {n R , r R }, ! , ! , P ′ I , P ′ R
) is a protocol according to Definition 51. For this protocol, we have again that k occurs both in the roles P ′ R and P ′ I , and therefore we have that:

M Π ! Fh ′ = ! νk.( ! ν(n I , r I ).P ′ I | ! ν(n R , r R ).P ′ R ).
As a last example, we will consider one for which identity names only occur in one role. This example can be seen as a simplified version of the DAA sign protocol that will be detailed in Chapter 10.

Example 53. We consider a simplified version of the protocol DAA sign (adapted from [START_REF] Smyth | Formal analysis of privacy in direct anonymous attestation schemes[END_REF]).

Note that a comprehensive analysis of the protocol DAA sign (as well as the protocol DAA join) will be conducted in Chapter 10. Before describing the protocol itself, we introduce the term algebra that will allow us to model signature, and zero knowledge proofs used in that protocol.

For this, we consider:

• Σ c = {sign, zk, pk, ⟨ ⟩, tuple, ok, sk I , error}, and

• Σ d = {checksign, check zk , public zk , proj 1 , proj 2 , proj 4 1 , proj 4 2 , proj 4 3 , proj 4 4 }.
We consider the computation relation induced by the empty set of equations, and the following rewriting system: checksign(sign(x, y), pk(y)) → x check zk (zk(sign(⟨x k , x id ⟩, z sk ), x k , tuple(y 1 , y 2 , y 3 , pk(z sk )))) → ok public zk (zk(x, y, z)) → z

proj i (⟨y 1 , y 2 ⟩) → y i i ∈ {1, 2} proj 4 i (tuple(y 1 , y 2 , y 3 , y 4 )) → y i i ∈ {1, 2, 3, 4}
The protocol is between a client C (the responder) and a verifier V (the initiator of the protocol). The client is willing to sign a message m using a credential issued by some issuer and then he has to convince V that the latter signature is genuine. The client C has a long-term secret key k C , an identity id C , and some credential cred C = sign(⟨k C , id C ⟩, sk I ) issued by some issuer I having sk I as a long-term signature key. Such a credential would be typically obtained once for all through a protocol similar to DAA join. We give below an Alice & Bob description of the protocol:

1. V → C : n V 2. C → V : zk(cred C , k C , tuple(n V , n C , m, pk(sk I )))
The verifier starts by challenging the client with a fresh nonce, the latter then sends a complex zero-knowledge proof bound to this challenge proving that he knows a credential from the expected issuer bound to the secret k C he knows. Before accepting this zero-knowledge proof, the verifier V (i) checks the validity of the zero-knowledge proof using the check zk operator, and (ii) verifies that this proof is bound to the challenge n V and to the public key of the issuer I using the public zk operator.

The processes P C and P V modelling respectively the client and the verifier role are defined as follows:

P V def = out(c V , n V ).
in(c V , x 1 ). let x 2 , x 3 , x 4 = eq(check zk (x 1 ), ok), eq(proj 4 1 (public zk (x 1 )), n V ), eq(proj 4 4 (public zk (x 1 )), pk(sk I )) in 0 else out(c V , error)

P C def = in(c R , y 1 ). out(c R , zk(sign(⟨k C , id C ⟩, sk I ), k C , tuple(y 1 , n C , m, pk(sk I )))).
This protocol falls in our class: the two parties being the verifier V and the client C. The tuple Π DAA def = ({k C , id C }, {n V }, {n C , m}, !, !, P V , P C ) is a protocol according to our Definition 51. We have that k C or id C only occur in P C , and therefore following Definition 52, we have that:

M Π DAA = (! νn V .P V ) | (! ν(k C , id C ). ! ν(n C , m).P C )
This models infinitely many different clients that may take part to infinitely many sessions of the protocol with any verifier that executes always the same role (he has no proper identity). We consider here a scenario where sessions can be executed concurrently. This corresponds to the cases where (i) we should consider arbitrary number of users for each role or (ii) we should consider arbitrary number of users having the role R but it suffices to consider the single identity of I. In addition to this distinction, note that two very different kinds of protocols lie in the class (i):

Discussion

(i-a) First case is when fn(I)∩fn(R) ̸ = ∅ and we will refer to this case as the shared case. Indeed, roles I and R from protocols satisfying the latter initially share some knowledge before the beginning of the protocol (i.e. they share the knowledge of the names in fn(I) ∩ fn(R)). In practice, this shared knowledge may have been established in various ways such as by using prior protocols, using another communication channel (e.g. optical scan of a password as it is done with e-passports, use of PIN codes) or by retrieving the identity from a database that matches the first received message (as it is often done with RFID protocols). For such protocols, it is expected that an initiator user and a responder user can communicate successfully producing an honest execution only if they have the same identity (i.e. they share the same names k).

(i-b) Second case is when fn(I) ∩ fn(R) = ∅ and we will refer to this case as the non-shared case as roles do not share any prior knowledge. For such cases, it is expected that an initiator user and a responder user can communicate successfully producing an honest execution whatever their identities.

Unlinkability and anonymity will be uniformly expressed for the cases (i-a) and (i-b) but our sufficient conditions will slightly differ depending on the considered case.

Security Goals

This section is dedicated to the definition of the security properties we are willing to verify on protocols: unlinkability and anonymity.

Unlinkability

Remind that according to the ISO/IEC standard 15408 [START_REF]Common criteria for information technology security evaluation -part 2: Security functional components[END_REF], unlinkability aims at ensuring that a user may make multiple uses of a service or a resource without others being able to link these uses together. In terms of our modelling, a protocol preserves unlinkability if any two sessions of a same role look to an outsider as if they have been executed with different identity names. In other words, an ideal version of the protocol with respect to unlinkability, allows the roles I and R to be executed at most once for each identity names. An outside observer should then not be able to tell the difference between the original protocol and the ideal version of this protocol.

In order to precisely define this notion, we have to formally define this ideal version of a protocol Π. This ideal version, denoted S Π , represents an arbitrary number of agents that can at most execute one session each. Such a process is obtained from M Π by simply removing the symbols ! and ! that are in the scope of identity names. Indeed, those constructs enable each identity to execute an arbitrary number of sessions (respectively concurrently and sequentially). Formally, depending on whether identity names occur in both roles, or only in the initiator role, this leads to slighly different definitions.

Definition 53. Given a protocol Π = (k, n I , n R , † I , † R , I, R), the process S Π is defined as follows:

• If k ∩ fn(I) ̸ = ∅ and k ∩ fn(R) ̸ = ∅, then S Π def = ! νk.(νn I .I | νn R .R); • If k ∩ fn(I) = ∅ and k ∩ fn(R) ̸ = ∅, then S Π def = † I νn I .I | ! νk.νn R .R.
Then, unlinkability is defined as a trace equivalence between S Π (where each identity can execute at most one session) and M Π (where each identity can execute an arbitrary number of sessions).

Definition 54. A protocol Π = (k, n I , n R , † I , † R , I, R) ensures unlinkability if M Π ≈ S Π .
Even if we consider the notion of trace equivalence instead of the stronger notion of labeled bisimilarity, our definition is in line with the strong notion of unlinkability as proposed in [START_REF] Arapinis | Analysing unlinkability and anonymity using the applied pi calculus[END_REF]. Although unlinkability of only one role (e.g. the tag for RFID protocols) is often considered in the literature (including [ACRR10]), we consider a stronger notion here since both roles are treated symmetrically. We believe this is needed to not miss some practical attacks (see Chapter 10 where such attacks are shown on real-world case studies).

Example 55. We consider the variant of the Feldhofer protocol as described in Example 52.

However, for illustrative purposes, we consider Π !

Fh ′ def = (k, {n I , r I }, {n R , r R }, !, !, P ′ I , P ′ R ), i
new n 1 R n 1 R n 1 R new n 2 R n 2 R n 2 R new n 1 T n 1 T , {n 2 R } k1 new n 2 T n 2 T , {n 1 R } k2 n 1 T , {n 1 R } k2 n 2 T , {n 2 R } k1 {n 1 T } k1 {n 1 T } k1 {n 2 T } k2 {n 2
T } k2 accept accept

Anonymity

According to the ISO/IEC standard 15408 [START_REF]Common criteria for information technology security evaluation -part 2: Security functional components[END_REF], anonymity aims at ensuring that a user may use a service or a resource without disclosing its identity. In terms of our modelling, a protocol preserves anonymity of some identities id ⊆ k, if a session executed with some particular (public) identities id 0 looks to an outsider as if it has been executed with different identity names. In other words, an outside observer should not be able to tell the difference between the original protocol and a version of the protocol where the attacker knows that specific roles I and R with identities id 0 (known by the attacker) are present.

Definition 55. Given a protocol Π = (k, n I , n R , † I , † R , I, R), and id ⊆ k, the process M Π,id is defined as follows:

• If k ∩ fn(I) ̸ = ∅ and k ∩ fn(R) ̸ = ∅, then M Π,id def = M Π | ν k.( † I ν n I .I 0 | † R ν n R .R 0 ). • If k ∩ fn(I) = ∅ and k ∩ fn(R) ̸ = ∅, then M Π,id def = M Π | ν k. † R ν n R .R 0 .
where I 0 = I{id → id 0 } and R 0 = R{id → id 0 } for some fresh public constants id 0 .

! νn V .P V | (! ν(k C , id C ). ! νm C .P C ) | (ν(k C , id C ).! νm C .P C {id C → id 0 }) ≈ ! νn V .P V | (! ν(k C , id C ). ! νm C .P C )
This intuitively represents the fact that the situation in which a specific client with some known identity id 0 may execute some sessions is indistinguishable from a situation in which this client is not present at all. Therefore, if these two situations are indeed indistinguishable from the point of view of the attacker, it would mean that there is no way for the attacker to deduce whether a client with a specific identity is present or not. This particular equivalence that only involves the replication operator (and not ! ) can actually be established relying directly on the ProVerif tool.

Our method also applies in presence of the ! operator whereas ProVerif is not able to analyse such a scenario.

Discussion

The definitions we proposed are variations of the ones proposed in [START_REF] Arapinis | Analysing unlinkability and anonymity using the applied pi calculus[END_REF]. In particular, they all share the same pattern: we compare some process modelling real usage of the protocol with another process modelling an idealised version of the system. However, a flurry of alternative definitions of unlinkability have been proposed in the literature (see, e.g. [START_REF] Brusó | Linking unlinkability[END_REF][START_REF] Brusó | Dissecting Unlinkability[END_REF] for a comparison). Among the strongest ones, various game-based formulations have been considered, both in the computational and symbolic models. Some of these definitions, unlike our definition of unlinkability, can be verified directly in ProVerif using the notion of diff-equivalence [START_REF] Backes | Zero-knowledge in the applied pi-calculus and automated verification of the direct anonymous attestation protocol[END_REF].

Game-based definition. We will not give any formal definition but instead briefly give its general idea. In such a definition, the following game is considered:

1. Learning phase: During this phase, the attacker can trigger an arbitrary number of sessions of the two roles (namely tag and reader) with the identity of his choice. This allows him to gain some knowledge. Eventually, the attacker chooses to end the learning phase and enter the second phase.

Guessing phase:

The challenger chooses an identity x among two distinguished identities id 1 and id 2 . The attacker is allowed to interact again (an arbitrary number of times) with roles of x, or of identities other than id 1 and id 2 .

The attacker wins the game if he can infer whether x is id 1 or id 2 , i.e. if he is able to distinguish between these two scenarios. This is typically the kind of scenario that can be checked relying on the diff-equivalence notion implemented in several automatic tools (e.g. ProVerif, Tamarin). However, as illustrated by the following example, we would like to stress that such game-based definitions do not imply unlinkability as defined in this part.

Chapter 9

Sufficient Conditions for Privacy

We now define our two conditions, namely frame opacity (Section 9.2) and well-authentication

(Section 9.
3), and our Main Theorem (Section 9.4) which states that these conditions are sufficient to ensure unlinkability and anonymity as defined in Chapter 8. We conclude the chapter with the proof of our Main Theorem (Section 9.5). Before doing that, we shall introduce annotations in the semantics of processes (Section 9.1) in order to ease their analysis.

Annotations

We shall now define an annotated semantics whose transitions are equipped with more informative actions. The annotated actions will feature labels identifying which concurrent process has performed the action. This will allow us to identify which specific agent (with some specific identity and session names) performed some action.

Formally, an annotation is of the form A(k, n) where A ∈ {I, R} and k, n are sequences of names, or constants from id 0 . Annotations are noted with the letter a, and the set of annotations is noted A. In the rest of the part, we shall call agent any initiator or responder process (i.e. I or R) or a continuation of those. It corresponds to a certain user (described by its identity names) playing a certain session (described by its session names) at a certain step of its role. Therefore, annotations and agents are closely related (there is a one-to-one correspondence if one forgets about continuations). However, we rely on the notion of agents when we want to point out the process, and we use the notion of annotations to refer to the information that are used to decorate actions and processes.

Given a protocol Π = (k, n I , n R , † I , † R , I, R) and id ⊆ k, consider any execution of M Π,id , M Π or S Π . In such an execution, all τ actions except τ then and τ else actions (i.e. τ ν , τ ! , τ r ) are solely used to instantiate new agents, by unfolding replications ! (using the semantical rule Repl) or repetitions ! (using the semantical rule Unfold), or choosing fresh session and identity names (using the semantical rule New). Performing these actions results in the creation of agents, that is, instances of I and R with fresh names or constants from id 0 . Actions other than τ ν , τ ! , τ r (that is, input, output and conditionals) are then only performed by those agents.

Sufficient Conditions for Privacy

The previous remark allows us to define an annotated semantics for our processes of interest. In that semantics, agents in the multiset of processes are annotated by their identity (i.e. identity and session names that have been created for them), and actions other than τ ν , τ ! , τ r are annotated with the identity of the agent responsible for that action. Note that actions τ then and τ else will be annotated as well. Traces of the annotated semantics will be denoted by ta. We stress that agents having in their identity constants id 0 shall be annotated with some A(k, n) where id 0 ⊆ k. Intuitively, in such a case, we keep the information that the identity id 0 of that agent has been disclosed to the attacker in the annotation.

We also assume that labels used to decorate output actions (i.e. elements of L) are added to the produced output actions so that we can refer to them when needed (output actions are thus of the form ℓ : out(c, w) [a]).

In annotated traces, τ ν , τ ! , τ r actions that are solely used to instantiate new agents are not really important. We sometimes need to reason up to these τ actions. Given two annotated trace ta and ta ′ , we write ta τ = ta ′ when both traces together with their annotations are equal up to some τ ν , τ ! , τ r actions. We also write

K ta = = ⇒ K ′ when K ta ′ -→ K ′ for some ta ′ such that ta τ = ta ′ .
Finally, an annotated process is of the form P [a] where P is a process and a ∈ A. After the initial τ actions, the annotated configuration is ({Iσ

I [a I ], Rσ R [a R ], S Π }; ∅) where σ I = {k → k ′ , n I → n ′ I }, and σ R = {k → k ′ , n R → n ′ R }.
The structure is preserved for the rest of the execution of ta, with three processes in the multiset (until they become null), two of which remaining annotated with a I and a R . After ta, the annotated configuration is ({S Π }; Φ 0 ) where Φ 0 has been defined in Example 48.

Example 59. Going back to Example 56 and starting with M Π,id , a possible annotated configuration obtained after some τ ν , τ ! , τ r actions can be K = (P, ∅) where P is a multiset containing the following processes:

• P C {k C → k 0 C , id C → id 0 , m C → m 0 C }[a 0 C ]; • !ν m C .P C {k C → k 0 C , id C → id 0 }; • P V {n V → n 1 V }[a 1 V ]; and • M Π DAA .
where

a 1 V = I(ϵ, n 1 V ) and a 0 C = R((k 0 C , id 0 ), m 0 C ).
We may note that the annotation a 1 V contains the empty sequence ϵ since the initiator role does not rely on identity names; and the annotation a 0 C contains id 0 .

Frame Opacity

In light of attacks based on leakage from messages where non-trivial relations between outputted messages are exploited by the attacker to trace an agent, our first condition will express that all relations the attacker can establish on output messages only depend on what is already observable by the attacker and never depend on a priori hidden information such as identity names of specific agents. Therefore, such relations cannot be exploited by the attacker to learn anything new about the agents involved in the execution. We achieve the latter by requiring that any reachable frame must be indistinguishable from an idealised frame that only depends on data already observed in the execution, and not on the specific agents (and their names) of that execution.

As a first approximation, one might take the idealisation of a frame {w i → u i } i∈I to be {w i → n i } i∈I where the (n i ) i∈I are distinct fresh nonces. It would then be very strong to require that frames obtained in arbitrary protocol executions are statically equivalent to their idealisation defined in this way. Although this would allow us to carry out our theoretical development, it would not be realistic since any protocol using, e.g. a pair, would fail to satisfy this condition. We thus need a notion of idealisation that retains part of the shape of messages, which a priori does not reveal anything sensitive to the attacker. We also want to allow outputs to depend on session names or previous inputs in ways that are observable, e.g. to cover the output of the signature of a previously input message.

Our idealised frames will be obtained by replacing each message, produced by an output of label ℓ, by a context that only depends on ℓ, whose holes are filled with fresh session names and (idealisations of) previously inputted messages. Intuitively, this is still enough to ensure that the attacker does not learn anything that is identity-specific. In order to formalise this notion, we assume two disjoint and countable subsets of variables: input variables X i = {x i 1 , x i 2 , . . .} ⊆ X , and session name variables X n = {x n 1 , x n 2 , . . .} ⊆ X , and a fixed, arbitrary idealisation operator ideal(•) : L → T (Σ c , X i ∪ X n ). Variables x i j intuitively refers to the j-nth variable received by the agent of interest. Therefore, we assume that idealisation operator satisfies the following:

∀ℓ ∈ L, ideal(ℓ)∩X i ⊆ {x i 1 , . . . , x i k }
where k is the number of inputs preceding the output labelled ℓ.

Definition 57. Let fr : A × X n → N be an injective function assigning names to each agent and name variable. We define the idealised frame associated to ta, denoted Φ fr ideal (ta), inductively on the annotated trace ta:

• Φ fr ideal (ϵ) = ∅ and Φ fr ideal (ta.α) = Φ fr ideal (ta) if α is not an output;

• Φ fr ideal ( ta.(ℓ : out(c, w)[a]) ) = Φ fr ideal (ta) ∪ {w → ideal(ℓ)σ i σ n }
where σ n (x n j ) = fr(a, x n j ) when x n j ∈ X n , and

-σ i (x i j ) = u j where ( R j Φ fr ideal (ta)
) ⇓ u j when x i j ∈ X i and R j is the recipe corresponding to the j-th input of agent a in ta.

Frame Opacity

We can now formalise the notion of frame opacity as announced: it requires that all reachable frames must be statically equivalent to idealised frames. Definition 58. The protocol Π ensures frame opacity if: for any execution (M Π,id ; ∅) ta -→ (Q; Φ), it holds that Φ ideal (ta) ∼ Φ.

Note that Φ ideal (ta) is well-defined above. Formally, it can be established by induction on the length of traces: assuming that Π ensures frame opacity for traces of length n then it is easy to establish that Φ ideal (ta) is defined for traces ta executable by M Π,id of length at most n + 1 and the frame opacity condition is thus defined for such traces. In the rest of the part, we will only consider idealisations for protocols that satisfy frame opacity, which ensures well-definedness.

There are many ways to choose the idealisation operator ideal(•). We present below a canonical syntactical construction that is sufficient to deal with almost all our case studies. This construction has been implemented as a heuristic to automatically build idealisation operators in the tool UKano. The tool UKano also provides other heuristics that generally lead to better performance but are less tight (i.e. they cannot always be used to establish frame opacity). We explain how UKano verifies frame opacity and compare the different heuristics it can leverage in Chapter 10.

At first reading, it is possible to skip the rest of the section and directly go to Section 9.3 since proposed canonical constructions are just instantiations of our generic notion of idealisation.

Canonical Syntactical Idealisation

Intuitively, this construction builds the idealisation operator by examining the initiator and responder roles as syntactically given in the protocol definition. The main idea is to consider (syntactical) outputted terms one by one, and to replace identity names and variables bound by a let construct by pairwise distinct session names variables. Definition 59. Let Π = (k, n I , n R , † I , † R , I, R) be a protocol that uses input variables {x i 1 , x i 2 , . . .} ⊆ X i (in this order) for its two roles, and distinct variables from X let in let constructions. Let σ be an injective renaming from k ∪ n R ∪ n I ∪ X let → X n . The canonical syntactical idealisation operator associated to Π maps any ℓ ∈ L occurring in an output action of the form ℓ : out(c, u) (for some c and some u) in I or R to uσ.

Example 63 (Continuing Example 51). First, we perform some renaming to satisfy the conditions imposed by the previous definition. We therefore replace x 1 by x i 1 in role I, and y 1 , y 2 by x i 1 , x i 2 in role R. We assume that x 2 , x 3 , and y 3 are elements of X let . We consider a renaming σ that maps k, n I , n R , x 2 , x 3 , y 3 to x n 1 , . . . , x n 6 . We obtain the following idealisation operator:

ℓ 1 → x n 2 ; ℓ 2 → senc(⟨x i 1 , x n 3 ⟩, x n 1 ); ℓ 3 → senc(⟨x n 5 , x n 2 ⟩, x n 1 )
Considering fr as defined in Example 60, i.e. such that fr(a I , x n j ) = n I j and fr(a R , x n j ) = n R j , and relying on the idealisation operator defined above, we have that: -----→ (P; Φ) either the last action corresponds to a safe conditional, or there exists a ′ such that:

Φ fr ideal (ta) = {w 1 → n I 2 , w 2 → senc(⟨n I 2 , n R 3 ⟩, n R 1 ), w 3 → senc(⟨n I 5 , n I 2 ⟩, n I 1 )}
(i) The annotations a and a ′ are associated in (ta, Φ);

(ii) Moreover, when fn(R) ∩ fn(I) ̸ = ∅ (the shared case), a ′ (resp. a) is only associated with a (resp. a ′ ) in (ta, Φ).

Intuitively, this condition does not require anything for safe conditional as we already know that they cannot leak new information to the attacker (he already knows their outcome). For unsafe conditionals, condition (i) requires that whenever an agent a evaluates them positively (i.e. he does not abort the protocol), it must be the case that this agent a is so far having an honest interaction with a dual agent a ′ . Indeed, as discussed in introduction, it is crucial to avoid such unsafe conditionals to be evaluated positively when the attacker is interfering because this could leak crucial information.

As illustrated in the following example, Condition (ii) is needed to prevent from having executions where an annotation is associated to several annotations, which would break unlinkability in the shared case (i.e. when fn(R) ∩ fn(I) ̸ = ∅).

Example 70. We consider a protocol between an initiator and a responder that share a symmetric key k. The protocol can be described informally as follows:

1. I → R : {n I } k 2. R → I : n R
Assuming that the two outputs are labelled with ℓ 1 and ℓ 2 respectively, we have that the idealisation operator:

ℓ 1 → x n 1 , ℓ 2 → x n 2
is suitable to establish frame opacity. We may note that the only conditional is the one performed by the responder role when receiving the ciphertext. He will check whether it is indeed an encryption with the expected key k. When an action τ then [R(k, n R )] occurs, it means that a ciphertext encrypted with k has been received by R(k, n R ) and since the key k is unknown by the attacker, such a ciphertext has been sent by a participant: this is necessarily a participant executing the initiator role with key k. Hence condition (i) of well-authentication holds (and can actually be formally proved). However, condition 9.5. Proof of our Main Theorem etitions a necessary number of times, create necessary identity and session names, etc. These ground configurations are generated from sequences of annotations satisfying some requirements.

Sequences of Annotations

The sequence of annotations from which we will build ground configurations shall satisfy some requirements that we list below. Essentially, the goal is to make sure that no freshness condition over session and identity names is violated. Definition 64. A sequence S of annotations is well-formed if the following conditions hold.

• In all annotations A(k ′ , n ′ ), the session parameters n ′ are names, and the identity parameters k ′ are made of names or constants id 0 . We also have that |n ′ | = |n A | and |k ′ | = |k| (remind that n I , n R and k are session and identity names from Π). Moreover, when id 0 ∩k ′ ̸ = ∅, then it holds that k ′ i = id 0i if, and only if, k i = id i (where id 0i , id i , k i , k ′ i are respectively the i-nth element of the sequences id 0 , id, k, k ′ ).

• No name appears both as identity and session parameter in any two annotations.

• Two different annotations never share a session parameter.

• Two annotations either have the same identity parameters, or do not share any identity parameter at all. We say that a sequence of annotations S is single-session when two different annotations of the same role never share an identity parameter and no annotation contains a constant in id 0 .

We straightforwardly lift those definitions to annotated traces by only keeping the underlying sequence of annotations and dropping actions. Roughly, well-formed (resp. well-formed, singlesession) sequence of annotations contains annotations of agents that can be instantiated from M Π,id (resp. S Π ). Conversely, we may note that given ta such that M Π,id ta -→ K ′ , we have that ta is well-formed.

Ground Configurations

After the introduction of some notations, we explain how ground configurations are obtained from well-formed sequences of annotations.

Given a well-formed sequence of annotations S, and some role A ∈ {I, R}, we introduce following notations:

• we note id A (S) the set of identity parameters of agents of role A occurring in S (i.e. the set {k | A(k, n) ∈ S}),

• for l ∈ id A (S), we note sess A (S, l) the set of session parameters of agents of role A and identity parameters l occurring in S (i.e. the set {n | A(l, n) ∈ S}),

Sufficient Conditions for Privacy

• for l ∈ id A (S), we note sess seq A (S, l) the sequence made of elements from sess A (S, l), without repetition, in order of first occurrence in S.

Finally, for some sequence of elements L = e 1 , e 2 , e 3 , . . . and a family of processes {P (e i )} i , we denote by ⨿ e∈L P (e) the process P (e 1 ); (P (e 2 ); (P (e 3 ); . . .)).

Definition 65. Let S be a well-formed sequence of annotations. The ground configuration associated to S denoted by K(S) is the multiset P I ⊔P R where P A is defined as follows depending on † A , where A is the process of Π corresponding to the role annotation A:

• if † A = ! (A can execute sessions concurrently) then

P A = { ( A{k → l, n A → m} ) [A(l, m)] | A(l, m) ∈ S } .
• if † A = ! (A cannot execute sessions concurrently) then

P A =    ⨿ m∈S l Q l A (m) | l ∈ id A (S) and S l = sess seq A (S, l)    .
where

Q l A (m) = ( A{k → l, n A → m} ) [A(l, m)].
Note that, as illustrated by the next example, we now consider annotations inside a process.

K(ta) = ⨿ n∈(n I ),(n ′ I ) Q k I (n) = (out(c I , senc(n I , k))[I(k, n I )]); (out(c I , senc(n ′ I , k))[I(k, n ′ I )]).
Note that K(ta) is also able to produce the annotated trace ta up to τ =.

We lift those definitions to annotated traces as before. A ground configuration associated to a well-formed sequence of annotations is essentially an "unfolding" of M Π,id . Therefore, there is a strong relationship between the original process and the one obtained through K(•) as shown next.

Proposition 24. If ta is a well-formed annotated trace then the following hold:

(1) If M Π,id ta = = ⇒ K (resp. S Π ta = = ⇒ K), then K(ta) ta = = ⇒ K ′ for some K ′ such that Φ(K) = Φ(K ′ ). (2) If K(ta) ta = = ⇒ K, then M Π,id ta = = ⇒ K ′ for some K ′ such that Φ(K) = Φ(K ′ ).

• for any a

1 = A 1 (k 1 , n 1 ), a 2 = A 2 (k 2 , n 2 ) ∈ A, if ρ(a 1
) and ρ(a 2 ) have the same identity parameters, then so do a 1 and a 2 ( i.e. k 1 = k 2 ).

The two first conditions are expected: renaming of annotations shall only modify session and identity parameters whilst preserving well-formedness. The final condition ensures that renamings do not create more "sequential dependencies" between agents (i.e. agents sharing the same identity and whose role can execute sessions only sequentially): after renaming, less pairs of agents have same identity.

Next, we define taρ as the annotated trace obtained from ta by applying ρ to annotations only. Note that, by definition of renamings, the resulting taρ is well-formed as well.

One can also define the effect of renamings on ground configurations.

If ρ(A(k, n)) = A(k ′ , n ′ ),
the renaming σ induced by ρ on A(k, n) is the (injective) mapping such that kσ = k ′ and nσ = n ′ . Given a ground configuration P = { ⨿ j P i j [a i j ]} i , we define Pρ = { ⨿ j P i j σ i j [ρ(a i j )]} i where σ i j is the renaming induced by ρ on a i j . Note that the renaming on parameters induced by a renaming of annotations may conflict: this happens, for example, when ρ

(A(k, n)) = A(k 1 , n) and ρ(A(k, m)) = A(k 2 , m).
A renaming of annotations can break executability. Even when executability is preserved, it is not obvious to relate processes before and after the renaming, as messages can be affected in complex ways and conditionals may not evaluate to the same outcome. Fortunately, frame opacity and well-authentication will provide us with strong properties to reason over executions, as seen in the next subsections.

Example 72. Consider the annotated trace ta from Example 58 that M Π,id can execute. The ground configuration K(ta) can execute it as well, using = ⇒. We now define ρ as follows:

ρ(I(k ′ , n ′ I )) = I(k 1 , n ′ I ) and ρ(R(k ′ , n ′ R )) = R(k 2 , n ′ R )
for some fresh names k 1 , k 2 . The trace taρ can no longer be executed by M Π,id nor by K(taρ) (even using = ⇒) because the first output

sent by R(k 2 , n ′ R ) ( i.e. senc(⟨n ′ I , n ′ R ⟩, k 2 )) will not be accepted by I(k 1 , n ′ I ) since k 1 ̸ = k 2 .

Control is Determined by Associations

We show in that section that the outcome of tests is entirely determined by associations. This will be useful to show that, if we modify an execution (by renaming agents) while preserving enough associations, then the control flow is left unchanged.

Proposition 25. We assume that Π satisfies item (i) of the well-authentication condition. Let ta = ta 0 .τ x [a 1 ] (for τ x ∈ {τ then , τ else }) be a well-formed annotated trace such that

K(ta) ta 0 .τ x [a 1 ]
-----→ (P; Φ) and the last action ( i.e. τ x [a 1 ]) is performed by an unsafe conditional. We have that τ x = τ then if, and only if, there exists a 2 ∈ A such that a 1 and a 2 are associated in (ta 0 , Φ). = ======= ⇒ (P ′ ; Φ) and thus M Π,id

ta * 0 .τ then [a 1 ]
------→ (P ′′ ; Φ). = ta 0 . As a consequence of well-authentication, item (i) applied on the above execution, we obtain that for some a 2 ∈ A, a 1 and a 2 are associated in (ta * 0 , Φ). Since ta 0 τ = ta * 0 , they are also associated in (ta 0 , Φ).

(⇐) For this other direction, we observe that (up to changes of recipes that do not affect the resulting messages) if two agents are associated in the above execution (starting with K(ta)), then they are executing the honest trace of Π modulo a renaming of parameters, thus the considered test must be successful. We thus assume that a 1 = A(k 1 , n 1 ) and a 2 = A(k 2 , n 2 ) are associated in (ta 0 , Φ) we shall prove that τ x = τ then . By association, ta 0 | a1,a2 is honest: its observable actions are of the form out(c 1 , w 1 ).in(c ′ 1 , M 1 ) . . . out(c n , w n ).in(c ′ n , M n ) with possibly an extra output at the end, and are such that M i Φ ⇓= E w i Φ for all 1 ≤ i ≤ n. Consider ta ′ obtained from ta 0 by replacing each recipe M i by w i . Since this change of recipes does not affect the resulting messages, the modified trace can still be executed by K(ta) and yields the same configuration (P; Φ). But now ta ′ | a1,a2 is a self-contained execution, i.e. if P and Q are the processes (possibly sub-processes) respectively annotated a 1 and a 2 in K(ta), we have:

({P [a 1 ], Q[a 2 ]}; ∅) ta ′ | a1,a2 ----→ ({P ′ [a 1 ], Q ′ [a 2 ]}; Φ ′ ) τ x [a 1 ] ---→ ({P ′′ [a 1 ], Q ′ [a 2 ]}; Φ ′ ).
In the shared case (i.e. fn(I) ∩ fn(R) ̸ = ∅), by definition of association, the identity parameters of a 1 are equal to those of a 2 . Otherwise, it holds that fn(I) ∩ fn(R) = ∅. In both cases, we thus have:

({ν k.(ν n I .I | ν n R .R)}; ∅) τ * -→ ({P [a 1 ], Q[a 2 ]}; ∅) ta ′ | a1,a2 ----→ ({P ′ [a 1 ], Q ′ [a 2 ]}; Φ ′ ) τ x [a 1 ] ---→ ({P ′′ [a 1 ], Q ′ [a 2 ]}; Φ ′ ).
In that execution, everything is deterministic (up to the equational theory) and thus the execution is actually a prefix of the honest execution of Π (from the process P Π defined in Definition 51), up to a bijective renaming of parameters (note that P and Q do not share session parameters).

Remind that all tests must be positive in the honest execution (i.e. τ else does not occur in the honest execution). Therefore, τ x = τ then concluding the proof.

Invariance of Frame Idealisations

In general, a renaming of annotations can break executability: as illustrated in Example 72, mapping two dual annotations to annotations of different identities breaks the ability of the two underlying agents to communicate successfully. Moreover, even when executability is preserved, parameters change (so do names) and thus frames are modified. However, as stated next in Proposition 26, such renaming do not change idealised frames. We obtain the latter since we made sure that idealised frames only depend on what is already observable and not on specific identity or session parameters. In combination with frame opacity, this will imply (Proposition 27) that a renaming of annotations has no observable effect on the resulting real frames.

Proposition 26. Let ta be an annotated trace and fr 1 be a name assignment such that Φ fr1 ideal (ta) is well-defined. Let ρ be a renaming of annotations, and fr 2 be an injective function satisfying fr 2 (aρ, x) = fr 1 (a, x). We have that Φ fr2 ideal (ta) is well-defined and Φ fr1 ideal (ta) = Φ fr2 ideal (taρ).

Proof of our Main Theorem

Next, it suffices to prove that no execution is blocked by a sequence in K(taρ). By definition of the renaming ρ (third requirement in Definition 66), if an agent P [ρ(a)] occurring in K(taρ) is in sequence with an agent ρ(a ′ ) before him, then P [aρ] occurring in (K(ta)ρ) must be in sequence with a before him as well. Hence, when a process P [ρ(a)]; Q is available (i.e. at top-level) at some point in the execution from K(ta)ρ, then a similar process P [ρ(a)]; Q ′ is also available at the same point in the execution from K(taρ). However, a processes may become available in the execution from K(ta)ρ only after having performed rule Unfold, while the same process may be immediately available in the multiset in the execution from K(taρ). This is why we only obtain a weak execution K(taρ) taρ ==⇒ (P ′′ ; Φ).

Proposition 29. If ta = ta 1 .ta 2 is a well-formed annotated trace and K(ta

1 .ta 2 )ρ ta 1 ρ --→ K then K(ta 1 )ρ ta 1 ρ --→ K ′ with Φ(K) = Φ(K ′ ).
Proof. The argument is the same as for Proposition 24, item (4): the processes that are added to K(ta 1 )ρ when considering K(ta 1 .ta 2 )ρ are unused in the execution of ta 1 ρ; moreover, the effect of ρ on the processes of K(ta 1 ) is obviously the same as in K(ta 1 .ta 2 ).

Finally, after having defined the notion of connection between agents, we can state our key lemma.

Definition 67. Annotations a and a ′ are connected in (ta, Φ) if they are associated in (ta 0 , Φ)

for some prefix ta 0 of ta that contains at least one τ then action of an unsafe conditional annotated with either a or a ′ .

Lemma 23. We assume that Π satisfies frame opacity and item (i) of well-authentication. Let ta be a well-formed annotated trace such that K(ta) ta -→ (P; Φ). Let ρ be a renaming of annotations. Moreover, when fn(I) ∩ fn(R) ̸ = ∅ (the shared case), we assume that for any annotations a, a ′ , it holds that a and a ′ are connected in (ta, Φ), if, and only if, ρ(a) and ρ(a ′ ) are dual.

Under those assumptions, one has K(ta)ρ taρ --→ (Q; Ψ) for some Ψ such that Φ ∼ Ψ.

Proof. We will proceed by induction on ta but we need to strengthen the invariants notably by relating the multisets P and Q: when

P = { ⨿ j∈J P i j [a i j ]} i∈I , Q must be of the form Q = { ⨿ j∈J Q i j [ρ(a i j )]} i∈I
, where P i j and Q i j are equal up to terms (i.e. ignoring terms in outputs and conditionals). We note P ∓ Q when this is the case.

For any prefix K(ta) ta 0 -→ (P 0 ; Φ 0 ) of the given execution, we prove that there exists an execution K(ta)ρ ta 0 ρ --→ (Q 0 ; Ψ 0 ) with those invariants:

(a) P 0 ∓ Q 0 ; (b) Φ 0 ∼ Ψ 0 ;
(c 1 ) when fn(I) ∩ fn(R) = ∅ (the non-shared case), ρ(a) and ρ(a ′ ) are associated in (ta 0 ρ, Ψ 0 )

if, and only if, a and a ′ are associated in (ta 0 , Φ);

(c 2 ) when fn(I) ∩ fn(R) ̸ = ∅ (the shared case), ρ(a) and ρ(a ′ ) are associated in (ta 0 ρ, Ψ 0 ) if, and only if, a and a ′ are associated in (ta 0 , Φ 0 ) and connected in (ta, Φ). 9.5. Proof of our Main Theorem of a (resp. aρ) and shall prove that τ x = τ y . We distinguish two cases, whether the conditional is safe or not.

• If the conditional is safe, then its outcome only depends on the inputs and outputs of a that are statically equivalent to those of ρ(a) by the invariant (b). Hence, the outcome of that test is the same for a and ρ(a) and τ x = τ y .

• If the conditional is unsafe, we make use of Proposition 25 to show that the outcome of the conditional is the same on both sides. First, we deduce the following executions from Proposition 24 item (4) applied on the execution before renaming and Proposition 29 applied on the execution after renaming:

K(ta 0 .τ x [a]) ta 0 .τ x [a] ----→ (P ′ 0 ; Φ 0 ) and K(ta 0 .τ y [a])ρ ta 0 ρ.τ y [aρ] ------→ (Q ′ 0 ; Ψ 0 ).
To infer τ x = τ y from Proposition 25, it remains to prove that a and a ′ are associated in (ta 0 , Φ 0 ) if, and only if, ρ(a) and ρ(a ′ ) are associated in (ta 0 ρ, Ψ 0 ). When not in the shared case, this is given by the invariant (c 1 ). Otherwise, (c 2 ) gives us that a and a ′ are associated when ρ(a) and ρ(a ′ ) are associated. Conversely, if a and a ′ are associated in (ta 0 , Φ), then by Proposition 25, the outcome of the test will be positive (i.e. τ x = τ then ) and a and a ′ are thus connected in (ta 0 , Φ). Therefore, ρ(a) and ρ(a ′ ) are associated in

(ta 0 ρ, Ψ 0 ) by (c 2 ).
After the execution of this conditional producing τ x = τ y , condition (a) obviously still holds since τ x = τ y implying that both agents go to the same branch of the conditional. Invariant (b) is trivial since frames have not changed. Conditions (c 1 ) and (c 2 ) are preserved because the association between a and a ′ is preserved if, and only if, the outcome of the test is positive, which is the same before and after the renaming.

Case where α is an input. We immediately have that Q 0 can perform α[ρ(a)] on the same channel and with the same recipe (since dom(Φ 0 ) = dom(Ψ 0 ) follows from Φ 0 ∼ Ψ 0 ). Conditions (a) and (b) are obviously preserved. Conditions (c 1 ) and (c 2 ) are preserved because honest interactions are preserved by the renaming, since Φ 0 ∼ Ψ 0 by invariant (b). We only detail one direction of (c 1 ), the other cases being similar. Assume that ρ(a) and ρ(a ′ ) are associated in ((ta 0 .α[a])ρ, Ψ 0 ). The renamed agents ρ(a) and ρ(a ′ ) are also associated in (ta 0 ρ, Φ ′ ), thus a and a ′ are associated in (ta 0 , Φ ′ ). Now, because α did not break the association of ρ(a) and ρ(a ′ ) in (ta 0 ρ, Ψ 0 ), it must be that the input message in α = in(c, M ) corresponds to the last output of ρ(a ′ ) in ta 0 ρ. Formally, if that last output corresponds to the handle w in Ψ 0 , we have M Ψ 0 ⇓= E wΨ 0 . But, because Φ 0 ∼ Φ 0 by invariant (b), we then also have M Φ 0 ⇓= E wΦ 0 and the association of a and a ′ in (ta 0 , Φ 0 ) carries over to (ta 0 .α[a], Φ 0 ).

Final Proof

Thanks to Lemma 23, we can transform any execution of M Π,id into an indistinguishable execution of S Π , provided that an appropriate renaming of annotations exists. In order to prove that 9. Sufficient Conditions for Privacy such a renaming exists in Proposition 31, we show below that in the shared case, there cannot be agents connected multiple times.

Proposition 30. Assume that Π satisfies item (ii) of the well-authentication condition and that fn(I) ∩ fn(R) ̸ = ∅ (shared case). Consider a well-formed annotated trace ta and an execution K(ta) ta -→ (P; Φ).

If there are three annotations a, a 1 , a 2 such that a and a 1 are connected in (ta, Φ) and a and a 2 are connected in (ta, Φ) then a 1 = a 2 .

Proof. Consider the first unsafe conditional performed by one of the three agents a, a 1 , a 2 . We claim that when this action is performed, a and a 1 are associated, and so are a and a 2 , which contradicts condition (ii) of well-authentication. Indeed, both pairs (a, a 1 ) and (a, a 2 ) are connected in (ta, Φ) and are thus associated until the first unsafe test of the corresponding pairs. Proposition 31. We assume that Π satisfies item (ii) of well-authentication. For any wellformed annotated trace ta such that K(ta) ta -→ K, there exists a renaming of annotations ρ satisfying the hypothesis of Lemma 23 and such that taρ is single-session.

Proof. For k ∈ id I (ta) ∪ id R (ta), we define Co(k) as follows:

• if in the shared case (i.e. fn(I) ∩ fn(R) ̸ = ∅), we let Co(k) be the set of all (n 1 , n 2 ) such that I(k, n 1 ) and R(k, n 2 ) are connected in (ta, Φ(K));

• otherwise (i.e. fn(I) ∩ fn(R) = ∅), we let Co(k) be the empty set.

Essentially, Co(k) denotes the set of pairs of (dual) sessions that the renaming to be defined should keep on the same identity. Applying Proposition 30, we deduce that for any k ∈ id A (ta) and (n 1 , n 2 ), (n 3 , n 4 ) ∈ Co(k), then either (i) n 1 = n 3 and n 2 = n 4 or (ii) n 1 ̸ = n 3 and n 2 ̸ = n 4 . Next, we assume the existence of a function k c : N * × N * × * N * → N * that associates to any sequence of names (k, n 1 , n 2 ) a vector of names of the length of identity parameters of Π:

k ′ = k c (k, n 1 , n 2 )
. These name vectors are assumed to be all disjoint and not containing any name already occurring in the annotations of ta. This gives us a mean to pick fresh identity parameters for each combination of k, n 1 , n 2 taken from the annotations of ta. We also assume a function k 1 such that the vectors k 1 (k, n 1 ) are again disjoint and not overlapping with annotations of ta

and any k c (k ′ , n ′ 1 , n ′ 2 )
, and similarly for k 2 (k, n 2 ) which should also not overlap with k 1 vectors. These last two collections of identity parameters will be used to give fresh identities to initiator and responder agents, independently. We then define ρ as follows:

I(k, n 1 ) → I(k c (k, n 1 , n 2 ), n 1 ) if (n 1 , n 2 ) ∈ Co(k) → I(k 1 (k, n 1 ), n 1 ) otherwise R(k, n 2 ) → R(k c (k, n 1 , n 2 ), n 2 ) if (n 1 , n 2 ) ∈ Co(k) → R(k 2 (k, n 2 ), n 2 ) otherwise 198 9.

Proof of our Main Theorem

Let us prove that ρ satisfies all requirements.

The mapping ρ is a renaming. First, for any well-formed ta ′ , the fact that ta ′ ρ is well-formed follows from the following: (i) session names are not modified and (ii) identity names are all pairwise distinct and never intersect except for agents ρ(I(k, n 1 )) and ρ(R(k, n 2 )) such that (n 1 , n 2 ) ∈ Co(k) but there cannot be a third agent sharing the same identity names according to the result obtained above. The mapping ρ is obviously role-preserving. Finally, if ρ(a) and ρ(a ′ ) share the same identity parameters then (a) fn(I) ∩ fn(R) ̸ = ∅ and (b) a and a ′ are connected in (ta, Φ) and are thus dual implying that a and a ′ share the same identity parameters as well.

The renaming ρ is single-session since id 0 never occurs in the image of ρ and all agents are mapped to agents having fresh, distinct identity parameters except for agents a, a ′ that were connected in (ta, Φ). But as already discussed, in such a case, there is no third agent sharing those identity parameters and a and a ′ are necessarily dual.

Hypothesis of Lemma 23. To conclude, we shall prove that, in the shared case, for any annotations a, a ′ , it holds that a and a ′ are connected in (ta, Φ), if, and only if, ρ(a) and ρ(a ′ ) are dual. The ⇐ direction has already been proved above. The ⇒ direction follows from the fact that, in such a case, the session parameters of a and a ′ would be in Co(k).

We conclude the section with the final proof of Theorem 8.

Proof of Theorem 8. It is easy to see that S Π ⊑ M Π ⊑ M Π,id , so it only remains to establish that M Π,id ⊑ S Π . Consider an execution M Π,id ta -→ (P; Φ). Proposition 24 yields an annotated trace ta ′ τ = ta and an execution K(ta) ta ′ -→ (P ′ , Φ). Let ρ be the renaming obtained in Proposition 31 for ta ′ . By Lemma 23, ta ′ ρ remains executable and is indistinguishable from ta ′ :

K(ta)ρ ta ′ ρ --→ (Q; Φ ρ ) with Φ ρ ∼ Φ.
We then deduce from Proposition 28 an execution

K(taρ) ta ′ ρ = == ⇒ (Q ′ ; Φ ρ ).
Since taρ is single-session, Proposition 24 implies:

(S Π ; ∅) ta * -→ (Q ′′ ; Φ ρ ) with ta * τ = ta ′ ρ.
This execution allows us to conclude: it has the same observable actions as ta since obs(ta) = obs(ta ′ ) = obs(ta ′ ρ) = obs(ta * ), and yields a statically equivalent frame (i.e. Φ ρ ∼ Φ).

Chapter 10

Mechanisation & Case Studies

In this chapter, we show why our Main Theorem and our conditions are interesting in practice.

We first explain how to verify each of our conditions using dedicated encodings in Section 10.1.

For that, we rely on the fact that each condition is fundamentally simpler that the original properties of interest (i.e. unlinkability and anonymity) and only focuses on one aspect of the underlying complex verification problem. For instance, one can get rid of control-flow issues when verifying frame-opacity and one can verify well-authentication using only reachability properties instead of more complex equivalence properties. Next, we describe our tool UKano that automates all those encodings.

In Section 10.2 with consider several case studies and we show that our method allows to establish new proofs or to find new attacks on real-world security protocols.

Mechanisation

We now discuss how to verify unlinkability and anonymity in practice, through the verification of our two conditions. More specifically, we describe how appropriate encodings allow one to verify frame opacity (Subsection 10.1.1) and well-authentication (Subsection 10.1.2), respectively through diff-equivalence and correspondence properties. These can then be verified by several tools such as ProVerif and Tamarin.

We additionally provide a tool, called UKano [UKA] (10.1.3), which mechanises the encodings described in this section. Our tool takes as input a specification of a protocol in our class and, computes encodings, and calls ProVerif to automatically check our two conditions, and thus unlinkability and anonymity. As we shall see in Section 10.2, our tool concludes on many interesting case studies.

Due to our choice of base tool, our presentation is sometimes biased towards ProVerif. We note, however, that the encodings are quite generic, and may be used to verify our properties through other tools, automatic or not, e.g. Tamarin. This may be useful to bypass some of ProVerif's limitations w.r.t. the supported cryptographic primitives or sequential sessions (which cannot be modelled and verified with enough precision).

Frame Opacity

We first explain how to check frame opacity using the diff-equivalence feature of ProVerif [START_REF] Blanchet | Automated verification of selected equivalences for security protocols[END_REF].

Intuitively, diff-equivalence is obtained from trace equivalence by forcing the two processes (or configurations) being compared to follow the same execution. More formally, diff-equivalence is a property of bi-processes, which are processes (or configurations) in which some terms are replaced by bi-terms of the form choice[u 1 , u 2 ]. Intuitively, a bi-process represents two processes: the first (resp. second) process is obtained by selecting the first (resp. second) component of choice operators. Said otherwise, each execution of a bi-process produces two frames instead of one. More importantly, when bi-processes are executed, exactly the same rule should be applied to the two processes on both sides. A bi-process is diff-equivalent if, when executing it, (i) both sides can always be executed synchronously (i.e. it never happens that a rule can be applied on one side but not on the other side) and (ii) the two resulting frames are statically equivalent.

We say that two regular multisets of processes are diff-equivalent when they can be combined into a diff-equivalent bi-process.

Our notion of frame opacity requires that, for any execution M Π,id ta -→ (P ; Φ), one has Φ ≈ Φ ideal (ta). It is possible to verify this condition by checking the diff-equivalence between M Π,id and a modified version of this process where each output u (identified by a label in L) has been replaced by a static idealisation induced by the idealisation operator ideal(•). As a first approximation, we consider the bi-process biproc(M Π,id ) obtained from M Π,id by replacing each ℓ : out(c, u ℓ ) by ℓ : out(c, choice[u ℓ , ideal(ℓ)]) and binding X n variables used in ideal(ℓ) by 'ν' constructs at the beginning of each role instance, so that they will be generated fresh for each session. We assume here that variables x i ∈ X i actually correspond to the appropriate input variables; this can be obtained easily by renaming.

The issue with this first bi-process is that diff-equivalence in ProVerif forces the left-hand and right-hand processes to execute exactly the same kind of actions at the same time, even for unobservable actions such as τ then , τ else . This is too constraining: typically, a normal execution involving a ciphered message may be mapped to an idealised execution where that message is replaced by a nonce, hence it will not pass tests such as the ability to be decrypted. However, recall that our only goal here is to make sure that, if a frame Φ is reachable from M Π,id then it is statically equivalent to its idealisation. We are not really interested in executability of the process on the right as we only use it to produce idealised frame corresponding to the real frame produced by the process on the left. We overcome this difficulty in the actual definition of biproc(M Π,id ) by pushing conditionals into messages and putting else branches in parallel.

We do not formally explain how to do so as it heavily depends on specificities of ProVerif, but just give an example to illustrate the pushing of conditionals: we show in Figure 10.1 (part of) the bi-process resulting from the application of our transformation to our running example; note that the computation of merge never fails (neither on the left, nor on the right) because catchFail always returns a message. More examples can be found in the ProVerif files produced by UKano for our case studies, available online [UKe].

Assuming that diff-equivalence holds for biproc(M Π,id ), we have that frame opacity holds (Feldhofer) too. Indeed, for any execution M Π,id ta -→ (P ; Φ), there exists some execution biproc(M Π,id ) ta -→ (Q, choice[Φ, Φ r ]) with Φ ≈ Φ r . By construction of the bi-process we have that Φ r ≈ Φ ideal (ta), thus frame opacity holds. Practical application. Our tool UKano does not require the user to input the idealisation function. Instead, a default idealisation is extracted from the protocol's outputs. The user is informed about this idealisation, and if he wants to, he can bypass it using annotations. In practice, this is rarely necessary. Moreover, UKano lets the user choose among different heuristics to build idealisation operators. We briefly explain and compare them in Subsection 10.1.3.

In case of protocols with sequential sessions, we could check frame opacity with concurrent sessions, which implies the property for the concurrent case.

We note, however, that frame opacity may be checked using more lightweight verification techniques than diff-equivalence. At least in case of standard cryptographic primitives (pairs, symmetric and asymmetric encryption, hash, MACs and signatures), we conjecture that frame opacity can be reduced to secrecy and freshness conditions; such reachability properties can be handled efficiently by several tools. For such cases (i.e. uses of standard primitives), we thus claim that our methods allows to completely reduce the verification of unlinkability and anonymity into purely reachability properties verification.

Well-authentication

We explain below how to check condition (i) of well-authentication. Once that condition is established, together with frame opacity, we shall see that condition (ii) is a consequence of a simple assumption on the choice of idealisation, which is always guaranteed when using UKano.

10.1. Mechanisation query k : key , n1 : b i t s t r i n g , n2 : b i t s t r i n g , nt : b i t s t r i n g , nr : b i t s t r i n g , mP: b i t s t r i n g , mR: b i t s t r i n g ; e v e n t ( T e s t I 1 ( k , n1 ) ) ==> ( e v e n t ( I n I 1 ( k , n1 ,mR) ) ==> ( e v e n t ( OutR1 ( k , n2 ,mR) ) ==> ( e v e n t ( InR1 ( k , n2 ,mP) ) ==> ( e v e n t ( OutI1 ( k , n1 ,mP) ) ) ) ) ) . structure of the ProVerif file produced by UKano makes it easy for the user to remove the proof obligations corresponding to safe conditionals.

Note that, for some examples, we also verified condition (i) of well-authentication using Tamarin by encoding the queries described above as simple lemmas (models are available at [UKe]).

In our case, one of the most important advantage of Tamarin over ProVerif is its capability to model ! and thus protocols for which a role executes its sessions in sequence. Relying on Tamarin, we were thus able to verify condition (i) for protocols that ensure unlinkability when sessions are running sequentially but not when they are running concurrently (e.g. we automatically verified the variant of Feldhofer described in Example 52).

Condition (ii)

We shall prove that, for the shared case, once condition (i) of well-authentication is known to hold, condition (ii) is a consequence of two simpler conditions. First, the first conditional of the responder role should be safe -remark that if this does not hold, similar attacks as the one discussed in Example 70 may break unlinkability. Second, messages outputted in honest interactions by different agents should always be different. -----→ (P; Φ) where two agents a and a ′ are associated and a ′ has performed the last τ then . If this test corresponds to a safe conditional, there is nothing to prove. Otherwise, we shall prove that a is only associated to a ′ , and vice versa. -----------------------→ (P; Φ)

M Π,id ta.out(c, w ℓ )[a].ta ′ .in(c ′ , R)[a ′ ].ta ′′ .τ then [a ′ ]
We have RΦ ⇓ Φ(w ℓ ). Assume, for the sake of contradiction, that a ′ is associated to another agent b ̸ = a. Then we have RΦ ⇓= E Φ(w ℓ ′ ), hence Φ(w ℓ ) = E Φ(w ℓ ′ ), for a handle w ℓ ′ corresponding to some output of b in the honest trace ta| a ′ ,b . This contradicts assumption (b).

Agent a is only associated to a ′ . Agent a must have performed an input in ta: this is obvious if a is a responder, and follows from assumption (a) otherwise. Let ℓ be the label of the previous output of a ′ and w ℓ be the corresponding handle in the frame Φ. Our execution is thus of the following form: -----------------------→ (P; Φ)

M Π,id ta.out(c, w ℓ )[a ′ ].ta ′ .in(c, R)[a].ta ′′ .τ then [a ′ ]
We know that the message m, satisfying RΦ ⇓ m, which is inputted by a is equal (modulo E) to the previous output of a ′ , that is Φ(w ℓ ). As before, condition (b) implies that it cannot be equal to the output of another agent having an honest interaction in ta, thus a is only associated to a ′ . Practical application. Condition (a) of Lemma 24 is usually easily checked manually; UKano leaves it to the user. Condition (b) may in general be very difficult to verify. In practice, once frame opacity is known to hold, condition (b) actually follows immediately from simple properties of the idealisation function, since checking that honest outputs cannot be confused in executions of M Π,id is equivalent to checking that they cannot be confused in idealised executions. Often, the idealisation function uses only function symbols that do not occur in E and such that at least one session variable x n ∈ X n occurs in ideal(ℓ) for each honest output label ℓ. Checking that the idealisation function enjoys these properties is straightforward. Let us now show that it implies condition (b) of Lemma 24.

Proposition 32. Let Π = (k, n I , n R , † I , † R , I, R) be a protocol such that fn(I) ∩ fn(R) ̸ = ∅ (shared case). Consider an idealised operator ideal(•) such that, for any label ℓ ∈ L occurring in the honest execution of Π, the following holds:

• ideal(ℓ) ∈ T (Σ s c , X i ∪ X n ) where Σ s c ⊆ Σ c contains function symbols that never occur in equations of E and • vars(ideal(ℓ)) ∩ X n ̸ = ∅.
If Π satisfies frame opacity for the idealised operator ideal(•) then condition (b) of Lemma 24 holds.

Proof. Consider an execution ta of M Π,id where agent a 1 performs an output with label ℓ and handle w, and agent a 2 ̸ = a 1 performs another output with label ℓ ′ and handle w ′ . We assume that ℓ occurs in the honest execution of Π and we note Φ the resulting frame from the above 206 10.1. Mechanisation execution. Assume, for the sake of contradiction, that Φ(w) = E Φ(w ′ ). Since the protocol ensures frame opacity for the idealised operator ideal(•), we deduce that:

Φ fr ideal (ta)(w) = E Φ fr ideal (ta)(w ′ ).
By hypothesis on ideal(ℓ), it holds that vars(ideal(ℓ)) ∩ X n ̸ = ∅. Therefore, some name fr(a 1 , x n ) occurs in Φ fr ideal (ta)(w) at some position, under non-malleable function symbols only (i.e. function symbols in Σ s c that do not occur in equations in E). Thus, the same function symbols must occur along the path to that position in Φ fr ideal (ta)(w ′ ), and fr(a 2 , x n ) = E t for some sub-term t of Φ fr ideal (ta)(w ′ ). Since the name fr(a 1 , x n ) does not occur in t by construction, this implies that the equational theory is degenerate (all terms can be equated) which we have ruled out by assumption (see Subsection 2.1.1 in Chapter 2).

The Tool UKano

As mentioned earlier, the tool UKano [UKA] automatises the encodings described in the previous section. It takes as input a ProVerif model specifying the protocol to be verified (and the identity names id) and returns:

1. whether frame opacity could be established or not: in particular, it infers an idealisation operator that, when in the shared case, satisfies the assumptions of Proposition 32 discussed in Subsection 10.1.2; 2. and the list of conditionals for which condition (i) of well-authentication holds.

If frame opacity holds and condition (i) of well-authentication holds for all conditionals -possibly with some exceptions for conditionals the user can identify as safe -then the tool concludes that that the protocol given as input ensures unlinkability and anonymity w.r.t. id. Note that the tool detects whether fn(I) ∩ fn(R) = ∅ or not and adapts the queries for verifying item (i) of well-authentication accordingly.

Our tool uses heuristics to build idealised operators that always satisfy requirements discussed in Subsection 10.1.2 (i.e. assumptions of Proposition 32). Three different heuristics for automatically building idealisation operators have been implemented and can be used using different options. The default heuristic follows the canonical syntactical construction described in Section 9.2 except that sub-terms having a function symbol at top-level that is involved in the equational theory will be replaced by a fresh session name in order to comply with hypothesis of Proposition 32. However, when using the option -ideal-full-syntax in the non-shared case, the tool fully adopts the canonical syntactical construction (and displays a warning message when in the shared case since all requirements are not met in this case). Further, the option -ideal-greedy can be used to modify the heuristics as follows:

• idealisation of a tuple is a tuple of idealisations of the corresponding sub-terms and • idealisation of any other term is a fresh session variable in X n . 207

Mechanisation & Case Studies

Such an idealised operator is much less precise (i.e. it often leads to false negatives) but since idealised messages are much simpler, it allows better performance when it works. Finally, the user can also define its own idealisations. The tool UKano always checks their conformity though (i.e. assumptions of Proposition 32 when in the shared case).

At a technical level, we built UKano on top of ProVerif. We only re-used the lexer, parser and AST of ProVerif and build upon those a generator and translator of ProVerif models implementing our sufficient conditions via the above encodings. This effort represents about 2k OCaml LoC. The official page of the tool UKano can be found at http://projects.lsv.ens-cachan.fr/ ukano/, the sources at http://github.com/LCBH/UKano, and the manual at http://github. com/LCBH/UKano/wiki.

Case Studies

In this section we apply our verification method to several case studies. We rely on our tool UKano to check whether the protocol under study satisfies frame opacity and well-authentication as defined in Chapter 9. We also discuss some variations of the protocols to examine how privacy is affected. Remind that if privacy can be established for concurrent sessions (i.e. † I = † R =!) then it implies privacy for all other scenarios (when one or the two roles play sessions only sequentially). We thus implicitly model protocols with concurrent sessions and discuss alternative scenarios only when attacks are found.

As explained in Section 10.1, UKano relies on ProVerif; the source code of our tool and material to reproduce results can be found in [UKA]. Before diving into our real-world case studies, we recall that all our running examples developed so far have been automatically analysed with our tool UKano (see Table 9.1). Furthermore, frame opacity can be automatically established for all of them using any heuristics to build idealisation (except Example 53 for which only the default and the fully syntactical heuristics allow to conclude). Furthermore, all case studies discussed in this section except two (i.e. PACE in Subsection 10.2.4 and ABCDH in Subsection 10.2.5) have been automatically verified using our tool UKano without any manual effort. We discuss little manual efforts needed to conclude for PACE and ABCDH in the dedicated sections.

We used UKano v0.2 based on ProVerif v1.92 on a computer with following specifications:

• OS: Linux 3.10-2-amd64 #1 SMP Debian 3.10.5-1x86_64 GNU/Linux • CPU / RAM: Intel(R) Xeon(R) CPU X5650 @ 2.67GHz / 47GO

Hash-Lock Protocol

We consider the Hash-Lock protocol as described in [START_REF] Juels | Defining strong privacy for RFID[END_REF]. This is an RFID protocol that has been designed to achieve privacy even if no formal proof is given. The protocol relies on a hash function, and can be informally described as follows.

Reader → Tag : n R Tag → Reader : n T , h(n R , n T , k) 208 10.2. Case Studies This protocol falls into our generic class of 2-party protocols in the shared case, and frame opacity and well-authentication can be automatically established in less than 0.01 second. We can therefore conclude that the protocol preserves unlinkability (note that anonymity does not make sense here). All implemented heuristics (see those three heuristics in Section 10.1) were able to successfully establish frame opacity automatically.

LAK Protocol

We present an RFID protocol first introduced in [LAK06], and we refer to the description given in [START_REF] Van Deursen | Attacks on RFID protocols[END_REF]. To avoid traceability attacks, the main idea is to ask the tag to generate a nonce and to use it to send a different message at each session. We suppose that initially, each tag has his own key k and the reader maintains a database containing those keys.

The protocol is informally described below (h models a hash function). In the original version (see e.g. [START_REF] Van Deursen | Attacks on RFID protocols[END_REF]), in case of a successful execution, both parties update the key k with h(k) (they always store the last two keys). Our framework does not allow one to model protocols that rely on a mutable state. Therefore, we consider here a version where the key is not updated at the end of a successful execution allowing the key k to be reused from one session to another. This protocol lies in the shared case since the identity name k is used by the reader and the tag.

Reader → Tag : r 1 Tag → Reader : r 2 , h(r 1 ⊕ r 2 ⊕ k) Reader → Tag : h(h(r 1 ⊕ r 2 ⊕ k) ⊕ k ⊕ r 1 )
Actually, this protocol suffers from an authentication attack. The protocol does not allow the reader to authenticate the tag. This attack can be informally described as follows (and already exists on the original version of this protocol). By using algebraic properties of ⊕, an attacker can impersonate a tag by injecting previously eavesdropped messages. Below, I(A) means that the attacker plays the role A.

I(Reader) → Tag : r 1 Tag → Reader : r 2 , h(r 1 ⊕ r 2 ⊕ k)

Reader → Tag : r ′ 1 I(Tag) → Reader : r I 2 , h(r 1 ⊕ r 2 ⊕ k) Reader → Tag : h(h(r 0 ⊕ r 1 ⊕ k) ⊕ k ⊕ r ′ 1 )
where

r I 2 = r ′ 1 ⊕ r 1 ⊕ r 2 , thus h(r 1 ⊕ r 2 ⊕ k) = E h(r ′ 1 ⊕ r I 2 ⊕ k).
Due to this, the protocol does not satisfy our well-authentication requirement even with sessions in sequence for Tag and Reader. Indeed, the reader can end a session with a tag whereas the tag has not really participated to this session. In other words, the reader passes a test (which does not correspond to a safe conditional) with success, and therefore performs a τ then action whereas it has not interacted honestly with a tag.

Actually, this trace can be turned into an attack against the unlinkability property. Indeed, by continuing the previous trace, the reader can send a new request to the tag generating a fresh nonce r ′′ 1 . The attacker I(Tag) can again answer to this new request choosing his nonce r ′′ 2 209 10. Mechanisation & Case Studies accordingly, i.e. r ′′ 2 = r ′′ 1 ⊕ r 1 ⊕ r 2 . This execution, involving two sessions of the reader talking to the same tag, cannot be mimicked in the single session scenario, and corresponds to an attack trace.

More importantly, this scenario can be seen as a traceability attack on the original version of the protocol (the stateful version) leading to a practical attack. The attacker will first start a session with the targeted tag by sending it a nonce r 0 and storing its answer. Then, later on, he will interact with the reader as described in the second part of the attack scenario. Two situations may occur: either the interaction is successful meaning that the targeted tag has not been used since its last interaction with the attacker; or the interaction fails meaning that the key has been updated on the reader's side, and thus the targeted tag has performed a session with the reader since its last interaction with the attacker. This attack shows that the reader may be the source of leaks exploited by the attacker to trace a tag. This is why we advocate for the strong notion of unlinkability we used, taking into account the reader and considering it as important as the tag.

We may note that the same protocol was declared untraceable in [START_REF] Van Deursen | Attacks on RFID protocols[END_REF] due to the fact that they have in mind a weaker notion of unlinkability.

To avoid the algebraic attack due to the properties of the xor operator, we may replace this operator using the pairing operator. The resulting protocol is a 2-party protocol that falls into our class, and for which frame opacity and well-authentication can be established (with concurrent sessions) using UKano, again in less than 0.01 second. Therefore, Theorem 8 allows us to conclude that it preserves unlinkability. Note also that frame opacity can be automatically checked using any heuristic described in Section 10.1.

BAC Protocol and some others

An e-passport is a paper passport with an RFID chip that stores the critical information printed on the passport. The International Civil Aviation Organization (ICAO) standard [START_REF]PKI for machine readable travel documents offering ICC read-only access[END_REF] specifies several protocols through which this information can be accessed. Before executing the Basic Access Control (BAC) protocol, the reader optically scans a weak secret from which it derives two keys k E and k M that are then shared between the passport and the reader. Then, the BAC protocol establishes a key seed from which two sessions keys are derived. The session keys are then used to prevent skimming and eavesdropping on the subsequent communication with the e-passport.

In [START_REF] Arapinis | Analysing unlinkability and anonymity using the applied pi calculus[END_REF], two variants of the BAC protocol are described and analysed w.r.t. the unlinkability property as formally stated in this part. We refer below to these two variants as the French version and the United Kingdom (U.K.) version. The U.K. version is claimed unlinkable (with no formal proof) whereas an attack is reported on the French version. To explain the difference between the two versions, we give a description of the passport's role1 in Figure 10 We consider the signature given in Example 1 (Chapter 2) augmented with a function symbol mac of arity 2. This is a public constructor whose purpose is to model message authentication code, taking as arguments the message to authenticate and the mac key. There is no rewriting rule and no equation regarding this symbol. We also assume public constants to model error messages. The U.K. version of the protocol does not distinguish the two cases of failure, i.e. error Mac and error Nonce are the same constant, whereas the French version does. message indicating whether the failure occurs due to a problem when checking the mac, or when checking the nonce. This allows the attacker to exploit this conditional to learn if the mac key of a Tag is the one used in a given message ⟨m, mac(m, k)⟩. Using this, he can very easily trace a tag T by first eavesdropping an honest interaction between the tag T and a reader.

The U.K. version of the BAC protocol is a 2-party protocol according to our definition. Note that since the two error messages are actually identical, we can merge the two let instructions, and therefore satisfy our definition of being a responder role. Then, we automatically proved frame opacity and well-authentication using UKano. It took less than 10 seconds. Therefore, Theorem 8 allows us to conclude that unlinkability is indeed satisfied.

Regarding the French version of this protocol, it happens that the passport's role is neither an initiator role, nor a responder role according to our formal definition. Indeed, our definition of a role, and therefore of a 2-party protocol does not allow to model two sequences of tests that will output different error messages in case of failure. As illustrated by the attack on the French version of the BAC protocol, imposing this syntactic condition is actually a good design principle w.r.t. unlinkability.

Once the BAC protocol has been successfully executed, the reader gains access to the information stored in the RFID tag through the Passive and Active Authentication protocols (PA and AA). They are respectively used to prove authenticity of the stored information and prevent cloning attacks, and may be executed in any order. A formal description of these protocols is available in [START_REF] Arapinis | Verifying privacy-type properties in a modular way[END_REF]. These two protocols also fall into our class and our conditions can be checked automatically both for unlinkability and anonymity properties. We can also use our

Mechanisation & Case Studies

technique to analyse directly the three protocols together (i.e. the U.K. version of the BAC together with the PA and AA protocols in any order). We analysed both orders: on one hand, we analysed BAC then PA then AA and, on the other hand, we analysed BAC then AA then PA. We thus prove unlinkability and anonymity w.r.t. all private data stored in the RFID chip (name, picture, etc.). UKano concludes within 4 minutes to establish both well-authentication and frame opacity (for any order PA/AA). Note that frame opacity can also be automatically checked using any heuristic described in Section 10.1. However, heuristics producing more complex idealisations (e.g. syntactical canonical construction) are less efficient: frame opacity can be established in 3 minutes using the greedy heuristic and in 20 minutes using the syntactic construction.

PACE Protocol

The Password Authenticated Connection Establishment protocol [PAC] (PACE) has been proposed by the German Federal Office for Information Security (BSI) to replace the BAC protocol. It has been studied in the literature [START_REF] Bender | Security analysis of the PACE key-agreement protocol[END_REF], [START_REF] Bender | The PACE AA protocol for machine readable travel documents, and its security[END_REF], [CSD + 12] but to the best of our knowledge, no formal proofs about privacy have been given. Similarly to BAC, the purpose of PACE is to establish a secure channel based on an optically-scanned key k. The protocol includes four main steps (see Figure 10.4):

• The tag randomly chooses a random number s T , encrypts it with the symmetric key k shared between the tag and the reader and sends the encrypted random number to the reader (message 1).

• Both the tag and the reader perform a Diffie-Hellman exchange (messages 2 & 3), and derive G from s T and g nRnT .

• The tag and the reader perform a Diffie-Hellman exchange based on the parameter G computed at the previous step (messages 5 & 6).

• The tag and the reader derive a session key k ′ which are confirmed by exchanging and checking the authentication tokens (messages 8 & 9).

A description in Alice & Bob notation is given in Figure 10.4. Moreover, at step 6, the reader will not accept as input a message which is equal to the previous message that it has just sent.

To formalise such a protocol, we consider the following signature: Σ c = {senc, sdec, dh, mac, gen, g, ok} and Σ d = {neq}.

Except g and ok which are public constants, all these function symbols are public constructor symbols of arity 2. The destructor neq has already be defined in Section 2.3 (in Chapter 2). The symbol dh is used to model modular exponentiation whereas mac will be used to model message authentication code. We consider the equational theory E defined by the following equations: sdec(senc(x, y), y) = x dh(dh(x, y), z) = dh(dh(x, z), y)

1.

Tag → Reader : {s T } k 2. Reader → Tag : g nR 3.

Tag → Reader : g nT 4. Both parties compute G = gen(s T , g nRnT ). 5. Reader → Tag :

G n ′ R 6. Tag → Reader : G n ′ T 7. Both parties compute k ′ = G n ′ R n ′ T 8. Reader → Tag : mac(G n ′ T , k ′ ) 9.
Tag → Reader : mac(G n ′ R , k ′ ) This protocol falls into our generic class of 2-party protocols. We take

Π PACE = (k, {s T , n T , n ′ T }, {n R , n ′ R }, !, !, I PACE , R PACE )
where the R PACE process (reader), described in Figure 10.5, is a responder role (we do not detail the continuation R ′ and we omit trivial conditionals). The process modelling the role I PACE can be obtained in a similar way. R PACE := in(c R , y 1 ).

out(c R , dh(g, n R )).in(c R , y 2 ). out(c R , dh(G, n ′ R )).in(c R , y 3 ). let y test = neq(y 3 , dh(G, n ′ R )) in out(c R , mac(y 3 , k ′ )); in(c R , y 4 ). let y 5 = eq(y 4 , mac(dh(G, n ′ R ), k ′ )) in R ′ . where G = gen(sdec(y 1 , k), dh(y 2 , n R )) and k ′ = dh(y 3 , n ′ R ). Unfortunately, ProVerif cannot handle the equation above on the dh operator (due to some termination issues). Instead of that single equation, we consider the following equational theory that is more suitable for ProVerif: dh(dh(g, y), z) = dh(dh(g, z), y) dh(dh(gen(x 1 , x 2 ), y), z) = dh(dh(gen(x 1 , x 2 ), z), y) This is sufficient for the protocol to work properly but it obviously lacks equations that the attacker may exploit.

First, we would like to highlight an imprecision in the official specification [PAC] that may lead to practical attacks on unlinkability. As the specification seems to not forbid it, we could have assumed that the decryption operation in G = gen(sdec(y 1 , k), dh(y 2 , n R )) is implemented in such a way that it may fail when the key k does not match with the key of the ciphertext y 1 . In that case, an attacker could eavesdrop a first message c 0 = senc(s 0 T , k 0 ) of a certain tag T 0 and then, in a future session, it would let the reader optically scan a tag T but replace its challenge senc(s T , k) by c 0 and wait for an answer of the reader. If it answers, he learns that the decryption did not fail and thus k = k 0 : the tag T is actually T 0 . We discovered this attack 10.2. Case Studies cannot be observed at all in S Π : if the attacker makes two readers talk to each other in S Π they cannot complete a session because they must have different identity names. In practice, this flaw seems hard to exploit but it could be a real privacy concern: if a tag initiates multiple readers, an attacker may learn which ones it had initiated by forwarding messages from one to another. It does not seem to be realistic in the e-passport scenario, but could be harmful in other contexts.

It seems that, in the e-passport context, a modelling with sequential sessions would be more realistic. We come back to such a modelling in Chapter 11.

Finally, we propose a simple fix to the above attack by adding tags avoiding confusions between reader's messages and tag's messages. It suffices to replace messages 8 and 9 from Fig- T ⟩, k ′ ) and mac(⟨c t , G n ′ R ⟩, k ′ ) where c r , c t are public constants, and adding the corresponding checks. Well-authentication can be automatically established using UKano in around 1 minute. However, the model produced by UKano to verify the frame opacity condition had to be slightly simplified (while preserving the semantics) in order to make ProVerif conclude more quickly. With this little extra manual effort, we verified frame opacity in less than 2 minutes. Therefore, PACE with tags preserves unlinkability in the model considered here.

Attributed-Based Authentication Scenario Using ABCDH Protocol

Most authentication protocols are identity-based: the user needs to provide his identity and prove to the service provider he is not trying to impersonate somebody else. However, in many contexts, the service provider just needs to know that the user has some non-identifying attributes (e.g. age, gender, country, membership). For instance, a bookshop just needs to have the proof that the user has the right to borrow books and does not need to know the full identity of the user. Attribute-based authentication protocols solve this problem and allow a user to prove to another user, within a secure channel, that he has some attributes without disclosing its identity.

We used our method to automatically establish unlinkability of a typical use case of such a protocol taking part to the IRMA project3 . We analysed a use case of the protocol ABCDH as defined in [START_REF] Alpár | A secure channel for attribute-based credentials[END_REF]. This protocol allows a smartcard C to prove to some Verifier V (which is also a smartcard) that he has the required attributes. The protocol aims at fulfils this goal without revealing the identity of C to V or to anyone else. One of its goal is also to avoid that any other smartcard C ′ replays those attributes later on. The protocol should also ensure unlinkability of C. To the best of our knowledge, there was no prior formal analysis of that security property for this protocol.

The key ingredient of this protocol is attribute-based credential (ABC). It is a cryptographic container for attributes. In ABC, attributes are signed by some issuers and allow for selective disclosure (SD): it is possible to produce a zero-knowledge (ZK) proof revealing a subset of attributes signed by the issuer along with a proof that the selected disclosed attributes are actually in the credential. This non-interactive proof protocol can be bound to some fresh data to avoid replay attacks. We shall use the notation SD(a i ; n) to denote the selective disclosure of 10. Mechanisation & Case Studies attributes a i bound to n. Note that SD(∅; n) (no attribute is disclosed) still proves the existence of a credential. There are two majors ABC schemes: Microsoft U-Prove [PZ13] and IBM's Idemix [START_REF] Camenisch | Electronic identities need private credentials[END_REF]. We decided to model IBM's scheme (since it is the one that is used in IRMA) following the formal model given in [START_REF] Camenisch | A formal model of identity mixer[END_REF]. It involves complex cryptographic primitives (e.g. commitments, blind signature, ZK proofs) but ProVerif can deal with them all. In this scheme, each user has a master secret never revealed to other parties. Issuers issue credentials bound to the master secret of users (note that users are known to issuers under pseudonyms). A SD consists in a ZK proof bound to n proving some knowledge: knowledge of the master secret, knowledge of a credential bound to the master secret, knowledge that the credential has been signed by the given organisation, knowledge that the credential contains some given attributes.

We analyse the ABCDH [AH13] using the model of SD from [START_REF] Camenisch | A formal model of identity mixer[END_REF] used in the following scenario:

• an organisation O age issues credentials about the age of majority;

• an organisation O check issues credentials giving the right to check the age of majority;

• a user C wants to watch a movie rated adult-only due to its violent contents; his has a credential from O age with the attribute adult;

• a movie theatre V wants to verify whether the user has the right to watch this movie; it has a credential from O check with the attribute canCheckAdult.

The scheme is informally given in Figure 10.6. n V , n C and n are fresh nonces. Functions f i are independent hash functions; we thus model them as free constructor symbols. The construction SD(•; •) is not modelled atomically and follows [CMS10] but we do not describe here its details.

1. Verifier → Client : dh(g, n V ), SD(canCheckAdult; f 1 (dh(g, n V ))) 2.

Client → Verifier : dh(g, n C ), SD(∅; f 1 (dh(g, n V ), dh(g, n C ))) 3. Verifier → Client : senc(⟨0x00, ok⟩, k) 4.

Client → Verifier : senc(⟨0x01, ok⟩, k) 5. Verifier → Client : senc(⟨n; requestAdult⟩, k) 6.

Client → Verifier : senc(⟨adult; SD(adult; f 3 (n, seed))⟩, k) The complete model of this protocol is quite complex and can be found in [UKe]. Unfortunately, no heuristic currently implemented in UKano allowed to verify frame opacity fully automatically. Nevertheless, based on the file generated by UKano for the fully syntactical heuristic and after some manual transformations, we were able to verify frame opacity in about 40 minutes.

Regarding well-authentication, due to the length of the protocol, the queries are also quite long. Because of the latter and the high complexity of the underlying term algebra, it required too much time for ProVerif to terminate. After some manual transformations and simplifications of

Conclusion

to reduce the size of such queries by relying on the other, smaller queries associated to other tests. For instance, assume the honest execution is of the form out(c I , w 1 ).in(c R , w 1 ).τ 1 then .out(c R , w 2 ). in(c I , w 2 ).τ 2 then . . . .. If we already know that all conditionals τ 1 then , . . . .τ k-1 then except the last one τ k then satisfy well-authentication then, in order to show that τ k then satisfies well-authentication as well, it should be sufficient to produce a query stating that if τ k then holds for an agent a then there exists an agent a ′ that is associated with a "between" the actions τ k-2 then and τ k then and thus skipping all events associated to actions before τ k-2 then . Second, note that models generated for verifying frame opacity heavily rely on nested conditionals in order to overcome false negatives stemming from a conditional making sense on the left (real protocol) but not on the right (idealised frame); see Subsection 10.1.1 for a discussion.

However, in many cases, a simple analysis of the protocol suffices to infer than some conditionals could not cause such mismatches and do not call for such costly precautions. We hope to be able to automate such analysis in order to produce simpler models.

Finally, a more efficient and also ambitious way to verify frame opacity could consist in developping a dedicated Horn clauses generation. One could adapt the ProVerif generation of clauses modelling executions of biprocesses for always prioritizing the left-process and then add clauses ProVerif generates for verifying static equivalence on resulting bi-frames.

Other tools as back-ends. Currently, our conditions are checked in UKano using ProVerif as back-end which, despite its great flexibility, supports only a limited kind of equational theory. In particular, the full Diffie-Hellman theory or associative-commutative theories needed for xor (widely used in RFID protocols) are not supported. However, we could consider using other tools such as Tamarin and Maude-NPA. For instance, we already successfully proved wellauthentication for Example 52 in Tamarin by translating queries described in Subsection 10.1.2 as lemmas statements. We think such encodings could be mechanised. We would also like to investigate the case of frame opacity. We could then leverage the richer cryptographic primitives modelling capabilities of Tamarin (e.g. thanks to recent efforts [START_REF] Dreier | Beyond Subterm-Convergent Equational Theories in Automated Verification of Stateful Protocols[END_REF]).

Better idealisation heuristics. Finally, we think that it is possible to make UKano build idealisations in a cleverer way, roughly by detecting when a term can be idealised by a nonce or when, on the contrary, it is crucial to retain its shape in order to remain precise enough. Hence, UKano could then use an adaptive heuristic by greedily idealising terms by session nonces when possible and use the more costly syntactical heuristic otherwise.

Regarding our Conditions and our Main Theorem

We also identify a number of research problems aimed at increasing the scope of our technique.

Stateful protocols. We would like to investigate the extension of our main theorem to the case of protocols with persistent state (from one session to the other). This is certainly technically challenging, but would make it possible to model more protocols (e.g. many RFID protocols 11.2. Regarding our Conditions and our Main Theorem are stateful), or at least model them more faithfully. We think that a good starting point is to define a notion of synchronised states between agents' internal states. Intuitively, agents having synchronised states may successfully execute a session (or its continuation) but never in the other case. Next, we shall strengthen well-authentication by requiring that agents that pass a conditional must be associated and must have synchronised states all the way. This way, we may be able to reuse our proof technique. Indeed, control-flow and internal states of agents would then be reduced to the association relation between agents. We would like to push this idea further and formalise it.

Beyond 2-party. Our method only applies on 2-party protocols. For instance, this was the reason why we have not modelled DAA join in combination with DAA sign (see Subsection 10.2.6) since the resulting protocol would be a 3-party protocol. Going beyond 2-party protocols would thus greatly extend the scope of our technique.

More generic notion of honest trace. As already mentioned in Subsection 10.2.4, we have shown that the PACE protocol does not ensure unlinkability when sessions of e-passports and readers can be executed concurrently. However, one could argue that executing sessions concurrently does not seem practical. Indeed, e-passports RFID chips' content are assumed to be impossible to clone. It is thus expected that there exists at most one physical e-passport equipped with given identity names.

Therefore, we have investigated the scenario where sessions can be executed only sequentially. We have turned to Tamarin since ProVerif is not able to model faithfully such scenarios. We wrote a Tamarin model encoding well-authentication and found that this condition does not hold even with the tagged version (see Subsection 10.2.4). This contrasts with the positive result obtained with ProVerif. Actually, this comes from the fact that Tamarin models Diffie-Hellman exponentiation in a more faithful way than ProVerif. Some behaviours that were not possible in the ProVerif model become possible, and it happens that well-authentication is not satisfied in such a model. Indeed, the attacker can alter the Diffie-Hellman shares, as informally depicted in Figure 11.1, without impacting successive agents' conditionals. This is problematic because

1.

Tag → Reader :

{s T } k 2.
Reader → Attacker : g nR 2 ′ . Attacker → Tag :

(g nR ) X 3.

Tag → Attacker : g nT 3 ′ . Attacker → Reader :

(g nT ) X successful tests will pass (independently of the message X) while such interactions are not honest according to our current definition of honest trace (see Definition 50). Obviously, this interaction is not an attack on unlinkability at all.

We have ideas to tackle this issue. First, one could extend the notion of "honest trace associated to a protocol" (Definition 51) as follows: to any protocol, we associate a set of symbolic

Conclusion

traces that are roughly traces with (possibly) variables in recipes. For instance, for PACE, one may use tr h = out(c I , w 1 ).in(c R , dh(w 1 , X)).out(c R , w 2 ).in(c I , dh(w 2 , X)). . . . in addition to the standard non-symbolic trace. However, in order to adapt our proof technique, we need to make sure that whatever the recipes chosen to fill in the variables (e.g. X in tr h ), the resulting concrete trace can be executed by the protocol and the produced frame has always the same idealisation.

Remark that this is the case for tr h in the case of the PACE protocol. We have hopes to adapt our theorem and our method this way in order to deal with PACE and other examples based on such Diffie-Hellman exchanges.

Getting rid of equivalence. We have conjectured that, for standard cryptographic primitives, frame opacity should be verifiable with enough precision via a conjunction of reachability properties (e.g. secrecy of encryption keys) and simple, syntactical checks (e.g. fresh nonce in ciphertext). We would like to prove such a result. A good starting point would be to consider (a)symmetric encryption, mac, signature and pairs defined via reduction rules with an empty set of equations E. We are convinced that the above can be established for such term algebras. We think that seeking for such a result in a way that can be applied to real-world case studies is an attractive and exciting research goal since it would allow to completely reduce the verification of complex equivalence based-properties such as unlinkability into purely reachability verification problems. The practical implication is that the verification could then be carried out using one of the numerous and highly efficient tools dealing with reachability only.

Compositional verification. We believe that our conditions could be verified more compositionally than the original anonymity and unlinkability properties. We notably have insights about a way to verify frame opacity more compositionally. Indeed, assuming well-authentication item (i) has been previously established, we know that if a protocol session reaches an unsafe conditional, this session has necessarily followed the honest execution and all its outputs are thus fixed. This remark allows us to intuitively split a protocol at the level of a given unsafe conditional and verify frame opacity for a system made of (the combination of): (i) the first part of the two roles before the given conditional, (ii) the last part of the two roles where all honest, expected messages that the first parts of the roles would have sent are directly given to the attacker. Note that the second system is intuitively made of more processes in parallel but we stress the fact that each process is half the size of the original roles.

Reusing Core Ideas of the Methodology

We believe that the overall methodology developed in this part could be applied in other contexts where privacy is critical: e.g. e-voting, attribute-based credentials, blockchain technologies, transparent certificate authorities. We have already successfully done so for the case of voteprivacy for a large class of e-voting protocols [START_REF] Cremers | Improving automatic symbolic analysis for e-voting protocols: Sufficient conditions for ballot secrecy[END_REF]. We now try to sum up the main steps of the overall methodology. We stress the fact that we have followed those steps when developing the present method but also when devising the method for proving vote-privacy [START_REF] Cremers | Improving automatic symbolic analysis for e-voting protocols: Sufficient conditions for ballot secrecy[END_REF].

Reusing Core Ideas of the Methodology

First, one has to delimit an interesting class of protocols including numerous real-world case studies and a privacy goal one typically want to establish for protocols in that class. Then, inspired by known attacks on the privacy goal for protocols in the class, one should try to identify main and deep reasons that enable those attacks. One way to achieve that consists in classifying known attacks into a few categories.

Second, one must devise a condition per class of attack that should neatly capture the ingredient enabling those attacks. Here, the main idea is to take advantage of (i) working with only a class of protocols and (ii) focusing on one simple aspect of the (often) complex privacy goal.

Thanks to that, conditions obtained this way can be much simpler than the original privacy goal and can be verified much more easily and with more precision. Note that, in our case (for the present method and for [CH17]), we were able to nicely divide the problem between control-flow issues (e.g. handled by well-authentication) and the other issues (e.g. relations between messages handled by frame opacity). This is of great interest since it allows to get over control-flow issues when looking at the other aspects. More precisely, once one has made sure that the typical control-flow issues do not break the privacy goals, one can focus on a simpler problem roughly by focusing on the honest execution and forgetting that many other behaviours are possible. This has also been very helpful and interesting for the method for proving vote-privacy [START_REF] Cremers | Improving automatic symbolic analysis for e-voting protocols: Sufficient conditions for ballot secrecy[END_REF].

Third, one shall make sure one has gathered enough conditions and then prove the soundness theorem; i.e. the combination of conditions always implies the privacy goal for protocols in the class. Finally, one may take advantage of the fact that the complex privacy goal has been split up into simpler sufficient conditions to mechanise the verification of the simpler conditions.

We believe that this methodology is a successful approach that helps to advance the stateof-the-art for the highly complex problem of the verification of privacy-related properties, and paves the way for further improvements.

General Conclusion

Future Work

We have already listed avenues for future work and interesting open questions throughout the thesis (see sections 5.5 and 6.5 for Part B and Chapter 11 for Part C). Nevertheless, we now recall a few of them and discuss a few more that we find particularly interesting.

POR without action-deterministic assumption. Dropping the action-deterministic assumption whilst keeping the soundness and completeness of POR techniques is an interesting challenge. We have already discussed the difficulties which arise without this assumption in Section 5.5. Solving them for a variant of our POR techniques would allow to greatly extend their scope and thus improve verification efficiency in many more cases.

POR for backward search. We would also be interested in adapting our POR techniques for backward search in the unbounded case (e.g. in the Tamarin tool). The potential benefits for Tamarin would be twofold. First, automatic verification would be more efficient. Second, interactive-proofs would be less cumbersome since fewer cases would have to be explored and considered.

Use our privacy verification method for the bounded case. One could wonder whether our privacy verification method based on sufficient conditions could be adapted for the bounded case. We think that it is the case and we see potential benefits and interests in doing so. First, we claim that, replacing replications ! and repetitions ! by "bounded" replications ! k and bounded repetitions ! k , one can adapt the definitions of M Π , S Π , M Π,id , strong unlinkability and anonymity (there is a need to match the number of total sessions on both sides though). We believe that our conditions straightforwardly restricted to the bounded cases allow us to prove that they always imply unlinkability and anonymity for this setting as well. There might be interests to develop such a method for two mains reasons.

First, compared to the verification in the unbounded case, frame opacity could then be decided instead of semi-decided. We thus benefit from the completeness of tools for the bounded case (e.g. Apte, Akiss).

Second, the verification for the bounded case of the two sufficient conditions would be more efficient. Concerning frame opacity, the condition seems easier to establish than unlinkability even in the bounded case since one can verify it with a process that is completely action-deterministic (see Definition 14 in Chapter 5) while it is not possible to do so for the original properties of interest (e.g. unlinkability). Therefore, one could benefit from the important speedups brought by our POR techniques developed in the Part B while it was not possible to leverage them to directly verify unlinkability. Indeed, if you force agents to use dedicated and pairwise distinct channels then unlinkability is broken by construction. Concerning well-authentication, the condition could be verified for the bounded case using tools such as ProVerif or Tamarin since they generally are precise enough when it comes to verifying purely reachability properties.

Future Work

We would like to pursue our investigation towards this direction. If it can be completed, our hope is to achieve twofold benefits: (i) better precision compared to verification entirely carried out in tools like ProVerif or Tamarin and (ii) better efficiency compared to verification done entirely in tools like Apte or Akiss.

Privacy via sufficient conditions approach. Another line of work we would like to pursue is to adapt the methodology presented in Part C in broader contexts. We have already argued in considerable detail in Chapter 11 that we consider the overall methodology generic enough to have hopes to derive new methods for analysing other privacy goals for other classes of security protocols.

From privacy to reachability. We think that seeking to verify frame opacity via reachability properties only, as proposed in Chapter 11, is an exciting research goal. Indeed, achieving the latter, in a more generic setting if possible, would allow to completely getting rid of the complex and costly equivalence verification when it comes to analyse privacy in security protocols.

Guidelines for privacy. In our opinion, the privacy via sufficient conditions approach also sheds light on the privacy notions themselves. Indeed, each sufficient condition helps to get a better grasp of necessary ingredients for preserving privacy. It thus might be interesting to translate such conditions into more comprehensive guidelines helping the design of new privacy-enhancing protocols. It may be achieved by carefully extracting essential ingredients behind sufficient conditions presented in Part C, [START_REF] Cremers | Improving automatic symbolic analysis for e-voting protocols: Sufficient conditions for ballot secrecy[END_REF] and in methods to come based on the same idea. Indeed, it may be the case that patterns emerge from different conditions used in several methods. For instance, one may remark strong similarities between the present well-authentication condition and the dishonest condition of [START_REF] Cremers | Improving automatic symbolic analysis for e-voting protocols: Sufficient conditions for ballot secrecy[END_REF].

To conclude, we believe that, although imperfect and still requiring much improvements, existing techniques for verifying privacy have reached enough maturity to guide design, analysis and standardisation. It took many years and much research effort to develop usable methods for verifying reachability properties and a few more years to get the standardisation and industrial community to actually use them. We now have the encouraging example of the TLS Working Group adopting an "analysis-before-deployment" paradigm for drafting TLS 1.3. We hope to see in the near future such examples that also take privacy into account.

Contents 12 . 2

 122 Future Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228 Bibliography 231

Figure 1 . 1 A

 11 Figure 1.1 A scytale and an Enigma machine

Figure 1 . 3

 13 Figure 1.3 Password of low entropy in some e-passport

  be a relation over constructor terms. The equational theory = E is the smallest equivalence relation over T (Σ c , N ∪ X ) containing E, stable by substitution from X to T (Σ c , N ∪ X ) and stable by application of function symbols in Σ c .

  As a result, we have for instance the following: sdec(senc(c, a ⊕ b), b ⊕ a) ⇓ c when a, b and c are names, whereas sdec(senc(c, a ⊕ b), b) ¡ ¡ ⇓, and sdec(a, b) ⊕ sdec(a, b) ¡ ¡ ⇓.

Figure 2 . 1

 21 Figure 2.1 Syntax of processes

Figure 3 . 1

 31 Figure 3.1 Semantical rules of biprocesses for conditional

3 . 1

 31 and anonymity of the initiator role of the Private Authentication protocol in Subsection 3.3.2. Only illustrative examples are given in this section, showing typical uses of trace equivalence. Formal definitions of different variants of unlinkability and anonymity for unbounded number of sessions and users will be given in Part C (Chapter 8).

First

  A sends to B a nonce N a and her public key (asymmetrically) encrypted with the public key of B. If the plaintext is of the expected form (i.e. the right-part of the pair contains the public key pub A ) then B sends to A the nonce N a , a freshly generated nonce N b and his public key, all of this being encrypted with the public key of A. Moreover, if the message received by B is not of the expected form then B sends out a "decoy" message: {N b } pub B . This message should basically be indistinguishable from B's other message from the point of view of an outsider.

Introduction 5 A

 5 Reduced Semantics: Theory 5.1 Instantiation of the Model and Class of Processes . . . . . . . . . . . . . . . . . . 5.2 Annotated Semantics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.2.1 Annotations and Semantics . . . . . . . . . . . . . . . . . . . . . . . . . . 5.2.2 Action Dependencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.2.3 Symmetries of Trace Equivalence . . . . . . . . . . . . . . . . . . . . . . . 5.2.4 Proof of the Strong Symmetry Lemma . . . . . . . . . . . . . . . . . . . . 5.3 Compression . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.3.1 Compressed Strategy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.3.2 Improper Blocks and Release ⊥ Rule . . . . . . . . . . . . . . . . . . . . . 5.3.3 Reachability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.3.4 Equivalence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.3.5 Proof of Theorem 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.4 Reduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.4.1 Strong Independence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.4.2 Priority Order And Necessity . . . . . . . . . . . . . . . . . . . . . . . . . 5.4.3 Reduced Semantics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.4.4 Reachability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.4.5 Equivalence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.5 Main Result and Discussions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Putting Reduced Semantics into Practice and Integration in Apte 117 6.1 Instantiation of the Model and Class of Processes . . . . . . . . . . . . .

Figure 4 . 1

 41 Figure 4.1 Overview of chapters 5 and 6. Optimised semantics part of our contributions are colored in red. Vertically, it goes from the regular semantics (as defined in Chapter 2), to symbolic semantics and Apte's semantics. Those semantics have variants when our optimisations are applied or not: regular (i.e. no optimisation), compression or reduction (that includes compression). The dashed line separates contents of Chapter 5 from Chapter 6.

Figure 5 . 1

 51 Figure 5.1 Semantics for this chapter

Figure 5 . 2

 52 Figure 5.2 Annotated semantics

  define the labelled skeletons by skl([P ] ℓ ) = [sk(P )] ℓ . When checking for equivalence of A and B, we shall assume that skl(A) = skl(B), i.e. the configurations have the same multiset of labelled skeletons. This technical condition is not restrictive in practice: as a consequence of actiondeterminacy, we show below (see Corollary 1) that, after pre-executing non-observable τ Π actions of A and B, sk(A) = sk(B) is a necessary condition for A ≈ B. Hence, once sk(A) = sk(B) is known, one can label A and B arbitrarily but consistently such that skl(A) = skl(B). Example 23. Let A = ({[in(a, x).(out(b, m).P 1 | P 2 )] 0 }; Φ) with P 1 = in(c, y).0 and P 2 = in(d, z).0, and let B be the configuration obtained from A by swapping P 1 and P 2 . We have skl(A) = skl(B) = {[in a ] 0 } # . Consider the following trace:

95 5 .

 5 A Reduced Semantics: Theory Start/In P is initial (P ; Φ) in(c,M ) -----→ a (P ′ ; Φ) (P ⊎ {P }; ∅; Φ) foc(in(c,M )) ---------→ c (P; P ′ ; Φ) Start/! P is initial (! a c,n P ; Φ) sess(a,c) ------→ a ({! a c,n P ; Q}; Φ) (P ⊎ {! a c,n P }; ∅; Φ) foc(sess(a,c)) ---------→ c (P ⊎ {! a c,n P }; Q; Φ) Pos/In (P ; Φ) in(c,M ) -----→ a (P ′ ; Φ) (P; P ; Φ) in(c,M )

Figure 5 . 3

 53 Figure 5.3 Compressed semantics

Theorem 2 .

 2 Let A and B be two action-deterministic configurations with skl(A) = skl(B). We have A ≈ B if, and only if, ⌈A⌉ ≈ c ⌈B⌉. Proof sketch, complete proof in Subsection 5.3.5. (⇒) Consider an execution ⌈A⌉ tr -→ c A ′ where tr is a proper trace (the other case is similar). Using Lemma 3, we get A ⌊tr⌋ --→ a ⌊A ′ ⌋. Then, Lemma 2 yields B ⌊tr⌋ --→ a B ′ for some B ′ such that Φ(⌊A ′ ⌋) ∼ Φ(B ′ ) and labelled skeletons are 5. A Reduced Semantics: Theory equal all along the executions. Relying on those skeletons, one can show that positive/negative phases are synchronised, and thus ⌈B⌉ tr -→ c B ′′ for some B ′′ with ⌊B ′′ ⌋ = B ′ . (⇐) We first deal with proper executions. Consider an execution A tr

5 .

 5 A Reduced Semantics: Theory Proof. Assume ⌈A⌉ ≈ sc ⌈B⌉, thanks to Theorem 1, it suffices to show A ≈ a B. Let us show the following intermediate result: for any complete execution A tr -→ a A ′ such that bc(tr) ∩ fc(B) = ∅, there is an execution B tr -→ a B ′ such that Φ(A ′ ) ∼ Φ(B ′ ). Thanks to Lemma 7 and by symmetry of ≈ a , this intermediate result implies the required conclusion A ≈ a B.

  P 2 producing a block b 2 = 105 5. A Reduced Semantics: Theory foc(in(c 2 , M 2 )).rel.out(c 2 , w 2 ) for some recipe M 2 . The compressed semantics explores both traces tr 1 = b 1 .b 2 and tr 2 = b 2 .b 1 .

Definition 25 .

 25 Two blocks b 1 and b 2 are sequentially independent (resp. recipe independent), written b 1 ∥ s b 2 (resp. b 1 ∥ r b 2 ), when all labelled actions α 1 ∈ b 1 and α 2 ∈ b 2 are sequentially independent (resp. recipe independent). They are independent, written b 1 ∥ b 2 when b 1 ∥ s b 2 and b 1 ∥ r b 2 . Otherwise they are dependent, written b 1 ⇌ b 2 .

  rel.out(c 1 , w 1 ) and M 2 = ok in the block b 2 = foc(in(c 2 , M 2 )).rel.out(c 2 , w 2 ), we obtain two blocks that are dependent ( i.e. b 1 ⇌ b 2 ) because M 1 uses w 2 . However, it is clearly not a necessity to execute one block before the other. Indeed, it suffices to replace M 1 by M ′ 1 = ok yielding same messages and execution but also removing dependencies (the induced block b ′ 1 = foc(in(c 1 , ok)).rel.out(c 1 , w 1 ) satisfies b ′ 1 ∥ b 2 ).

  26. Given a frame Φ, the relation ≡ Φ is the smallest equivalence over plausible compressed traces such that tr.b 1 .b 2 .tr ′ ≡ Φ tr.b 2 .b 1 .tr ′ when b 1 ∥ b 2 , and tr.b 1 .tr ′ ≡ Φ tr.b 2 .tr ′ when (b 1 = E b 2 )Φ. Example 29 (Resuming Example 28). Consider a compressed execution of the trace b 2 .b 1 (where

  witnessing the fact that b 1 and b 2 can actually be swapped and no block is actually necessary for the other to be executed. The traces b 1 .b 2 and b 2 .b 1 are thus redundant and exploring only one of them should be sufficient.

  A block b is weakly authorised after tr, noted tr ▷ b, when tr = ϵ; or tr = tr 0 .b 0 and either (i) b ⇌ b 0 or (ii) b ∥ b 0 , b 0 ≺ b, and tr 0 ▷ b. A block b is strongly authorised after tr, Φ, noted (tr, Φ) ▶ b, when tr ▷ b ′ for all b ′ satisfying

Figure 5 . 5 2 ≺ b 3 , the latter entails b ′ 2 ⇌ b 3 .

 552323 Figure 5.5 Interleavings with 3 processes in parallel

tr 0

 0 ▷ b ′ for any b ′ such that (b ′ = E b)Φ 0 . Assume that it is not the case, this means that for some b ′ such that (b = E b ′ )Φ 0 , the trace tr 0 can be written tr ′ 0 .b 0 . . . . .b n with: b i ∥ b ′ and b i ≺ b ′ for any i > 0, as well as b 0 ∥ b ′ and b ′ ≺ b 0 . Let tr ′ = tr ′ 0 .b ′ .b 0 . . . b n . We have tr ′ ≺ lex tr and tr ′ ≡ Φ tr 0 .b ′ , which contradicts the Φ-minimality of tr.

  0 .b.tr 1 and tr m = tr ′ 0 .b m .tr ′ 1 with (tr 0 = E tr ′ 0 )Φ and b m ≺ b. Again, since when dropping recipes, the relation ≡ Φ only swaps sequentially independent labelled skeletons, block b m must have a counterpart in tr and, more precisely, in tr 1 . We thus have a more precise decomposition of tr: tr = tr 0 .b.tr 11 .b ′ m .tr 12 such that (b ′ m = E b m )Φ. We now show that b ′ m cannot be executed after tr 0 .b.tr 11 in the semi-reduced semantics (assuming that the trace has been executed so far in the reduced semantics). In other words, we show that tr 0 .b.tr 11 ▷ b ′ m does not hold. We have seen that (b ′ m = E b m )Φ and b m ≺ b so it suffices to show: b m ∥ b i for any b i ∈ b.tr 11 First, we prove b i ∥ r b m (i.e. they are recipe independent) for any b i ∈ b.tr 11 . This comes from the fact that tr ′ 0 .b m .tr ′ 1 = tr m is plausible, and thus the inputs of b m only use handles introduced in tr ′ 0 which are the same as those introduced in tr 0 . In particular, the inputs of b m do not rely on the handles introduced in b.tr 11 . Similarly, using the fact that tr 0 .b.tr 11 .b ′ m .tr 12 = tr is plausible and b ′- m = b - m , we deduce that handles of outputs of b m are not used in b.tr 11 . Second, we show that b i ∥ s b m (i.e. they are sequentially independent) for any b i ∈ b.tr 11 . For this, we remark that for any traces tr 1 .b.tr 2 ≡ Φ tr ′ 1 .b ′ .tr ′ 2 such that (b = E b ′ )Φ, we have that b ∥ s b s for all b s ∈ skl(tr ′ 1 )\skl(tr 1 ) where skl(tr) is the multiset of labelled skeletons of blocks of tr, and \ should be read as multiset substraction. This can be easily shown by induction on the relation ≡ Φ . By applying this helping remark to tr 0 .b ′ m .tr ′ 2 ≡ Φ tr 0 .b.tr 11 .b ′ m .tr 12 , we obtain the required conclusion: b ′ m ∥ s b.tr 11 and thus b m ∥ s b.tr 11 .

Proposition 13 .

 13 For any static equivalent frames Φ ∼ Ψ and compressed traces tr and tr ′ , we have that tr ≡ Φ tr ′ if, and only if, tr ≡ Ψ tr ′ . Proof. The two implications are symmetric, we thus only show one implication. Considering the two generators of ≡ Φ , the only non-trivial step is to show that tr.b 1 .tr ′ ≡ Ψ tr.b 2 .tr ′ when (b 1 = E b 2 )Φ. But the latter condition, together with Φ ∼ Ψ, yields (b 1 = E b 2 )Ψ which allows us to conclude.

A

  ′ be such that A tr -→ sr A ′ for some tr such that bc(tr) ∩ fc(B) = ∅. Lemma 11 tells us that A tr -→ sc A ′ , and thanks to Lemma 12, we have that tr is Φ(A ′ )-minimal. Let b 1 , . . . , b k be the improper blocks that occur in tr. We have that there exist tr 0 , tr 1 , . . . , tr k made of proper blocks such that tr = tr 0 .b 1 .tr 1 .b 2 . . . . tr k-1 .b k .tr k . We have that b 1 , . . . , b k are pairwise independent, and also: tr ≡ Φ(A ′ ) tr 0 .tr 1 . . . tr k .b 1 . . . . .b k

  From this we conclude tr ≡ Φ(B ′ ) tr 0 .tr 1 . . . tr k .b 1 . . . . .b k , hence B tr -→ sc B ′ by Lemma 10. Since tr is Φ(A ′ )-minimal it is also Φ(B ′ )-minimal (by Proposition 13), and thus B tr -→ sr B ′ by Lemma 12.

Figure 6 . 1

 61 Figure 6.1 Instance of the Semantics for Chapter 6

Figure 6 . 3

 63 Figure 6.3 Annotated symbolic semantics for symbolic configurations

Figure 6 . 4

 64 Figure 6.4 Symbolic compressed semantics

  Otherwise, we have that dep(tr, c) = ∅. Then, given a symbolic, compressed trace tr, we define Deps(tr) by Deps(ϵ) = ∅ and Deps(tr.io c (X, w)) =    Deps(tr) ∪ {X⋉dep(tr, c)} if dep(tr, c) ̸ = ∅ Deps(tr) otherwise Intuitively, Deps(tr) corresponds to the accumulation of the dependency constraints generated for all prefixes of tr. Example 41. We consider the symbolic version of Example 31 (in Subsection 5.4.3 with its associated Figure 5.5). We let ≺ be such that c 1 ≺ c 2 ≺ c 3 .

2 . 1 .

 21 Both directions of this mapping (propositions 20 and 21) directly follow from the already established mapping between symbolic, compressed executions and compressed executions (see propositions 17 and 18) in addition to Proposition 19 stating that Deps(•) exactly mimics (•, •) ▶ •.

6. 3 .

 3 Integration in Apte satisfaction relation, written θ |= S + , such that θ |= ∅ always holds, and θ |= S + 1 implies θ |= S + 2 when S + 2 ⊆ S + 1 . We define the set of solutions of C + as Sol + (C + ) = { θ ∈ Sol(C) | θ |= S + }. An extended symbolic process (P; Φ; S; S + ) is a symbolic process with an additional set of extended constraints S + .

Axiom 4 .( 2 )

 42 We assume the following about the partial solution: (1) For any valid pair (A; B), we have that ps(A) = ps(B) for any A, B ∈ A ∪ B. This allows us to simply write ps(A; B) when A ∪ B ̸ = ∅. For any intermediate valid pair (A; B) such that (A; B) -→ A2 (A ′ ; B ′ ) and A ′ ∪ B ′ ̸ = ∅, we have ps(A ′ ; B ′ ) = ps(A; B) ⊔ θ for some θ. Example 43. Continuing Example 42, we first note that ({Q 0 }; {Q 0 }) is a valid pair. Second, the exploration

  is the substitution associated to θ (resp. θ + ) w.r.t. (Φ A ; S A ). By assumption we have A ≺ + B and thus there exists some B = (P B ; Φ B ; S B ; S + B ) ∈ B with θ + ∈ Sol + (B), and Φ B λ B θ + ∼ Φ A λ θ + where λ B θ + is the substitution associated to θ + w.r.t. (Φ B ; S B ). By Lemma 16 we have (P ′ ; Φ ′ ; ∅) tr ′ = = ⇒ B with obs(tr ′ ) = tr o = obs(tr). To conclude the proof, it remains to show that θ ∈ Sol( B ) and that Φ A λ θ ∼ Φ B λ B θ where λ B θ is the substitution associated to θ w.r.t. (Φ B ; S B ).

6.Figure 6 . 5 Figure 6 . 6

 6566 Figure 6.5 Impact of optimisations on verification time on toy example.

6. 5 .Figure 6 . 7

 567 Figure 6.7 Maximum number of parallel processes verifiable in 20 hours.

8 .

 8 Model & Problem by the parallel composition of the processes P I and P R , corresponding respectively to the roles I and R. P Fh def = νk. (νn I .P I | νn R .P R )

3 . 1 (

 31 in Chapter 3), unlinkability could be expressed as the trace equivalence between K = (!P Fh ; ∅) (the ideal version) and K ′ = (!νk.(!νn I .P I | !νn R .P R ); ∅) (the real version). As said in the introduction, this equivalence is non-trivial, and cannot be established using existing verification tools such as ProVerif or Tamarin. The technique developed in this part will notably allow one to establish it automatically.

Definition 51 .

 51 A protocol Π is a tuple (k, n I , n R , † I , † R , I, R) where k, n I , n R are three disjoint sets of names, I (resp. R) is an initiator (resp. responder) role such that fn(I) ⊆ k ⊔ n I , fn(R) ⊆ k ⊔ n R , and † I , † R ∈ {!, ! }. Labels of I and R must be pairwise distinct. Names k (resp. n I ⊔ n R ) are called identity names (resp. session names). Given a protocol Π, we define P Π def = νk.(νn I .I | νn R .R) and assume that P Π tr h

=

  out(c I , n I ).

  : shared and non-shared protocols. As shown in Definition 52, we distinguish two cases whether (i) both roles use identity names (i.e. fn(I) ∩ k ̸ = ∅ and fn(R) ∩ k ̸ = ∅) or (ii) only one role uses identity names (i.e. by symmetry this is when fn(I)∩k = ∅ and fn(R)∩k ̸ = ∅).

Example 54 .

 54 Going back to our running example (Example 51), unlinkability is expressed through the following trace equivalence: ! νk.(! νn I .P I | ! νn R .P R ) ≈ ! νk.(νn I .P I | νn R .P R ).

Figure 8 . 1 A

 81 Figure 8.1 A scenario involving two concurrent sessions (possible only if k1 = k2).

Definition 56 .

 56 Let Π = (k, n I , n R , † I , † R , I, R),and id ⊆ k. We say that Π ensures anonymity w.r.t. id if M Π,id ≈ M Π . Example 56. Going back to Example 53, anonymity w.r.t. identity of the client ( i.e. id C ) is expressed through the following equivalence (where m C represents the sequence n C , m):

Example 58 .

 58 Considering the protocol Π Fh defined in Example 51, process S Π Fh can notably perform the execution seen in Example 48. The annotated execution has the trace ta given below, where k ′ , n ′ I and n ′ R are fresh names, a I = I(k ′ , n ′ I ) and a R = R(k ′ , n ′ R ): ta = τ ! .τ ν .τ ν .τ ν . ℓ 1 : out(c I , w 1 )[a I ].in(c R , w 1 )[a R ]. ℓ 2 : out(c R , w 2 )[a R ].in(c I , w 2 )[a I ].τ then [a I ].

ℓ 3 :

 3 out(c I , w 3 )[a I ].in(c R , w 3 )[a R ].τ then [a R ]

Example 71 .

 71 Consider for instance a trivial protocol Π def = (k, n I , n R , ! , ! , I, R) where I = out(c I , senc(n I , k)) and R = in(c R , x). We have that M Π =! νk.( ! νn I .I | ! νn R .R) ta -→ (Q; ϕ) for ta = τ ! .τ ν .τ r .τ ν . ℓ : out(c I , w 0 )[I(k, n I )].τ r .τ ν . ℓ : out(c I , w 1 )[I(k, n ′ I )]. The ground configuration associated to ta is as follows:

  Proof. (⇒) We start by applying Proposition 24 to obtain an execution M Π,id ta0.τ then[a1]

192 9 . 5 .

 95 Proof of our Main Theorem for some ta * 0 τ

201 10 .

 10 Mechanisation & Case Studies

Figure 10 . 2

 102 Figure 10.2 Example of ProVerif query for checking condition (i)

Lemma 24 .

 24 Let Π = (k, n I , n R , † I , † R , I, R) be a protocol such that fn(I) ∩ fn(R) ̸ = ∅ (shared case)that satisfies condition (i) of well-authentication. Condition (ii) of well-authentication holds provided that:(a) the first conditional that occurs in R is safe;(b) for any execution ta of (M Π,id ; ∅), if ta 1 = ta| a1,b1 and ta 2 = ta| a2,b2 are honest with a 1 ̸ = a 2 , then any message outputted by a 1 in ta 1 is different (modulo E) from any message outputted by a 2 in ta 2 .Proof. Consider an execution M Π,id ta.τ then [a ′ ]

205 10 .

 10 Mechanisation & Case StudiesAgent a ′ is only associated to a. Consider the last input of a ′ and the last output of a:

  .

3 .

 3 The relevant point is the fact that, in case of failure, the French version sends a different error 10.2. Case StudiesTag → Reader : n T Reader → Tag : {n R , n T , k R } kE , mac kM ({n R , n T , k R } kE ) Tag → Reader : {n T , n R , k T } kE , mac kM ({n T , n R , k T } kE )The BAC protocol using Alice & Bob notation between Tag ( i.e. passport) and Reader is depicted above. The corresponding process modelling Tag is defined below, where m = senc(⟨n T , ⟨π 1 (sdec(x E , k E )), k T ⟩⟩, k E ). T (k E , k M ) = νn T .νk T .out(c T , n T ).in(c T , x). let x E = π 1 (x), x M = π 2 (x), z test = eq(x M , mac(x E , k M )) in let z ′ test = eq(n T , π 1 (π 2 (sdec(x E , k E )))) in out(c T ,⟨m, mac(m, k M )⟩) else out(error Nonce ) else out(error Mac )

Figure 10 . 3

 103 Figure 10.3 Description of the BAC protocol

Figure 10 . 4

 104 Figure 10.4 PACE in Alice & Bob notation

Figure 10 . 5

 105 Figure 10.5 Process R PACE

ure 10 .

 10 4 by respectively mac(⟨c r , G n ′

Figure 10 . 6

 106 Figure 10.6 ABCDH (where seed = dh(dh(g, nC ), nV ) and k = f2(seed))

Figure 11 . 1

 111 Figure 11.1 Example of successful but dishonest interaction (X can be any message)

Table 1 .

 1

	[CCK12]	Spec [TD10]

1 Main features of existing tools (for bounded number of sessions)

Table 1 .

 1 1.4. State of the Art: Methods and Tools

		ProVerif [BAF08]	Maude-NPA [SEMM14]	Tamarin [MSCB13]
	Equivalence		diff-equivalence
	Primitives	linear + convergent with finite variant	convergent modulo AC XOR, A.G.) with finite variant (inc.	convergent with finite variant + DH
	Class of protocols	full	linear role with filtering	full + state
	Input syntax applied-pi calculus	strand spaces	multiset rewriting
	Termination		may diverge
	Exploration	resolution	backward

2 Main features of existing tools (for an unbounded number of sessions) commutative operators. The resulting tool is very efficient, and terminates on many examples. It has thus established itself as the leading tool.

  • for any term t and messages u 1 , u 2 such that t ⇓ u 1 , it holds that t ⇓ u 2 if, and only if,

	2. Modelling Security Protocols
	• n ⇓ n for any n ∈ N ;
	• f(t 1 , . . . , t k ) ⇓ f(u 1 , . . . , u k ) for f ∈ Σ c of arity k and t i ⇓ u i for all 1 ≤ i ≤ k,
	• if t ⇓ u then tρ ⇓ uρ for any bijective ρ : N → N ;
	• for any term t, messages u and v, and context t ′ [] built from Σ and N , if t ⇓ u and t ′ [u] ⇓ v
	then t ′ [t] ⇓ v;
	3 several ways to operationally generate such computation
	relations (e.g. from reduction rules or equations) satisfying all requirements.
	Definition 2. A computation relation is a relation over T (Σ, N ) × T (Σ c , N ), denoted ⇓, such
	that:

  the attacker to use them, helping to model threat models more accurately.

	2.2. Process Algebra
	computed by the attacker using R over Φ. Either this computation fails (i.e. t ¡ ¡ ⇓) or it computes
	a message (i.e. t ⇓ u). This allows the attacker to observe failure of some computations and
	equalities or inequalities between results of successful computations.
	Example 5. Consider a frame Φ = {w 1 → k, w 2 → senc(k ′ , k), w 3 → senc(m, k ′ )} for some mes-
	sage m and names k, k ′ ∈ N . From this knowledge, the attacker is able to infer k ′ using the recipe
	R = sdec(w 2 , w 1 ) ( i.e. RΦ ⇓ k ′ ) and m using the recipe R ′ = sdec(w 3 , R) = sdec(w 3 , sdec(w 2 , w 1 ))
	( i.e. R ′ Φ ⇓ m). The attacker is also able to observe the failure of the computation R f Φ ¡ ¡ ⇓ for
	R f = sdec(w 3 , w 1 ).
	The attacker's knowledge, that is the set of messages he learnt by eavesdropping messages
	outputted by agents of the protocol, is organised into a frame. Formally, a frame is a substitution
	from W to messages and is noted Φ, Ψ. An attacker builds his own messages by applying
	public function symbols (i.e. symbols in Σ pub ) to terms he already knows and that are available
	through variables in W. Formally, a computation done by the attacker is a recipe, i.e. a term
	in T (Σ pub , W). Recipes will be denoted by R, M , N . Note that, although we do not give
	the attacker the ability to generate fresh names to use in recipes, we obtain exactly the same
	capability by assuming an infinite supply of public constants without equation in Σ c ∩ Σ pub .
	Assume a frame Φ and a recipe R such that vars(R) ⊆ dom(Φ), then t = RΦ is the term

  and output are standard. A process in(c, x).P waits for an input on channel 2. Modelling Security Protocols c and then behaves like P {x → u} where u is the inputted message. A process out(c, t).P can output the message u on channel c provided that t computes u and then behaves like P . The process νn.P can pick up fresh names n that P can then use. The replication !P behaves like an infinite parallel composition P | (P | (P | . . .)). The construct let x = t in P else Q allows to write computations and conditionals compactly. Such a process tries to evaluate the terms t and if no failure happens, i.e. when for all i, t i ⇓ u i for some message u i (noted t ⇓ u), then the process P {x i → u i } i is executed. Otherwise, i.e. when there is some t i such thatt i ¡ ¡ ⇓ (noted t ¡ ¡ ⇓), the process Q is executed. Note also that the let instruction together with the eq theory as defined in Example 10 can encode the usual conditional construction. Indeed, "let x = eq(t 1 , t 2 ) in P else Q" will execute P only if the computation succeeds on eq(t 1 , t 2 ),that is only if t 1 ⇓ u 1 , t 2 ⇓ u 2, and u 1 = E u 2 for some messages u 1 and u 2 . A process recX.P is a recursive process: it intuitively satisfies the equation X = P . For instance, the process recX.(out(c, ok).X) behaves like an infinite sequence of the output out(c, ok). Finally, the last construct νc out ch (a, c). P allows to create new fresh channel names c that the continuation P may use after making them public by outputting them on the channel a.

  The In rule can be

	Par	({Π S} ⊎ P; Φ) τ Π -→ (P ⊎ S; Φ)
	In	({in(c, x).P } ⊎ P; Φ) in(c, R) ----→ ({P {x → u}} ⊎ P; Φ)
		where R is a recipe such that RΦ ⇓ u
	Out	({out(c, t).P } ⊎ P; Φ) out(c, w) -----→ ({P } ⊎ P; Φ ⊎ {w → u})
		where w is a fresh variable and t ⇓ u
	New	({νn.P } ⊎ P; Φ) τ ν -→ ({P } ⊎ P; Φ)
		where n are fresh names from N
	Repl	({! P } ⊎ P; Φ) τ ! -→ ({P, ! P } ⊎ P; Φ)
	Let	({let x = t in P else Q} ⊎ P; Φ) τ then --→ ({P {x → u}} ⊎ P; Φ)
		when t ⇓ u for some u
	Let-Fail ({let x = t in P else Q} ⊎ P; Φ) τ else --→ ({Q} ⊎ P; Φ)
		when t ¡ ¡ ⇓
	Out ch	({νc out ch (a, c). P } ⊎ P; Φ) outch(a, c) ------→ ({P } ⊎ P; Φ)
		where c are fresh
	Unfold ({recX.P } ⊎ P; Φ) τ r -→ ({P {X → recX.P }} ⊎ P; Φ)
		Figure 2.2 Semantics for processes

  and, t ′ = t[uθ] p ( i.e. t in which the sub-term at position p has been replaced by uθ). If for some position p, there is more than one rewriting rule that can be applied, the one occurring first in the ordered set is applied. We note * the reflexive, Consider a f ∈ Σ c of arity k, some terms t i and messages u i such that t i ⇓ u i for all 1 ≤ i ≤ k.

	transitive closure of	∪ = E .
	Proposition 1. If R is a rewriting system then the relation • ⇓ • induced by R ( i.e. t ⇓ u if,
	and only if, t * u and u is a message) is a computation relation.
	Proof. We prove all requirements separately:
	• Since We thus have t i	* u i for each i. One then deduces f(t 1 , . . . , t k ) ⇓ f(u 1 , . . . , u k ) since
	f(t 1 , . . . , t k ) * f(u 1 , t 2 , . . . , t k ) . . . * f(u 1 , . . . , u k ). Indeed, = E is stable by application of
	constructor symbols, and each application of reduction rules on some t i can be adapted by
	transforming the position p into i • p.
	• We prove that for any term t, if t ⇓ u for some message u and ρ : N → N is a bijective
	mapping then tρ ⇓ uρ. First, we remark that = E is stable by bijection of names. It then
	suffices to show that if t	t ′ then tρ	t ′ ρ. By hypothesis, there is a position p and a
	rewriting rule g(u 1 , . . . , u n

* is reflexive, one has n ⇓ n for any n ∈ N ;

•

  and tρ tρ[uθ ′ ] p . Finally, note that tρ[uθ ′ ] p = t ′ ρ since uθ ′ = (uθ)ρ. Therefore, one has tρ t ′ ρ. • Consider a term t and messages u 1 , u 2 such that t ⇓ u 1 . If u 1 = E u 2 , t ⇓ u 2 follows from the fact that = E is included in * . We now assume that t ⇓ u 2 and shall prove that u 1 = E u 2 . By hypothesis, there exist two reductions t * u 1 and t * u 2 . In order to prove u 1 = E u 2 , we intuitively show that when t 1 and t 2 are two terms that are equal modulo = E on some sub-terms and t 1 = E on some sub-terms and possibly (ii) applications of reduction rules. To that end, we formally define ≡ E to be the smallest equivalence relation such that for any term with hole t[] and messages u 1 and u 2 then t[u] ≡ E t[v] when u = E v. We now prove the following intermediate result: For any two terms t 1 ≡ E t 2 and two reductions t 1 Remark that this intermediate result would conclude the proof. Indeed, applying repeatedly this result on the two finite reductions t * u 1 and t * u 2 entails that u 1 ≡ E u 2 (since no reduction can be applied on messages) implying u 1 = E u 2 . We now prove the intermediate result. We thus consider two terms t 1 ≡ E t 2 and two reductions t 1

	* t ′ 1 , t 2	* t ′ 2 then the two terms t ′ 1 and t ′ 2 are
	equal modulo (i) t ′ 1 and t 2	t ′ 2 , either t ′ 1 ≡ E t ′ 2 or
	there exist two terms t ′′ 1 ≡ E t ′′ 2 and two reductions t ′ 1	t ′′ 1 and t ′ 2	t ′′ 2 .
				t ′ 1 and t 2	t ′ 2 .
	There must be two positions p 1 and p 2 such that for i ∈ {1, 2}, there is a reduction rule
	g

The reduction rule which has been applied on t i can thus be applied on t ′

  Let t[] be a context built from Σ and N , u 1 , u 2 be messages. We assume u 1 = E u 2 , and,t[u 1 ] ⇓ v 1 for some message v 1 . By hypothesis, we thus have that t[u 1 ] * v 1 . Let us prove by induction on the reduction t[u 1 ] * v 1 that t[u 2 ] * v 1 .Let p be the position of the hole in t. We reason by case analysis on the first step of t[u 1 ] * v 1 . If t[u 1 ] = E v ′ then v ′ = E v1 and t[u 1 ] and v ′ are messages and so is t[u 2 ]. In that case, we deduce t[u 2 ] * v 1

	2. Modelling Security Protocols
	of * . Otherwise, t[u 1 ]
	2-i yielding t ′ 2-i	t ′′ 2-i . Moreover,
	t ′′ 1 |pi ≡ E t ′′ 2 |pi for all i ∈ {1, 2}. Since at other positions (i.e. positions that are not a prefix
	or a suffix of p 1 or p 2 ), the same term is present in t ′′ i , t ′ i and t i , and t 1 ≡ E t 2 , one can
	deduce t ′′ 1 ≡ E t ′′ 2 concluding the proof.
	• from the stability of = E by application of constructor symbols. If t[u 1 ]	t ′ * v 1 and
	the reduction rule is applied to a position above u 1 (i.e. at a position p ′ that is a prefix of
	p) then the exact reduction rule can be applied to t[u 2 ] as well, leading to t ′ : t[u 2 ]	t ′ .
	Indeed, all arguments of the destructor are taken modulo = E . We conclude by transitivity

t 2 ) ⇓ ok if, and only if, t 1 and t 2 can be reduced to messages that are not equal modulo = E . In ProVerif, the priority over rules is achieved by using the otherwise key word which specifies a rule that should be used only if previous ones could not. The extension has been introduced with [CB13].

  [] such that t ′ = t ′′ [u 1 ] and thus t[u 1 ] t ′′ [u 1 ]. Since the reduction rule is applied on a strict sub-term of t, one has t[u 2 ] t ′′ [u 2 ]. We conclude t[u 2 ] * v 1 by inductive hypothesis. Consider a term t, some messages u and v, and a context t ′ [] built from Σ and N such that t ⇓ u and t ′ [u] ⇓ v. Let us prove that t ′ [t] * v (implying t ′ [t] ⇓ v). By hypothesis, we have the two following reductions: t ′ [u] * v and t * u. First, we show that t ′ [t] * t ′ [u]. Indeed, one can modify applications of reduction rules on t to be applied to t ′ [t] by modifying the position where they are applied. We conclude t ′ [t]

	Hence t[u 2 ] ⇓ v 1 .
	• Example 10. The properties of symbols in Σ d (see Example 1) are reflected through the following
	ordered set of rewriting rules:
	sdec(senc(x, y), y) → x	eq(x, x) → ok
	π i (⟨x 1 , x 2 ⟩) → x i for i ∈ {1, 2}.
	neq(x, x) → no	neq(x, y) → ok
	Thanks to Proposition 1, we deduce from this rewriting system a computation relation as defined
	in Definition 2. Note that the resulting computation relations satisfies the relations given in
	Example 4.
	Remark 3. Thanks to the fact that rules are given priorities, we are able to give a semantics
	for neq such that neq(t 1 ,

* v by transitivity of * .

  Note that = E ⊆≡ E d : if u = E v for some messages u, v then u ≡ E d v. We say that a term t computes a message u (i.e. t ⇓ u) if t ≡ E d u and t is valid as defined below. Definition 6. A term t is said valid, denoted valid(t), when for any t ′ ∈ subTerms(t), it holds that there exists a message v ′ such that t ′ ≡ E d v ′ . We say that ≡ E d is a conservative extension of = E when for all messages u 1 , u 2 ,if u 1 ≡ E d u 2 then u 1 = E u 2 . Assuming that ≡ E d is a conservative extension of = E ,the relation t ⇓ u induced by the validity predicate ( i.e. t ⇓ u if t is valid and u a message such that t ≡ E d u) is a computation relation.

	Intuitively, the validity condition expresses the fact that if a failure occurs during a bottom-up
	computation of the term then it propagates through the whole term.
	Finally, we can prove that the computation relation induced by such equational theories fulfils
	all requirements of Definition 2 provided that ≡ E d is a conservative extension of = E as defined
	next.
	Definition 7. Proposition 2.
	X ) be a relation over terms. The equational theory ≡ E d
	is the smallest equivalence relation over T (Σ, N ∪ X ) containing E ⊎ E d , stable by substitution
	from X to T (Σ, N ∪ X ) and stable by application of function symbols in Σ.

•

  Consider a term t, some messages u and v, and a context t ′ [] built from Σ and N such that t ⇓ u and t ′ [u] ⇓ v . Let us prove that t ′ [t] ⇓ v. By hypothesis, we have that t ≡ E d u and t ′ [u] ≡ E d v. By stability of ≡ E d by application of function symbols, one has t ′ [t] ≡ E d t ′ [u] and thus, by transitivity of ≡ E d , t ′ [t] ≡ E d v. It remains to show valid(t ′ [t]). We already proved that t ′ [t] ≡ E d v where v is a message. Consider now a strict sub-term t s of t ′ [t]. If it is a sub-term of t then valid(t s ) follows from t ⇓ u. If it is a sub-term of t ′ without hole then valid(t s ) follows from t ′ [u] ⇓ v. Otherwise, there exists t ′

	s a sub-term of t ′ such that
	t s = t ′ s [t]. Applying the same argument as before, we deduce that t ′ s

  By hypothesis, we have that t[u 1 ] ≡ E d v 1 and valid(t[u 1 ]). Since ≡ E d is stable by application of function symbols and u 1 ≡ E d u 2 , we also have t[u 2] ≡ E d t[u 1 ] ≡ E d v 1 .Since this reasoning can also be applied for all sub-terms of t[u 2 ], we deduce valid(t[u 2 ]). Indeed, equational theories are not flexible enough to give the expected semantics to this destructor. On the contrary, equational theories are better at specifying reductions involving interactions between destructors ( e.g. for dest 1 , dest 2 ∈ Σ d , equations dest 1 (dest 2 (x)) E d const(x) cannot directly be specified using reduction rules).

	Example 11. The properties of symbols in Σ d (see Example 1) are reflected through the following
	equations:
	sdec(senc(x, y), y) E d x	eq(x, x) E d ok
	π i (⟨x 1 , x 2 ⟩) E d x i for i ∈ {1, 2}.
	It is easy to see that the induced ≡ E d is a conservative extension of = E . Indeed, each equation
	involves only one destructor symbol on one side and a constructor term on the other side and
	all equations involve pairwise distinct destructor symbols. Therefore, if two messages u 1 , u 2 are
	such that u 1 ≡ E d u 2 involving an equation from E d \E then, since it introduces a destructor symbol
	that cannot be removed using other equations, the same equation has to applied (but in the other
	direction). The two applications of this equation must cancel out.
	The induced computation relation (given by Proposition 2) coincides with the one given in
	Example 10 except for neq.

  Classical POR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151 7.2 Security Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 7.3 Proof Theory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154

	7 Related Work	151
	7.1

. . . . . 6.2 Combining Compression and Reduction with Constraint Solving . . . . . . . . . 6.2.1 Symbolic Semantics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.2.2 Embedding Compression into Symbolic Semantics . . . . . . . . . . . . . 6.2.3 Embedding Reduction into Symbolic Semantics . . . . . . . . . . . . . . . 6.3 Integration in Apte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.1 Apte in a Nutshell . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.2 Specification of the Procedure . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.3 Proof of the Original Procedure . . . . . . . . . . . . . . . . . . . . . . . . 6.3.4 Integrating Compression . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.5 Integrating Dependency Constraints . . . . . . . . . . . . . . . . . . . . . 4.3. Stability of the Security Notions 6.4 Implementation and Benchmarks . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 6.4.1 Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 6.4.2 Benchmarks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 6.5 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

  Lemma 3 gives us B ⌊tr c ⌋ --→ a B ′ . We can now apply Lemma 1 to obtain B tr -→ a B ′ and conclude.

Corollary 2. Let A and B be two action-deterministic configurations with skl(A) = skl(B). We have A ≈ B if, and only if, ⌈A⌉ ≈ sc ⌈B⌉. Proof. It follows from lemmas 6 and 8 Lemma 9. Let A and B be two action-deterministic configurations. Then ⌈A⌉ ⊑ c ⌈B⌉ implies ⌈A⌉ ⊑ sc ⌈B⌉.

  in d and P r 1 = in d | out e .in c . Those two processes are not trace equivalent (i.e. ({P l 1

  t).P outputA simple process P = {P 1 , . . . , P n } # is a multiset of basic processes P i on pairwise distinct chan-

nels c i . We consider the class of simple configurations; i.e. configurations whose first components are simple ground processes.

Example 33. The Private Authentication protocol defined in Subsection 3.3.2, which will be our running example in this chapter, lies in our class:

  6. Putting Reduced Semantics into Practice and Integration in Apte

	In	({in(c, y).P } ⊎ P; Φ; S)	in(c,X) = ==== ⇒ ({P {y → x}} ⊎ P; Φ; S ∪ {dom(Φ) ⊢ ? X x})
		where X (resp. x) is a fresh second-order (resp. first-order) variable
	Out	({out(c, t).P } ⊎ P; Φ; S)	out(c,w) =====⇒ ({P } ⊎ P; Φ ⊎ {w → t}; S)
			where w is a fresh variable
	Then	({if t τ else ==⇒ ({Q} ⊎ P; Φ; S ∪ {t 1 ̸ = ? t 2 })
	Blocked-Out ({out(c, t).P } ⊎ P; Φ; S)

1 = t 2 then P else Q} ⊎ P; Φ; S)

τ then = == ⇒ ({P } ⊎ P; Φ; S ∪ {t 1 = ? t 2 }) Else ({if t 1 = t 2 then P else Q} ⊎ P; Φ; S) τo = = ⇒ ({0} ⊎ P; Φ; S ∪ {t ̸ = ? t})

Figure 6.2 Symbolic semantics for symbolic configurations may just write Φλ ⇓ without making the choice explicit. Finally, we explicitly write NF R (A) to refer to its normal form (i.e. (NF R (Pθ); Φλ θ ⇓) where NF R has been defined in Chapter 2).

  is the substitution associated to θ w.r.t. A (resp. B). We have that ⌈({Q 0 (sk B , pk(sk A ))}; Φ 0 )⌉ ̸ ⊑ s c ⌈({Q 0 (sk B , pk(sk ′ A ))}; Φ 0 )⌉. Continuing Example 36, we have that:

	We

have that A and B are in trace equivalence w.r.t. -→c, denoted A ≈ s c B, if A ⊑ s c B and B ⊑ s c A. 127 6. Putting Reduced Semantics into Practice and Integration in Apte Example 38.

  .e. a situation where concurrent sessions are authorised. We may be interested in checking unlinkability as in Example 54, i.e. whether the following equivalence holds or not:

	Tag 2 key k 2	Tag 1 key k 1	Attacker	Reader 1 key k 1		Reader 2 key k 2
	! νk.(ν(n I , r I ).P ′ I | ν(n R , r R ).P ′ R ) ≈ ! νk.(! ν(n I , r I ).P ′ I | ! ν(n R , r R ).P ′ R )
	Actually, this equivalence does not hold. When concurrent sessions are authorised, an attacker
	can interfere and swap messages coming from two different parallel sessions. Performing these
	swaps, the two sessions will end correctly if, and only if, the keys that are involved in both sessions
	are the same. Such a scenario, depicted in Figure 8.1 (which is possible on the right-hand side)
	cannot be mimicked on the left-hand side (each tag can execute only once). Therefore the attacker
	observes that such an interaction is possible whereas this scenario has no counterpart in the single
	session scenario. In practice, this can be very harmful when e.g. tags are distributed among
	distinct groups ( e.g. for access control policies) sharing each the same key k. By interacting with
	two tags, the attacker would then be able to know if they belong to the same group. The attacker
	would thus have the ability to trace a group (rather than individual tags); we still consider the
	former as unlinkability attack.
	Now, coming back to the variant of the Feldhofer protocol as decribed in Example 52 (with
	sessions running sequentially only), it can be shown relying on the technique developed in this
	part that unlinkability holds. We have that:
	! νk.(ν(n I , r I ).P ′ I | ν(n R , r R ).P ′ R ) ≈ ! νk.( !	ν(n I , r I ).P ′ I |	!	ν(n R , r R ).P ′ R )

  9. Sufficient Conditions for Privacya and a ′ , we denote by ta| a,a ′ the subsequence of ta that consists of actions of the form α[a] or α[a ′ ]. Given a protocol Π, we say that two annotations a 1 = A 1 (k 1 , n 1 ) and a 2 = A 2 (k 2 , n 2 ) are associated in (ta, Φ) if:• they are dual, i.e. A 1 ̸ = A 2 , and k 1 = k 2 when fn(R) ∩ fn(I) ̸ = ∅ (the shared case);• the interaction ta| a1,a2 is honest for Φ (see Definition 50). The protocol Π is well-authenticating if, for any execution (M Π,id ; ∅) ta.τ then[a]

	Definition 62. Example 69. Continuing Example 58, the annotations I(k ′ , n ′ I ) and R(k ′ , n ′ R ) are associated
	in (ta, Φ 0 ).
	Finally, we can state our second condition.
	Definition 63.

  Example of ProVerif file checking frame opacity

		10.1. Mechanisation
	! new k ;
	! new nI ; new nR ; new n1 ; new n2 ; new n3 ;
	(	( * I n i t i a t o r r o l e : * )
		out ( cI , c h o i c e [ nI , n1 ] ) ;
		i n ( cI , x ) ;
		l e t merge = c h o i c e [
		l e t c a t c h F a i l =
		l e t yt , ynR = eq ( p r o j 1 ( dec ( x , k ) ) , nI ) ,
		p r o j 2 ( dec ( x , k ) ) i n
		enc ( ( ynR , nI ) , k )
		e l s e n2 ,
		n2 ] i n
		out ( cI , merge ) )
	| (	( * Responder r o l e : * )
		i n ( cR , z ) ;
		out ( cR , c h o i c e [ enc ( ( nI , nR ) , k ) , n3 ] ) ; . . . )
		Figure 10.1

A scytale (see Figure1.1) is a rod around which a parchment is wrapped to read and write the message (in the axis of the rod). The diameter of the rod constitutes the key to cipher and decipher. Indeed, when wrapped around a rod of a different diameter, the message is unreadable.

This commonly refers to the knowledge-based part of the economy.

GAFAM (or Big Five) refers to the most influential international technology companies: Google, Apple, Facebook, Amazon and Microsoft.

There are examples of companies (e.g. Navizon [nava]) selling tools to trace people exploiting traceability attacks (see the survey[START_REF] Demir | Analysing the privacy policies of wi-fi trackers[END_REF]). Such tools have for example been used by supermarkets to trace customers through their shelves[navb,[START_REF] Turow | The Aisles Have Eyes[END_REF].

For instance, when researchers disclosed an attack [car] to remotely take control over Jeep Cheroke cars, Fiat Chrysler had to recall 1.54 million vehicles to fix the issue.

Diffie and Hellman have been rewarded by the ACM Turing Award in 2016 for having laid the foundations of asymmetric encryption.

They can thus retrieve the low-entropy password.

This is not a paranoid scenario, remember the already mentioned tools which are sold e.g. by Navizon[nava] to trace people by exploiting traceability attacks.

http://www.ntu.edu.sg/home/atiu/spec-prover/

http://akiss.gforge.inria.fr

http://proverif.inria.fr

The very recent extension[START_REF] Blanchet | Automated reasoning for equivalences in the applied pi calculus with barriers[END_REF] neither solves the problem as it only allows to relax those constraints in specific situations.

We will describe more precisely those protocols and why unlinkability cannot be verified directly using diff-equivalence in Part C.

See https://github.com/akiss/akiss.

Except if they already know part of the plaintext. Indeed, in such a case, they can try to decrypt and check whether the result matches the part of the expected plaintext they know.

When the context is not clear, we use {} # to denote that the underlying object is a multiset and use ⊎ to denote union of multisets.

Our notion of internal reduction is close to but different from the one in[START_REF] Abadi | Mobile values, new names, and secure communication[END_REF]. It notably plays the role of the structural equivalence from[START_REF] Abadi | Mobile values, new names, and secure communication[END_REF] and can be chosen such that it plays parts of the role of the internal reduction as defined in[START_REF] Abadi | Mobile values, new names, and secure communication[END_REF].

Note that we will see that action-determinism guarantees that such skeletons are pariwise distinct.

Remind that conditionals are executed by the internal reduction and their outcomes are only known "at runtime", so do the explored branches (either Then or Else).

This definition yields infinite executions for -→ A if no inequivalent pair is met. Each such execution eventually reaches (∅; ∅) while, in practice, executions are obviously not explored past empty pairs. We chose to introduce this minor gap to make the theory more uniform.

We use the notation σ 1 ⊔ σ 2 to emphasise the fact that the two substitutions do not interact together. They have disjoint domain, i.e. dom(σ 1 ) ∩ dom(σ 2 ) = ∅, and no variable of dom(σ i ) occurs in img(σ j ) with {i, j} = {1, 2}.

We dismiss here the (infinitely many) transitions obtained for infeasible actions, which yield (∅; ∅).

https://github.com/akiss/akiss

Although this would be an interesting question, we do not expect that any improvement of compression would come out of it. Indeed, compression can be argued to be maximal in terms of eliminating redundant traces without analysing data: for any compressed trace there is a way to choose messages and modify tests to obtain a concrete execution which does not belong to the equivalence class of any other compressed trace.

This is possible if different physical tags share the same identity (e.g. as it may be the case in access control scenarios). In such a case, it may happen that two different physical tags are running two sessions concurrently.

We do not model the getChallenge constant message that is used to initiate the protocol but it is clear this message does not play any role regarding the security of the protocol.

For that different attack, we obviously consider that decryption is a constructor, and thus cannot fail.

For more information about IRMA ("I Reveal My Attributes"), see https://www.irmacard.org.

Before executing the join protocol, the TPM and the issuer should establish a one-way authenticated channel that is not specified by the DAA scheme.

Remerciements

Part B Partial Order Reduction Techniques

Significantly Improving Efficiency for the Bounded Case Finally, given two simple extended processes A = (P A ; Φ A ) and B = (P B ; Φ B ), we say that A ≈ A c B when A ≈ + B for any ({ (P A ; Φ A ; ∅) }; { (P B ; Φ B ; ∅) }) tr -→ A c (A; B).

As expected, -→ A1 c allows to consider much fewer explorations than with the original -→ A1 . It inherits the features of compression, prioritising outputs, not considering interleavings of outputs, executing inputs only under focus, and preventing executions beyond improper blocks. These constraints apply to individual processes in A ∪ B, but we remark that they also have a global effect in -→ A1 c , e.g. all processes of A ∪ B must start a new block simultaneously: recall that the beginning of a block corresponds to some outputs after some inputs, and after the outputs, no more outputs are available.

Example 44. Continuing Example 43, there is only one non-trivial 3 compressed exploration of one action from the valid pair ({Q t 1 }; {Q t 1 }). It corresponds to the output on channel c 2 :

x 2 = ? ok}; S + 2 ). In particular, for any i ∈ {1, 2}, we have

Observe that, because -→ A c is obtained from -→ A by a subset restriction in -→ A1 up to some disequality constraints, we have that (A ′ ; B ′ ) is a valid pair when ({ A }; { B }) tr -→ A c (A ′ ; B ′ ) for some quiescent, symbolic processes A, B having empty sets of constraints. Following the same reasoning as the one performed in Section 6.3.3, we can establish that ≈ s c coincides with ≈ A c . The main difference is that -→c already ignores τ -actions, and therefore we do not need to apply the obs(•) operator.

Lemma 19. Let (A; B) be a valid pair such that (A; B) tr -→ A c (A ′ ; B ′ ). Then, for all A ′ ∈ A ′ there is some A ∈ A such that A tr -→c A ′ . Symmetrically for B ′ ∈ B ′ .

Lemma 20. Let A = (P; Φ; ∅), B = (Q; Ψ; ∅), and A ′ = (P ′ ; Φ ′ ; S ′ ) be three quiescent, symbolic processes such that (P; Φ) ≈ A c (Q; Ψ), A tr -→c A ′ and θ ∈ Sol(A ′ ). Then there exists an exploration ({ A }; { B }) tr -→ A c (A ′ ; B ′ ) and some A + ∈ A ′ , θ + ∈ Sol + (A + ) such that A + = A ′ and λ θ = E λ θ + , where λ θ (resp. λ θ + ) is the substitution associated to θ (resp. to θ + ) with respect to (Φ ′ ; S ′ ). Symmetrically for B tr -→c B ′ .

Lemma 21. Let A, B and A ′ be quiescent, simple symbolic processes such that A tr -→c A ′ = (P ′ ; Φ ′ ; S ′ ), θ ∈ Sol(A ′ ), and ({ A }; { B }) tr -→ A c (A ′ ; B ′ ) with θ ∈ Sol + (C) for some C ∈ A ′ ∪B ′ . Then there exists some A + ∈ A ′ such that A + = A ′ and θ ∈ Sol + (A + ). Symmetrically for B tr -→c B ′ . so the induction hypothesis applies and we obtain

) such that the first-order substitutions associated to θ| V1 and θ + c is also present in -→ A r , i.e. that ps(A 3 ; B 3 ) does not violate Deps(tr.α) in the sense of Definition 47. This is because, by definition of the partial solution, we have that θ + 3 = ps(A 3 ; B 3 )⊔τ for some τ , so that if ps(A 3 ; B 3 ) violated Deps(tr.α) then we would have θ + 3 ̸ |= (Φ3;S3) Deps(tr.α). Since θ + 3 and θ induce the same first-order substitutions with respect to (Φ 3 ; S 3 ), we would finally have θ ̸ |= (Φ3;S3) Deps(tr.α), contradicting the hypothesis on θ.

Finally, we show the main theorem of this chapter: Apte implementing the reduced strategy as explained above computes the trace equivalence for quiescent simple processes.

Theorem 7. For any quiescent initial simple processes A and B such that skl(A) = skl(B), we have that:

A ≈ B if, and only if, A ≈ A r B.

Proof. Let A = (P; Φ) and B = (Q; Ψ) be two quiescent, initial simple processes such that skl(A) = skl(B). We prove the two directions separately.

(⇒) Applying Corollary 4 and theorem 6, we have that A ≈ B implies A ≈ A c B. Then, we easily deduce A ≈ A r B. Indeed, for any ({ (P; Φ; ∅) }; { (Q; Ψ; ∅) }) tr -→ A r (A ′ ; B ′ ) we have ({ (P; Φ; ∅) }; { (Q; Ψ; ∅) }) tr -→ A c (A ′ ; B ′ ) by definition of -→ A r , and thus A ′ ∼ + B ′ by hypothesis.

(⇐) For the other direction, it suffices to show that A ≈ A r B implies A ⊑ s r B (by Corollary 5). Let (P; Φ; ∅) tr -→c A ′ = (P ′ ; Φ ′ ; S ′ ) with θ ∈ Sol(A ′ ) and θ |= (Φ ′ ;S ′ ) Deps(tr). By Lemma 22, we have ({ (P; Φ;

Since A ≈ A r B, we have A ′ ∼ + B ′ : there must be some

. By Lemma 19, we have (Q; Ψ; ∅) tr -→c B + . Furthermore, we can show as before (see the end of the proof of Proposition 22) that θ ∈ Sol(B + ) and

e. sets of handles that second-order variables may use coincide), and

Chapter 7

Related Work

The techniques we have presented in this Part borrow from standard ideas from concurrency theory, trace theory, and, perhaps more surprisingly, proof theory. Blending all these ingredients, and adapting them to the demanding framework of security protocols, we have come up with partial order reduction techniques that can effectively be used in symbolic verification algorithms for equivalence properties of security protocols. We now discuss related work, and there is a lot of it given the huge success of POR techniques in various application areas. We shall focus on the novel aspects of our approach, and explain why such techniques have not been needed outside of security protocol analysis. These observations are not new: as pointed out by Baier and Katoen [START_REF] Baier | Principles of Model Checking (Representation and Mind Series[END_REF], "[POR] is mainly appropriate to control-intensive applications and less suited for data-intensive applications"; Clarke et al. [START_REF] Clarke | Partial order reductions for security protocol verification[END_REF] also remark that "In the domain of model checking of reactive systems, there are numerous techniques for reducing the state space of the system. One such technique is partial-order reduction. This technique does not directly apply to [security protocol analysis] because we explicitly keep track of knowledge of various agents, and our logic can refer to this knowledge in a meaningful way." In Section 7.1, we first compare our work with classical POR techniques. We then comment on previous work in the domain of security protocol analysis in Section 7.2. We conclude the chapter with some remarks on the relationship between our optimised semantics and focused proof systems in Section 7.3. trace equivalent modulo outputs (the same traces can be found after removing output actions).

Classical POR

The justification for their reduction would fail in our setting, where we consider standard trace equivalence with observable outputs. More importantly, their requirement that a reduced system should be equivalent to the original one makes it impossible to swap input actions, and thus reductions such as the execution under focus of our compressed semantics cannot be used. The authors leave as future work the problem of combining their algorithm with symbolic executions, in order to be able to lift the restriction to a finite number of messages.

Cremers and Mauw proposed [START_REF] Cas | Checking secrecy by means of partial order reduction[END_REF] a reduction technique for checking secrecy in security protocols. Their method allows to perform outputs eagerly, as in our compressed semantics.

It also uses a form of sleep set technique to avoid redundant interleavings of input actions. In addition to being applicable only for reachability properties, the algorithm of [START_REF] Cas | Checking secrecy by means of partial order reduction[END_REF] works under the assumption that for each input only finitely many input messages need to be considered. The authors identify as important future work the need to lift their method to the symbolic setting.

Earlier work by Mödersheim et al. has shown how to combine POR technique with symbolic semantics [START_REF] Mödersheim | Constraint differentiation: Search-space reduction for the constraint-based analysis of security protocols[END_REF] in the context of reachability properties for security protocols, which has led to high efficiency gains in the OFMC tool of the AVISPA platform [A + 05]. While their reduction is very limited, it brings some key insight on how POR may be combined with symbolic execution. For instance, their reduction imposes a dependency constraint on the interleavings of {in(c, x).out(c, m), in(d, y).out(d, m ′ )}. Assuming that priority is given to the process working on channel c, this constraint enforces that any symbolic interleaving of the form in(d, M ′ ).out(d, w ′ ).in(c, M ).out(c, w) would only be explored for instances of M that depend on w ′ . Our reduced semantics constrains patterns of arbitrary size (instead of just size 2 diamond patterns as above) by means of dependency constraints. Going back to Example 31 (in Subsection 5.4.3), their technique will only be able (at most) to exploit the dependencies depicted in blue plain arrows, and they will not consider the one represented by the dashed 2-arrow. Lastly, they will even do not detect all the patterns of this kind. Whereas we generate dependency constraints on the fly, they implement their technique by looking for such a pattern afterwards. Moreover, our POR technique has been designed to be sound and complete for trace equivalence checking as well.

Proof Theory

The reader familiar with focused proof systems [START_REF] Andreoli | Logic programming with focusing proofs in linear logic[END_REF] will have recognised the strong similarities with our compressed semantics. The strategies are structured in the same way, around positive and negative phases. More deeply, the compressed semantics can actually be derived systematically from the focused proof system of linear logic, through an encoding of our processes into linear logic formulas (such that proof search corresponds to process executions). There are several such encodings in the literature, see for instance [START_REF] Miller | Encryption as an abstract data type[END_REF][START_REF] Garg | Type-directed concurrency[END_REF][START_REF] Deng | Relating reasoning methodologies in linear logic and process algebra[END_REF]. Intuitively, we would map input and output respectively to existential and universal quantifiers, which are respectively positive and negative in (linear) logic -the universal quantifier introduces a fresh handle (eigenvariable) that may be used for future instantiations of existentially quantified variables.

Part C

Verifying Privacy via Sufficient

Conditions Significantly Improving Precision of Privacy Verification for the

Unbounded Case

successive replications ! collapse, the most appropriate bi-process one can come up with is the following:

It is now possible to understand why diff-equivalence is not precise enough. Since exactly the same rules will be applied on the left and on the right, two instances of the role T having the same key on the left cannot have the same key on the right: e.g.

The same for R: e.g.

Note that, on the left, the first instance t 1 of T can successfully execute a session of the protocol with the second instance r 2 of R. However, when looking at the right side, those two processes t 1 and r 2 are most likely unable to have such an "honest" interaction because their long-term keys (i.e. respectively k 1 r and k 2 r ) do not match. Therefore, the above bi-process is most likely not diff-equivalent and we did not even examine the processes T and R to conclude so. Obviously, the above trace equivalence does not systematically fail to hold since one can come up with the pair (t 1 , r 1 ) on the right to mimic a successful interaction of (t 1 , r 2 ) on the left. To sum up, the crux of the problem is that diff-equivalence considers an over-approximation of the Dolev-Yao attacker by giving him the internal structure of the two processes to be verified, the attacker is thus able to observe from which replication a given instance of a role originates.

The latter almost systematically leads to false attacks and makes diff-equivalence of no use when it comes to verify unlinkability. Remark that similar issues arise with other privacy goals such as vote-privacy (only partially addressed in [START_REF] Delaune | Automatic verification of privacy properties in the applied pi-calculus[END_REF][START_REF] Blanchet | Automated reasoning for equivalences in the applied pi calculus with barriers[END_REF]).

In practice, this means that many security protocols cannot be verified. We already discussed the case of the Feldhofer protocol in Subsection 3.3.1 (in Part A). But as explained above, this is not an isolated problem: unlinkability of the BAC protocol (used in e-passport) cannot be automatically established either (despite recent improvements on diff-equivalence checking [START_REF] Cheval | Proving more observational equivalences with ProVerif[END_REF]) and similarly for most of the numerous real-world case studies we will present in Chapter 10.

Contributions. We believe that looking at trace equivalence of any protocol is a too general problem and that much progress can be expected when one focuses on a few privacy goals and a class of protocols only (yet large and generic enough). We follow this different approach.

We aim at proposing sufficient conditions that can be automatically checked, and that imply unlinkability and anonymity for a large class of security protocols. The success of our solution will be measured by confronting it to many real-world case studies.

More precisely, we identify a large class of 2-party protocols (simple else branches, arbitrary cryptographic primitives) and we devise two conditions called frame opacity and wellauthentication that imply unlinkability and anonymity for an unbounded number of sessions.

We show how these two conditions can be automatically checked using e.g. the ProVerif tool, and we provide tool support for that. Using our tool UKano (built on top of ProVerif), we have automatically analysed several protocols, among them the Basic Access Control (BAC) protocol as well as the Password Authenticated Connection Establishment (PACE) protocol that are both used in e-passports. We notably establish the first proof of unlinkability for ABCDH [START_REF] Alpár | A secure channel for attribute-based credentials[END_REF] and for the BAC protocol followed by the Passive Authentication (PA) and Active Authentication (AA) protocols. We also report on an attack that we found on the PACE protocol, and another one that we found on the LAK [START_REF] Lee | RFID mutual authentication scheme based on synchronized secret information[END_REF] protocol whereas it is claimed untraceable in [START_REF] Van Deursen | Attacks on RFID protocols[END_REF].

It happens that our conditions are rather tight: we provide an attack every time one of them is not satisfied.

We believe that the overall methodology and proof method could be used for other classes of protocols and other privacy goals. For instance, reusing the core ideas of the present methodology, we devised a new method [START_REF] Cremers | Improving automatic symbolic analysis for e-voting protocols: Sufficient conditions for ballot secrecy[END_REF] to automatically verify vote-privacy for a large class of e-voting protocols.

Our sufficient conditions. We now give an intuitive overview of our two sufficient conditions.

In order to do this, assume that we want to design a mutual authentication protocol between a tag T and a reader R based on symmetric encryption, and we want this protocol to be unlinkable.

We assume that k is a symmetric key shared between T and R.

Frame opacity. A first attempt to design such a protocol is presented using Alice & Bob notation as follows (n R is a fresh nonce):

This first attempt based on a challenge-response scheme is actually linkable. Indeed, an active attacker who systematically intercepts the nonce n R and replaces it by a constant will be able to infer whether the same tag has been used in different sessions or not by comparing the answers he receives. Here, the tag is linkable because, for a certain behaviour (possibly malicious) of the attacker, some relations between messages leak information about the agents that are involved in the execution. Our first condition, namely frame opacity, actually checks that all outputted messages have only relations that only depend on what is already observable. Such relations can therefore not be exploited by the attacker to learn anything new about the involved agents.

Well-authentication. Our second attempt takes the previous attack into account and randomises the tag's response and should achieve mutual authentication by requiring that the reader must answer to the challenge n T . This protocol can be as follows:

Here, Alice & Bob notation shows its limit. It does not specify how the reader and the tag are supposed to check that the messages they received are of the expected form, and how they should react when the messages are not well formed. This has to be precisely defined, since unlinkability depends on it. For instance, assume the tag does not check that the message he receives at step 3 contains n T , and aborts the session if the received message in not encrypted with its own k. In such an implementation, an active attacker can eavesdrop a message {n T } k sent by R to a tag T , and try to inject this message at the third step of another session played Chapter 8

Model & Problem

In this chapter, we first define the instantiation of the semantics (Section 8.1) we shall work with in the present part. We then define (Section 8.2) the class of protocols we are dealing with.

Finally, we define (Section 8.3) the security goals unlinkability and anonymity we want to verify and compare our definitions to others in the literature.

Instantiation of the Model

In this part of the thesis, we eventually leverage the tool ProVerif in Chapter 10 and shall use the corresponding instantiation of the semantics. However, the theoretical part of our approach (i.e. the theorem stating that our conditions imply privacy) can be formulated in a more generic framework that we define now.

Term Algebra. We assume any signature Σ, any equational theory = E , and any computation relation ⇓. In other words, our approach is completely generic in the term algebra.

Example 47. We may for instance consider the signature Σ = {senc, sdec, ⟨ ⟩, proj 1 , proj 2 , ⊕, 0, eq, neq, ok}.

of Example 1 (Chapter 2) equipped with the equational theory of Example 2 (Chapter 2) and the computation relation induced by the rewriting system given in Example 10 (Chapter 2).

Syntax & Semantics. We fix in this part R = R par and thus obtain an internal reduction R breaking parallel compositions greedily. We already proved in Section 4.1 that this choice does not impact the induced notion of trace equivalence.

Example 48. One of our running examples in this part will be the Feldhofer protocol (see examples 6 and 9 in Chapter 2).

We recall here how we modelled it and describe one of its executions. We consider the term algebra introduced in Example 47. The protocol is modelled

Model & Problem

Example 57. We consider the following protocol between a tag T and a reader R that share a symmetric key k. We consider that sessions can be executed in parallel, and we assume that T aborts in case the nonce n R he receives is equal to the nonce n T he sent previously (in the same session).

1.

We consider the term algebra introduced in Example 1, and the equational theory introduced in Example 2 (see Chapter 2) with in addition the equation sdec(senc(x, y), y) = x. To show that the property formally stated in Definition 54 does not hold, consider the following scenario.

A same tag starts two sessions 1 and therefore generates two nonces n T and n ′ T . The attacker answers to these requests by sending back the two encrypted messages to the tag who will accept both of them, and sends on the network two messages that are actually equal (the exclusive or operator is commutative). Therefore the attacker observes a test, namely the equality between the last two messages, which has no counterpart in the single session scenario. Therefore, this protocol does not ensure unlinkability. In practice, this can be very harmful. Suppose, for example, that tags are distributed among distinct groups ( e.g. for access control policies) sharing each the same key k. By interacting with two tags, the attacker would then be able to know if they belong to the same group and thus be able to trace groups.

To the best of our knowledge, all the existing game-based variants of unlinkability that are amenable to automation relying on the diff-equivalence notion suffer from this problem. We may also note that the attack described in Example 55 is not captured when considering the gamebased version of unlinkability. Actually, this protocol can even be proved secure using ProVerif when considering the game-based version of unlinkability while it suffers from the attack depicted in Figure 8.1.

Sufficient Conditions for Privacy

Note that this is not necessarily well-defined, as the term t j = R j Φ fr ideal (ta) may not compute to a message m j such that t j ⇓ m j . However, if Φ fr ideal (ta) is well-defined, and ta.α results from an execution together with the frame Φ such that Φ fr ideal (ta) ∼ Φ, then Φ fr ideal (ta.α) is also well-defined.

Remark that, by definition, Φ fr ideal (ta) never depends on the specific identity names occurring in ta but only on the set of involved agents (without any knowledge about their identity names) and how they interact with each other. In particular, idealised frames do not depend on whether agents rely on the specific constants id 0 or not.

Example 60. Continuing Example 58, we may consider the idealisation operator defined as follows:

Let fr be an injective function such that fr(a I , x n j ) = n I j and fr(a R , x n j ) = n R j . We have that Φ fr ideal (ta) is well-defined and

On the latter simple example, such an idealisation will be sufficient to establish that any reachable frame obtained through an execution of M Π Fh is indistinguishable from its idealisation. This simple idealisation operator is however not always sufficient for our purposes, and as illustrated by the following two examples, we sometimes need to consider more complex idealisation operators.

Example 61. Continuing Example 52, and to have some hope to establish our indistinguishability property, namely frame opacity defined below, we need to define an idealisation operator that retains part of the shape of outputted messages. Typically, assuming that the three outputs are labelled with ℓ 1 , ℓ 2 and ℓ 3 respectively, we will consider:

Example 62. Regarding Example 53, we need also to define an idealisation that retains the shape of the second outputted message. Moreover, the idealisation of the second outputted message will depend on the nonce previously received. Typically, assuming that the two outputs are labelled with ℓ 1 , and ℓ 2 respectively, we will consider:

The following proposition establishes that the particular choice of fr in Φ fr ideal (ta) is irrelevant with respect to static equivalence. We can thus note Φ ideal (ta) ∼ Φ instead of ∃fr, Φ fr ideal (ta) ∼ Φ.

Proposition 23. We have Φ fr ideal (ta) ∼ Φ fr ′ ideal (ta) for any fr and fr ′ .

Proof. It suffices to observe that there exists a bijection σ :

where ta is the trace given in Example 58.

Although this canonical syntactical idealisation is quite different from the one described in Example 60, it also allows us to establish that any reachable frame obtained through an execution of M Π Fh is indistinguishable from its idealisation.

Example 64 (Continuing Example 52). Consider a renaming σ that maps k, n I , n R , x 2 , x 3 ,

We obtain the following idealisation operator:

) Such an idealisation operator is suitable to establish frame opacity.

Example 65 (Continuing Example 53). Consider a renaming σ that maps: k

We obtain the following idealisation operator:

x n 5 , pk(sk I ))); ℓ 3 → error Such an idealisation operator is also suitable to establish frame opacity.

As illustrated by the previous examples, this canonical syntactical idealisation is sufficient to conclude on most examples. Actually, using this canonical construction, we automatically build the idealisation operator and check frame opacity for all the examples we have introduced in the previous sections and for most of the case studies presented in Chapter 10.

Semantical Idealisation

However, the previous construction is clearly purely syntactic and therefore closely connected to the way we write the roles of the protocol. Its main weakness is the way it deals with variables bound by let constructions. Since there is no way to statically guess the shape of messages that will be instantiated for those variables, the previous technique replaces them by fresh session names. False negatives may result from such over-approximations.

We may therefore prefer to build an idealisation operator looking at the messages outputted during a concrete execution. In such a case, we may simply retain part of the shape of messages, which a priori does not reveal anything sensitive to the attacker (e.g. pairs, lists). This can be formalised as follows:

that does not occur in E and such that: for all 1 ≤ i ≤ n, there exists a recipe R i ∈ T (Σ pub , {w})

Example 66. Considering the signature and the equational theory introduced in Example 1 and Example 2, the symbols ⟨ ⟩ and ok are the only ones that are transparent. Regarding the pairing operator, the recipes R 1 = proj 1 (w) and R 2 = proj 2 (w) satisfy the requirements.

Once such a set Σ t is fixed, the idealisation associated to a label ℓ occurring in Π will be computed relying on a particular (but arbitrary) message u that has been outputted with this 9.3. Well-Authentication label ℓ during a concrete execution of M Π . The main idea is to go through transparent functions until getting stuck, and then replacing the remaining sub-terms using distinct name variables from X n .

Example 67. Consider the protocol given in Example 51 and the frame Φ 0 as defined in Example 48, the resulting idealisation associated to Π (considering the messages outputted in Φ 0 ) is:

The protocol given in Example 52 will give us:

Even if these idealisation operators are quite different from the ones presented in Example 63 and Example 64, they are also suitable to establish frame opacity.

In [START_REF] Hirschi | A method for verifying privacy-type properties: the unbounded case[END_REF], the idealisation operator associated to Π was exclusively computed using this method. However, it happens to be insufficient to establish frame opacity in presence of function symbols that are neither transparent nor totally opaque such as signatures. Indeed, a signature function symbol is not transparent according to our definition, but an attacker can make the difference between a signature sign(m, sk(A)) and a random nonce. Therefore, replacing such a term by a fresh session name will never allow one to establish frame opacity.

However, this construction leads to simpler idealisation operators that often allow better performance. We thus also have implemented a heuristic following the above ideas in the tool UKano.

Well-Authentication

Our second condition will prevent the attacker from obtaining some information about agents through the outcome of conditionals. To do so, we will essentially require that conditionals of I and R can only be executed successfully in honest, intended interactions. However, it is unnecessary to impose such a condition on conditionals that never leak any information, which are found in several security protocols. We characterise below a simple class of such conditionals, for which the attacker will always know the outcome of the conditional based on the past interaction.

, where the x i are the variables bound by the previous inputs of that role, and u i are the messages used in the previous outputs of that role.

Example 68. Consider the process given below:

The conditional is used to ensure that the agent will not accept as input the message he sent at the previous step. Such a conditional is safe according to our definition.

Note that trivial conditionals required by the grammar of protocols (Definition 49) are safe and will thus not get in the way of our analysis. We can now formalise the notion of association, which expresses that two agents are having an honest, intended interaction (i.e. the attacker essentially did not interfere in their communications). For an annotated trace ta and annotations our formal definition of unlinkability since such a trace will have no counterpart in S Π . More formally, the trace tr = out(c I , w 0 ).in(c R , w 0 ).τ then .out(c R , w 1 ).in(c R , w 0 ).τ then .out(c R , w 2 ) will be executable starting from M Π and will allow one to reach that frame:

the second action τ then will not be possible, and more importantly this will prevent the observable action out(c R , w 2 ) to be triggered.

Main Theorem: Soundness of Conditions w.r.t. Privacy

Our main theorem establishes that the previous two conditions are always sufficient to ensure unlinkability and anonymity for security protocols in our class. Theorem 8. Consider a protocol Π = (k, n I , n R , † I , † R , I, R) and some identity names id ⊆ k.

If the protocol is well-authenticating and ensures frame opacity, then Π ensures unlinkability and anonymity w.r.t. id.

Note that, when id = ∅, we have that M Π,id ≈ M Π and our two conditions coincide on M Π,id and M Π . We thus have as a corollary that if M Π ensures well-authentication and frame opacity, then Π is unlinkable. Before proving our Main Theorem in the next section, we show its applicability by summarising the different case studies we were able to verify notably using our theorem.

We first summarise in Table 9.1 the result of the confrontation of our method to our various running examples, focusing on unlinkability. We note for a condition automatically checked using our tool UKano and when the condition does not hold. For the analysis of Feldhofer variant with ! , we do not rely on UKano (which is based on ProVerif) since ProVerif does not support the ! operator. We establish the well-authentication property using Tamarin and frame opacity using ProVerif by allowing sessions to be run concurrently and thus doing a sound overapproximation of the protocol's behaviours. Remark that being able to verify different conditions using different methods or tools is also an advantage of our method. Except for the latter example, all positive results were automatically established using our tool UKano.

In Table 9.2, we summarise the result of the confrontation of our method to our real-world case studies, focusing on unlinkability. Detailed descriptions of our case studies are in Chapter 10. We remark that our conditions have proven to be tight enough for all our case studies: when a condition fails to hold, we could always discover a real attack on unlinkability. Most of the positive results (when unlinkability holds) and all attacks are new. Note that all positive results were established automatically using our tool UKano (which is based on ProVerif) without any manual effort (except for the cases indicated by * for which little manual efforts were needed).

Sufficient Conditions for

Proof of our Main Theorem

We provide in this section the proof of Theorem 8. Our main argument consists in showing that, for any execution of M Π,id , there is an indistinguishable execution of S Π (the other direction being easy). This indistinguishable execution will be obtained by a modification of the involved agents. We will proceed via a renaming of agents applied to an abstraction of the given execution of M Π,id . We then prove that the renamed executions can still be executed and produce an indistinguishable frame.

In this section we fix a protocol Π, some identity names id and some fresh constants id 0 yielding a process M Π,id as defined in Section 8.3. The construction of the proof will slightly differ depending on † I , † R (sequential or concurrent sessions) and whether fn(I) ∩ fn(R) = ∅ or not (shared case).

Abstraction of Configurations

Instead of working with M Π,id , M Π , and S Π , it will be more convenient to work with ground configurations. Intuitively, we will associate to each execution of M Π,id , M Π , and S Π , a ground configuration that contains all agents involved in that execution, already correctly instantiated. By doing so, we are able to get rid of technical details such as unfolding replications and rep-9.5. Proof of our Main Theorem

Proof. Item (1) holds by construction of the operator K(•), which has been built by closely mimicking how M Π,id and S Π create agents. We thus have that when an agent is at top-level in a configuration in the execution of M Π,id (or S Π ) then it is also available in the execution of K(ta). In general, less τ ν , τ ! , τ r actions are necessary for the execution starting with K(ta) than for the executions starting with M Π,id or S Π . Indeed, there is no need, in ground configurations, to spawn agents by unfolding replications or repetitions or creating fresh names. This is because agents are (more) immediately available in K(ta). Item (2) heavily relies on the well-formedness of ta. One can thus prove that all agents in K(ta) can be created along the execution by choosing appropriate names when triggering rules New. For instance, the first item of Definition 64 makes sure that the arity of parameters in agents matches the number of names to be created. The second and third items of Definition 64 ensure that the freshness guard conditions of the rule New holds for names to be created. Finally, the fourth item of Definition 64 implies that when an agent a = A(k, n) must be created then either (i) names in k are completely fresh and this identity k can be created from M Π,id by unfolding ! and create names k or (ii) names in k have already been created and thus the agent a can be created from the last replicated process used to create identity k in the first place. Item (3) is similar to (2). The single-session hypothesis provides exactly what is needed to mimic the execution using S Π rather than M Π,id .

Finally, item (4) stems from a simple observation. Compared to K(ta 1 ), the multiset of processes K(ta 1 .ta 2 ) adds processes in parallel and in sequence after some processes of K(ta 1 ). However, these extra processes are unused when executing ta 1 , thus K(ta 1 ) can perform the same execution.

Renamings of Annotations

As mentioned before, we shall prove that for any execution of M Π,id , there is an indistinguishable execution of S Π . This indistinguishable execution that S Π can perform will be obtained by a renaming of annotations. We define next a generic notion of such renamings of annotations. However, the crux of the final proof is to find a good renaming that implies: (i) the executability by S Π of the renamed trace, (ii) the static indistinguishability of the resulting frames (before and after the renaming).

Definition 66. A renaming of annotations (denoted by ρ) is an injective mapping from annotations to annotations such that:

• for any well-formed sequence of annotations S, Sρ is well-formed;

• ρ is role-preserving: i.e. initiator (resp. responder) annotations are mapped to initiator (resp. responder) annotations;

Proof. We proceed by induction on ta. The interesting case is when ta = ta 0 .ℓ : out(c, w)[a] and

with σ n 1 (x n j ) = fr 1 (a, x n j ) and σ i 1 (x i j ) = R j Φ fr1 ideal (ta 0 ) ⇓ where R j is the j-th input of a in ta 0 . The idealised frame Φ fr2 ideal (ta) is defined similarly, using σ n 2 and σ i 2 relying on ta 0 ρ and fr 2 instead of ta 0 and fr 1 . By induction hypothesis (i.e. Φ fr1 ideal (ta 0 ) = Φ fr2 ideal (ta 0 ρ)), we only have to establish that ideal(ℓ)σ i

, which allows us to conclude.

Proposition 27. We assume that Π satisfies the frame opacity condition. Let ρ be a renaming of annotations and ta be a well-formed annotated trace. If K(ta) ta = = ⇒ (P 1 ; Φ 1 ) and K(taρ) taρ ==⇒ (P 2 ; Φ 2 ), then we have that

Proof. We start by applying Proposition 24 on the two given executions to obtain two executions starting with M Π,id :

with ta * τ = ta and ta * ρ τ = taρ. Note that, if ta 1 and ta 2 are two annotated traces such that ta 1 τ = ta 2 and fr 1 is a name assignment, then Φ fr1 ideal (ta 1 ) = Φ fr1 ideal (ta 2 ). Therefore, as a direct consequence of Proposition 26, frame opacity and Proposition 23, we obtain the required conclusion: Φ 1 ∼ Φ 2 .

A sufficient Condition for Preserving Executability

We can now state a key lemma (Lemma 23), identifying a class of renamings which yield indistinguishable executions. More precisely, this lemma shows that for renamings satisfying some requirements, if K(ta) can execute an annotated trace ta then K(ta)ρ has an indistinguishable execution following the annotated trace taρ. Remark that, in the conclusion, the renaming is applied after building the ground configuration (K(ta)ρ) instead of building the ground configuration of the renamed trace (K(taρ)). Both variants are a priori different. However, in the final proof and in order to leverage previous propositions, we will need to relate executions of K(ta) with executions of K(taρ). The following easy proposition bridges this gap. We also state and prove a variant of Proposition 24, item (4). when ρ is applied after building the ground configuration.

Proposition 28. Let ta be a well-formed annotated trace and ρ a renaming of annotations. If

K(ta)ρ taρ

--→ (P ′ ; Φ) then K(taρ) taρ ==⇒ (P ′′ ; Φ).

Proof. Essentially, the proposition follows from the fact that there are less agents in sequence in K(taρ) than in K(ta)ρ, thanks to the third item of Definition 66.

More formally, by considering K(taρ) and K(ta)ρ as multiset of processes without sequence (by removing all sequences and taking the union of processes), we obtain the same multisets.

Sufficient Conditions for Privacy

We proceed by induction on the prefix ta 0 of ta. If ta 0 is empty, then ta 0 ρ can obviously be executed, and condition (a) holds because K(ta) ∓ K(ta)ρ by definition. Condition (b) is trivial since frames are both empty. In order to check conditions (c 1 ) and (c 2 ), note that association coincides with duality for empty traces. Let us verify condition (c 1 ) in the non-shared case. Being dual simply means being distinct roles, hence one obviously has that ρ(a) and ρ(a ′ ) are dual if, and only if, a and a ′ are. Let us verify condition (c 2 ) in the shared case. By hypothesis, we have that a and a ′ are connected in (ta, Φ) if, and only if, ρ(a) and ρ(a ′ ) are dual. Furthermore, if a and a ′ are connected in (ta, Φ) then they are dual and therefore they are associated in (ϵ, ∅). Hence (c 2 ).

Otherwise, we are considering a prefix of ta of the form ta 0 .α where α can be any action. The action α may be an input, an output, a conditional (i.e. τ then or τ else ) or a τ action produced by the Unfold rule. By (a), we know that there is a process in Q 0 which is able to perform an action of the same nature. If this action is τ (excluding the cases of τ then , τ else ) then triggering the process in Q 0 producing τ concludes the proof since all invariants are trivially preserved after this action.

We now have to deal with the case where α is an input, an output or a conditional. In those cases α is necessarily annotated, say by a, and has been produced by a process annotated a in P 0 . By induction hypothesis we have (P 0 ; Φ 0 ) and (Q 0 ; Ψ 0 ) and executions

satisfying all our invariants. Note that one has (ta 0 .α[a])ρ = ta 0 ρ.α[ρ(a)]. Now, we have to prove that exactly the same action α can be executed by the corresponding process annotated ρ(a) in Q 0 given by the invariant P 0 ∓ Q 0 (taking into account recipe for input and failure/success for conditional), and that our invariants are preserved after its execution. We now distinguish the three kinds of actions α can be:

Case where α is an output. We immediately have that Q 0 can perform α[ρ(a)], on the same channel and with the same handle. We now have to check our invariants for ta 0 .α [a]. Condition (a) is obviously preserved. Conditions (c 1 ) and (c 2 ) follow from the fact that association is not affected by the execution of an output: ρ(a) and ρ(a ′ ) are associated in (ta 0 .α[a])ρ if, and only if, they are associated in ta 0 ρ, and similarly without ρ. Finally, we shall prove (b):

is the resulting frame after the action α[a] (resp. α[aρ]). Applying Proposition 24 item (4) on the execution before renaming and Proposition 29 on the execution after renaming, one obtains

We finally conclude Φ ′ 0 ∼ Ψ ′ 0 using Proposition 28 on the execution on the right and then Proposition 27.

Case where α is a conditional. We first need to make sure that the outcome of the test is the same for a and aρ. We let τ x (resp. τ y ) be the action produced by evaluating the conditional

Mechanisation & Case Studies

Condition (i)

Condition (i) of well-authentication is basically a conjunction of reachability properties, which can be checked in ProVerif using correspondence properties [START_REF] Abadi | Computer-assisted verification of a protocol for certified email[END_REF]. For each role A ∈ {I, R}, we associate to each syntactical output (resp. input) of the role an event which uniquely identifies the action. More formally, we use events of the form OutA i (k, n, m) and InA j (k, n, m), whose arguments contain:

• identity parameters k and session parameters n;

• the message m that is inputted or outputted.

In the same fashion, we also add events of the form TestA k (k, n) at the beginning of each then branch.

For each conditional of the protocol, we first check if the simple syntactical definition of safe conditionals holds (see Definition 61). If it is the case we do nothing for this conditional.

Otherwise, we need to check condition (i) of well-authentication. It can be expressed as a correspondence property using events as explained next. Given a role A ∈ {I, R} and a conditional of this role whose event is TestA i (k, n), we express as a correspondence property the fact that if the conditional is positively evaluated, then the involved agent must be associated to a dual agent:

1. when the event TestA i (k, n) is fired, 2. there must be a previous event InA j (k, n, m) (InA j corresponding to the input just before the conditional), Moreover, when fn(I)∩fn(R) ̸ = ∅ (shared case), to reflect that duality also requires that identity parameters should be the same, we replace k ′ by k. Note that by using the same messages (m, m ′ , etc.) for corresponding inputs and outputs, we express that the messages that are outputted and inputted are equal modulo the equational theory E.

We show in Figure 10.2 the ProVerif query we produce for checking condition (i) on the first conditional of P I from our running example.

Practical application. In our tool, safe conditionals are not (yet) automatically identified. Actually, the tool lists all conditionals and tells which ones satisfy condition (i) of well-authentication. The user can thus easily get rid of the conditionals that he identifies as safe. Furthermore, the 10. Mechanisation & Case Studies using our method since, in our first attempt to model the protocol, we modelled sdec(•, •) as a destructor (that may fail) and the computation of G as an evaluation:

This test has to satisfy our requirement in order to declare the protocol well-authenticating. But this conditional computing G is not safe and does not satisfy the requirements of Definition 63 (the attack scenario described is a counter-example). The same attack scenario shows that the protocol does not ensure unlinkability (this scenario cannot be observed when interacting with S Π ). Similarly to the attack on LAK, we highlight here the importance to take the reader into account and give it as much importance as the tag in the definition of unlinkability. Indeed, it is actually a leakage from the reader that allows an attacker to trace a specific tag.

Second, we report on an attack 2 that we discovered using our method on some models of PACE found in the literature [START_REF] Bender | Security analysis of the PACE key-agreement protocol[END_REF], [START_REF] Bender | The PACE AA protocol for machine readable travel documents, and its security[END_REF],[CSD + 12]. Indeed, in all those papers, the first conditional of the reader let y test = neq(y 3 , dh(G, n ′ R )) in is omitted. Then the resulting protocol does not satisfy the well-authentication condition. To see this, we simply have to consider a scenario where the attacker will send to the reader the message it has outputted at the previous step. Such an execution will allow the reader to execute its role until the end, and therefore execute τ then , but the resulting trace is not an honest one. Again, this scenario can be turned into an attack against unlinkability as explained next. As before, an attacker could eavesdrop a first message c 0 = senc(s 0 T , k 0 ) of a certain tag T 0 . Then, in a future session, it would let the reader optically scan a tag T but replace its challenge senc(s T , k) by c 0 . Independently of whether k is equal to k 0 or not, the reader answers g nR . The attacker then plays the two rounds of Diffie-Hellman by reusing messages from the reader (he actually performs a reflection attack). More precisely, he replies with

The crucial point is that the attacker did not prove he knows k (whereas he is supposed to do so to generate G at step 4) thanks to the reflection attack that is not detected. Now, the attacker waits for the reader's answer. If it is positive (the process R ′ is executed), he learns that k = k 0 : the tag T is actually the same as T 0 . Third, we turn to PACE as properly understood from the official specification: when the latter test is present and the decryption may not fail. In that case, we report on a new attack. UKano found that the last test of the reader violates well-authentication. This is the case for the following scenario: the message senc(s T , k) sent by a tag T (k, n T ) is fed to two readers R(k, n 1 R ), R(k, n 2 R ) of same identity name. Then, the attacker just forwards messages from one reader to the other. They can thus complete the two rounds of Diffie-Hellman (note that the test avoiding reflection attacks holds). More importantly, the mac-key verification phase (messages 8 and 9 from Figure 10.4) goes well and the attacker observes that the last conditional of the two readers holds. This violates well-authentication but also unlinkability because the latter scenario 10.2. Case Studies the generated file, we successfully established well-authentitcation for this protocol in about 2 hours and 20 minutes.

To sum up, we were able to verify unlinkability of the ABCDH protocol with minor manual efforts in around 3 hours.

DAA Join & DAA Sign

A Trusted Platform Module (TPM) is a hardware device aiming at protecting cryptographic keys and at performing some cryptographic operations. Typically, a user may authenticate himself to a service provider relying on such a TPM. The main advantage is to physically separate the very sensitive data from the rest of the system. On the downside however, such devices may be used by malicious agents to breach users' privacy by exploiting their TPMs. Direct Anonymous Attestation (DAA) protocols have been designed to let TPMs authenticate themselves whilst providing accountability and privacy.

In a nutshell, some issuers issue credentials representing membership to a group to the TPM using group signatures via the DAA join sub-protocol. Those credentials are bound to the internal secret of the TPM that must remain unknown to the service provider. Then, when a TPM is willing to prove to a verifier its membership to a group, it uses the DAA sign subprotocol. We analysed the RSA-based DAA join and sign protocols as described in [START_REF] Smyth | Formal analysis of privacy in direct anonymous attestation schemes[END_REF]. Both protocols rely on complex cryptographic primitives (e.g. blind signature, commitments, and Zero Knowledge proofs) but ProVerif can deal with them all. Note that the authors of [START_REF] Smyth | Formal analysis of privacy in direct anonymous attestation schemes[END_REF] have automatically established a game-based version of unlinkability of the combination of DAA Join and DAA Sign using ProVerif. We have analysed both protocols separately since the combination of the two protocols is a 3-party protocol.

DAA Join

In the RSA-based DAA join protocol, the TPM starts by sending a credential request in the form of a commitment containing its internal secret, some session nonce and the public key of the issuer. The issuer then challenges the TPM with some fresh nonces encrypted asymmetrically with the public key of the TPM. After having received the expected TPM's answer, the issuer sends a new nonce as second challenge. To this second challenge, the TPM needs to provide a ZK proof bound to this challenge proving that he knows the internal secret on which the previous commitment was bound. Finally, after verifying this proof, the issuer blindly signs the commitment allowing the TPM to extract the required credential.

Mechanisation & Case Studies

We give in Figure 10.7 an Alice & Bob description of the protocol between the TPM and the issuer. The message zeta I = h((0, bsnI)) relies on bsnI: using a fresh bsnI allows to ensure that the session of DAA Join will be unlinkable from previous ones. The message tsk = h((DAAseed, h(pub I )), cnt, 0) combines the internal secret of the TPM (i.e. DAAseed) with the public key of the issuer (i.e. pub I ). The commit message N I = commit(zeta I , tsk) binds zeta I with the internal secret while the commit message U = clommit(pub I , n v , tsk) expresses a credential request. The goal of the TPM will be to get the message U signed by the issuer. More precisely, the issuer will blindly sign the message U after making sure that the TPM can decrypt challenges encrypted with its public key (step 2.) and that he can provide a fresh ZK proof showing he knows its internal secret binds in U and N I (step 5.). Finally, if all checks are successful, the issuer will blindly sign the credential request U (step 6.). We note clsign((e, v ′′ , U ), sk I ) the blind signature of a commitment U with signature key sk I and nonces e, v ′′ . Note that ZK(•, •) has two arguments: the first one should contain private data and the second one should contain public data. One can always extract public data from ZK proofs and one can check if both public and private data match as expected. This protocol falls in our class and lies in the shared case 4 (i.e. fn(I) ∩ fn(R) ̸ = ∅). We automatically analysed this protocol with UKano and established both frame opacity and wellauthentication in less than 5 seconds. frame opacity can be established using any heuristic implemented in UKano but the greedy heuristic allows one to obtain simpler idealised messages which yield better performance (2 seconds instead of 28 seconds for the fully syntactical heuristic).

DAA Sign

Once a TPM has obtained such a credential, it may prove its membership using the DAA sign protocol. This protocol is played by a TPM and a verifier: the verifier starts by challenging the TPM with a fresh nonce (step 1.), the latter then sends a complex ZK proof bound to this nonce (step 2.). The latter ZK proof also proves that the TPM knows a credential from the expected issuer bound to a secret he knows (essentially a message clsign((e, v ′′ , U ), sk I ) received in a previous session of DAA join). The verifier accepts only if the ZK can be successfully checked (step 3.).

We give in Figure 10.8 an Alice & Bob description of the protocol between a verifier and the TPM willing to sign a message m using its credential cred = clsign((e, v ′′ , U ), sk I ) he received from a past DAA join session. From its credential cred, the TPM will compute a new credential dedicated to the current sign session: cred ′ = clcommit((pub I , cred), n c ). Indeed, if the TPM had directly used cred then two sessions of DAA sign would have been trivially linkable.

Again, this protocol falls in our class and lies in the non shared case. Indeed, we model infinitely many different TPMs may take part to the DAA sign protocol with any verifier whose role is always the same (he has no proper identity). Using the canonical syntactical idealisation for frame opacity, we automatically established (using UKano) frame opacity and well-authentication and thus unlinkability in less than 3 seconds. Frame opacity can be automatically established using the fully syntactical heuristic but not using other heuristics (greedy and the default heuristic).

Summary

We now summarises our results in Table 10.1. We notably indicate the verification time in seconds to verify both conditions. When there is an attack, we give the time ProVerif takes to show that one of the condition fails to hold. We note for a condition automatically checked using our tool UKano and when the condition does not hold. Note that all positive results were established automatically using our tool UKano (which is based on ProVerif) without any manual effort (except for the cases indicated by * for which little manual efforts were needed).

Conclusion

We have identified two conditions, namely well-authentication and frame opacity, which imply anonymity and unlinkability for a wide class of protocols. Additionally, we have shown that these two conditions can be checked automatically using the tool ProVerif, and we have mechanised their verification in a tool called UKano. This yields a new verification technique to check anonymity and unlinkability for an unbounded number of sessions. It has proved quite effective on various case studies. In particular, it has brought first-time unlinkability proofs for the BAC protocol (e-passport) and ABCDH protocol. Our case studies also illustrated that our methodology is useful to discover attacks against unlinkability and anonymity as illustrated by the new attacks we found on PACE and LAK.

In the next section, we discuss limitations of the present technique and list main avenues for future work.

Regarding Mechanisation and the Tool UKano

We start with limitations and possible improvements for the practical aspects of our method. Optimising generated models. For complex protocols (e.g. PACE and ABCDH), UKano produces models for verifying our conditions that are rather large on which ProVerif may not terminate in reasonable time. While this was expected -the more complex the protocols are, the longer is the verification time -we think this effect could be diminished by optimising generated models. For instance, the manual modifications needed to make ProVerif terminate for PACE (Subsection 10.2.4) or for ABCDH (Subsection 10.2.5) are based on simple observations and could be mechanised in future versions of the tool UKano. We now discuss the two optimisations we needed to make ProVerif terminate in reasonable time.

First, when verifying well-authentication, one has to verify one query per conditional. Each query essentially states that if the underlying conditional holds for an agent then there must be a sequence of events modelling the fact that this agent is associated to another. For complex protocols, this sequence of events may be very long (e.g. 12 actions for ABCDH). However, it is possible Chapter 12

General Conclusion 12.1 Summary

When I started this thesis in 2013, several verification tools were already capable of analysing privacy-related properties. There were some recent decision procedures for a bounded number of sessions implemented in tools such as Apte, Akiss and Spec, and, pragmatic, yet highly efficient, semi-decision procedures for an unbounded number of sessions implemented e.g. in ProVerif and Tamarin. As shown throughout this thesis, having such (semi-)decision procedures is not enough.

The aim of this thesis is to bridge the gap between, on one hand, such (semi-)decision procedures and, on the other hand, actual, practical verification of privacy goals for security protocols. For each line of work, we have identified an important issue limiting its practical impact. We have addressed those issues separately.

In Part B, we have focused on the state space explosion problem of decision procedures for a bounded number of sessions. We have developed new partial order reduction techniques compatible with equivalence verification than can be nicely integrated in frameworks on which those procedures are based.

Part C has been dedicated to solving the precision issue of semi-decision procedures for an unbounded number of sessions. We have developed a new method for verifying unlinkability and anonymity that does not suffer from this precision issue. We think that the underlying methodology allows to shed some light on those privacy goals. We also hope to reuse this methodology in broader contexts.

For addressing both issues, we have proceeded back and forth between theory and practice. Practical aspects have motivated and guided our developments. But our solutions to the identified problems have required highly theoretical developments. Furthermore, we have been continuously checking the practical relevance of our solutions by putting them into practice on real-world case studies and by conducting benchmarks. Titre : Vérification automatique de la protection de la vie privée : entre théorie et pratique Mots clefs : Protocoles de sécurité, vérification, vie privée, méthodes formelles Résumé : Notre société de l'information s'appuie de façon cruciale sur notre capacité à échanger des données protégées par des protocoles cryptographiques. Étant donné leur prédominance et leur importance, il est important de garantir qu'ils accomplissent leurs objectifs, tels que la protection de la vie privée. Idéalement, ces garanties sont obtenues par des méthodes formelles qui, via leurs fondements mathématiques, permettent une analyse rigoureuse. Seulement, ces méthodes sont limitées par des problèmes de passage à l'échelle et de précision que nous nous proposons de résoudre dans cette thèse. Pour le premier problème, nous développons des méthodes de réduction d'ordre partiel pour réduire drastiquement l'espace d'exploration. Pour le second, nous proposons une nouvelle approche de vérification. Nous définissons deux propriétés facilement vérifiables qui impliquent la non-traçabilité et l'anonymat. Nous montrons l'impact pratique important de nos travaux via leur implémentation et leur application à des protocoles industriels menant à la découverte de nouvelles attaques et de preuves de sécurité.

Title : Automated Verification of Privacy in Security Protocols: Back and Forth Between Theory & Practice Keywords : Security Protocols, verification, privacy, formal methods Abstract : Our information society notably relies on secure information exchanges typically achieved by security protocols. Given, their ubiquitous and critical nature, we need guarantees that they meet their goals such as privacy properties. Ideally, those guarantees are established via formal methods providing mathematical frameworks to analyse security protocols. However, existing methods suffer from scalability and precision issues that the present thesis aims to address. First, to mitigate the scalability problem, we de-velop partial order reduction techniques enabling to dramatically reduce the search space to explore when analysing security protocols. Second, we solve a critical precision issue by adopting a privacy via sufficient conditions approach. We show that two well-designed and easily verifiable conditions always imply unlinkability and anonymity. We confirm the practical relevance of our contributions by implementing them and using them for analysing real-life security protocols, finding new attacks and establishing new proofs.