Gilles Barthe

David Pointcheval

Keywords: Security, cryptographic protocols, electronic voting, equivalence, type systems, privacy Résumé Sécurité, protocoles cryptographiques, vote électronique, équivalence, typage, secret du vote Helios Ballot Box Public Bulletin Board Tallying Authority Ballots Voters Result

In this thesis we study several aspects of the security of remote electronic voting protocols. Such protocols describe how to securely organise elections over the Internet. They notably aim to guarantee vote privacy -i.e., votes must remain secret -and verifiability -it must be possible to check that votes are correctly counted. Our contributions are on two aspects.

First, we propose a new approach to automatically prove equivalence properties in the symbolic model. Many privacy properties can be expressed as equivalence properties, such as in particular vote privacy, but also anonymity or unlinkability. Our approach relies on typing: we design a type system that can typecheck two protocols to prove their equivalence. We show that our type system soundly implies trace equivalence, both for bounded and unbounded numbers of sessions. We compare a prototype implementation of our typechecker with other existing tools for symbolic equivalence, on a variety of protocols from the literature. This case study shows that our procedure is much more efficient than most other tools -at the price of losing precision (our tool may fail to prove some equivalences).

Our second contribution is a study of the definitions of privacy and verifiability -more precisely, individual verifiability, a property that requires each voter to be able to check that their own vote is counted. We prove that, both in symbolic and computational models, privacy implies individual verifiability, contrary to intuition and related previous results that seem to indicate that these two properties are opposed. Our study also highlights a limitation of existing game-based definitions of privacy: they assume the ballot box is trusted, which makes for significantly weaker guarantees than what protocols aim for. Hence we propose a new game-based definition for vote privacy against a dishonest ballot box. We relate our definition to a simulation-based notion of privacy, to show that it provides meaningful guarantees, and conduct a case study on several voting schemes.

Introduction Introduction 1 Context

Electronic voting has been gaining more and more importance in recent years. Information technology is more and more prominent in all domains of society, and it is then natural to envisage applying it to facilitate organising elections. Electronic voting -the use of computers to organise elections -manifests itself in two main forms. First, voting machines that are installed at polling stations, and that voters use to cast their votes. Second, remote voting systems, where voters cast their votes from the Internet. In this thesis, we will be more concerned with that second category.

The advantages of electronic voting are clear: it makes elections much more practical to organise than paper voting. In particular, votes are much easier to gather and count: ballots can simply be sent over the Internet to a server controlled by the authorities, and then tallied by computers. This could help reduce the infrastructure required to hold elections or referendums. Electronic voting systems, both on-site and remote, have already been deployed in real elections, both on small and large scales, e.g. Internet voting to elect the members of parliament in Estonia and France (in the latter case only for citizens living abroad) or for referendums in Switzerland, voting machines for national elections in the United States or in Brazil, etc. But, as with any system that manipulates sensitive data, comes the problem of ensuring this data is securely handled. How can I be sure that the result announced by the election organisers is the right one? That my vote was properly counted, and not somehow removed from the ballot box? Can I be certain that my vote remains secret? That no one can learn in any way which candidate I voted for? Such questions have been discussed over centuries in the context of paper voting, and are typically considered crucial from the point of view of democracy. Indeed, what legitimacy would the winner have when there is no way to ensure they are the rightful winner? And how could I freely express my opinion by voting without fearing reprisal, if there was a risk that my vote could be revealed later on? Protocols To provide such guarantees, remote voting systems take the form of cryptographic protocols. These make use of cryptography (e.g. encryption, signatures, . . . ) to protect the votes, and describe precisely what cryptographic operations should be performed by each party (i.e. the voters, authorities. . . ). But it is now a well-known issue that cryptographic protocols are hard to get right -to make really secure. A major example is the TLS (Transport Layer Security) protocol. TLS aims to secure communications on the web. It notably provides authentication guarantees, so that users can be sure they are communicating with the server that they wanted to reach. It also aims to guarantee the confidentiality and integrity of communications: any data exchanged between a server and a client should remain secret from any other third party, and it should not be possible for such a third party to tamper with it. TLS was first proposed in 1999 [START_REF] Dierks | The TLS Protocol Version 1.0. RFC 2246[END_REF], and then updated and corrected many times, the latest version being published in 2018 [START_REF] Rescorla | The Transport Layer Security (TLS) Protocol Version 1.3[END_REF]: over time many vulnerabilities and attacks against each successive version have been found (e.g. Logjam [START_REF] Adrian | Imperfect forward secrecy: How Diffie-Hellman fails in practice[END_REF], POODLE [START_REF] Moller | This POODLE Bites: Exploiting The SSL 3.0 Fallback[END_REF], Triple Handshake [START_REF] Bhargavan | Triple handshakes and cookie cutters: Breaking and fixing authentication over tls[END_REF], . . . ), meaning that the protocol was never really secure.

Formal analysis Formal methods have proved to be a powerful tool to study the security of cryptographic protocols. Broadly speaking, they consist in designing mathematical models of the protocols, and of an adversary trying to attack them, as well as formal definitions for the security properties that should be guaranteed. The goal is then to prove formally that no adversary, in the chosen model, can make it so that the properties are violated. Over the last decades, they have been used to prove security or find attacks for many real-life protocols, such as the BAC (Basic Access Control) protocol used by RFID chips in biometric passports [START_REF] Arapinis | Analysing unlinkability and anonymity using the applied pi calculus[END_REF], the AKA (Authenticated Key Agreement) protocol used by mobile phones to connect to 3G/4G/5G networks [START_REF] Arapinis | New privacy issues in mobile telephony: fix and verification[END_REF][START_REF] Basin | A Formal Analysis of 5G Authentication[END_REF][START_REF] Koutsos | The 5G-AKA Authentication Protocol Privacy[END_REF], or the TLS protocol mentioned earlier [START_REF] Delignat-Lavaud | Implementing and proving the TLS 1.3 record layer[END_REF].

Let us look at an example of a voting protocol, to illustrate the kind of attacks they can be subject to, and how formal methods can help in that context.

Example: Helios

Description Helios is an electronic voting protocol that was first proposed in 2009 [START_REF] Adida | Helios: Web-based open-audit voting[END_REF]. Although it has not been deployed in large scale high-stake elections, it has been used in various smaller scale situations, such as the election of the president of the University of Louvain-la-Neuve [START_REF] Adida | Electing a university president using open-audit voting: Analysis of real-world use of helios[END_REF].

Among other properties, Helios aims to protect the privacy of voters, by keeping their votes secret. To that end, Helios makes use of asymmetric cryptography. Technical details regarding the cryptographic construction used are irrelevant here, we will only describe informally its behaviour. Basically, an election authority, composed of several trustees, jointly generate a pair of a public and a private key for the election. The public key is published, while the private key is split into several shares that are distributed among the trustees. These shares are generated in such a way that all of the trustees (or a certain threshold of them) need to agree in order to decrypt a message. This decreases the risk that the talliers misuse the key: only a fraction of them needs to be trusted. The public key will then be used by the voters to encrypt their votes, and the trustees must agree to jointly decrypt the ballots, and compute the result. For better clarity, we will from now on in our explanations refer to the group of trustees as a if it were a single authority, which we will call election authority or tallying authority, that is the only owner of the secret key sk, and uses it to decrypt the ballots. Fix Fortunately, this ballot copying attack can be quite easily prevented. It relies on the ability for Charlie to submit an exact copy of Alice's ballot to the ballot box. The ballot box could easily detect that the same ballot has already been submitted by Alice earlier, and reject it. This correction to the protocol was proposed by the authors in [START_REF] Cortier | Attacking and Fixing Helios: An Analysis of Ballot Secrecy[END_REF]: they call the operation of rejecting these duplicate ballots weeding. It at least prevents the attack: now when Charlie tries to submit b A in his own name to the ballot box, his attack is detected, and the ballot rejected. But is it actually sufficient to make Helios really secure? How can we know that there are no other ways of attacking the voters' privacy? This attack illustrates that even very simple flaws in a voting protocol are not at all obvious. This is where formal methods can help: by defining precisely what properties should be satisfied, we can formally verify that the protocols are secure.

In fact, as it turns out, performing weeding fails to prevent a similar attack discovered by Roenne, in a context where revote is allowed, i.e. when each voter can submit several ballots, of which only the last one will be counted. This second attack is as follows. The attacker Charlie could decide to not only eavesdrop, but also block Alice's ballot b A entirely -cutting her connection to the voting server. She will try to vote again, with a new ballot b A for the same candidate. As before, Charlie will submit b A under his own name. Even with weeding, the server will accept this ballot. Indeed, since b A was blocked when Alice tried to submit it, the server has never seen that ballot. Hence, the result will, as in the previous attack, contain two votes for Alice's choice, and Charlie will thus learn her vote.

Relations between properties

An interesting point to note regarding the properties of voting systems we described earlier is that vote privacy intuitively seems to be at odds with verifiability. Indeed, vote privacy basically requires that as little information as possible leaks regarding the votes. Of course, the result of the election itself intrinsically gives some indication of how voters voted in any reasonable voting scheme; but privacy would require that this inevitable leakage is the only information an attacker can obtain on the individual votes. On the other hand, if a protocol is to be verifiable, it must include some mechanisms that allow voters to check that their vote was taken into account. To perform this verification, the voters typically need some information to be published by the authorities in addition to the result of the election. This additional information risks leaking information about the votes, which would violate vote privacy. The intuition hence seems to indicate that the more a voting system is designed with verifiability in mind, the harder it will be for this system to also guarantee vote privacy.

In fact, this intuition has been formally proved by Chevallier-Mames, Fouque, Pointcheval, Stern and Traoré [START_REF] Chevallier-Mames | On some incompatible properties of voting schemes[END_REF]. They established that verifiability and unconditional privacy are incompatible. They consider a very strong notion of privacy, unconditional privacy, which requires that the votes remain perfectly secret even from an adversary that has unbounded computational power. However, no such result has been established in the case -usual for cryptographic protocols -of a polynomial adversary, such as is considered in all existing game-based definitions for vote privacy [START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF]. Still, following this intuition, official regulations and recommandations about electronic voting tend to favour one of the two properties over the other -for instance French recommandations only require vote privacy [START_REF]Délibération n o 2010-371 du 21 octobre 2010 portant adoption d'une recommandation relative à la sécurité des systèmes de vote électronique[END_REF], though newer recommandations also ask for transparency [START_REF]Délibération n o 2019-053 du 25 avril 2019 portant adoption d'une recommandation relative à la sécurité des systèmes de vote par correspondance électronique[END_REF], while Swiss law first requires privacy, and a level of verifiability that depends on the number of voters who vote online [START_REF]Ordonnance de la ChF sur le vote électronique (OVotE) du 13 décembre 2013[END_REF].

Formal analysis

To analyse a protocol w.r.t. the properties above, we need to design a formal model of both the protocol and the properties. We also need to specify against what kind of attacker they should hold. Several such models for security protocols have been proposed. They can mostly be sorted into two broad classes.

Symbolic models

The attack on Helios described above stems from a logical flaw in the specification of the protocol, rather than an attack on the cryptographic primitives used: it can be performed without breaking the cryptography. Symbolic models focus on such attacks: they consider an abstract and idealised model of cryptography. While the security of the real cryptographic primitives usually relies on computational hardness assumptions (e.g. factorisation or discrete logarithm), in symbolic models, the primitives are assumed to be perfect and unbreakable. For instance, an encryption primitive will be assumed not to leak any information regarding the plaintexts to anyone who does not know the correct decryption key. Primitives are typically represented as abstract function symbols, and the messages exchanged by the different parties are modelled as abstract terms constructed using these symbols. The properties of the cryptographic primitives, i.e. the computations that the protocol parties and the adversary can perform on these terms, are characterised as an equational theory, that is, a set of equations that define the behaviour of the primitives.

For instance, asymmetric encryption could be modelled using a symbol aenc, with arity 2, and a symbol pk, with arity 1: pk(k) represents the public key associated with private key k, and aenc(M, pk(k)) represents the asymmetric encryption of message M with that public key. An associated symbol adec can be used to represent the corresponding decryption operation: adec(M, k) represents the operation of decrypting message M with the private key k.

The behaviour of the primitive would then be modelled as the following equation, stating that decrypting a message with the correct key successfully returns the original plaintext: adec(aenc(M, pk(k)), k) = M This equational theory specifies that the only computation that can be performed on a ciphertext aenc(M, pk(k)) is to decrypt it using the key k. This models a perfect encryption primitive, that cannot be broken or leak information on the plaintext in any way to someone who does not have the decryption key.

Symbolic models typically consider an attacker that has complete control over the network, and can therefore intercept or block any messages sent by a protocol participant, and, within the limits allowed by the equational theory considered, use them to perform any computation, i.e. apply any function symbol to them to construct new terms. Finally the attacker has the ability to modify messages before their reach their destination, by replacing them with any term he can compute. This attacker model is usually called the Dolev-Yao attacker, as it was first considered by Dolev and Yao in 1983 [START_REF] Dolev | On the security of public key protocols[END_REF].

Different symbolic models exist to describe the behaviour of protocols against such an attacker. One of the most prominent approaches, and the one we choose in this thesis when considering a symbolic setting, is to model protocols as processes in a process algebra such as the pi-calculus, which is a common tool to model distributed programs. This idea first took the form of the spi-calculus that was proposed by Abadi and Gordon in 1997 [START_REF] Abadi | A calculus for cryptographic protocols: The spi calculus[END_REF]. Standard pi-calculus provides constructions to model processes running in parallel, and exchanging simple messages by inputting or outputting them on communication channels. The spi-calculus extends it with cryptographic primitives, modelled as terms as explained earlier. It was then generalised into the applied pi-calculus by Abadi and Fournet in [START_REF] Abadi | Mobile values, new names, and secure communication[END_REF], which, compared to the spi-calculus, further separates the equational theory from the process algebra. This makes it easier to state security properties independently of the equational theory considered. Among other approaches are most notably those based on multiset rewriting [START_REF] Cervesato | A Meta-Notation for Protocol Analysis[END_REF], where protocols are represented as rewrite rules, that describe the evolution of the state of participants and the knowledge of the attacker during the execution of the protocol. cryptographic games, where an adversary interacts with the protocol through oracles that run the algorithms modelling it, and is asked to try to break its security in a specific way. For instance, an indistinguishability property between two scenarios would be modelled by a game Exp β (λ), where the adversary interacts with one of the two possible scenarios, depending on a secret bit β. The adversary is then asked to guess this bit β, i.e. to determine which scenario is running, and his guess constitutes the result of the game. The advantage of the adversary is then the difference between the probabilities it guesses 1 when β = 0 and when β = 1:

Adv A (λ) = |P(Exp 0 (λ) = 1) -P(Exp 1 (λ) = 1)| Security is then defined by requiring that asymptotically (w.r.t. the security parameter λ), no adversary can do significantly better than random guessing. That is, that no adversary has a non-negligible advantage Adv A (λ) in that game.

As explained earlier, in the case of vote privacy, the two scenarios which the adversary tries to distinguish could for instance be two runs of the voting scheme, with the votes of two voters being exchanged: Exp 0 (λ) would then have Alice vote 0 and Bob 1, while Exp 1 (λ) would have Alice vote 1 and Bob 0. A more general formalisation would let the adversary himself choose which votes are used: the adversary would propose two votes v 0 , v 1 , and, depending on β, Alice would vote v 0 and Bob v 1 , or the other way around. Even more generally, in the formalisations we use in later chapters, the votes of more than just two voters can be swapped.

Such notions of security are typically proved by reduction: that is, by proving that breaking the security of the protocol entails breaking some security assumption on the underlying cryptographic primitives, which in turn breaks some underlying computational hardness assumption (e.g. RSA, factoring,. . . ).

Computational models are much more precise than symbolic models, as they do not rely on as strong abstractions, and make much weaker assumptions on the primitives. On the other hand, the abstractions and idealisations made by symbolic models allow for much easier automated verification, as we discuss in the next section. In some cases, however, it has been proved that with reasonable assumptions symbolic models can be computationally sound, in the sense that proving symbolic security implies computational security [START_REF] Abadi | Reconciling two views of cryptography[END_REF][START_REF] Cortier | Computationally sound symbolic secrecy in the presence of hash functions[END_REF][START_REF] Cortier | A survey of symbolic methods in computational analysis of cryptographic systems[END_REF]. Another recent approach that bridges the symbolic and computational worlds is the Bana-Comon model [START_REF] Bana | Towards unconditional soundness: Computationally complete symbolic attacker[END_REF]. It considers a symbolic representation of an attacker without restricting it to a fixed set of operations, contrary to usual symbolic models, which lets the model be computationally sound by construction, while allowing for symbolic reasoning.

Automated verification

Symbolic vs computational Manually proving the security of a given protocol, either in symbolic or computational models, tends to be rather tedious, even for simple examples, and is prone to errors that can be difficult to detect. A natural idea is then to design procedures and tools to automatically produce these proofs. As mentioned in the previous paragraph, computational models use a much thinner abstraction layer than symbolic models, which makes automated reasoning more difficult in these models. The only significant tools that allow to reason in a computational setting are CryptoVerif [START_REF] Blanchet | A computationally sound mechanized prover for security protocols[END_REF], that automates transformations between games, EasyCrypt [START_REF] Barthe | Computeraided security proofs for the working cryptographer[END_REF], that makes use of probabilistic relational Hoare logic, and F [START_REF] Swamy | Dependent types and multimonadic effects in F*[END_REF], a functional programming language that provides a rich type system to encode security properties. Only CryptoVerif is fully automatic, while EasyCrypt and F can rather be seen as interactive provers that assist the user in creating and verifying a proof.

ProVerif is correct, in the sense that when it declares a protocol secure, the property indeed holds. It is however not complete: it can in some cases not terminate, or find false attacks that do not disprove the property, due to the overapproximation it performs being too coarse. For example, ProVerif's overapproximation tends to treat all processes as if they were replicated, and hence is at risk to find false attacks when the security of a protocol relies on the fact that something happens only once. This can notably be the case when considering voting protocols that require that each voters votes at most once. The main other tool for the unbounded case is Tamarin [START_REF] Meier | The TAMARIN Prover for the Symbolic Analysis of Security Protocols[END_REF][START_REF] Basin | Automated Symbolic Proofs of Observational Equivalence[END_REF], which uses multiset rewriting rather than process algebras and Horn clauses, but, similarly to ProVerif, handles trace properties and diff-equivalence. Tamarin however is not fully automatic, but rather interactive: it allows the user to provide lemmas to guide the tool. This allows Tamarin to prove cases that would be difficult to handle automatically, but of course requires more work from the user.

On the other hand, when restricting the study to bounded numbers of sessions, several procedures have been designed recently, that decide protocol equivalence. One of the first such tools was SPEC [START_REF] Dawson | Automating open bisimulation checking for the spi calculus[END_REF], which proves a strong notion of equivalence (bisimulation) for a fixed signature of cryptographic primitives. More recent tools rather prove a weaker notion, called trace equivalence. APTE [START_REF] Cheval | APTE: an Algorithm for Proving Trace Equivalence[END_REF] decides trace equivalence, also for a fixed set of cryptographic primitives, but can handle more complex constructions such as else-branches. Akiss [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocols[END_REF] uses Horn clauses, and can handle user-provided primitives and equational theories (within a large class that captures most usual primitives). More recently, Deepsec [START_REF] Cheval | DEEPSEC: Deciding Equivalence Properties in Security Protocols -Theory and Practice[END_REF] can, as Akiss, handle user-specified equational theories and complex constructions (such as else branches, private channels). It is much more efficient than previous tools -it was designed to establish an upperbound on the complexity of the problem of deciding equivalence, as part of a proof that the problem is coNEXP-complete. An advantage of both Akiss and Deepsec is that they can take advantage of parallelisation to speed up verification. Finally, SAT-Equiv [START_REF] Cortier | SAT-Equiv: an efficient tool for equivalence properties[END_REF] can handle a fixed equational theory (that contains most usual primitives), and reduces equivalence to a graph planning problem. It is very efficient, but however imposes some restrictions on the protocols considered -it requires a well-typedness property, and as a result tags may need to be added to messages when encoding the protocol. All of these tools share the common issue that they to some extent work by considering all possible executions of the processes considered, which must be done to decide equivalence: they therefore tend to suffer, to different degrees, from efficiency issues when considering processes that involve a large numbers of parallel branches.

Typing Type systems are a common tool from the domain of Programming Languages, that are used to statically enforce safety properties such as the absence of runtime errors in programs. A simple use of types is to describe the nature of the values considered, with types such as int, string, bool and so on. Programs are then checked using type systems containing rules such as the following (very simple) example, that states that the product of two integers is also an integer:

x : int y : int x * y : int Type systems can be seen as overapproximating the possible behaviours of programs, by abstracting the values into their types. The advantage of such an approach is that it provides efficient (but of course incomplete) ways of proving properties that would be undecidable in general.

Type systems can also be used to prove much stronger properties in the context of security. They have been applied in particular to the verification of trace properties such as authentication

Contributions

or secrecy properties [START_REF] Gordon | Authenticity by typing for security protocols[END_REF][START_REF] Bugliesi | Authenticity by tagging and typing[END_REF][START_REF] Focardi | Formal Models and Techniques for Analyzing Security Protocols[END_REF]. In such a case, one could for instance tag the values that should not be published with a type secret and values that may safely be published with a type public. The following simple typing rule would then indicate that the encryption of a secret message does not leak any secret information, and is thus safe to publish, provided that the key used is secret:

x : secret k : secret enc(x, k) : public

One would then typecheck the whole protocol to ensure that all messages that can ever be output to the network can be given type public.

We have already evoked F [START_REF] Swamy | Dependent types and multimonadic effects in F*[END_REF]. It, as well as its relational extension rF [START_REF] Barthe | Probabilistic relational verification for cryptographic implementations[END_REF], relies on a rich type system with dependent and refinement types: types that contain logical formulas, which can encode complex conditions on the values they are given to. Contrary to the approach described above, its type system is not specifically dedicated to security protocols, but instead allows to manually write logical formulas, that can encode very complex properties such as cryptographic games. Typechecking thus produces complex proof obligations, that are discharged by F to a SAT-solver. Such techniques have been used to produce verified implementations of very large and complex protocols such as TLS [START_REF] Delignat-Lavaud | Implementing and proving the TLS 1.3 record layer[END_REF]. However, a downside of such complex types is that although the typechecking itself is automated, highly non-trivial work is required from the user to come up with the correct types that will allows proofs to go through.

Contributions

This thesis brings several contributions to the domain of formal analysis of electronic voting protocols, on two main aspects:

• first, the automated verification of symbolic equivalence properties such as vote privacy, with the design of a type system for equivalence;

• second, a study of the notions of privacy and verifiability, that leads to the surprising result that privacy in fact implies individual verifiability, and to the design of a new game-based definition of privacy, that allows to consider a dishonest ballot box.

This section presents these contributions more in detail, and briefly describes other work performed during my PhD, that I chose not to present in this thesis.

A type system for symbolic equivalence

We propose a new approach to the problem of automated proofs of equivalence properties, that makes use of type systems. As explained earlier, these have been applied to the case of trace properties such as reachability/secrecy properties. The difficulty is that such techniques typically overapproximate the set of possible executions of a protocol by abstracting the messages into their types. They can then ensure that some "bad" state (e.g. where the attacker learns a secret) can never be reached, by proving the stronger statement that such a state is never reached by the overapproximated set of executions. However, this would not be a sound way of doing things for equivalence. Even if the overapproximations of two processes P and Q are equivalent, it could be that some specific behaviours are actually possible in P but not in Q, which would make P and Q not equivalent, but might be missed due to the approximation. Instead, we design a type system that can typecheck two processes P and Q together, to ensure that they have the same behaviours, and we use the types to establish invariants regarding the messages stored in variables by these processes. While typechecking, our type system collects all output messages (or in fact, subterms of these messages) into what we call a constraint. Some additional checks on this constraint ensure that not only P and Q have similar behaviours, but also the messages an attacker can observe in corresponding executions of the two processes are indistinguishable. Our type system handles a fixed signature of cryptographic primitives that includes most usual ones. We prove that our type system soundly implies symbolic equivalence, even when considering processes with a mix of replicated (i.e. executed an unbounded number of times) and nonreplicated parts.

We also implemented, in collaboration with Niklas Grimm, a prototype of our type-checking procedure, which we apply to several examples of protocols from the literature (e.g. key exchange protocols), in order to compare its performance to that of the other automatic tools for symbolic equivalence listed earlier. This benchmark shows that for bounded numbers of sessions, our approach is very efficient, and suffers much less than the other tools from large numbers of sessions/parallel branches. In the unbounded case, our approach can handle a mix of replicated and non-replicated processes. Our overapproximation is more precise than ProVerif's in such cases, and can leverage the fact that some part of the processes can only be executed once. This flexibility notably allows us to prove vote privacy for Helios, for which ProVerif cannot conclude. Indeed, as previously evoked, Roenne's attack implies that the property only holds if voters only vote once, which causes ProVerif to find false attacks. In exchange, our prototype requires light type annotations to be provided by hand by the user, and is less general w.r.t. the equational theory considered than ProVerif.

Privacy and verifiability

We study the definitions of vote privacy and verifiability, and establish that, surprisingly, privacy implies individual verifiability. This result, while counterintuitive, does not contradict the previous result from [START_REF] Chevallier-Mames | On some incompatible properties of voting schemes[END_REF], as we consider established definitions with a polynomial adversary, rather than an unbounded one. Let us explain the basic intuition of our result. Consider a voting system that is not verifiable at all, i.e. where an adversary can somehow prevent the vote of any voter of his choice from being counted, without being detected. In such a system, an adversary trying to learn my vote could simply block all other voters' votes: the result itself would then count only my vote, and therefore reveal it. That attack would of course only work only in such an extremely non-verifiable case: we show how to generalise this intuition to produce an attack on privacy from any attack on individual verifiability. We conduct our proof in both symbolic and computational models, two very different settings, to further show that this implication is not an artefact from the chosen model, but an intrinsic property of the notions of privacy and verifiability. An important aspect of our result, that perhaps explains why it is counter-intuitive, is that it holds when considering the same trust assumptions w.r.t. the election authorities for both privacy and verifiability. In existing work however, verifiability is usually studied against an attacker that controls the ballot box, while privacy notions typically implicitly assume the ballot box to be trusted.

Privacy against a dishonest ballot box

This last remark highlights a limitation of existing (game-based) definitions for vote privacy: they implicitly consider a trusted ballot box, while voting systems typically aim at protecting voters from a dishonest ballot box. A similar observation was made in [START_REF] Culnane | A Peered Bulletin Board for Robust Use in Verifiable Voting Systems[END_REF][START_REF] Bernhard | Ballot secrecy with malicious bulletin boards[END_REF]. This leads to the last main contribution presented in this thesis: the design of a definition for privacy against a dishonest ballot box, in a computational setting. Our notion is based on BPRIV, a state-of-the-art notion of vote privacy against a honest ballot box, first introduced in [START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF]. Designing a meaningful definition when the ballot box is

Outline

untrusted is made noticeably difficult by the attack described in the previous paragraph. An adversary that controls the ballot box can always remove ballots from it, which leads to the result giving out more information than it should about the remaining ones. This trivially violates the naïve privacy notion that requires that no matter what, the adversary cannot gain information about the votes. We present a way of defining a slightly weaker privacy notion, which does not consider the behaviour above an attack, but still provide meaningful guarantees. More precisely, we show that our notion is stil sufficiently robust, in the sense that it implies a simulation-based notion of vote privacy. This simulation-based property states that the voting system securely implements an ideal functionality, which makes clear what power an adversary can have against the system. We then apply our privacy notion to a few voting protocols from the literature, namely Helios [START_REF] Adida | Helios: Web-based open-audit voting[END_REF], Belenios [START_REF] Cortier | Belenios: a simple private and verifiable electronic voting system[END_REF] and Civitas [START_REF] Clarkson | Civitas: Toward a secure voting system[END_REF], to illustrate that it allows for a more precise characterisation of the level of privacy they offer.

BeleniosVS During my PhD, I also worked on the design and proof of the BeleniosVS voting protocol [START_REF] Cortier | BeleniosVS: Secrecy and Verifiability against a Corrupted Voting Device[END_REF]. BeleniosVS is an extension of Belenios [START_REF] Cortier | Belenios: a simple private and verifiable electronic voting system[END_REF] and BeleniosRF [START_REF] Chaidos | BeleniosRF: A non-interactive receipt-free electronic voting scheme[END_REF], which makes use of Voting Sheets, i.e. sheets containing pre-encrypted ballots that are distributed to voters. Voters cast their vote by scanning the ballot of their choice from their sheet on the device they use to participate in the election, rather than by having that device encrypt the vote itself. This way, the device never has access to the vote in clear, which allows the system to guarantee vote privacy to voters without requiring them to trust their device. I participated in proving that BeleniosVS guarantees privacy, verifiability, and receipt-freeness properties. I chose not to present this work in this thesis. QUIC Finally, an internship at Microsoft Research in Cambridge gave me the opportunity to participate in the verification of the QUIC protocol. QUIC is a new protocol originally proposed by Google and currently being standardised by IETF. It provides a similar functionality as TLS, but relies on the network protocol UDP, while TLS relies on TCP. In particular, this allows QUIC to receive and decrypt data packets out of order, without having to wait for previous packets to arrive, which allows for lower latency and better performance. I participated in developing a security model of the QUIC packet construction in F , and discovering a slight vulnerability in the way some header data in the packets are protected. This work is still under development, and will also not be presented in this thesis.

Outline

The thesis is organised into two parts of three chapters each, the first being dedicated to the type system for protocol equivalence, and the second to the study of privacy and verifiability definitions.

• Chapter 1 introduces the rather standard symbolic model we use, and the formal definition of the trace equivalence notion we consider.

• Chapter 2 presents the type system for equivalence as well as the attached procedure for constraints, and the proof of their soundness for both bounded and unbounded numbers of sessions.

• In Chapter 3 we conduct a case study by detailing the application of our type system to two relevant examples of protocols (Helios and Private Authentication). We also present the experimental results of our prototype implementation.

• Chapter 4 presents our result that vote privacy implies individual verifiability in a symbolic model.

• Chapter 5 details the same result in a computational model.

• In Chapter 6, finally, we expose our new definition for vote privacy against a dishonest ballot box, prove that it implies a simulation-based notion of privacy, and study its properties, notably applying it to real examples of voting protocols.

Related publications

The work on the type system for equivalence detailed in Part I has been published in two articles [START_REF] Cortier | A Type System for Privacy Properties[END_REF] and [START_REF] Cortier | Equivalence properties by typing in cryptographic branching protocols[END_REF], presented respectively at the conferences CCS'17 (ACM Conference on Computer and Communications Security) and POST'18 (Principles of Security and Trust). These two articles were written in collaboration with Véronique Cortier, Niklas Grimm and Matteo Maffei. The work on privacy and verifiability (Chapters 4 and 5) has been published in an article [START_REF] Cortier | Voting: You Can't Have Privacy without Individual Verifiability[END_REF] presented at the CCS'18 conference.

The work on BeleniosVS, not detailed in this thesis, was published in an article [START_REF] Cortier | BeleniosVS: Secrecy and Verifiability against a Corrupted Voting Device[END_REF] presented at the CSF'19 (IEEE symposium on Computer Security Foundations).

In addition, the source code for the implementation of the typechecker, the example files for the benchmark, as well as the scripts used to generate the graphs featured in Chapter 6 are available at [1].

Part I A Type System for Equivalence

Introduction to Part I

Formal methods proved to be indispensable tools for the analysis of advanced cryptographic protocols. As explained in introduction, mature push-button analysis tools have emerged and have been successfully applied to many protocols from the literature in the context of trace properties such as authentication or confidentiality. A current and very active topic is the adaptation of these techniques to the more involved case of trace equivalence properties. These are the natural symbolic counterpart of cryptographic indistinguishability properties, and they are at the heart of many privacy properties.

For instance, consider an electronic voting protocol, such as Helios evoked in introduction, involving a part V oter (id, v) run by voter id who wishes to vote for candidate v, and a part representing the server's role S. This scheme preserves secrecy of the vote if an attacker cannot know who voted for which candidate. That is, the attacker should not be able to distinguish an execution where Alice votes for 0 and Bob for 1 from an execution where Alice votes for 1 and Bob for 0. This can be expressed by the equivalence Voter(Alice, 0)|Voter(Bob, 1)|S ≈ t Voter(Alice, 1)|Voter(Bob, 0)|S.

Another example of an application of equivalence properties is unlinkability. Consider for instance the case of RFID protocols, that typically involve an RFID tag and a reader, and aim to let the tag authenticate the reader. These are for instance used by electronic passports, or contactless cards for public transportation. A basic requirement of such protocols is that they should correctly ensure authentication. They should also preserve the secrecy of data stored on the tag (e.g. keys, . . . ). These requirements are trace properties. However, they do not cover all security guarantees one might want for RFID tags. A potential issue of these protocols is that, if not designed carefully, they might allow an attacker to track a user, i.e. to recognise and identify them by simply interacting with their tag. To prevent such privacy breaches, a protocol must satisfy unlinkability: an attacker should not be able to link different sessions of the protocol to the same user. Consider a protocol Reader(k)|Tag(k), in which a reader is communicating with a tag with which it shares a secret key k. Unlinkability can be expressed (adapting the formalisation proposed in [START_REF] Arapinis | Untraceability in the applied pi calculus[END_REF]) as the equivalence

Reader(k Alice ) | Tag(k Alice ) | Reader(k Alice ) | Tag(k Alice ) ≈ t Reader(k Alice ) | Tag(k Alice ) | Reader(k Bob ) | Tag(k Bob )
requiring that the attacker cannot determine whether he sees the same tag (belonging to Alice) twice, or two different tags (belonging to Alice and Bob respectively).

In addition to vote privacy and unlinkability, trace equivalence is used to express many privacy properties, such as differential privacy [START_REF] Eigner | Differential privacy by typing in security protocols[END_REF], or anonymity [START_REF] Abadi | Private authentication[END_REF][START_REF] Arapinis | Analysing unlinkability and anonymity using the applied pi calculus[END_REF].

Related work

As we detailed in introduction, several tools and procedures have been proposed in recent years to automatically verify equivalence properties in the symbolic model. As the problem is undecidable when considering an unbounded number of sessions of protocols [START_REF] Chrétien | From security protocols to pushdown automata[END_REF], these tools use one of two approaches. Either they restrict themselves to bounded numbers of sessions only, in which case the problem becomes decidable, or they handle the unbounded case, at the cost of being incomplete -typically relying on overapproximations and heuristics to prove equivalence, with no termination guarantees.

Tools that decide equivalence in the bounded case notably encompass SPEC [START_REF] Dawson | Automating open bisimulation checking for the spi calculus[END_REF], APTE [START_REF] Cheval | APTE: an Algorithm for Proving Trace Equivalence[END_REF][START_REF] Baelde | Partial order reduction for security protocols[END_REF], Akiss [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocols[END_REF], and more recently Deepsec [START_REF] Cheval | DEEPSEC: Deciding Equivalence Properties in Security Protocols -Theory and Practice[END_REF] and SAT-Equiv [START_REF] Cortier | SAT-Equiv: an efficient tool for equivalence properties[END_REF]. These tools vary in the class of cryptographic primitives and of protocols they can consider. However, as they decide the problem of equivalence, due to its complexity -it is coNEXP-complete [START_REF] Cheval | DEEPSEC: Deciding Equivalence Properties in Security Protocols -Theory and Practice[END_REF] -they all tend to suffer from the state explosion problem. Most of the older tools can typically not analyse more than a few sessions of even relatively small protocols. The more recent tools -SAT-Equiv and Deepsec -are more efficient and depending on the protocol considered may go a bit further, but they still inevitably suffer when considering large numbers of sessions.

The only tools that can verify equivalence properties for an unbounded number of sessions are ProVerif [START_REF] Blanchet | Automated verification of selected equivalences for security protocols[END_REF], Maude-NPA [START_REF] Santiago | A Formal Definition of Protocol Indistinguishability and Its Verification Using Maude-NPA[END_REF], and Tamarin [START_REF] Basin | Automated Symbolic Proofs of Observational Equivalence[END_REF]. ProVerif checks a property that is stronger than trace equivalence, namely diff-equivalence, which works well in practice provided that protocols have a similar structure. However, as for trace properties, the internal design of ProVerif, that relies on translating the protocols to a set of Horn clauses, renders the tool unable to distinguish between exactly one session and infinitely many. This overapproximation often yields false attacks, in particular when the security of a protocol relies on the fact that some action is only performed once. Maude-NPA also checks diff-equivalence but often does not terminate. Tamarin, based on multiset rewriting, can handle an unbounded number of sessions and is very flexible in terms of supported protocol classes but it often requires human interactions.

Contribution

In this part, we consider a novel type checking-based approach. Several sound type systems have successfully been developed for proving trace properties (e.g. [START_REF] Gordon | Authenticity by typing for security protocols[END_REF][START_REF] Bugliesi | Authenticity by tagging and typing[END_REF][START_REF] Bugliesi | Analysis of typed analyses of authentication protocols[END_REF]). One advantage is that a few typing annotations often suffice to convey the reasons why a protocol is secure. Intuitively, a type system over-approximates protocol behaviour. Due to this over-approximation, it is no longer possible to decide security properties but the types typically convey sufficient information to prove security. Extending this approach to equivalence properties is a delicate task. Indeed, two protocols P and Q are in equivalence if (roughly) any trace of P has an equivalent trace in Q (and conversely). Overapproximating behaviours may not preserve equivalence.

Instead, we develop a somewhat hybrid approach: we design a type system to overapproximate the set of possible traces and we collect the set of sent messages into constraints. We then propose a procedure for proving (static) equivalence of the constraints. These do not only contain sent messages but also reflect internal checks made by the protocols, which is crucial to guarantee that whenever a message is accepted by P , it is also accepted by Q (and conversely).

After introducing our symbolic model, as well as the relevant notions and properties in Chapter 1, we present our type system in detail in Chapter 2. We show that our type system soundly proves equivalence of protocols for both a bounded and an unbounded number of sessions, or a mix of both. This is particularly convenient to analyse systems where some actions are limited (e.g., no revote, or limited access to some resource). More specifically, we show that whenever two protocols P and Q are type-checked to be equivalent, then they are in trace equivalence, for the standard notion of trace equivalence [START_REF] Boreale | Proof techniques for cryptographic processes[END_REF], against a full Dolev-Yao attacker.

In particular, one advantage of our approach is that it proves security directly in a security model that is similar to the ones used by the other popular tools, in contrast to many other security proofs based on type systems. Our result holds for protocols with all standard primitives (symmetric and asymmetric encryption, signatures, pairs, hash), with atomic keys (that can be fresh or long-term keys) and no private channels. Similarly to ProVerif, we need the two protocols P and Q to have a rather similar structure.

In Chapter 3, we present a case study, where we use our type system to prove vote privacy for Helios, and anonymity for the Private Authentication protocol. In addition, in collaboration with Niklas Grimm, we designed a prototype implementation of our type system. We evaluate its performance on several protocols of the literature. In the case of a bounded number of sessions, our tool provides a significant speed-up compared to most other tools. To be fair, let us emphasise that these tools can decide equivalence while our tool checks sufficient conditions by the means of our type system. In the case of an unbounded number of sessions, the performance of our prototype tool is comparable to ProVerif. In contrast to ProVerif, our tool can consider a mix of bounded and unbounded number of sessions. As an application, we can prove for the first time ballot privacy of the well-known Helios e-voting protocol [START_REF] Adida | Helios: Web-based open-audit voting[END_REF], without assuming a reliable channel between honest voters and the ballot box. ProVerif fails in this case as ballot privacy only holds under the assumption that honest voters vote at most once, otherwise the protocol is subject to a copy attack [START_REF] Roenne | [END_REF]. For similar reasons, Tamarin also fails to verify this protocol.

Related publications

The three chapters in this part are based on two articles [START_REF] Cortier | A Type System for Privacy Properties[END_REF] and [START_REF] Cortier | Equivalence properties by typing in cryptographic branching protocols[END_REF], published respectively at the conferences CCS'17 (ACM Conference on Computer and Communications Security) and POST'18 (Principles of Security and Trust). These two articles were written in collaboration with Véronique Cortier, Niklas Grimm and Matteo Maffei.

Chapter 1

Preliminaries: Symbolic Model and Pi-calculus

Introduction

In this chapter, we present the syntax and semantics of the symbolic model we consider. Typically, in such models, cryptographic operations are idealised and represented by abstract function symbols. Messages are then constructed using these abstract cryptographic primitives. The abilities of the attacker, i.e. what he can compute given a set of messages using the properties of the primitives, are modelled as a rewriting system on messages. Security protocols are then modelled as processes of a process algebra, such as the applied pi-calculus [START_REF] Abadi | Mobile values, new names, and secure communication[END_REF]. We present here a calculus close to [START_REF] Cheval | Lengths may break privacy -or how to check for equivalences with length[END_REF] inspired from the calculus underlying the ProVerif tool [START_REF] Blanchet | Modeling and verifying security protocols with the applied pi calculus and ProVerif[END_REF].

Messages and Terms

Messages are modelled as terms built over a signature of abstract cryptographic primitives. Formally, we consider an infinite set of names N for nonces, which are used to model random values generated during an execution of the protocol. We also assume an infinite set of variable names V.

Cryptographic primitives are modelled through a signature F, that is, a set of function symbols, given with their arity (i.e. the number of arguments).

Given a signature F, a set of names N , and a set of variables V, the set of terms T (F, V, N ) is the set inductively defined by applying functions to variables in V and names in N . That is, the smallest set that

• contains V and N : V ∪ N ⊆ T (F, V, N );

• and is closed under application of function symbols in F: ∀f ∈ F with arity n. ∀t 1 , . . . , t n ∈ T (F, V, N ). f (t 1 , . . . , t n ) ∈ T (F, V, N ).

A substitution σ = {M 1 /x 1 , . . . , M k /x k } is a mapping from variables x 1 , . . . , x k ∈ V to messages M 1 , . . . , M k . We let dom(σ) = {x 1 , . . . , x k }. We say that σ is ground if all messages M 1 , . . . , M k are ground. We let names(σ) = 1≤i≤k names(M i ). The application of a substitution σ to a term t is denoted tσ. Intuitively, applying σ to a term t is the operation of replacing each occurrence of a variable x ∈ dom(σ) in t with the message σ(x). Formally, this operation is defined inductively as follows.

∀n ∈ N . nσ = n ∀x ∈ V. xσ = σ(x) if x ∈ dom(σ)
x otherwise ∀f ∈ F with arity n. ∀t 1 , . . . , t n ∈ T (F, V, N ). f (t 1 , . . . , t n )σ = f (t 1 σ, . . . , t n σ)

In the following, we will consider the signature:

F c = {pk/1, vk/1, enc/2, aenc/2, sign/2, •, • /2, h/2}
whose function symbols model respectively public and verification keys, symmetric and asymmetric encryption, concatenation and hash. The companion primitives (symmetric and asymmetric decryption, signature check, and projections) are represented by the following signature:

F d = {dec/2, adec/2, checksign/2, π 1 /1, π 2 /1}
We also consider a set C of public constants, i.e. function symbols of arity 0, used as agent names for instance. We assume the set N of names is partitioned into the set FN of free nonces, intended to represent nonces created by the attacker, and the set BN of bound nonces, used to represent nonces created by the protocol parties. We similarly consider an infinite set of names K for keys, split into sets FK and BK, that represent keys generated respectively by the attacker, and by protocol parties. Finally we assume the set of variables to be split into two subsets V = X AX where X are variables used in processes while AX are variables used by the attacker to store messages.

For any term t, we denote by names(t) (resp. keys(t), vars(t)) the set of names (resp. keys, variables) occurring in t. A term is ground if it does not contain variables.

We consider the set T (F c ∪ F d ∪ C, V, N ∪ K) of cryptographic terms, simply called terms. Messages are terms containing only constructors, i.e. from T (F c ∪ C, V, N ∪ K).

An attacker term, is a term from T (F c ∪ F d ∪ C, AX , FN ∪ FK). In particular, an attacker term cannot use nonces and keys created by the protocol's parties.

Example 1. For instance, the following terms M and N are messages that represent the encryption of respectively a name n ∈ N and a variable x ∈ X with a key k ∈ BK:

M = enc(n, k), N = enc(x, k).
M is ground, while N is not. We have names(M ) = {n}, names(N ) = ∅, and keys(M ) = keys(N ) = {k}.

The following term R is an attacker term that represents the attacker attempting to decrypt a message he has stored in a variable y ∈ AX with a key stored in a variable z ∈ AX : R = dec(y, z) Note that attacker terms cannot contain keys in BK: intuitively the attacker does not know a priori any key used by the protocol agents. To decrypt a message with a key, as in R, he thus needs to have obtained and stored that key in one of his variables.

The evaluation of a term t, denoted t↓, corresponds to the bottom-up application of the cryptographic primitives. Basically, destructors are applied when possible: e.g. decrypting an encrypted message with the correct key returns the plaintext. For instance, dec(enc(0, k), k), where k is a key, evaluates to 0. When a destructor is present but cannot be applied, the evaluation fails. For instance, trying to decrypt a ciphertext with the wrong key fails: dec(enc(0, k), k ), where k = k are two different keys, fails and evaluates to ⊥. In addition, evaluation enforces that the keys used are always atomic, i.e. elements of K, rather than constructed from other messages. Evaluating a message where a non-atomic key is used, e.g. enc(0, k, k ) where a pair composed of two keys is used as an encryption key, will fail, and yield ⊥.

Formally, t↓ for a term t is recursively defined as follows. Note in particular that this evaluation operation models encryption algorithms that are length-hiding: the only computation that can be performed on a ciphertext is to decrypt it with the decryption key. Hence, from a ciphertext, an adversary cannot recover any information on the length of the plaintext. Additionally, the asymmetric encryption operation described by the model is anonymous, in the sense that a ciphertext reveals no information on the public key used to produce it.

u↓ = u if u ∈ N ∪ V ∪ K ∪ C pk(t)↓ = pk(t↓) if t↓∈ K vk(t)↓ = vk(t↓) if t↓∈ K h(t)↓ = h(t↓) if t↓ = ⊥ t 1 , t 2 ↓ = t 1 ↓, t 2 ↓ if t 1 ↓ = ⊥ and t 2 ↓ = ⊥ enc(t 1 , t 2 )↓ = enc(t 1 ↓, t 2 ↓) if t 1 ↓ = ⊥ and t 2 ↓∈ K sign(t 1 , t 2 )↓ = sign(t 1 ↓, t 2 ↓) if t 1 ↓ = ⊥ and t 2 ↓∈ K aenc(t 1 , t 2 )↓ = aenc(t 1 ↓, t 2 ↓) if t 1 ↓ = ⊥ and t 2 ↓= pk(k) for some k ∈ K π 1 (t)↓ = t 1 if t↓= t 1 , t 2 π 2 (t)↓ = t 2 if t↓=
Also note that the evaluation of term t succeeds only if all underlying keys are atomic, even when these keys would disappear from the final message during evaluation. For example, while dec(enc(0, k), k)↓= 0, we have dec(enc(0, k, k ), k, k )↓= ⊥, because the message k, k is not an atomic key, even though it disappears during the evaluation.

We write t = ↓ t if t↓= t ↓.

Processes and Semantics

Security protocols describe how messages should be exchanged between participants. We model them through a process algebra, whose syntax is displayed in Fig. 1.1. We identify processes up to α-renaming, which is defined as usual. To avoid capture of bound variables and names, we then assume that all bound names, keys, and variables in the process have been renamed so that they are all are distinct.

A configuration of the system is a tuple (P; φ; σ) where:

• P is a multiset of processes that represents the current active processes.

Destructors used in processes:

d ::= dec(x, t) | adec(x, t) | checksign(x, t ) | π 1 (x) | π 2 (x)
where x ∈ X , t ∈ K ∪ X , t ∈ {vk(k)|k ∈ K} ∪ X .

Processes: P, Q ::= 0 | new n.P | out(M ).P | in(x).P

| (P | Q) | let x = d in P else Q | if M = N then P else Q | !P
where n ∈ BN ∪ BK, x ∈ X , and M, N are messages. • φ is a substitution with dom(φ) ⊆ AX and for any x ∈ dom(φ), φ(x) (also denoted xφ) is a message that only contains variables in dom(σ). φ represents the terms that have been sent on the network by the processes.

• σ is a ground substitution, that contains the messages with which variables in the processes are instantiated in the current execution.

The semantics of processes is given through a transition relation α -→ on configurations, defined in Figure 1.2. α is the action associated to the transition. This action represents what an attacker can observe when the transition is executed. It can be • τ , which denotes a silent action, i.e. a transition where the attacker cannot observe anything;

• in(R), which denotes that the attacker provides as input to the process a message constructed by applying an attacker term R, called the recipe, to the frame of messages previously output;

• or new ax.out(ax), which denotes that a message is output to the attacker by the process, and stored in variable ax in the frame.

The relation w --→ * is defined as the reflexive transitive closure of α -→, where w is the concatenation of all actions. We also write equality up to silent actions = τ .

Intuitively, process new n.P creates a fresh nonce or key, and behaves like P . Process out(M ).P emits M and behaves like P , provided that the evaluation of M is successful. The corresponding message is stored in the substitution φ, corresponding to the attacker knowledge. The attacker controls the communication between processes, in the sense that a process may input any message that the attacker can forge (rule In). More precisely, the attacker uses a recipe R to compute a new message from his knowledge φ. Note that all names, except the attacker names FN , are initially assumed to be secret, and similarly for keys. Process P | Q corresponds to the parallel composition of P and Q. Process let x = d in P else Q behaves like P in which x is replaced by d if d can be successfully evaluated, and behaves like Q otherwise. -----------→({P } ∪ P; φ ∪ {t/ax n }; σ) Out if tσ is a ground term, (tσ)↓ = ⊥, ax n ∈ AX and n = |φ| + 1 ({in(x).P } ∪ P; φ; σ)

in(R) ----→ ({P } ∪ P; φ; σ ∪ {(Rφσ)↓ /x}) In if R is an attacker term such that vars(R) ⊆ dom(φ),
and

(Rφσ)↓ = ⊥ ({let x = d in P else Q} ∪ P; φ; σ) τ -→ ({P } ∪ P; φ; σ ∪ {(dσ)↓ /x}) Let-In if dσ is ground and (dσ)↓ = ⊥ ({let x = d in P else Q} ∪ P; φ; σ) τ -→ ({Q} ∪ P; φ; σ) Let-Else if dσ is ground and (dσ)↓= ⊥, i.e. d fails ({if M = N then P else Q} ∪ P; φ; σ) τ -→ ({P } ∪ P; φ; σ) If-Then if M , N are messages such that M σ, N σ are ground, (M σ)↓ = ⊥, (N σ)↓ = ⊥, and M σ = N σ ({if M = N then P else Q} ∪ P; φ; σ) τ -→ ({Q} ∪ P; φ; σ) If-Else if M , N are messages such that M σ, N σ are ground and (M σ)↓= ⊥ or (N σ)↓= ⊥ or M σ = N σ ({!P } ∪ P; φ; σ) τ -→
({P, !P } ∪ P; φ; σ) Repl Process if M = N then P else Q behaves like P if M and N correspond to two equal messages and behaves like Q otherwise. The replicated process !P behaves as an unbounded number of copies of P in parallel. In the following, we will often omit the else-branch in conditionals and destructor applications when it is empty, i.e. 0. Similarly, we will omit the null process at the end of branches, e.g. simply writing in(x).out(M ) for in(x).out(M ).0. A trace of a process P is any possible sequence of transitions in the presence of an attacker that may read, forge, and send messages. Formally, the set of traces trace(P ) is defined as follows.

trace(P ) = {(w, φ, σ)|({P }; ∅; ∅) w --→ * (P; φ; σ)} Example 2.
Consider the Helios protocol mentioned in introduction. Informally, the behaviour of the protocol is as follows:

V i → S : [{v i } r i pk(ks) ] k i S → V 1 , . . . , V n : v 1 , . . . , v n
where {m} r pk denotes the asymmetric encryption of message m with public key pk randomised with r; and [m] k denotes the signature of m with key k. Voters V 1 , . . . , V n each send their vote v i encrypted with the public key pk(k s ) of the election to the server S on an authentic channel (modelled here by a signature). For simplicity, compared to the informal description from the introduction, we have combined here the roles of the ballot box and the tallying authority into a single entity S. The server decrypts all ballots, to compute and publish the result, i.e. the set of votes in clear.

We describe here a simplified version of Helios, incorporating the weeding operation, in a simple case with only two (honest) voters A and B and a voting server S. The protocol can be modelled by the process:

H = new r a .Voter(k a , v a , r a ) | new r b .Voter(k b , v b , r b ) | P S
where Voter(k, v, r) represents voter k willing to vote for v using randomness r while P S represents the voting server. Voter(k, v, r) encrypts the vote v, using the value r to randomise the encryption; and signs the ciphertext before outputting it, which models sending the ciphertext over an authenticated channel.

Voter(k, v, r) = out(sign(aenc( v, r , pk(k S )), k))
Note that we model the randomised asymmetric encryption by having the random value r appear paired together with the payload v. This of course an abstraction, which does not reflect how the randomness would be used in the actual construction of the cryptographic primitive. At the level of abstraction of our symbolic model however, this correctly models the behaviour of randomised encryption.

The voting server receives ballots from A and B and then outputs the decrypted ballots, after some mixing.

P S =in(x 1 ).in(x 2 ). let y 1 = checksign(x 1 , vk(k a )) in let y 2 = checksign(x 2 , vk(k b )) in let z 1 = adec(y 1 , k s ) in let z 1 = π 1 (z 1 ) in let z 2 = adec(y 2 , k s ) in let z 2 = π 1 (z 2 ) in (out(z 1 ) | out(z 2 ))
Let us describe a possible execution of process H, that describes a "normal" run of the protocol, where the attacker does not interfere. We can first apply rule Par twice to H, to split the parallel branches. Then rules New and Out can be applied to process new r a .Voter(k a , v a , r a ), storing message sign(aenc( v a , r a , pk(k S )), k a ) into the variable ax 1 ∈ AX . The same rules can be applied to new

r b .Voter(k b , v b , r b ), storing sign(aenc( v b , r b , pk(k S )), k b ) into variable ax 2 ∈ AX .
We can then apply rule In twice to process P S , inputting the two messages stored in ax 1 , ax 2 . Consequently these two messages are stored in variables x 1 , x 2 . The messages have the expected form: applying rule Let-In six times hence successfully applies all destructors, storing all intermediary results in variables y 1 , y 2 , z 1 , z 2 , and finally messages v a , v b into z 1 and z 2 . Rule Par can then be applied to split the two parallel branches out(z 1 ), out(z 2 ). We may then apply rule Out to any of the two, say the first one: v a is stored in variable ax 3 , and then the other:

v b is stored in ax 4 .
At this point, there are no more processes to be reduced, except for implicit null processes: rule Zero takes care of these, and the execution reaches its end.

Altogether, the execution can be summarised by

({H}, ∅, ∅) t -→ * (∅, φ, σ)
where the sequence t of actions (ignoring silent actions) is

t = τ new ax 1 .out(ax 1
φ = [ax 1 → sign(aenc( v a , r a , pk(k S )), k a ), ax 2 → sign(aenc( v b , r b , pk(k S )), k b ), ax 3 → z 1 , ax 4 → z 2 ],
and finally the substitution σ stores the contents of all variables in the processes:

σ = [x 1 → sign(aenc( v a , r a , pk(k S )), k a ), x 2 → sign(aenc( v b , r b , pk(k S )), k b ), y 1 → aenc( v a , r a , pk(k S )), y 2 → aenc( v b , r b , pk(k S )), z 1 → v a , r a , z 2 → v b , r b , z 1 → v a , z 2 → v b ].
Note that the execution of this process is not deterministic. For instance we could have chosen, when reducing process P S , to first perform the output of z 2 and then that of z 1 . This would have produced the reduction

({H}, ∅, ∅) t -→ * (∅, φ , σ),
with the same actions t and substitution σ as the execution above, but a different substitution φ , that is similar to φ, but with the contents of variables ax 3 and ax 4 being swapped.

Equivalence

When processes evolve, sent messages are stored in a substitution φ while the values of variables are stored in σ. A frame is simply a substitution ψ where dom(ψ) ⊆ AX . It represents the knowledge of an attacker. In what follows, we will typically consider φσ.

Intuitively, two sequences of messages are indistinguishable to an attacker if he cannot perform any test that could distinguish them. This is typically modelled as static equivalence [START_REF] Abadi | Mobile values, new names, and secure communication[END_REF]. Here, we consider of variant of [START_REF] Abadi | Mobile values, new names, and secure communication[END_REF] where the attacker is also given the ability to observe when the evaluation of a term fails, as defined for example in [START_REF] Cheval | Lengths may break privacy -or how to check for equivalences with length[END_REF].

Definition 1 (Static Equivalence). Two ground frames φ and φ are statically equivalent if and only if they have the same domain, and for all attacker terms R, S with variables in dom(φ) = dom(φ ), we have

(Rφ = ↓ Sφ) ⇐⇒ (Rφ = ↓ Sφ ).
We then write φ ≈ φ .

Example 3. Consider constant values a, b ∈ C, and keys k, k ∈ K. The following static equivalence holds:

[

ax 1 → enc(a, k)] ≈ [ax 1 → enc(b, k)].
Indeed, even though two different public values a, b are used on either side, they are encrypted with a key k, and the frame does not reveal this key. Thus the attacker is unable to observe this difference. If however the frame reveals key k, the equivalence is broken:

[ax 1 → enc(a, k), ax 2 → k] ≈ [ax 1 → enc(b, k), ax 2 → k].
Indeed, the attacker can now use k to decrypt and observe a difference. For instance, using recipes R = dec(ax 1 , ax 2 ) and S = a, we have Rφ = a = Sφ, while Rφ = b = Sφ (where φ, φ are the frames on the left and on the right).

Then two processes P and Q are in equivalence if no matter how the adversary interacts with P , a similar interaction may happen with Q, with equivalent resulting frames. Definition 2 (Trace Equivalence). Let P , Q be two processes. We write P t Q if for all (s, φ, σ) ∈ trace(P ), there exists (s , φ , σ ) ∈ trace(Q) such that s = τ s and φσ and φ σ are statically equivalent. We say that P and Q are trace equivalent, and we write

P ≈ t Q, if P t Q and Q t P .
Note that this definition already includes the attacker's behaviour, since processes may input any message forged by the attacker.

Example 4. For instance, the following trace equivalence holds:

new k.out(enc(a, k)) ≈ t new k.out(enc(b, k)).
Indeed, these two processes can only produce (with the same sequences of actions) the two frames [ax 1 → out(enc(a, k))] and [ax 2 → out(enc(b, k))], which are statically equivalent as explained in the previous example.

On the other hand, outputting the key k breaks the equivalence:

new k.out(enc(a, k)).out(k) ≈ t new k.out(enc(b, k)).out(k).
Indeed, the process on the left can produce the frame [ax 1 → enc(a, k), ax 2 → k], and the process on the right (with the same actions) can only produce the frame

[ax 1 → enc(b, k), ax 2 → k].
As explained in the previous example, these two frames are not statically equivalent: hence, there exists a behaviour of the left process that cannot be mimicked by any behaviour of the right process. Thus, P t Q, which implies P ≈ t Q.

As evoked in introduction, ballot privacy is typically modelled as an equivalence property [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF] that requires that an attacker cannot distinguish when Alice is voting 0 and Bob is voting 1 from the scenario where the two votes are swapped.

Continuing Example 2, ballot privacy of Helios can be expressed as follows:

new r a .V oter(k a , 0, r a ) | new r b .V oter(k b , 1, r b ) | P S ≈ t new r a .V oter(k a , 1, r a ) | new r b .V oter(k b , 0, r b ) | P S
This notion of equivalence is the property our type system entails. In the next chapter, we present the type system in detail, and establish that it is sound, i.e. that it correctly implies trace equivalence.

Chapter 2

Type System

Introduction

As explained in introduction, type systems are a powerful tool to statically verify safety properties in the context of programming languages, but can also be used to enforce much stronger security guarantees in the case of cryptographic protocols. The advantage of typing-based approaches is that they typically produce efficient, although by design incomplete, ways to prove properties that are undecidable in general. As mentioned earlier, they have been applied in the context of security protocols to prove trace properties such as authentication and secrecy properties (e.g. [START_REF] Gordon | Authenticity by typing for security protocols[END_REF][START_REF] Bugliesi | Authenticity by tagging and typing[END_REF][START_REF] Bugliesi | Analysis of typed analyses of authentication protocols[END_REF]). Typically, this kind of approach consists in using types to carry information (e.g. labels indicating the level of confidentiality) about the messages exchanged. This basically forms an overapproximation of all possible executions of a protocol, by considering the types as an abstraction of the messages. It is then possible to check that this overapproximated set of executions never violates the trace property considered, e.g. by publishing a message whose type indicates it should be secret. However, such an overapproximation would not be sound when considering equivalence properties. Indeed, even if the overapproximations of the possible traces of two processes P and Q are equivalent, it does not mean that the actual processes are. It might be that some behaviour of P is actually impossible in Q, but that the overapproximation misses that fact. Such a case would break the equivalence of P and Q. Instead, we propose an approach where the two processes are typechecked at the same time, with typing rules designed to ensure that they have the same behaviours. As we will see, this is not sufficient: we also need to check that the messages exchanged by the processes on the left and on the right are also equivalent. To that end, our typechecking rules collect these messages, and some additional conditions are checked on them afterwards, to ensure they do not leak information.

This chapter presents the type system we propose to statically verify trace equivalence properties for pi-calculus processes, as defined in the previous chapter. We then establish the soundness of the type system for protocols with a bounded number of sessions, i.e. without replication, and finally lift this result to the case of unbounded numbers of sessions.

Overview

We first introduce the key ideas underlying our approach on (the fixed version of) the Helios voting protocol [START_REF] Adida | Helios: Web-based open-audit voting[END_REF]. Helios is a verifiable voting protocol, that we have described informally in introduction. It that has been used in various elections, including the election of the rector of the University of Louvain-la-Neuve. We described a pi-calculus process modelling a simplified version of Helios in Chapter 1. We consider here a slightly more detailed model, that we will now present. The informal behaviour of the system, with a server S and n voters V 1 , . . . , V n , is depicted below.

S → V i : r i V i → S : [{v i } r i ,r i pk(ks) ] k i S → V 1 , . . . , V n : v 1 , . . . , v n
where {m} r pk(k) denotes the asymmetric encryption of message m with the key pk(k) randomised with the nonce r, and [m] k denotes the signature of m with key k. v i is a value in the set {0, 1}, which represents the candidate that voter V i votes for. In the first step, the voter casts her vote, encrypted with the election's public key pk(k s ) and then signed. Since generating a good random number is difficult for the voter's client (typically a JavaScript run in a browser), a typical trick is to input some randomness (r i ) from the server and to add it to its own randomness (r i ). In the second step the server outputs the tally (i.e., a randomised permutation of the valid votes received in the voting phase). Note that the original Helios protocol does not assume signed ballots. Instead, voters authenticate themselves through a login mechanism. For simplicity, we abstract this authenticated channel by a signature.

As in the model from the previous chapter, we consider here an abstraction of the tallying process from the actual Helios protocol. In the real scheme, the voting server only collects ballots, and a different entity, the tallying authority, is in charge of computing and publishing the result. Moreover this tallying entity is actually split into several trustees who each have only a share of the decryption key, to distribute the trust among them. We consider here the case of a honest voting server and tallying authority -although the attacker is still able to block and intercept the ballots sent by voters to the server. Hence, for simplicity, we conflate the server and talliers into a single entity, that retrieves all ballots and publishes the result of the election.

As already explained in introduction, a voting protocol provides vote privacy [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF] if an attacker is not able to know which voter voted for which candidate. Intuitively, this can be modelled as the following trace equivalence property, which requires the attacker not to be able to distinguish A voting 0 and B voting 1 from A voting 1 and B voting 0.

Voter(k a , 0) | Voter(k b , 1) | CompromisedVoters | S ≈ t Voter(k a , 1) | Voter(k b , 0) | CompromisedVoters | S
where Voter(k, v) is a process modelling a voter with private key k voting for candidate v, S is a process modelling the behaviour of the server, and CompromisedVoters a process representing voters controlled by the attacker. These would typically simply give their keys to the attacker, and let him vote for them. The attacker may a priori control an unbounded number of voters.

Despite its simplicity, this protocol has a few interesting features that make its analysis particularly challenging. First of all, as discussed in introduction, the server is supposed to discard ciphertext duplicates, otherwise a malicious eligible voter E could intercept A's ciphertext, sign it, and send it to the server [START_REF] Cortier | Attacking and Fixing Helios: An Analysis of Ballot Secrecy[END_REF], as exemplified below:

A → S : [{v a } ra,r a pk(ks) ] ka E → S : [{v a } ra,r a pk(ks) ] ke B → S : [{v b } r b ,r b pk(ks) ] k b S → A, B : v a , v b , v a

Overview

This would make the two tallied results distinguishable, thereby breaking trace equivalence, since

v a , v b , v a ≈ t v a , v b , v b .
Even more interestingly, each voter is supposed to be able to vote only once, otherwise the same attack would apply [START_REF] Roenne | [END_REF] even if the server discards ciphertext duplicates (as the randomness used by the voter in the two ballots would be different). This makes the analysis particularly challenging, and in particular out of scope of existing cryptographic protocol analysers such as ProVerif. Indeed, as mentioned earlier, ProVerif abstracts away from the number of protocol sessions, and due to this abstraction reports this attack even when it is made impossible by having voters vote only once.

In the following sections, we introduce a type system to statically check trace equivalence between processes. Our typing judgements thus capture properties of pairs of terms or processes, which we will refer to as the left and right term or process, respectively. Typing judgments are parametrised by a typing environment Γ, which is a mapping from names, keys, and variables to types. We will usually denote typing environments Γ.

Let us now give an intuition of what types we need to typecheck the aforementioned equivalence property. We first assume standard security labels: HH stands for high confidentiality and high integrity, HL for high confidentiality and low integrity (e.g. a message encrypted with a public key), and LL for low confidentiality and low integrity.1

In the case of Helios, the nonces r a and r b are sent by the server in clear and unauthenticated: we will give them label LL. However, the nonces r a and r b generated by the voters should not be published, hence we will give them label HH.

More precisely, we will use type τ l,1 i to describe randomness of security label l produced by the randomness generator at position i in the program, which can be invoked at most once. As we consider processes up to α-renaming, we will assume that each distinct invocation of the randomness generator in the process uses a different name (e.g. r a , r b , etc. in the Helios example). We will then use this name to refer to the position i of the corresponding call to the generator. For instance, nonce r a will thus be given type τ HH,1 r a . We will also use a type τ l,∞ i , which is similar, except that the randomness generator can be invoked an unbounded number of times, i.e. the corresponding "new" instruction occurs in a replicated process. Although this "infinite" type does not occur in the case of Helios, since we purposefully prevent revote, it will be useful later on when considering other examples. These types induce a partition on random values, in which each set contains at most one element or an unbounded number of elements, respectively. This turns out to be useful, as explained below, to type-check protocols, like Helios, in which the number of times messages of a certain shape are produced is relevant for the security of the protocol.

We also give security labels to keys: k a , k b and k s should remain secret, and we will thus give them label HH. Let us emphasise that these labels are not assumptions, but rather an indication to guide the typechecking. That is, we do not assume that these keys are secret, but rather we indicate that they should not be published, and the typechecking will ensure that they are indeed not.

The security label is not sufficient when reasoning about keys: we also want, at least when a key is trusted, to somehow encode information regarding what messages it can encrypt or sign. To do this, the complete type we use for keys has the form key l (T ), where l is the label of the key itself, and T the type of the messages it can encrypt or sign. When the key is trusted (i.e., l = HH), the type system will ensure that it correctly only encrypts messages of the right type.

In the case of Helios, the protocol specifies that k a should only be used to sign encryptions of the vote of A, together with the randomness r a , r a . To express this, we use a type {T } ks , that describes the asymmetric encryption of a message of type T with the key k s2 . As we will see later on, we will need to encode precisely in the payload type T what is the value of this vote. To do this we introduce a refinement type τ LL,1 0 ; τ LL,1 1 , that describes with the same notations as the types for nonces the value -here 0 or 1 -of the term, both on the left and on the right. All in all, putting all these ingredients together, we give the following type to k a :

k a : key HH ({ τ LL,1 0 ; τ LL,1 1 * HL * τ HH,1 r a } ks ).
A similar type conveys the information that k b is a trusted key, that signs only the encryption of Bob's vote, i.e. 1 on the left and 0 on the right:

k b : key HH ({ τ LL,1 1 ; τ LL,1 0 * HL * τ HH,1 r b } ks ).
The type of k s is similar: it also has label HH since it is trusted. However, this time there are several possibilities for the messages it encrypts. Indeed, it can be used to encrypt Alice's vote, or Bob's vote: thus, it inherits the two payload types, which are combined in disjunctive form. Since the associated encryption key is public -it is the election public key -it can also be used by the attacker to encrypt a dishonest vote, or in fact any arbitrary message. To reflect that, public key types implicitly convey an additional payload type, the one characterising messages encrypted by the attacker: these are of low confidentiality and integrity. Following these observations, we can give the following type to k s :

k s : key HH (( τ LL,1 0 ; τ LL,1 1
The information carried by the types, and analysed during the typechecking, is however not sufficient in general for equivalence. Consider for instance a key k with a simple type key HH (HL), i.e. a trusted key (label HH) that can encrypt any message (HL being the most generic type: the one for messages that should not be published, but cannot be trusted either). Consider then the processes P = out(enc(0, k)).out(enc(0, k)), and Q = out(enc(0, k)).out(enc(1, k)).

Overview

P outputs twice the same public value 0, encrypted with k, while Q first encrypts 0 and then 1. This is perfectly fine w.r.t. the type of the key k: that trusted key is allowed to encrypt any message. Note however that we did not (contrary to the Helios example) randomise the encryption here: hence the two ciphertexts published by P are the same, while the two messages from Q are different. This trivially makes P and Q non-equivalent, but cannot be detected by the key type. Indeed, the key type only enforces local conditions each time the key is used to encrypt or decrypt, while the problem here is more global -it involves different messages, in different outputs, that could be in different parts of a real protocol. To detect such issues, we need some sort of global view of the messages exchanged.

To produce this global view, the type system generates a set containing the sequence of all pairs of messages produced in the outputs of the left and right processes -or in fact, as we will explain in later sections, subterms of these messages. We call this set a constraint. For instance, just to give an idea of what a constraint looks like, the constraints generated in the Helios example are reported below:

C = {({sign(aenc( 0, x, r a , pk(k S )), k a ) ∼ sign(aenc( 1, x, r a , pk(k S )), k a ), aenc( 0, x, r a , pk(k S )) ∼ aenc( 1, x, r a , pk(k S )), sign(aenc( 1, y, r b , pk(k S )), k b ) ∼ sign(aenc( 0, y, r b , pk(k S )), k b ), aenc( 1, y, r b , pk(k S )) ∼ aenc( 0, y, r b , pk(k S ))}, [x : LL, y : LL])}
Once typechecking is done, we basically need to check for the kind of repetitions displayed above in the constraints. Intuitively, we need the sequences of messages on the left and the right to be statically equivalent, which is the case in the Helios example above. The actual general condition is actually a bit more complex, as these messages may contain uninstantiated variables, for which we want to use the type information collected during typechecking. We will later on define formally that condition, called consistency, that characterises the indistinguishability of the messages output by the process. We are then able to show that typechecking with consistent constraints soundly implies trace equivalence.

Non-uniformity A central assumption that would simplify the analysis when checking for equivalence is uniform execution, meaning that the two processes of interest always take the same branch in a branching statement. For instance, this means that all decryptions must always succeed or fail equally in the two processes. That is for instance the case in the example described above. It would be possible to enforce this condition, by restricting the type system so that encryption and decryption are only allowed with keys whose equality on the left and on the right can be statically proved.

There are however protocols that require non-uniform execution for a proof of trace equivalence, e.g., the private authentication protocol [START_REF] Abadi | Private authentication[END_REF]. This protocol aims at authenticating B to A, anonymously w.r.t. other agents. More specifically, agent B may refuse to communicate with agent A but a third agent D should not learn whether B declines communication with A or not. The protocol can be informally described as follows, where pk(k) denotes the public key associated to key k, and aenc(M, pk(k)) denotes the asymmetric encryption of message M with this public key. . We model the protocol as:

A → B : aenc( N a , pk(k a ) , pk(k b )) B → A : aenc( N a , N b , pk(k b ) , pk(k a )) if B accepts A's request aenc(N b , pk(k)) if B declines A's request Γ(k b , k b ) =
P a (k a , pk b ) = new N a .out(aenc( N a , pk(k a ) , pk b )). in(z) P b (k b , pk a ) = new N b . in(x). let y = adec(x, k b ) in let y 1 = π 1 (y) in let y 2 = π 2 (y) in if y 2 = pk a then out(aenc( y 1 , N b , pk(k b ) , pk a )) else out(aenc(N b , pk(k)))
where adec(M, k) denotes asymmetric decryption of message M with private key k. We model anonymity as the following equivalence, intuitively stating that an attacker should not be able to tell whether B accepts requests from the agent A or C:

P a (k a , pk(k b )) | P b (k b , pk(k a )) ≈ t P a (k a , pk(k b )) | P b (k b , pk(k c ))
We now show how we can type the protocol in order to show trace equivalence. The initiator P a is trivially executing uniformly, since it does not contain any branching operations. We hence focus on typing the responder P b .

The beginning of the responder protocol can be typed using standard techniques. Then however, we perform the test y 2 = pk(k a ) on the left side and y 2 = pk(k c ) on the right side. Since we cannot statically determine the result of the two equality checks -and thus guarantee uniform execution -we have to typecheck the four possible combinations of then and else branches. This means we have to typecheck outputs of encryptions that use different keys on the left and the right side.

To deal with this we do not assign types to single keys, but rather to pairs of keys (k, k )which we call bikeys -where k is the key used in the left process and k is the key used in the right process. The key types used for typing are presented in Fig. 2.1.

As an example, we consider the combination of the then branch on the left with the else branch on the right. This combination occurs when A is successfully authenticated on the left side, while being rejected on the right side. We then have to typecheck B's positive answer together with the decoy message: Γ aenc( y 1 , N b , pk(k b ) , pk(k a )) ∼ aenc(N b , pk(k)) : LL. For this we need the type for the bikey (k a , k). Decrypting non-uniformly When decrypting a ciphertext that was potentially generated using two different keys on the left and the right side, we have to take all possibilities into account.

Typing

l ::= LL | HL | HH KT ::= key l (T ) | eqkey l (T ) | seskey l,a (T ) with a ∈ {1, ∞} T ::= l | T * T | T ∨ T | KT | pkey(KT ) | vkey(KT ) | (T ) T | {T } T | τ l,a n ; τ l ,a m with a ∈ {1, ∞}
Consider the following extension of the process P a where agent A decrypts B's message.

P a (k a , pk b ) = new N a .out(aenc( N a , pk(k a ) , pk b )). in(z). let z = adec(z, k a ) in out(1) else out(0)
In the decryption, there are the following possible cases:

• The message is a valid encryption supplied by the attacker (using the public key pk(k a )), so we check the then branch on both sides with Γ(z ) = LL.

• The message is not a valid encryption supplied by the attacker so we check the else branch on both sides.

• The message is a valid response from B. The keys used on the left and the right are then one of the four possible combinations (k a , k), (k a , k c ), (k, k c ) and (k, k).

-In the first two cases the decryption will succeed on the left and fail on the right. We hence check the then branch on the left with Γ(z ) = HL with the else branch on the right. If the type Γ(k a , k) were different from Γ(k a , k c ), we would check this combination twice, using the two different payload types.

-In the remaining two cases the decryption will fail on both sides. We hence would have to check the two else branches (which however we already did).

While checking the then branch together with the else branch, we have to check Γ 1 ∼ 0 : LL, which rightly fails, as the modified protocol no longer guarantees trace equivalence.

Typing

Types

In our type system we give types to pairs of messages -one from the left process and one from the right one. We store the types of nonces, variables, and keys in a typing environment Γ. While we store a type for a single nonce or variable occurring in both processes, we assign a potentially different type to every different combination of keys (k, k ) used in the left and right process -so called bikeys. This is an important non-standard feature that enables us to type protocols using different encryption and decryption keys.

T <: T (SRefl) T <: HL (SHigh) T <: T T <: T T <: T

(STrans)

LL * LL <: LL (SPairL) T 1 <: T 1 T 2 <: T 2 T 1 * T 2 <: T 1 * T 2 (
T <: T (T ) T <: (T ) T (SEnc) T <: T {T } T <: {T } T (SAenc) Figure 2.3: Subtyping Rules
The types for messages are defined in Figure 2.2. We consider a subtyping relation <: on types, which is defined by subtyping rules given in Figure 2.3. In particular, rules SRefl and STrans make it reflexive and transitive, as expected from a subtyping relation. We explain below the types and their meaning, as well as the remaining subtyping rules.

We assume three security labels HH, HL and LL, ranged over by l, whose first (resp. second) component denotes the confidentiality (resp. integrity) level. Intuitively, values of high confidentiality may never be output to the network in plain, and values of high integrity are guaranteed not to originate from the attacker. Type HL is the least informative of these levels, as it gives no information regarding the message it applies to. Such a message has high confidentiality and low integrity: it can therefore not be published, but we do not know where it originates from or what it contains. For this reason, any (typable) message could be given this type: rule SHigh expresses that any type is a subtype of HL.

Pair types T * T describe the type of their components: such a type indicates a pair whose first component has type T and second component type T . Four subtyping rules apply to pair types. Rule SPair is the simplest: it allows to subtype types T 1 and T 2 separately into T 1 , T 2 , to get that the pair type T 1 * T 2 is a subtype of T 1 * T 2 . Rule SPairL states that LL * LL is a subtype of LL: intuitively, it means that as long as two messages have low confidentiality and can be published, then the same is true for the pair of these two messages. Finally, rules SPairS and SPairS state that any pair type is a subtype of HH, as long as one of its two components is HH. In terms of messages, this corresponds to the fact that as soon as one component of the pair has high integrity, i.e. cannot have been constructed by the attacker, then the whole pair cannot either.

The union type T ∨ T is given to messages that can have type T or type T . We call branches all the types obtained by splitting the ∨ type. More precisely:

Typing

Definition 3 (Branches of a type). If T is a type, we write branches(T ) the set of all types T such that T is not a union type, and either

• T = T ;
• or there exist types T 1 ,. . . ,T k ,T 1 ,. . . ,T k such that

T = T 1 ∨ . . . ∨ T k ∨ T ∨ T 1 ∨ . . . ∨ T k
This naturally extends to typing environments as follows.

Definition 4 (Branches of an environment). For a typing environment Γ, we write branches(Γ) the sets of all environments Γ such that

• dom(Γ ) = dom(Γ) • ∀x ∈ dom(Γ). Γ (x) ∈ branches(Γ(x)).
The type τ l,a n describes nonces and constants of security level l: the label a ranges over {∞, 1}, denoting whether the nonce is bound within a replication or not (constants are always typed with a = 1). We assume a different identifier n for each constant and restriction in the process. The type τ l,1 n is populated by a single name, (i.e., n describes a constant or a non-replicated nonce) and τ l,∞ n is a special type, that is instantiated to τ l,1 n j in the jth replication of the process.

Type τ l,a n ; τ l ,a m is a refinement type that restricts the set of possible values of a message to values of type τ l,a n on the left and type τ l ,a m on the right. For a refinement type τ l,a n ; τ l,a n with equal types on both sides we simply write τ l,a n . Keys can have three different types ranged over by KT , ordered by a subtyping relation (rules SEqKey, SSesKey): seskey l,a (T ) <: eqkey l (T ) <: key l (T ). For all three types, l denotes the security label of the key: as rule SKey indicates, all of these types are subtypes of l. T is the type of the payload that can be encrypted or signed with these keys. This allows us to transfer typing information from one process to another one: e.g. when encrypting, we check that the payload type is respected, so that we can be sure to get a value of the payload type upon decryption. The three different types encode different relations between the left and the right component of a bikey (k, k ). While type key l (T ) can be given to bikeys with different components k = k , type eqkey l (T ) can only be given to a bikey provided the keys are equal on both sides. Type seskey l,a (T ) additionally guarantees that the key in question is never associated to a different key in another bikey, at any point in the execution. More precisely, type eqkey l (T ) could be given to a bikey (k, k) even if at some point the bikey (k, k ) for some k = k occurs (this bikey (k, k ) would then be given some other type key l (T )). In contrast, if (k, k) is given type seskey l,a (T ), then k can never be associated with a different key k : a bikey with type seskey l,a (T ) is always the same on the left and the right throughout the whole process. We allow for dynamic generation of keys of type seskey l,a (T ), and use a label a to denote whether the key is generated under replication or not -just like for nonce types.

We denote the sets of all keys in an environment Γ by:

keys(Γ) = {k ∈ K | ∃k ∈ K. (k, k ) ∈ dom(Γ) ∨ (k , k) ∈ dom(Γ)}.
We also denote the set of all session keys in Γ by:

seskeys(Γ) = {k ∈ K | ∃l, a, T. Γ(k, k) = seskey l,a (T )}.
For a key of type T , we use types pkey(T ) and vkey(T ) for the corresponding public key and verification key, and types (T ) T and {T } T for symmetric and asymmetric encryptions of messages of type T with this key. Public keys and verification keys can be treated as LL if the corresponding keys are equal (rules SPubkey,SVkey): a public key is safe to output, provided that the same public key is output on the left and on the right. Subtyping on encryptions is directly induced by subtyping of the payload types (rules SEnc, SAenc).

Constraints

When typing messages, we generate constraints of the form (M ∼ N ), with the meaning that the attacker may see M and N in the left and right process, respectively, and that these two messages are thus required to be indistinguishable. Definition 5 (Constraint). Formally, a constraint is defined as a pair of messages, separated by the symbol ∼:

u ∼ v
As we will see, several constraints may be generated when typing messages: we thus also consider sets of constraints, which we usually denote c. We will also consider couples (c, Γ) composed of such a set, and a typing environment Γ, that contains type information on the variables, gathered while typing the messages. Finally, when typechecking processes, we will obtain several such tuples, and will thus need to handle sets of these, which we will call constraint sets and usually denote C.

The next section describes the typing rules of our type system. Before we get to that, let us define a few operations on constraints and constraint sets that will be useful. We first give an intuition of these operations, before defining them formally.

When typechecking processes, as we will see in the next sections, we will obtain several constraint sets, and we will need to join them by computing what we call their product union. Basically, given two constraint sets C, C , this operation yields a constraint set C∪ × C that contains all elements of the form c ∪ c , where c comes from C and c from C . Of course, by definition of a constraint sets, c does not occur alone in C, but rather as a component of a tuple (c, Γ) (and similarly for c ). We thus also define a notion of union for typing environments. This union corresponds to the intuition of simply putting together all the types contained in the environments: the union of Γ = [x : T ] and Γ = [y : T ] would simply be Γ ∪ Γ = [x : T, y : T ]. This is well defined when Γ and Γ have disjoint domains. In case they do not, say if both Γ and Γ contain a binding for some variable z, we require that they agree on the type of z. This property, which we call compatibility, is formally defined below. Definition 6 (Compatible environments). We say that two typing environments Γ, Γ are compatible if they are equal on the intersection of their domains, i.e. if ∀x ∈ dom(Γ) ∩ dom(Γ ). Γ(x) = Γ (x).

We can then define formally the union of two typing environments. Definition 7 (Union of environments). Let Γ, Γ be two compatible environments. Their union Γ ∪ Γ is defined by

• dom(Γ ∪ Γ ) = dom(Γ) ∪ dom(Γ ) • ∀x ∈ dom(Γ). (Γ ∪ Γ )(x) = Γ(x) • ∀x ∈ dom(Γ ). (Γ ∪ Γ )(x) = Γ (x)
Note that this function is well defined since Γ and Γ are assumed to be compatible.

Finally we can define the following two operations on constraint sets. Definition 8 (Operations on constraint sets). We define two operations on constraints.

• the product union of constraint sets:

C∪ × C := {(c ∪ c , Γ ∪ Γ ) | (c, Γ) ∈ C ∧ (c , Γ ) ∈ C ∧ Γ, Γ are compatible}
• the addition of a set of constraints c to all elements of a constraint set C:

C∪ ∀ c := C∪ × {(c , ∅)} = (c ∪ c , Γ) | (c, Γ) ∈ C

Typing messages

The typing judgement for messages is of the form Γ M ∼ N : T → c which reads as follows: under the environment Γ, M and N are of type T . Either this is a high confidentiality type, i.e. M and N are not disclosed to the attacker, or M and N are indistinguishable for the attacker provided the set of constraints c is consistent (the proper definition of consistency is provided in a later section).

The most common use case for our typing rules for messages is when a message is output on the network: in that case we want to ensure the messages on the left and right processes can be given type LL, to check they do not let the attacker distinguish between the two processes. Typing messages with other types is only used on subterms of output messages, to ensure that the payload of an encryption or signature has the correct type, or to infer refinements so that we are able to determine the outcome of equality checks and destructor applications statically.

We present the typing rules for messages in Figure 2.4 and comment on them in the following.

Rules for nonces Confidential nonces can be given their label from the typing environment using rule TNonce. Since their label prevents them from being released in clear, the attacker cannot observe them and we do not need to add constraints for them. They can however be output in encrypted form and will then appear in the constraints associated to the encryption. Public nonces (labelled as LL) on the other hand are potentially already known by the attacker. Thus they can only be typed if they are equal on both sides (rule TNonceL), so as not to let the attacker observe a difference between each side.

Rules for variables and pairs

We require variables to be the same in the two processes, deriving their type from the environment (TVar). The rule for pairs operates recursively component-wise (TPair). Rules for keys A non-standard rule that is crucial for the typing of branching protocols is rule TKey. As the typing environment contains types for bikeys (k, k ), this rule allows us to type two potentially different keys with their type from the environment. With rules TPubKeyL and TVKeyL, we can give type LL to a public key or verification key that is explicitly associated with the same key on both sides. Rules TPubKey and TVKey on the other hand allow us to type different public keys pk(M ), pk(N ) (resp. verification keys) with a public key type. They require that we can show there exists a valid key type for the terms M and N . This highlights another important technical point: we do not only support a fixed set of keys, but also allow for the usage of keys in variables, that have been received from the network. That is, the messages M , N do not need to explicitly be written as keys in the process, but rather might be variables containing for instance messages obtained from the network, or by decrypting messages received from the network.

Γ(n) = τ l,a n Γ(m) = τ l,a m l ∈ {HH, HL} Γ n ∼ m : l → ∅ (TNonce) Γ(n) = τ LL,a n Γ n ∼ n : LL → ∅ (TNonceL) a ∈ C ∪ FN ∪ FK Γ a ∼ a : LL → ∅ (TCstFN) Γ M ∼ N : T → ∅ ∃T , l.T <: key l (T ) Γ pk(M ) ∼ pk(N ) : pkey(T ) → ∅ (TPubKey) k ∈ keys(Γ) ∪ F K Γ pk(k) ∼ pk(k) : LL → ∅ (TPubKeyL) Γ M ∼ N : T → ∅ ∃T , l.T <: key l (T ) Γ vk(M ) ∼ vk(N ) : vkey(T ) → ∅ (TVKey) k ∈ keys(Γ) ∪ F K Γ vk(k) ∼ vk(k) : LL → ∅ (TVKeyL) Γ M ∼ N : HL → ∅ Γ h(M ) ∼ h(N ) : LL → {h(M ) ∼ h(N )} (THash) Γ M ∼ N : LL → c Γ h(M ) ∼ h(N ) : LL → c (THashL) M↓ = ⊥ N↓ = ⊥ names(M ) ∪ names(N ) ∪ vars(M ) ∪ vars(N ) ∪ keys(M ) ∪ keys(N ) ⊆ dom(Γ) ∪ keys(Γ) ∪ F N ∪ F K Γ M ∼ N : HL → ∅ (THigh) Γ M ∼ N : T → c T <: T Γ M ∼ N : T → c (TSub) Γ M ∼ N : T → c Γ M ∼ N : T ∨ T → c (TOr) Γ(m) = τ l,1 m or m ∈ FN ∪ C ∧ l = LL Γ(n) = τ l ,1 n or n ∈ FN ∪ C ∧ l = LL Γ m ∼ n : τ l,1 m ; τ l ,1 n → ∅ (TLR 1 ) Γ(m) = τ l,∞ m Γ(n) = τ l ,∞ n Γ m ∼ n : τ l,∞ m ; τ l ,∞ n → ∅ (TLR ∞ ) Γ M ∼ N : τ l,a m ; τ l,a n → c l ∈ {HL, HH} Γ M ∼ N : l → c (TLR') Γ M ∼ N : τ LL,a n ; τ LL,a n → c Γ M ∼ N : LL → c (TLRL') Γ x ∼ x : τ l,1 m ; τ l ,1 n → ∅ Γ y ∼ y : τ l ,1 m ; τ l ,1 n → ∅ Γ x ∼ y : τ l,1 m ; τ l ,1 n → ∅ (

Rules for symmetric encryption

To show that a message is of type (T ) T -that is, a message of type T encrypted symmetrically with a key of type T , we have to show that the corresponding terms (used as plaintext and key) have exactly these types, in rule TEnc. The generated constraints are simply propagated. In addition we need to show that T is either (a subtype of) a valid type for a key, or LL. The first case corresponds to encryption performed by the processes using a message which can statically be shown to be a key. The second case models encryption with untrusted keys received from the network. Note that this rule allows us to encrypt messages with different keys in the two processes. It can for instance be used to type a message encrypted with k on the left and a different key k on the right, provided the bikey (k, k ) can be given a key type. This can be done e.g. if the typing environment Γ contains a mapping for (k, k ), using rule TKey.

For encryptions with honest keys, i.e. keys that can be given a key type with label HH, we can use rule TEncH to give type LL to the messages. This rule requires that we can prove the payload type is respected. More precisely, once two messages have been given type (T ) T , e.g. using rule TEnc, if T is (a subtype of) key HH (T ), then the messages can be given type LL. Indeed, the label HH guarantees that the key is secret, and therefore hides the plaintexts from the attacker: thus we do not need to give them type LL. However, the type T of the payload in (T ) T must be the same as the type T of the messages the key can encrypt in key HH (T ). This enforces that keys always encrypt messages of the correct type specified in their key types. As we will see in the next section, this property will be used to extract information regarding the type of the plaintext when decrypting messages. In addition, even though the attacker cannot read the plaintext, he can perform an equality check on the ciphertext that he observes. Therefore, we add the entire ciphertexts to the constraints Rule TEncL allows us to give type LL to encryptions even if the key is corrupted. However, we then have to type the plaintexts with type LL since we cannot guarantee their confidentiality. This typically models the case of messages encrypted with keys known by the attacker in sessions with dishonest users. Formally, this typing rule lets us give type LL to messages that already have type (T ) T , in the case where T <: key LL (T ) (for some T ) is a subtype of a non-secret key type; or if T = LL is not even a key type. It requires that the payload type T is LL. Since we already add constraints for giving type LL to the plaintext, we do not need to add any additional constraints regarding the ciphertexts.

Rules for asymmetric encryption

The case of asymmetric encryption is quite similar, although slightly more involved. The difference is that we can always choose to ignore the key type and use type LL to check the payload instead. This allows us to type messages produced by the attacker, who, contrary to the symmetric case, always has access to the public key but does not need to respect its type, even for honest keys. He may use the public key to encrypt plaintexts whose type do not match the one specified in the key type. However, any messages encrypted this way are already known by the attacker, and must therefore be of type LL. Therefore, we allow giving type LL to encryptions where the payload does not have the expected type even when the key is honest, provided the payload itself can be given type LL.

As in the symmetric case, to show that a message is of type {T } T , i.e. the type for messages of type T encrypted asymmetrically with a key of type T , rule TAenc requires that the plaintext and key can be given type T and T respectively. In addition T must be is either a valid type for a public key, or LL. Here again, the second case models encryption with untrusted keys received from the network.

When encrypting with honest keys (label HH), rule TAencH, similarly to rule TEncH, lets us give type LL to messages of type {T } T , provided that T is a public key type associated with a confidential key, and that T is indeed the payload type specified in the key type. Here also we add the entire encryptions to the constraints, since the attacker can only check different encryptions for equality, but not open them to reveal the plaintext.

Rule TAencL is similar to rule TEncL, except that, as explained, the encryption key is public, even when the associated decryption key is secret, i.e. if the key has type pkey(key HH (T )).

The attacker may use it to encrypt messages of the "wrong" type, that is, a type different from T . Hence rule TAencL allows us to give type LL to encryptions even if we do not respect the payload type, or if the key is corrupted. We then have to type the plaintexts with type LL since we cannot guarantee their confidentiality (when the encryption is produced by the protocol agents) or since they are already known by the attacker (when it is produced by him). Additionally, we have to ensure that the same key is used in both processes, because the attacker might possess the corresponding private keys and test which decryption succeeds. This is done by requiring that the private key has type eqkey l (T ) (rather than just key l (T )). As in the symmetric case, since we already add constraints for giving type LL to the plaintext, we do not need to add any additional constraints.

Rules for signatures Signatures are also handled similarly, with the difference that, contrary to encryption, they do not hide the contents of the message. Therefore we need not only to ensure that the message to be signed correctly has the type specified by the key type, but also to give it type LL even if an honest key is used, as outputting the signature would reveal the payload to the attacker.

Formally, rule TSignH lets us type signatures with honest keys. We can give type LL to messages sign(M, M ) on the left and sign(N, N ) on the right, provided that • the terms used as signing keys (M , N ) can be given a key type eqkey HH (T ) (for some T );

• the payloads M , N can be given the type T , which the key type specifies as the expected payload type for these keys;

• the payloads can also be given type LL, as they could be seen by the attacker.

Note that the key type is required to be eqkey HH (T ) and not just key HH (T ): indeed, the attacker has access to all verification keys, and thus would notice messages being signed with different keys on the left and on the right. We additionally collect together all the constraints generated when typing the payloads.

Typing

Rule TSignL is similar for the case of dishonest keys, that have type LL, except that in that case the payload type is not enforced, as the attacker may sign messages of any type.

Rules for hashes

The case of hashing can be seen as similar to asymmetric encryption with honest keys, but is simpler, as we do not have to take key types into account. The first typing rule for hashes (THash) gives them type LL and adds the term to the constraints, only requiring that the arguments of the hash function can be given type HL, the least restrictive type. Intuitively this is justified, because the hash function makes it impossible to recover the argument. Thus, publishing a hash of any messages is fine regardless of their types: the hash simply must be added to the constraint, as the attacker may still perform equality checks on hashes he sees.

The second rule (THashL) gives type LL only if we can also give type LL to the argument of the hash function, but does not add any constraints on its own, and just passes on the constraints created for the arguments. This means we are typing the message as if the hash function would not have been applied and use the message without the hash, which is a strictly stronger result. Both rules have their applications: while the former has to be used whenever we hash a secret, the latter may be useful to avoid the creation of unnecessary constraints when hashing terms like constants or public nonces.

Rules for HL, subtyping, and union types Rule THigh states that we can give type HL to any message, which intuitively means that it is always safe to treat any message as if it should not be published. The rule simply enforces that the message is well-formed in the sense that it only contains names, variables, and keys that are either bound in the typing environment, or free (i.e. generated by the attacker).

As expected, rule TSub allows us to subtype messages according to the subtyping relation.

Rule TOr also follows the intuition: it allows us to give a union type to messages, as long as they are typable with at least one of the two types.

Rules for refinements

The remaining rules deal with refinement types. TLR 1 and TLR ∞ are the introduction rules for them. Two names m, n can be given type τ l,a m ; τ l ,a n if τ l,a m and τ l ,a n are their respective type in Γ. The same is true for constant and public names: they do not have a type in Γ and are instead given label LL. Nonce generated by the protocol can be replicated or not (both rules TLR 1 and TLR ∞ apply), while public names and constant cannot be marked as replicated (only rule TLR 1 applies to them).

Rules TLR' and TLRL' are the corresponding elimination rules: similarly to rules TNonce and TNonceL, they allow to give type l ∈ {HH, HL, LL} to messages with a refinement type with the corresponding label τ l,a m ; τ l,a n . When l = LL, they additionally require that the two names m and n are the same, just as in TNonceL.

Finally, TLRVar allows to derive a new refinement type for two variables for which we have singleton refinement types, by taking the left refinement of the left variable and the right refinement of the right variable. Formally, if x has type τ l,1 m ; τ l ,1 n and y has type τ l ,1 m ; τ l ,1 n , then a message consisting of x on the left and y on the right can be given type τ l,1 m ; τ l ,1 n . The reason why this rule only applies with non-replicated refinement types lies in the intuition of the replicated types. A replicated type τ l,∞ m ; τ l ,∞ n is intended to represent the type for a nonce generated when invoking the randomness generator in one copy of a replicated process. More precisely, the index of the replicated copy in question is intended to be the same on both sides.

That is, this nonce should have been generated in the first replication on both sides, or in the second replication on both sides, etc. but not e.g. in the first on the left and the second on the right. Applying rule TLRVar with replicated refinement types would break this intuition: x and y could very well contain nonces generated in different replications of the process. Hence, we restrict it to unreplicated types.

We will see applications of this rule in the e-voting protocol, where we use it to combine A's vote (0 on the left, 1 on the right) and B's vote (1 on the left, 0 on the right), into a message that is the same on both sides.

Typing Processes

From now on, we assume that processes assign a type to freshly generated nonces and keys. That is, new n.P is now of the form new n : T. P , and similarly for new k.P . This requires a (very light) type annotation from the user. In addition, we assume in this section that P and Q do not contain replication and that variables and names are renamed to avoid any capture.

The typing judgement for processes is of the form Γ P ∼ Q → C and can be interpreted as follows: if two processes P and Q can be typed in Γ and if the generated constraint set C is consistent, then P and Q are trace equivalent.

When typing processes, the typing environment Γ is passed down and extended from the root towards the leaves of the syntax tree of the process, i.e., following the execution semantics. The generated constraints C however, are passed up from the leaves towards the root, so that at the root we get all generated constraints, modelling the attacker's global view on the process execution.

More precisely, each possible execution path of the process -there may be multiple paths because of conditionals -creates its own set of constraints c together with the typing environment Γ that contains types for all names and variables appearing in c. Hence, typing a pair of processes P , Q yields a constraint set C, which, as defined in Section 2.3.2, is a set elements of the form (c, Γ) for a set of constraints c. Keeping track of the types assigned to variables when typing is required for the constraint checking procedure, as they help us to be more precise when checking the consistency of constraints.

Well-formed environment

We first introduce a notion of well-formedness for typing environments. The judgement Γ reads "Γ is well-formed", and is defined in Figure 2.5. Basically, this condition ensures that the environment is correctly constructed. First, a well-formed environment Γ must only contain bindings for nonces, variables, and bikeys. It can also not contain several types for the same nonce, variable, or bikey. A name n ∈ BN can only be bound to a nonce type τ l,a n (rule GNonce); a variable x can be bound to any type (rule GVar); and a bikey (k, k ) ∈ BK 2 must be associated with a key type. The three rules for bikeys enforce the intuitive meaning of the different key types explained earlier (Section 2.1). They basically ensure that seskey l,a (T ) and eqkey l (T ) are only given when the key is the same on both sides, and that in addition a key with type seskey l,a (T ) is never part of another bikey.

More precisely a bikey (k, k ) can be bound to either

• a key type seskey l,a (T ) for some a, l, T (rule GSesKey): in that case, k must be equal to k , and this key must not appear in any other bikey bound in Γ.

• a key type eqkey l (T ) (rule GEqKey): as in the previous case, we require that k = k . k may appear in other bikeys bound in Γ, but we require that any such bikey is given a key

[] (GNil) Γ n ∈ BN n / ∈ dom(Γ) Γ, n : τ l,a n (GNonce) Γ x / ∈ dom(Γ) Γ, x : T (GVar) Γ k, k ∈ BK (k, k ) / ∈ dom(Γ) k / ∈ seskeys(Γ) k / ∈ seskeys(Γ) (∀l, T . Γ(k, k) = eqkey l (T ) ⇒ l = HH) (∀l, T . Γ(k , k ) = eqkey l (T ) ⇒ l = HH) Γ, (k, k ) : key HH (T ) (GKey) Γ k ∈ BK (k, k) / ∈ dom(Γ) (∀k , l , T . Γ(k, k ) <: key l (T ) ⇒ l = l ) (∀k , l , T . Γ(k , k) <: key l (T ) ⇒ l = l ) Γ, (k, k) : eqkey l (T ) (GEqKey) Γ k ∈ BK ∀k = k.(k, k ) / ∈ dom(Γ) ∧ (k , k) / ∈ dom(Γ)
Γ, (k, k) : seskey l,a (T ) (GSesKey) type with the same security label l. It would indeed not make sense for a key to be secret when considered in one bikey, and known by the attacker in another bikey. Note that the condition that (k, k) itself is not already bound in Γ implies in particular that k does not already have type seskey l,a (T ).

• a key type key l (T ) (rule GKey). In that case, we allow k and k to be different, but we require that l = HH: indeed, a bikey with a different value on either side must be kept secret, or the attacker could use it to distinguish the two processes. As before, we require that neither k nor k already appear with a seskey l,a (T ) type, and that any other binding for k or k has the same label HH (as rule GKey already implies this last condition for type key l (T ), we only need to check it when the type is eqkey l (T )).

Typing processes: inputs, outputs, parallel branching Our typing rules for processes are presented in Figure 2.6 and explained in the following. Rule PZero copies the current typing environment in the constraints and checks the well-formedness of the environment (Γ ). As this instruction is at the end of every execution path, we use the typing environment at this point for constraint checking, as it is guaranteed to contain an entry for all nonces and variables that may have been used on this execution path and hence may appear in the constraints. In addition, we require that all variables with union types in Γ have been split beforehand, i.e. that branches(Γ) = {Γ}. As we will see, this can be done by applying rule POr as needed when reaching the null process.

Messages output on the network are possibly learned by the attacker. Rule POut states that we can output messages to the network if we can type them with type LL, i.e., they are indistinguishable to the attacker, provided that the generated set c of constraints is consistent. The constraints of c are then added to all constraints in the constraint set C, using the ∪ ∀ operator defined earlier in Section 2.3.2.

Γ branches(Γ) = {Γ} Γ 0 ∼ 0 → (∅, Γ) (PZero) Γ P ∼ Q → C Γ M ∼ N : LL → c Γ out(M ).P ∼ out(N ).Q → C∪ ∀ c (POut) Γ, x : LL P ∼ Q → C Γ in(x).P ∼ in(x).Q → C (PIn) Γ, n : τ l,a n P ∼ Q → C Γ new n : τ l,a n .P ∼ new n : τ l,a n .Q → C (PNew) Γ, (k, k) : seskey l,a (T ) P ∼ Q → C
Γ new k : seskey l,a (T ).P ∼ new k : seskey l,a (T ).Q → C (PNewKey) Γ adec(x, y) ∼ adec(x, y) : T (DAdecT')

Γ P ∼ Q → C Γ P ∼ Q → C Γ P | P ∼ Q | Q → C∪ × C (PPar) Γ, x : T P ∼ Q → C Γ, x : T P ∼ Q → C Γ, x : T ∨ T P ∼ Q → C ∪ C (POr) Γ t ∼ t : T Γ, x : T P ∼ Q → C Γ P ∼ Q → C Γ let x = t in P else P ∼ let x = t in Q else Q → C ∪ C (PLet) Γ(y) = LL Γ(k 1 , k 2 ) <: key HH (T ) Γ, x : T P ∼ Q → C Γ P ∼ Q → C (∀T .∀k 3 = k 2 . Γ(k 1 , k 3 ) <: key HH (T ) ⇒ Γ, x : T P ∼ Q → C k3 ) (∀T .∀k 3 = k 1 . Γ(k 3 , k 2 ) <: key HH (T ) ⇒ Γ, x : T P ∼ Q → C k3 ) Γ let x = dec(y, k 1 ) in P else P ∼ let x = dec(y, k 2 ) in Q else Q → C ∪ C ∪ ( k3 C k3 ) ∪ ( k3 C k3 ) (PLetDec) Γ(y) = LL Γ(k, k) <: key HH (T ) Γ, x : T P ∼ Q → C Γ, x : LL P ∼ Q → C Γ P ∼ Q → C (∀T .∀k 3 = k. Γ(k, k 3 ) <: key HH (T ) ⇒ Γ, x : T P ∼ Q → C k3 ) (∀T .∀k 3 = k. Γ(k 3 , k) <: key HH (T ) ⇒ Γ, x : T P ∼ Q → C k3 ) Γ let x = adec(y, k) in P else P ∼ let x = adec(y, k) in Q else Q → C ∪ C ∪ C ∪ ( k3 C k3 ) ∪ ( k3 C k3 ) (PLetAdecSame) k1 = k2 Γ(y) = LL Γ(k1, k2) <: key HH (T ) Γ, x : T P ∼ Q → C Γ, x : LL P ∼ Q → C Γ, x : LL P ∼ Q → C Γ P ∼ Q → C (∀T .∀k3 = k2. Γ(k1, k3) <: key HH (T ) ⇒ Γ, x : T P ∼ Q → C k 3 ) (∀T .∀k3 = k1. Γ(k3, k2) <: key HH (T ) ⇒ Γ, x : T P ∼ Q → C k 3 ) Γ let x = adec(y, k1) in P else P ∼ let x = adec(y, k2) in Q else Q → C ∪ C ∪ C ∪ C ∪ ( k 3 C k 3 ) ∪ ( k 3 C k 3 ) (PLetAdecDiff) Γ(y) = τ l,a n ; τ l ,a m ∨ Γ(y) <: key l (T ) Γ P ∼ Q → C Γ let x = d(y) in P else P ∼ let x = d(y) in Q else Q → C (PLetLR)
Γ P ∼ Q → C 1 Γ P ∼ Q → C 2 Γ P ∼ Q → C 3 Γ P ∼ Q → C 4 Γ if M = M then P else P ∼ if N = N then Q else Q → C 1 ∪ C 2 ∪ C 3 ∪ C 4 (PIfAll)
Γ(k, k) <: key LL (T ) Γ(x) = LL Γ dec(x, k) ∼ dec(x, k) : LL (DDecL) Γ(k, k) = seskey l,a (T ) Γ(x) = (T ) seskey l,a (T ) Γ dec(x, k) ∼ dec(x, k) : T (DDecT) Γ(y) = seskey l,a (T ) Γ(x) = (T ) seskey l,a (T ) Γ dec(x, y) ∼ dec(x, y) : T (DDecT') Γ(y) = seskey HH,a (T ) Γ(x) = LL Γ dec(x, y) ∼ dec(x, y) : T (DDecH') (Γ(y) = seskey LL,a (T ) ∨ Γ(y) = LL) Γ(x) = LL Γ dec(x, y) ∼ dec(x, y) : LL (DDecL') Γ(k, k) <: key LL (T ) Γ(x) = LL Γ adec(x, k) ∼ adec(x, k) : LL (DAdecL) Γ(y) = seskey HH,a (T ) Γ(x) = LL Γ adec(x, y) ∼ adec(x, y) : T ∨ LL (DAdecH') (Γ(y) = seskey LL,a (T ) ∨ Γ(y) = LL) Γ(x) = LL Γ adec(x, y) ∼ adec(x,
Γ(k, k) <: key HH (T ) Γ(x) = LL Γ checksign(x, vk(k)) ∼ checksign(x, vk(k)) : T (DCheckH) Γ(k, k) <: key LL (T ) Γ(x) = LL Γ checksign(x, vk(k)) ∼ checksign(x, vk(k)) : LL (DCheckL) Γ(y) = vkey(T ) T <: eqkey HH (T ) Γ(x) = LL Γ checksign(x, y) ∼ checksign(x, y) : T (DCheckH') (Γ(y) = vkey(T ) ∧ T <: eqkey LL (T )) or Γ(y) = LL Γ(x) = LL Γ checksign(x, y) ∼ checksign(x, y) : LL (DCheckL') Γ(x) = T * T Γ π 1 (x) ∼ π 1 (x) : T (DFst) Γ(x) = T * T Γ π 2 (x) ∼ π 2 (x) : T (DSnd) Γ(x) = LL Γ π 1 (x) ∼ π 1 (x) : LL (DFstL) Γ(x) = LL Γ π 2 (x) ∼ π 2 (x) : LL (DSndL)

Typing

Conversely, messages input from the network are stored in variables to which we give type LL (rule PIn), since the message is known to or may even originate from the attacker.

Rule PNew introduces a new nonce, which may be used in the continuation processes. This nonce is added with its type to the environment. Similarly, rule PNewKey allows us to generate new session keys at runtime, which is useful to accurately model security protocols.

In rule PPar, when typechecking parallel composition P | P ∼ Q | Q , we first typecheck the individual subprocesses P ∼ Q, P ∼ Q . We then take the product union C∪ × C (as defined in Section 2.3.2) of the generated constraint sets C, C as the new constraint set.

Intuitively, the elements in C correspond to the constraints for each possible execution path in P and Q, and the ones in C to the execution paths of P and Q . Hence for their parallel composition, we need to combine each possible execution of P (and Q) with each possible execution of P (and Q ). The product union operation does exactly that. The combinations that are discarded due to incompatible environments correspond to impossible executions (e.g., taking the left branch in P and the right branch in P in two conditionals with the same guard).

POr is the elimination rule for union types, which requires the continuation process to be well-typed with both types.

Generic rules for destructor application

Several rules handle the application of destructors to messages: a general rule, PLet, and four additional rules for specific cases, PLetDec, PLetAdecSame, PLetAdecDiff, and PLetLR.

First, rule PLet applies to the case where we can statically know that a destructor application succeeds or fails equally in the two processes. To ensure this property, for this rule, we only allow the same destructor to be applied to the same variable in both processes. As usual, we then typecheck the two then-branches together, as well as the else branches, and then take the union of the corresponding constraints. Rule PLet relies on additional rules for destructors. We present them in Figure 2.8.

• Rule DDecL simply states that decrypting a variable of type LL (typically input from the network) with an untrusted key (label LL) yields a result of type LL. Rule DDecL' is similar, but can be applied when decrypting using a variable as a key, as opposed to decrypting with a message that is explicitly a key. Rules DAdecL and DAdecL' are analogous to rules DDecL and DDecL' respectively, for the case of asymmetric decryption.

• Symmetric decryption with a trusted session key (with label HH) returns, in case of success, a value of the key's payload type (rule DDecH'). Note that this rule only applies when the key has type seskey HH,a (T ). Indeed, using a trusted key is not sufficient to know that decryption will succeed or fail equally on both sides: we need to know that, when encrypting, this key can never be used to encrypt a message on the left while a different key would be used on the right (and conversely). This is enforced by requiring that the key never appears with another key in a bikey in Γ. Type seskey HH,a (T ) exactly expresses this condition. To decrypt with a key that does appear in other bikeys, a more complex rule (PLetDec) is required, which we will present later. Rule DDecH' only applies to the case where the key is a variable. No additional "DDecH" rule is used for the case where the key is explicit, as rule PLetDec will apply to all decryptions with trusted, explicit symmetric keys.

• Rule DAdecH' is similar to rule DDecH', but for the asymmetric case. As stated earlier, in that case, even when decrypting with a trusted key, the ciphertext may have been constructed by the attacker who knows the public key. Hence, decryption yields a message of type T ∨ LL, rather than simply T . Here again it is important that the key is of type seskey HH,a (T ), since this guarantees that the key is never used in combination with a different key and hence decryption will always equally succeed or fail in both processes. As before, the other cases are handled by special rules PLetAdecSame and PLetAdecDiff.

• Rule DDecT treats the case in which we know that the variable x is a symmetric encryption of a specific type. If the type of the key used for decryption matches the key type used for encryption, we know the exact type of the result of a successful decryption. DDecT' is similar to DDecT, with a variable as key. Asymmetric decryption is handled by analogous rules DAdecT and DAdecT'.

• Verifying a signature with the verification key associated to a trusted key yields a message of the payload type specified in the type of the key in rule DCheckH. If the signature key is not trusted, we simply obtain an untrusted message, of type LL, as the signature may have been produced by the attacker (rule DCheckL). Note that the typing rules for messages only allow to sign messages with the same key on either side, as using a different key would let the attacker distinguish between the two sides. Hence, as long as the signature is checked using the same key on both sides, we know that the verification will succeed or fail equally on both sides.

Rules DCheckH' and DCheckL' are similar, except a variable is used as a verification key.

• Finally, rules DFst, DSnd apply when projecting pairs: if a message has type T * T , its first and second projections respectively have types T and T . Rules DFstL and DSndL state that projecting an untrusted message of type LL yields another untrusted message.

Rules for symmetric decryption Rule PLetDec handles symmetric decryptions where we use fixed honest keys k 1 , k 2 (labelled HH as a bikey in Γ) for decryption in each process. In our type system, we allow encryptions with potentially different keys on either side, which requires cross-case validation in order to retain soundness. That is, since different keys may be used, we cannot statically know that decryption will succeed or fail equally on both sides. For instance decrypting with k 1 on the left and k 2 on the right a message encrypted with k 1 on the left and some other key k 3 on the right would succeed on the left but fail on the right. Still, the number of possible combinations of encryption keys is limited by the assignments in the typing environment Γ. The typing rules for messages intuitively ensure that the messages we encounter can only be encrypted with keys that match one of the bikeys in Γ. To cover all the possibilities, we thus type the following combinations of continuation processes:

• Both then branches: In this case we know that decryption succeeds on both sides, i.e. key k 1 was used for encryption on the left, and k 2 on the right. Since Γ(k 1 , k 2 ) <: key HH (T ), we know that in this case the payload type is T , and we type the continuation with Γ, x : T .

• Both else branches: If decryption fails on both sides, we type the two else branches without introducing any new variables.

• Left then, right else: The encryption may have been created with key k 1 on the left side and another key than k 2 on the right side. Hence, we consider each k 3 = k 2 such that Γ(k 1 , k 3 ) maps to a key type with some payload type T . Note that by well-formedness of Γ, all possible such bikeys also have label HH. For each such k , we have to typecheck the left then branch and the right else branch with Γ, x : T .

• Left else, right then: This case is analogous to the previous one.

The generated set of constraints is then simply the union of all generated constraints for the subprocesses, accounting for all possible execution paths.

Rules for asymmetric decryption

The rules for asymmetric decryption are similar, except they are split into two rules, PLetAdecSame and PLetAdecDiff, depending on whether the decryption key is the same on both sides or not. As in the symmetric case, we cannot know that decryption succeeds or fails equally on the left and the right, and we thus need to consider all bikeys in Γ where the decryption keys occur. The difference lies in the fact that, contrary to the symmetric case, even when the key is trusted, the attacker knows the public key, and may thus have produced the ciphertext.

If the same decryption key is used on both sides, when decryption succeeds on both sides, it may yield a plaintext provided by the attacker. Hence we additionally typecheck both thenbranches, giving type LL to the plaintext. However when decryption fails e.g. on the left and succeeds on the right, this means the ciphertext we tried to decrypt was not encrypted with the same public key on both sides. Thus it cannot originate from the attacker, who has to behave the same on both sides. We therefore do not need to typecheck the cross-cases with a plaintext of type LL (but only with the payload type specified in the key types).

If different keys k 1 , k 2 are used to decrypt, when decryption succeeds on both sides, we know for the same reason that the message was not constructed by the attacker, and thus we do not need to typecheck the then-branches with type LL. However we might be decrypting a message from the attacker, encrypted with e.g. pk(k 1 ) on both sides. Then decryption would then succeed on the left and fail on the right: we need to typecheck the left then-branch together with the right else-branch, while considering the plaintext to be LL (and conversely for the case of messages encrypted with pk(k 2 )).

In the special case in which we know that the concrete value of the argument of the destructor application is a nonce or constant due to a refinement type, and we know statically that any destructor application will fail, we only need to type-check the else branch (rule PLetLR).

Rules for conditional branching

The remaining rules handle conditional branching. As for destructor applications, the difficulty while typing conditionals is to determine whether the same branch is taken in both processes. One way to ensure this is with a trick: in rule PIfL, we type both the left and the right operands of the conditional with type LL and add both generated sets of constraints to the constraint set. Intuitively, this means that the attacker could perform the equality test himself, since the guard is of type LL, which means that the conditional must take the same branch on the left and on the right. These are exactly the same steps that we would take to output the respective values on the network (see rule POut), hence it would be safe to output them on the network. It then follows directly that the equality check evaluates to the same value in the two processes, otherwise the attacker could use his observations on the (theoretical) outputs to distinguish the processes.

Rule PIfP allows us to do this without generating new constraints, in the special case where one of the messages being compared is the same public name or constant on both sides. Indeed in that case, regardless of constraints, the other message (of type LL) has to be either equal to that name on both sides, or different from it on both sides.

In the special case in which we can statically determine the concrete value of the terms in the conditional, thanks to the refinement types, we have to typecheck only the single combination of branches that will be executed (rule PIfLR). Note that this rule only applies for non-replicated nonce types (with a = 1): intuitively, these types can only be given to one single nonce. This is however not the case of replicated nonce types (with a = ∞): we cannot know whether we are comparing the value of two copies of a nonce coming from different instances of a replicated process, or from the same instance. This case is handled by rule PIfLR'*. Although we know that the nonces on both sides are of the same type, we cannot assume that they are equal. Yet, a replicated refinement type guarantees us that any nonce with this type has been generated in the same replicated instance on the left and on the right. This means that the two nonces we compare either come from the same instance on both sides, or they come from different instances on both sides. Thus the equality check always yields the same result in the two processes.

Similarly, when the type of one of the messages being compared indicates it is a pair, while the other has a nonce type, we know that the equality check will always fail on both sides. Rule PIfI allows us to only typecheck the else-branches. This could easily be extended to more cases of incompatible types.

All these special cases highlight how a careful treatment of names in terms of equivalence classes (statically captured by types) is a powerful device to enhance the expressiveness of the analysis.

Another special case is if the messages being compared are of type HH on the left, and of type LL on the right. As a secret of high integrity can never be equal to a public value of low integrity, we know that both processes will take the else branch (PIfS). This rule is crucial, since it may allow us to prune the LL typing branch produced by asymmetric decryption.

Finally, rule PIfAll lets us typecheck any conditional by simply checking the four possible branch combinations. In contrast to the other rules for conditionals that we presented, this rule does not require any other preconditions or checks on the terms M, M , N, N .

Remark As a final remark on the typing rules, notice that we do not have any typing rule for replication: this is in line with our general idea of typing a bounded number of sessions and then extending this result to the unbounded case in the constraint checking phase, as detailed in the next sections.

Constraints

Our type system collects constraints that intuitively correspond to (an overapproximation of) symbolic messages that the attacker may see (or deduce) during an execution of the process. Therefore, intuitively, two processes are in trace equivalence only if the collected constraints are in static equivalence for any plausible instantiation of the variables they contain.

However, checking static equivalence of symbolic frames for exactly the instantiations that correspond to a real execution may be as hard as checking trace equivalence [START_REF] Cheval | Deciding equivalence-based properties using constraint solving[END_REF]. Conversely, checking static equivalence for all possible instantiations may be too strong and may prevent proving equivalence of processes. Instead, we use again the abstraction of types to overapproximate the set of possible instantiations. We use the typing information gathered by our type system,

Constraints

and we consider only instantiations that comply with the type. Such instantiations are said to be well-typed. Actually, we even restrict our attention to instantiations where variables of type LL are only replaced with deducible terms.

Hence, we define a constraint to be consistent if the corresponding two frames are in static equivalence for any instantiation that can be typed and produces constraints that are included in the original constraint.

Formally, we first introduce the following ingredients.

Definition 9 (Frames associated to a set of constraints). If c is a set of constraints, let φ l (c) and φ r (c) denote the frames composed of the left and right terms of the constraints respectively (in the same fixed order).

Definition 10 (Frames associated to environments). If Γ is a typing environment, φ Γ LL denotes the frame that is composed of all low confidentiality nonces and keys in Γ, i.e. all nonces n such that ∃a. Γ(n) = τ LL,a n and keys k such that ∃T.Γ(k, k) <: key LL (T ), as well as all public encryption keys pk(k) and verification keys vk(k) for k ∈ keys(Γ). This intuitively corresponds to the initial knowledge of the attacker. Definition 11 (Notations). For a typing environment Γ, we denote by Γ X its restriction to variables, and by Γ N ,K its restriction to names and bikeys.

Definition 12 (Well-typed substitutions). Two ground substitutions σ, σ are well-typed in Γ with constraint c σ if they preserve the types for variables in Γ, i.e.

• dom(σ) = dom(σ ) = dom(Γ X ),

• and ∀x. Γ σ(x) ∼ σ (x) : Γ(x) → c x for some c x such that c = x∈dom(Γ X ) c x .

We then write Γ N ,K σ ∼ σ : Γ X → c σ .

The instantiation of a constraint is defined as expected:

Definition 13 (Instantiation of constraints). If c is a set of constraints, and σ, σ are two substitutions, let c σ,σ be the instantiation of c by σ on the left and σ on the right, that is,

c σ,σ = {M σ ∼ N σ | M ∼ N ∈ c}.
Similarly we write for a constraint set

C C σ,σ = {( c σ,σ , Γ) | (c, Γ) ∈ C}.
We can now formally define the consistency property.

Definition 14 (Consistency).

A set of constraints c is consistent in an environment Γ if for all subsets c ⊆ c and Γ ⊆ Γ such that Γ N ,K = Γ N ,K and vars(c ) ⊆ dom(Γ ), for all (ground) substitutions σ,σ well-typed in Γ with a constraint c σ such that c σ ⊆ c σ,σ , the frames φ Γ LL ∪ φ l (c )σ and φ Γ LL ∪ φ r (c )σ are statically equivalent. We say that (c, Γ) is consistent if c is consistent in Γ, and that a constraint set C is consistent if each element (c, Γ) ∈ C is consistent.

Note that not only do we restrict our attention to instantiations σ, σ that are well-typed, but we also require that typechecking them produces as constraints a subset of the constraints for the frames φ, φ (once instantiated). The intuition behind this restriction is that the constraint c φ should contain everything the attacker can observe in an execution that produces the frames φ, φ . Similarly, the constraint c σ is intended to contain what the attacker can observe from the public messages (i.e. those of type LL) in σ, σ . Intuitively, in any actual run of the protocol, the information learned from c σ should already be contained in the information learned from c φ , which is why it is sufficient to check consistency for instantiations that satisfy this condition. We will show later on that this intuition is correct in our type system.

Soundness

In this section, we provide our first main result: the soundness of our type system, i.e. whenever two processes can be typed with consistent constraints, then they are in trace equivalence.

Our type system soundly enforces trace equivalence: if we can typecheck P and Q then P and Q are equivalent, provided that the corresponding constraint set is consistent.

Theorem 1 (Typing implies trace equivalence). For all P , Q, and C, for all Γ containing only keys, if Γ P ∼ Q → C and C is consistent, then P ≈ t Q.

We now present the proof for Theorem 1. Rather than a fully formal proof, we choose to give an intuition of the structure of the proof, by only describing the main lemmas, and how they follow from one another. The fully detailed proofs are provided in Appendix A.1. Unless specified otherwise, the environments Γ considered in the lemmas are implicitly assumed to be well-formed.

The core of the proof is an invariant that basically states that when two processes P , Q can be typechecked with a consistent constraint, then any reduction step performed in P can be mimicked by one or several steps in Q, with the same observable action. The processes obtained after reduction can still be typechecked with consistent constraints, and the frames of output messages during the reduction can be given type LL. This invariant will be formally stated later.

Intuitively, by applying this invariant successively, we know that for such P , Q, any chain of reduction in P can be simulated in Q so that the sequences of messages on the left and on the right have type LL. We then prove that this implies these two sequences of messages are statically equivalent. This shows the trace inclusion P t Q, and by symmetry we obtain the other inclusion, proving that the two processes are trace equivalent.

In the following, we present some of the main lemmas that we use to prove the invariant and the soundness theorem, explain why they are needed, and sketch their proofs somewhat informally. The fully formal proofs, and the precise statement of all lemmas, can be found in Appendix A.1.

i.e. branches(Γ ) = {Γ }3 . Then

P , Q still typecheck in Γ ∪ Γ : Γ ∪ Γ P ∼ Q → C , where C = {(c, Γ c ∪ Γ )|(c, Γ c ) ∈ C}.
The proof for this lemma follows from a clear induction on the type derivation for the judgement Γ P ∼ Q → C. Lemma 2 (Consistency for Subsets).

• If (c, Γ) is consistent, and c ⊆ c then (c , Γ) is consistent.

• Let C be a consistent constraint set. Then every subset C ⊆ C is also consistent.

• If C∪ ∀ c is consistent then C also is.
This property follows quite easily from the definition of consistency.

Lemma 3 (Substitution preserves typing). Consider messages M , N of type T in Γ, i.e. Γ M ∼ N : T → c for some c. Consider two ground substitutions σ, σ that correctly evaluate, i.e. ∀x. σ(x)↓ = ⊥ (and similarly for σ ). Assume they are well-typed, i.e. Γ N ,K σ ∼ σ : Γ X → c σ .

Then

Γ N ,K M σ ∼ N σ : T → c , for some c ⊆ c σ,σ ∪ c σ .
Here again, the proof is an easy induction on the type derivation for Γ M ∼ N : T → c.

We then establish another series of lemmas, that show the types used to describe the structure of terms (i.e. (T ) T , {T } T , etc.) correctly follow the intuition we gave for them earlier.

For instance, here is (part of) the lemma for symmetric encryptions. The first point of the lemma states that messages of type (T ) T are indeed either the encryption of a message of type T with a message of type T , or variables (intuitively some x such that Γ(x) = (T ) T ). The second one states that if two messages have type LL, and one of them is an encryption, then the other one also is. In addition, either the terms used as keys can be given a trusted key type (label HH), and then the plaintexts have the expected payload type, or the terms used as keys as well as the plaintexts have type LL. Intuitively, in the first case the encryption must have been produced by a legitimate process (since the key is secret), and the typechecking thus enforces that process provided a payload with the correct type. In the second case, the key is not trusted, and thus the encrypted message may have been generated by the attacker: the payload has type LL. Lemma 4 (Symmetric encryption types). For all Γ, T, T , M, N, M 1 , M 2 , c:

• If Γ M ∼ N : (T ) T → c then -either M = enc(M 1 , M 2 ), N = enc(N 1 , N 2 ) and c = c 1 ∪ c 2 , for some M 1 , M 2 , N 1 , N 2 , c 1 , c 2 such that Γ M 1 ∼ N 1 : T → c 1 , and Γ M 2 ∼ N 2 : T → c 2 ,
or M and N are variables.

• If Γ enc(M 1 , M 2 ) ∼ N : LL → c then N = enc(N 1 , N 2 ) for some N 1 , N 2 ,
and

-either Γ M 1 ∼ N 1 : T → c 1 , Γ M 2 ∼ N 2 : key HH (T ) → c 2 , and c = {enc(M 1 , M 2 ) ∼ N } ∪ c 1 ∪ c 2 , for some T , c 1 , c 2 ; -or Γ M 1 ∼ N 1 : LL → c 1 , Γ M 2 ∼ N 2 : LL → c 2 , and c = c 1 ∪ c 2 for some c 1 , c 2 .
Proof sketch. Both points are proved by induction on the typing derivation: we study all possible cases for the last rule of the derivation, and all of them are rather straightforward. For the first point for instance, this last rule can only be TEnc, TVar, or TSub, by the form of the type (T ) T . In the TEnc and TVar cases, the premises of the rule directly prove the claim. In the TSub case, earlier technical lemmas (described in Appendix A.1) show us that before subtyping, M and N had necessarily been given type (T ) T for some T <: T : applying the induction hypothesis to that judgement proves the claim.

Armed with these technical lemmas, we are now able to prove more meaningful properties about the behaviour of messages that can be typed.

The following lemma states that the typing rules for destructors, used in rule PLet, are sound. More precisely, we establish that when a destructor is given typed T by these rules, then instantiating it in a well-typed manner produces a term that either fails to evaluate on both sides, or evaluates on both sides to messages of type T . In addition, in the second case, typing the messages produces as constraints a subset of the constraints associated with the instantiation.

Γ N ,K σ ∼ σ : Γ X → c σ , where Γ = Γ N ,K ∪ Γ| dom(σ) . Then 1. (dσ)↓= ⊥ ⇐⇒ (d σ )↓= ⊥ 2. And if (dσ)↓ = ⊥ then there exists c ⊆ c σ such that Γ N ,K (dσ)↓∼ (d σ )↓: T → c
Proof sketch. We prove this property by examining, for each sort of destructor (symmetric and asymmetric decryption, signature verification, pair projection) which of the rules can lead to the judgement Γ d ∼ d : T . For instance, in the case of symmetric decryption, one possibility is that this judgement was obtained by rule DDecL. In that case we know that T = LL, and that d = d = dec(x, k) for some x, k, T such that Γ(k, k) <: key LL (T ) and Γ(x) = LL. Hence, by well-typedness, Γ N ,K σ(x) ∼ σ (x) : LL → c for some c ⊆ c σ . Lemma 4 then guarantees us that if σ(x) is indeed an encryption with key k, then so is σ (x), and conversely. This proves the first point: decryption either succeeds on both sides, or fails on both sides. In addition, Lemma 4 also implies that when decryption succeeds, the plaintexts in the two encryptions have type LL with a constraint c ⊆ c ⊆ c σ . This proves the claim for that case. All the other cases have similar proofs, that use the other technical lemmas mentioned earlier.

This property is required to establish our invariant: indeed, we need to know that after performing a reduction step in well-typed processes, we still obtain well-typed processes. In the case of a destructor application, if the processes were typechecked using rule PLet, we know that the (uninstantiated) destructor is given some type T by the destructor typing rules. We also know that the two else-branches typecheck, as well as the two then-branches when adding to the environment that the destructor produced a term of type T . This suffices to show that the two processes still typecheck after reduction only if we can be sure that the two processes follow the same branch (i.e., both then-branches or both else-branches), and that when the destructor application succeeds, it indeed yields a term of type T . This is precisely what Lemma 5 tells us.

We also prove the following property. It states that when two messages can be typed (with any type), then their evaluation either succeeds for both, or fails for both. Note that messages do not contain destructors: thus the only reason why the evaluation might fail is the use of something other than a key in a key position in the message. Lemma 6 (Typable messages either reduce on both sides, or fail on both sides). For all (well-formed) Γ, for all messages M , M , for all T , c, if

Γ M ∼ N : T → c, then M↓= ⊥ ⇐⇒ N↓= ⊥.
Proof sketch. The proof is by induction on the type derivation of Γ M ∼ N : T → c. The most interesting case is arguably that of rule TEnc:

in that case M = enc(M 1 , M 2 ), N = enc(N 1 , N 2 ) and T = (T 1 ) T 2 for some M 1 , M 2 , N 1 , N 2 , c 1 , c 2 , T 1 , T 2 such that Γ M i ∼ N i : T i → c i (for i = 1, 2)
, T 2 is either LL or a key type, and c = c 1 ∪ c 2 . The evaluation of M (resp. N ) fails when M 1 ↓= ⊥ (resp. N 1 ), or when M 2 ↓ (resp. N 2 ) is not a key. By induction, M 1 ↓= ⊥ if and only if N 1 ↓= ⊥. In addition, it can be proved that since Γ M 2 ∼ N 2 : T 2 → c 2 and T 2 is LL or a key type, M 2 and N 2 are necessarily either two keys, or none of them is a key (this property is one of the technical lemmas mentioned earlier). This proves the claim for this case. The other cases are similar, again relying on technical properties established earlier.

As for the previous lemma, this property is required to prove our invariant. It is important when considering the output of messages. Consider processes out(M ).P , out(N ).Q that were typechecked using rule POut. We need (among other conditions) to ensure that if the output can be performed in the first process, then it can also be performed in the second one.

The semantics specifies that a message can only be output if it successfully evaluates. We cannot now a priori that M and N do. It may indeed be possible that the messages are e.g. encrypted with a key provided by the attacker, in which case, depending on whether the attacker gave an actual key or some other message, the processes might reduce or not. This lemma guarantees us that M and N will either evaluate on both sides or fail on both sides, and thus that if the left process reduces, then so does the right process.

We next prove another key lemma, which formally confirms the intuition given earlier, that the attacker should only be able to construct messages of type LL. More precisely, it states that from two frames of messages of type LL (one on the left, one on the right), by applying attacker recipes, the attacker (1) cannot construct terms that would evaluate on one side and fail on the other, (2) can only obtain messages of type LL (when the evaluation succeeds).

At this point we introduce a notation for such frames of type LL, that represent the knowledge of the attacker: Definition 15 (LL frames). Consider two frames φ, φ with the same domain. We say that φ, φ have type LL in an environment Γ with constraint c, and write

Γ φ ∼ φ : LL → c, if ∀x ∈ dom(φ). Γ φ(x) ∼ φ (x) : LL → c x for some c x such that c = x∈dom(φ) c x .
Formally, the aforementioned property is then: Lemma 7 (LL type is preserved by attacker terms). Consider Γ, and two frames φ and φ such that Γ φ ∼ φ : LL → c φ . Then for all attacker term R with vars(R) ⊆ dom(φ), either

Γ Rφ↓∼ Rφ ↓: LL → c for some c ⊆ c φ or Rφ↓= Rφ ↓= ⊥.
Proof sketch. This proof is by induction on the attacker recipe R. We describe here the case where R = dec(S, K) for some recipes S, K. The other cases are mostly similar. We apply the induction hypothesis to K, and distinguish three cases.

1. if Kφ↓= ⊥, then by induction Kφ ↓= ⊥, and thus Rφ↓= Rφ ↓= ⊥.

2. otherwise, by induction, Γ Kφ↓∼ Kφ ↓: LL → c for some c ⊆ c φ . Then:

• either Kφ↓ is not a key, and then we can show that Kφ ↓ cannot be a key either (this is one of the technical lemmas, provided in Appendix A.1). Thus, again, Rφ↓= Rφ ↓= ⊥.

• or Kφ↓ is a key k, and the same technical lemma shows that Kφ ↓ is necessarily the same key k, and that either Γ(k, k) <: key LL (T ) (for some T ), or k ∈ F K is a key produced by the attacker. We then apply the induction hypothesis to S: either Sφ↓= Sφ ↓= ⊥, or Γ Sφ↓∼ Sφ ↓: LL → c for some c ⊆ c φ . In the first case, again, Rφ↓= Rφ ↓= ⊥ and the claim holds. In the second case, we apply Lemma 4:

either Sφ↓ and Sφ ↓ are both encryptions with k: i.e. Sφ↓= enc(M, k) and Sφ ↓= enc(N, k) for some M , N , and Lemma 4 also tells us that Γ M ∼ N : LL → c for some c ⊆ c ⊆ c φ . Since in this case Rφ↓= M and Rφ ↓= N , this proves the claim. -or neither of them are: then again, Rφ↓= Rφ ↓= ⊥ and the claim holds. This property validates the fact that we assign type LL to messages input from the network. It is crucial in order to prove the invariant, in particular in the case where we consider processes of the form in(x).P , in(x).Q (rule PIn). Indeed, these will reduce to P and Q respectively, with some message constructed by the attacker using the frame of previous outputs being stored in variable x. To show that P and Q still typecheck, we will want to use the premise of rule PIn: it guarantees that they typecheck provided x is considered to have type LL. We know that the message actually stored into x has this type thanks to Lemma 7.

As mentioned, the invariant we prove will guarantee that for processes that typecheck with consistent constraints, any execution produces frames that are of type LL, with consistent constraints. For this to imply trace equivalence, we need to show that such frames are statically equivalent.

As we explained earlier, the intuition is that the constraints produced when typechecking messages with type LL contain all the information the attacker learns when observing these messages. Static equivalence of the constraints, which is intuitively what consistency entails, then implies the frames to be statically equivalent.

More precisely, we first show the following property, which formalises that intuition. It states that messages of type LL can always be reconstructed by the attacker using only the messages contained in the constraints, as well as public names and keys. Lemma 8 (LL terms are recipes on their constraints). Consider ground messages M , N , such that Γ M ∼ N : LL → c for some Γ, c. Then there exists an attacker recipe R without destructors such that

M = R(φ l (c) ∪ φ Γ LL ) and N = R(φ r (c) ∪ φ Γ LL ).
Proof sketch. We actually prove an equivalent formulation: we show that this holds as soon as messages have any type T <: LL. That statement is equivalent to the one above, thanks to rule TSub, but it allows us to prove the claim by induction on the typing derivation for Γ M ∼ N : T → c (the first formulation is indeed not inductive in the case of rule TSub). We study each possible case for the last rule applied in that derivation. Most cases are rather straightforward, either directly or just by applying the induction hypothesis. For instance, in the case of rules TEncH or THash, M ∼ N is directly added to the constraint, which makes the claim trivial. For rules such as TPair or THashL, c contains the constraints generated when typing each component of the pair (resp. the message being hashed). By induction, these components can therefore be constructed by the attacker by applying some recipe on (a subset) of the constraints. Then M and N themselves can be obtained by pairing (resp. hashing) these recipes.

Some cases are slightly more involved and require the use of some technical lemmas. We will not detail all cases here, but only, for the sake of example, that of rule TEncL. In that case, we know by the premise of the rule that Γ M ∼ N : (LL) T → c with T <: key LL (T ) (for some T ). By Lemma 4, we then know that M , N are encryptions of messages M , N of type LL (with some constraint c ⊆ c) with some untrusted key. By induction4 , we then know that M , N can be constructed by the attacker using the constraint c. Since the attacker knows the untrusted encryption key, he can thus also construct M , N , which prove the claim in that case.

Using that lemma, we can then prove that frames of type LL with consistent constraints are statically equivalent.

Lemma 9 (LL frames with consistent constraints are statically equivalent). For all ground frames φ, φ such that Γ φ ∼ φ : LL → c for some c consistent in Γ N ,K , φ and φ are statically equivalent.

Proof. Consider two attacker recipes R, R , that use variables in dom(φ)(= dom(φ )). Since Γ φ ∼ φ : LL → c, by definition for any x ∈ dom(φ) φ(x) and φ (x) have type LL in Γ for some subset of c. Thus, by Lemma 8, there exists a recipe R x such that φ

(x) = R x (φ l (c) ∪ φ Γ LL ) and φ (x) = R x (φ r (c) ∪ φ Γ LL )
. By replacing in R and R each occurrence of every such variable x with R x , we obtain two attacker recipes R, R , such that

Rφ = R(φ l (c) ∪ φ Γ LL ), Rφ = R(φ r (c) ∪ φ Γ LL ), R φ = R (φ l (c) ∪ φ Γ LL ), and R φ = R (φ r (c) ∪ φ Γ LL ).
Since φ, φ are ground, it is easy to see from the typing rules for messages that so is c. Thus, by definition of consistency, φ l (c) ∪ φ Γ LL and φ r (c) ∪ φ Γ LL are statically equivalent. Hence

R(φ l (c) ∪ φ Γ LL ) = R (φ l (c) ∪ φ Γ LL ) ⇔ R(φ r (c) ∪ φ Γ LL ) = R (φ r (c) ∪ φ Γ LL ) i.e. Rφ = R φ ⇔ Rφ = R φ
which proves that φ, φ are statically equivalent.

Note that this lemma only applies to ground frames, and not to symbolic frames where variables remain uninstantiated. According to the semantics of pi-calculus, when a process reduces, a symbolic frame φ is produced, as well as a ground substitution σ that contains the instantiation of each variable in φ for the current execution. We will then apply the previous lemma to the ground frame φσ. The invariant that follows lets us know that this frame (together with the corresponding frame from the right process) has type LL, with consistent constraints.

Let us now state formally the invariant. For legibility, we present here a slightly simplified statement, where some conditions regarding the domains of the substitutions and the set of variables bound in processes are omitted. The complete statement can be found in Appendix A.1.

Lemma 10 (Invariant). Consider an environment Γ, and multisets of processes

P = {P i } i , Q = {Q i } i with |P| = |Q| such that ∀i.Γ P i ∼ Q i → C i for some C i . Also consider frames φ P , φ Q such that Γ φ P ∼ φ Q : LL → c φ for some c φ . Let σ P , σ Q be ground substitutions such that Γ N ,K σ P ∼ σ Q : Γ X → c σ for some c σ . Assume c σ ⊆ c φ σ P ,σ Q , and that (∪ × i C i )∪ ∀ c φ σ P ,σ Q is consistent.
Consider a reduction step on the left: (P, φ P , σ P ) α -→ (P , φ P , σ P ). Then there exists a sequence of actions

w = τ α, such that (Q, φ Q , σ Q ) w --→ * (Q , φ Q , σ Q ) for some Q , φ Q , σ Q , with |Q | = |P | and ∀i.Γ P i ∼ Q i → C i for some Γ , C i . In addition Γ φ P ∼ φ Q : LL → c φ and Γ N ,K σ P ∼ σ Q : Γ X → c σ for some c σ , c φ such that c σ ⊆ c φ σ P ,σ Q and (∪ × i C i )∪ ∀ c φ σ P ,σ Q is consistent.
Proof sketch. Basically, according to the semantics of pi-calculus, the reduction step performed on P, i.e. (P, φ P , σ P ) α -→ (P , φ P , σ P ), is more precisely affecting only one of the processes P i ∈ P: outputting or inputting a message, performing a conditional branching, etc. is only done in one of the processes at a time.

The proof then consists in a case disjunction on the last typing rule applied in the type derivation for P i , i.e.

Γ P i ∼ Q i → C i .
We do not give all details here, but rather explain in general how the proof goes. In each case, the proof has the following structure.

• The typing rule imposes some conditions on the form of processes P i , Q i : e.g. if this rule is POut then P i = out(M ).P i (and similarly for Q i ), if the rule is PIn then P i = in(x).P i , and so on.

• In turn, the form of P i gives us information about which reduction rule is applied to P i in the reduction step. In the cases of POut and PIn for instance, it can only be rule Out (resp. In).

• Since the typing rules require that Q i has the same head symbol as P i , the same reduction rule can be applied to Q i . Depending on the case, additional conditions may need to be checked. For instance, in the case of an output, we need to make sure that the message in Q i is legal to output, knowing that the one in P i is. That is, we must show that that message successfully evaluates. As explained earlier, this is done using Lemma 6. In other cases we similarly use other lemmas that were omitted here.

• This shows that Q can be reduced too, with the same actions as P (in some cases, silent actions may need to be performed before actually performing in Q the same observable action as in P; we omit such details here).

• We then need to show the conditions on the type of processes, frames and substitutions hold after the reduction. Most of the processes are unchanged and still typecheck, although the environment may have been extended with new variables, e.g. in the input case: in such cases we use Lemma 1. For the processes actually being reduced, these conditions usually follow from the premises of the typing rule. For instance in the output case, one premise of the rule guarantees us that the continuation processes after the output still typecheck. The conditions on the frames is that they should have type LL: the only case where some messages are added to the frame is the output case, in which the premises of rule POut enforce this condition. Regarding the substitutions, what we must show is basically that the messages actually stored in variables in the execution have the type the typing rules assign to these variables. For instance in the input case, the variable in which the message is stored is supposed to have type LL. We thus need to show the messages actually input have this type: as explained earlier, this is done thanks to Lemma 7. In the case of a destructor application, we similarly use Lemma 5; other cases use some lemmas we omitted in this presentation.

• Finally, we need to prove the consistency of the constraints after reduction. More precisely, we know that (

∪ × i C i )∪ ∀ c φ σ P ,σ Q is consistent and must show that (∪ × i C i )∪ ∀ c φ σ P ,σ Q is.
Basically, what may happen during a reduction step is that some constraints disappear from the constraints C i of the processes, and are added to the constraint c φ of the frames. That is typically the case when the reduction step is an output: typing the continuation processes after the output no longer generates constraints for the messages output, however these messages are added to the frames, and thus these constraints are instead generated when typing the frames. We thus use some technical lemmas regarding consistency and union and instantiation of constraints, such as Lemma 2 to prove consistency of the new constraints.

The intuition behind the constraint C = (∪ × i C i )∪ ∀ c φ σ P ,σ Q may be a bit difficult to get. Before we get to the remainder of the proof, let us give an informal description of the role this constraint plays, omitting all technical details, just to explain the intuition. One way to do this is to examine how C evolves during a reduction. Basically, in the beginning, the frames and substitutions are empty, and C is thus simply the constraint set for the initial processes. In particular, it contains the constraints for all (uninstantiated) messages that will be output during the reduction. During the reduction, each time a message is output, it is added to φ. Conversely the output operation disappears from the process remaining to be reduced, as it has been executed. The constraints for the message, thus initially present in (∪ × i C i ), are hence "passed" to c φ . Thus, intuitively, (∪ × i C i )∪ ∀ c φ as a whole does not really change, which is basically what allows us to prove in the invariant that its consistency is preserved. Once the end of the execution has been reached, intuitively, no processes are left to reduce, and thus C only consists in the instantiation of c φ . The invariant thus lets us know us that c φ σ P ,σ Q is consistent. As discussed earlier, we will need to know that the instantiated frames φ P σ P , φ Q σ Q have consistent constraints (in order to show their static equivalence). By Lemma 3, this constraint is basically c σ ∪ c φ σ P ,σ Q : as the invariant also establishes that c σ ⊆ c φ σ P ,σ Q , its consistency follows from the previous observation.

Note that we show, as part of the invariant, that the constraints c σ from the instantiations σ, σ are contained in the (instantiated) constraints c φ σ,σ of the frames. This justifies the intuition presented in Section 2.4 that considering only such instantiations in the definition of consistency is sufficient.

Using the invariant, together with Lemma 9, we can now prove that typing implies trace inclusion:

Lemma 11 (Typing implies trace inclusion). For all P , Q, and C, for all Γ containing only keys, if

Γ P ∼ Q → C and C is consistent, then P t Q.
Proof sketch. Consider a sequence of reductions ({P }, ∅, ∅) s -→ * (P, φ P , σ P ) on the left process. By applying successively the invariant (Lemma 10), we can construct a sequence of reductions

({Q}, ∅, ∅) s --→ * (Q, φ Q , σ Q ) on
the right process. To prove the claim, it is then sufficient to show that φ P σ P and φ Q σ Q are statically equivalent. First, by the invariant, we know that

Γ φ P ∼ φ Q : LL → c φ and Γ N ,K σ P ∼ σ Q : Γ X → c σ for some Γ, c φ , c σ . Using Lemma 3, we have Γ N ,K φ P σ P ∼ φ Q σ Q : LL → c for some c ⊆ c φ σ P ,σ Q ∪ c σ , which is itself a subset of c φ σ P ,σ Q by the invariant. Lemma 9 will conclude the proof if we can show that c is consistent in Γ N ,K . By the invariant, C∪ ∀ c φ σ P ,σ Q is consistent,
where C is the constraint obtained when typechecking processes in P, Q. Using technical lemmas analogous to Lemma 2, we can prove this implies the consistency of c φ σ P ,σ Q , which (again using technical lemmas) implies the consistency of c.

It is clear from the typing rules that the type system is symmetric, in the sense that if Therefore, by symmetry, the soundness theorem (Theorem 1) follows from Lemma 11.

Γ P ∼ Q → C, then Γ Q ∼ P → C,
Since we do not have typing rules for replication, Theorem 1 only allows us to prove equivalence of protocols for a finite number of sessions. Thanks to our infinite nonce types, we can however still prove equivalence for an unbounded number of sessions, as detailed in the next section.

From bounded to unbounded number of sessions

In this section, we show how we can lift the soundness result from the previous section to the case of replicated processes, i.e. with an unbounded number of section, while still only needing to typecheck a finite number of sessions.

For more clarity, without loss of generality we consider that for each infinite nonce type τ l,∞ m appearing in the processes, the set of names BN also contains an infinite number of fresh names {m i | i ∈ N} which do not appear in the processes or environments. We will denote by N 0 the set of unindexed names in BN and by N i the set of indexed names. We similarly assume that for all the variables x appearing in the processes, the set X of all variables also contains fresh variables {x i | i ∈ N} which do not appear in the processes or environments. We denote X 0 the set of unindexed variables, and X i the set of indexed variables. Finally, we assume for all key k declared in the processes with type seskey l,∞ (T ) that the set BK contains keys {k i | i ∈ N}. This is simply a naming convention, and we do not lose any generality.

Intuitively, whenever we can typecheck a process of the form new n : τ l,1 n . new m : τ l,∞ m . P , with the rules presented in Section 2.3.4, we can actually also typecheck

new n : τ l,1 n . (new m 1 : τ l,1 m 1 .P 1 | . . . | new m k : τ l,1 m k .P k )
where in P i , the nonce m has been renamed to m i and variables x have been renamed to x i .

That is, if we can typecheck a process representing a single session of a protocol, then we can also typecheck any number of copies of this process in parallel, even if new nonces are generated within the replicated process, provided they are given a nonce type with a = ∞.

We will now first define formally this operation of expanding a process to n sessions, and then formally state the claim above.

Definitions: expansion to n sessions

Formally, we define the renaming of a term t for session i as follows.

Definition 16 (Renaming of a term). We denote by [ t ] Γ

i , the term t in which names n such that Γ(n) = τ l,∞ n for some l are replaced with n i , keys k such that Γ(k, k) = seskey l,∞ (T ) for some l, T are replaced with k i , and variables x are replaced with x i .

Similarly, when a message is of type τ l,∞ m ; τ l ,∞ p , it intuitively represent a value generated in a replicated process. As briefly mentioned earlier, the intended meaning of that infinite refinement type is that when actually expanding the replication to n copies of the process, the type could represent values generated in any of the copies, as long as they are created in the same copy on the left and on the right. That is, values of type τ l,1 m i ; τ l ,1 p i , for any i. The nonce type τ l,∞ m represents infinitely many nonces (one for each potential session). That is, for n sessions, the type τ l,∞ m ; τ l ,∞ p is intended to represent all τ l,1 m i ; τ l ,1 p i . Formally, given a type T , we define its expansion to n sessions, denoted [ T ] n , as follows.

Definition 17 (Expansion of a type).

[

l ] n = l [ T * T ] n = [ T ] n * [ T ] n key l (T ) n = key l ([ T ] n ) eqkey l (T ) n = eqkey l ([ T ] n ) seskey l,a (T ) n = seskey l,1 ([ T ] n ) [ pkey(T ) ] n = pkey([ T ] n ) [ vkey(T ) ] n = vkey([ T ] n ) [ (T ) T ] n = ([ T ] n ) [ T ] n [ {T } T ] n = {[ T ] n } [ T ] n [ T ∨ T ] n = [ T ] n ∨ [ T ] n τ l,1 m ; τ l ,1 p n = τ l,1 m ; τ l ,1 p τ l,∞ m ; τ l ,∞ p n = n j=1 τ l,1 m j ; τ l ,1 p j
where l, l ∈ {LL, HH, HL}, k ∈ K.

The crucial point is the last one: infinite refinement types for nonces τ l,∞ m ; τ l ,∞ p n are expanded into a union type n j=1 τ l,1 m j ; τ l ,1 p j . We may also note that, contrary to infinite nonce refinement types, infinite session key types are not turned into union types. The reason for this is that the refinement types carry information regarding the value of the messages they can be given to. When expanding the replicated copies of a process, there are now several possibilities for the value of a message that had previously an infinite refinement type: it could be the value generated in any of the n copies. Hence the need for a union type. However, session key types do not carry information about the value of the key, but only about the type of messages it should encrypt or sign. This information does not change once the key may have several values, from different copies of the process: thus there is no need for a union type here.

Note finally that the size of the expanded type [ T ] n depends on n.

We need to adapt typing environments accordingly.

Definition 18 (Renaming and expansion of typing environments). For any typing environment Γ, we define its renaming for session i as:

[ Γ ] i = {x i : T | Γ(x) = T } ∪ {(k, k ) : T | Γ(k, k ) = T ∧ ∀l, T .T = seskey l,∞ (T )} ∪ {(k i , k i ) : seskey l,1 (T ) | Γ(k, k) = seskey l,∞ (T ) ∪ {m : τ l,1 m | Γ(m) = τ l,1 m } ∪ {m i : τ l,1 m i | Γ(m) = τ l,∞ m }.
and then its expansion to n sessions as

[ Γ ] n i = {x i : [ T ] n | [ Γ ] i (x i ) = T } ∪ {(k, k ) : [ T ] n | [ Γ ] i (k, k ) = T } ∪ {m : τ l,1 m | [ Γ ] i (m) = τ l,1 m }.
The idea is that [ Γ ] i is simply renaming all variables, names, keys by indexing them with the session number i, and giving them the corresponding finite nonce or key type. However renaming does not expand any types: the types of variables, or the payload types in key types may still contain infinite refinement types. The expansion [ Γ ] n i then replaces these with their expansion, i.e. replacing all refinements with a union of n finite types, for each of the n sessions. Note that in [ Γ ] n i , due to the expansion, the size of the types (potentially) depends on n. By construction, the environments contained in the constraints generated by typing do not contain union types (see rule PZero). However, refinement types with infinite nonce types introduce union types when expanded. In order to recover environments without union types after expanding, which, as we will explain in the next subsection, is needed for our consistency checking procedure, we will use the branches(•) operation defined in Section 2.3.2.

We define the renaming of a process for session i in a similar way.

Definition 19 (Renaming of a process). For all process P , for all i ∈ N, for all environment Γ, [ P ] Γ i as the process obtained from P by:

• for each nonce n declared in P by new n : τ l,∞ n , and each nonce n such that Γ(n) = τ l,∞ n for some l, replacing every occurrence of n with n i , and the declaration new n : τ l,∞ n with new n i : τ l,1 n i ;

• for each key k declared in P by new k : seskey l,∞ (T ), and each key k such that Γ(k, k) = seskey l,∞ (T ) for some l, T replacing every occurrence of k with k i , and the declaration new k : seskey l,∞ (T ) with new k i : seskey l,1 ([ T ] n );

• replacing every occurence of a variable x with x i .

Finally, when typechecking two processes containing nonces with infinite nonce types, we collect constraints that represent "families" of constraints. That is, the constraints we collect represent all the constraints that would correspond to typechecking each replicated copy of the process. We therefore also need to expand them.

Definition 20 (Renaming and expansion of constraints). Given a set of constraints c, and an environment Γ, we define the renaming of c for session i in Γ as

[ c ] Γ i = {[ u ] Γ i ∼ [ v ] Γ i | u ∼ v ∈ c}.
This is propagated to constraint sets as follows: the renaming of C for session i is

[ C ] i = {([ c ] Γ i , [ Γ ] i ) | (c, Γ) ∈ C}
and its expansion to n sessions is

[ C ] n i = {([ c ] Γ i , Γ ) | ∃Γ. (c, Γ) ∈ C ∧ Γ ∈ branches([ Γ ] n i )}.
Again, note that the size of [ C ] i does not depend on the number of sessions considered, while the size of the types present in [ C ] n i does. For example, for

C = {({h(x) ∼ h(x)}, [x : τ HH,∞ m ; τ HH,∞ p ])}, we have [ C ] i = {({h(x i ) ∼ h(x i )}, [x i : τ HH,∞ m ; τ HH,∞ p ])} and [ C ] n i = {({h(x i ) ∼ h(x i )}, [x i : n j=1 τ HH,1 m j ; τ HH,1 p j ])}.
We now have all the notations required to formally state the previous claim, that typechecking one session is sufficient to know that any number of sessions typecheck.

Soundness for replicated processes

Our type system is sound for replicated processes provided that the collected constraint sets are consistent, when instantiated with all possible instantiations of the nonces and keys. In fact, we can even typecheck processes with a replicated part and a non-replicated part. Theorem 2. Consider processes P , Q, P ,Q such that P , Q and P , Q do not share any variable. Consider Γ, containing only keys and nonces with finite key or nonce types. Assume that P and Q only bind nonces and keys with infinite nonce types, i.e. using new m : τ l,∞ m and new k : seskey l,∞ (T ) for some label l and type T ; while P and Q only bind nonces and keys with finite types, i.e. using new m : τ l,1 m and new k : seskey l,1 (T ). Let us abbreviate by new n the sequence of declarations of each nonce m ∈ dom(Γ) and session key k such that Γ(k, k) = seskey l,1 (T ) for some l, T . If

• Γ P ∼ Q → C, • Γ P ∼ Q → C , • C ∪ × (∪ × 1≤i≤n [ C ] n i ) is consistent for all n ≥ 1, then new n. ((!P ) | P ) ≈ t new n. ((!Q) | Q ).
Basically, if P , Q typecheck with C and P , Q with C , assuming finite and infinite nonce types are used as expected, then P |!P and Q |!Q are trace equivalent, provided the constraints formed of C and any number of (renamed) copies of C are all consistent.

We provide in later sections a procedure to prove that such constraints of unbounded size are consistent.

For now, we present the main steps of the proof of Theorem 2. As for the proof of soundness in the non-replicated case, we do not give here the detailed proof, but rather state the main lemmas and briefly sketch their proofs. All detailed proofs can be found in Appendix A.2.

We first show that if two messages can be given type T in Γ, then the renaming of these messages for session i has type [ T ] n in (any branch of) the expansion of Γ to n sessions.

Lemma 12 (Typing terms with replicated names). Consider messages

M , N such that Γ M ∼ N : T → c for some Γ, T , c. Then for all n ∈ N and all i ∈ 1, n , for all Γ ∈ branches([ Γ ] n i ), Γ [ M ] Γ i ∼ [ N ] Γ i : [ T ] n → [ c ] Γ i
Proof sketch. This property is proved by induction on the type derivation Π for Γ M ∼ N : T → c. We study each possibility regarding the last typing rule applied in this derivation.

In most cases, the claim directly follows from the definition of the expanded types, environments and constraints, and the induction hypothesis. For instance in the case of rule TNonce, the form of the rule entails that M , N are two names m, n, and that T ∈ {HH, HL}. The derivation is then

Π = Γ(m) = τ l,a m Γ(p) = τ l,a p Γ m ∼ p : l → ∅ . It is clear from the definition of [ Γ ] n i that Γ ([ m ] Γ i ) = τ l,1 [ m ] Γ i , and that Γ ([ p ] Γ i ) = τ l,1 [ p ] Γ i . Then, by rule TNonce, we have Γ [ M ] Γ i ∼ [ N ] Γ i : l → ∅
which proves the claim for this case. Another example would be the case of rule TEncH: then T = LL and there exist T , k, c such that

Π = Π Γ M ∼ N : (T ) T → c T <: key HH (T ) Γ M ∼ N : LL → c = c ∪ {M ∼ N } .

By applying the induction hypothesis to Π , since [ (T )

T ] n = ([ T ] n ) [ T ] n , there exists a proof Π of Γ [ M ] Γ i ∼ [ N ] Γ i : ([ T ] n ) [ T ] n → [ c ] Γ i
In addition it is clear by the definitions of [ • ] n and of subtyping that since T <: key HH (T ), we have [ T ] n <: key HH ([ T ] n ). Therefore by rule TEncH, we have

Γ [ M ] Γ i ∼ [ N ] Γ i : LL → c Γ i ∪ {[ M ] Γ i ∼ [ N ] Γ i } = [ c ] Γ i
Let us finally describe one last case, which is a bit more involved: the case of rule TLR'. In that case there exist m, p, l such that T = l, and

Π = Π Γ M ∼ N : τ l,a m ; τ l,a p → c Γ M ∼ N : l → c .
Let us distinguish the case where a is 1 from the case where a is ∞.

• If a is 1: by applying the induction hypothesis to Π , since τ l,a m ; τ l,a

p n = τ l,1 m ; τ l,1 p , we have Γ [ M ] Γ i ∼ [ N ] Γ i : τ l,a m ; τ l,a p → [ c ] Γ i . Thus by rule TLR', we have [ Γ ] n i [ M ] Γ i ∼ [ N ] Γ i : l → [ c ] Γ i .
• If a is ∞: by applying the induction hypothesis to Π , since

τ l,a m ; τ l,a p n = 1≤j≤n τ l,1 m j ; τ l,1 p j , we have Γ [ M ] Γ i ∼ [ N ] Γ i : 1≤j≤n τ l,1 m j ; τ l,1 p j → [ c ] Γ i .
We can prove5 that this implies the existence of some j ∈ 1, n such that

Γ [ M ] Γ i ∼ [ N ] Γ i : τ l,1 m j ; τ l,1 p j → [ c ] Γ i .
Thus, by rule TLR', we have Γ

[ M ] Γ i ∼ [ N ] Γ i : l → [ c ] Γ i , which proves the claim.
We also prove the following lemma, that is the analogous property to Lemma 12 for the destructor rules used by rule PLet: Lemma 13 (Typing destructors with replicated names). For all Γ, t, t , T , if

Γ t ∼ t : T then for all i, n ∈ N such that 1 ≤ i ≤ n, [ Γ ] n i [ t ] Γ i ∼ t Γ i : [ T ] n
The proof of this property is immediate by examining the typing rules for destructors.

Using these last two lemmas, as well as some additional technical lemmas omitted here, we then prove the claim made in the beginning of this section, that typechecking processes with replicated types is sufficient to ensure any renamings of these processes still typecheck when expanding the environment to n sessions.

Lemma 14 (Typing processes with expanded types). Consider processes

P , Q such that Γ P ∼ Q → C for some Γ, C. Then for all n ∈ N and i ∈ 1, n , there exists C ⊆ [ C ] n i such that [ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C
Proof sketch. This proof is by induction on the derivation Π of Γ P ∼ Q → C. We study each case for the last rule applied in this derivation. We will not detail all cases here, as they are all rather similar. Basically, we show that, in each case, as the renamed process have the same structure as the original ones, the same typing rule can be applied to typecheck them in the expanded environment. To do this, we need to show that the premises of the rule still hold. When the premise involves typechecking processes, this is usually done by applying the induction hypothesis. For all rules whose premises require to typecheck some messages (e.g. POut, PIfL,. . . ), we apply Lemma 12 to show that these messages, once renamed, still have the correct type in the expanded environment. In the case of rule PLet, we apply Lemma 13 to show that the (renamed) destructors still have the correct type in the expanded environment.

As an example, let us detail the case of rule POut. In that case, then P = out(M ).P , Q = out(N ).Q for some M , N , P , Q , and

Π = Π Γ P ∼ Q → C Π Γ M ∼ N : LL → c Γ P ∼ Q → C = C ∪ ∀ c
.

By Lemma 12, for all Γ ∈ branches([ Γ ] n i ), there exists a proof Π Γ of the type judgement Γ [ M ] Γ i ∼ [ N ] Γ i : LL → [ c ] Γ i . Moreover, by induction, there exists C ⊆ [ C ] n i and a proof Π of the type judgement [ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C .
We can show (again, with some technical properties omitted in this proof sketch) that this implies, for all branches Γ of

[ Γ ] n i , that Γ [ P ] Γ i ∼ [ Q ] Γ i → C Γ for some C Γ ⊆ C ⊆ [ C ] n i . In addition, we have [ P ] Γ i = [ out(M ).P ] Γ i = out([ M ] Γ i ).
[ P ] Γ i , and similarly for process

Q [ Q ] Γ i = out([ N ] Γ i ).[ Q ] Γ i .
Therefore, using Π Γ , Π Γ and rule POut, we have for any branch

Γ ∈ branches([ Γ ] n i ) that Γ [ P ] Γ i ∼ [ Q ] Γ i → C Γ ∪ ∀ [ c ] Γ i ⊆ [ C ] n i ∪ ∀ [ c ] Γ i .

It can then be proved that typechecking processes in all branches of [ Γ ] n

i like this implies they typecheck in [ Γ ] n i itself, i.e.

[ Γ ] n i

[ P ] Γ i ∼ [ Q ] Γ i → C ⊆ C n i ∪ ∀ [ c ] Γ i = [ C ] n i
which proves the claim for this case.

Using this lemma, we then show that any number of (renamed) copies of P , Q in parallel typecheck:

Lemma 15 (Typing n sessions). Consider processes P , Q such that Γ P ∼ Q → C for some Γ, C. Then for all n ∈ N then for all n ≥ 1, there exists C ⊆ ∪ × 1≤i≤n [ C ] n i such that [ Γ ] n [ P ] Γ 1 | . . . | [ P ] Γ n ∼ [ Q ] Γ 1 | . . . | [ Q ] Γ n → C where [ Γ ] n is defined as 1≤i≤n [ Γ ] n i . Proof sketch. Note that the union 1≤i≤n [ Γ ] n i is well-defined, as for any indices i = j, we have dom([ Γ ] n i ) ∩ dom([ Γ ] n j ) ⊆ K ∪ N
, and the types associated to keys and nonces are the same in each [ Γ ] n i . The property follows from Lemma 14. Indeed, that lemma guarantees that for all

i ∈ 1, n , [ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C i for some C i ⊆ [ C ] n i . Using technical lemmas such as Lemma 1, we can then show that [ Γ ] n [ P ] Γ i ∼ [ Q ] Γ i → C i for some C i .
More precisely, the environments in the elements of C i do not contain all renamed keys, names and variables, but only those indexed with i, similarly to [ Γ ] n i . Thus, typechecking in [ Γ ] n adds all the other renamed elements to these environments: performing this operation on C i yields constraint C i .

By applying rule PPar n -1 times, we thus have

[ Γ ] n [ P ] Γ i 1 | . . . | [ P ] Γ i n ∼ [ Q ] Γ i 1 | . . . [ Q ] Γ i n → ∪ × 1≤i≤n C i
Only a technical point remains to be proved: that

∪ × 1≤i≤n C i ⊆ ∪ × 1≤i≤n [ C ] n i .
We omit this proof here, as it is more technical than insightful, and provide it in Appendix A.2 instead.

Theorem 2 then follows from Lemma 15 and the soundness theorem (Theorem 1). Indeed, consider P , Q and P , Q that typecheck with respectively C and C in Γ, and assume they satisfy the assumptions on finite and infinite types from Theorem 2. Using Lemma 15 and rule PPar we can show (we omit the details here) that for any n, P in parallel with n (renamed) copies of P and Q in parallel with n (renamed) copies of

Q typecheck with (a subset of) constraint set C ∪ × (∪ × 1≤i≤n [ C ] n i )
. These two processes are not replicated: Theorem 1 then applies, and if we know that

C ∪ × (∪ × 1≤i≤n [ C ] n i
) is consistent for any n, implies that they are trace equivalent. That is, that P in parallel with n copies of P and Q in parallel with n copies of Q are trace equivalent for any n. Therefore, P in parallel with !P and Q in parallel with !Q are trace equivalent, which proves Theorem 2.

Theorem 1 requires to check consistency of one constraint set. Theorem 2 now requires to check consistency of an infinite family of contraint sets. Instead of deciding consistency, we provide in the next sections a procedure that checks a slightly stronger condition, which allows us to efficiently prove consistency of this infinite family by only considering a finite number of its elements.

Checking consistency

Procedure for consistency

As defined earlier (Definition 14), checking consistency of a set of constraints basically amounts to checking static equivalence of the corresponding frames, for any possible well-typed instantiations of their variables.

We devise a procedure check_const(C) for checking consistency of a constraint set C, depicted in Figure 2.9. Basically, we need to make sure that any equality test the attacker may perform on terms constructed from the left side of the constraint yields the same result when performed on the right side.

Using properties established in Section 2.5, we are able to show that it suffices to check that the messages in the constraints (without applying any attacker recipe) satisfy the same equalities.

The procedure then works as follows:

• First, variables of refined type τ l,1 m ; τ l ,1 n are replaced by m on the left-hand-side of the constraint and n on the right-hand-side.

• Second, we check that terms have the same shape (encryption, signature, hash) on the left and on the right and that asymmetric encryption and hashes cannot be reconstructed by the adversary (that is, they contain some fresh, secret nonce).

• The most important step consists in checking that the terms on the left satisfy the same equalities than the ones on the right. Whenever two left terms M and N are unifiable, their corresponding right terms M and N should be equal after applying a similar instantiation.

From now on, we only consider constraint sets that can actually be generated when typing processes, as these are the only ones for which we need to check consistency.

Formally, the procedure check_const is described in Figure 2.9. It consists of three steps. First, we replace variables with refinements of finite nonce types by their left and right values. In particular a variable with a union type is not associated with a single value and thus cannot be replaced. This is why the branching operation needs to be performed when expanding environments containing refinements with types of the form τ l,∞ n . Second, we check that the resulting constraints have the same shape. Finally, as soon as two constraints M ∼ M and N ∼ N are such that M , N are unifiable, we roughly check that M = N , and conversely. The actual condition, as seen in Figure 2.9, is slightly more involved, especially when the constraints contain variables of refined types with infinite nonce types. More precisely, the actual condition that would need to be checked is that whenever M , N can be unified with a unifier µ, then any substitution µ such that µ and µ are well-typed unifies M and N (and conversely). Indeed, the type system guarantees that the instantiations of variables that can occur in actual executions are well-typed (see Lemma 10). We consider for the procedure a stronger, but easier to ensure condition. We discard cases where M , N can only be unified by unifiers that do not respect the refinement types, as such instantiations cannot occur in actual executions. Moreover when M , N can be unified by µ, we check that M and N are equal, after replacing each variable with a refinement type (that µ respects) with the corresponding value, as well as instantiating each variable of type LL to which µ associates a nonce n with this same nonce n. This overapproximates the actual condition stated earlier: indeed, any well-typed µ would respect these two conditions.

Example 5. Consider the simplified model of Helios from Example 2. When typechecked with appropriate key types (as detailed in Introduction of this chapter), these processes yield constraint sets containing notably the following two constraints.

{ aenc( 0, r a , pk(k s )) ∼ aenc( 1, r a , pk(k s )), aenc( 1, r b , pk(k s )) ∼ aenc( 0, r b , pk(k s )) }
For simplicity, consider the set c containing only these two constraints, together with a typing environment Γ where r a and r b are respectively given types τ HH,1 ra and τ HH,1 r b , and k s is given type key HH (T ) for some T .

The procedure check_const({(c, Γ)}) can detect that the constraint c is consistent and returns true. Indeed, as c does not contain variables, step1 Γ (c) simply returns (c, Γ). step2 Γ (c) then returns true, since the messages appearing in c are messages asymmetrically encrypted with secret keys, which contain a secret nonce (r a or r b ) directly under pairs. Finally step3 Γ (c) trivially returns true, as the messages aenc( 0, r a , pk(k s )) and aenc( 1, r b , pk(k s )) cannot be unified, as well as the messages aenc( 1, r a , pk(k s )) and aenc( 0, r b , pk(k s )).

Consider now the following set c , where encryption has not been randomised:

c = { aenc(0, pk(k s )) ∼ aenc(1, pk(k s )), aenc(1, pk(k s )) ∼ aenc(0, pk(k s )) }
The procedure check_const({(c , Γ)}) returns false. Indeed, contrary to the case of c, step3 Γ (c ) fails, as the encrypted message do not contain a secret nonce. Actually, the corresponding frames are indeed not statically equivalent since the adversary can reconstruct the encryption of 0 and 1 with the key pk(k s ) (in his initial knowledge), and check for equality.

F := {x ∈ dom(Γ) | ∃m, n, l, l . Γ(x) = τ l,1 m ; τ l ,1 n } and σ F , σ F defined by • dom(σ F ) = dom(σ F ) = F • ∀x ∈ F. ∀m, n, l, l . Γ(x) = τ l,1 m ; τ l ,1 n ⇒ σ F (x) = m ∧ σ F (x) = n and Γ is Γ| dom(Γ)\F extended with Γ (n) = τ l,1
n for all nonce n such that τ l,1 n occurs in Γ.

∀x ∈ dom(µ). ∃l, l , m, p. (Γ(x) = τ l,∞ m ; τ l ,∞ p ) ⇒ (xµ ∈ X ∨ ∃i. xµ = m i ) we have M αθ = N αθ where ∀x ∈ dom(µ). ∀l, l , m, p, i. (Γ(x) = τ l,∞ m ; τ l ,∞ p ∧ µ(x) = m i ) ⇒ θ(x) = p i and α is the restriction of µ to {x ∈ dom(µ) | Γ(x) = LL ∧ µ(x) ∈ N };
and if the symmetric condition for the case where M , N are unifiable holds as well, then return true.

check_const(C) := for all (c, Γ) ∈ C, let (c 1 , Γ 1 ) := step1 Γ (c) and check that step2 Γ1 (c 1 ) = true and step3 Γ1 (c 1 ) = true.

Soundness in the bounded case

For constraint sets without infinite nonce types, check_const entails consistency. We now sketch the proof for this claim. The reader may notice that the procedure does consider the case of infinite nonce types: this will be useful to prove consistency of replicated constraints in the next section. As before, we only sketch the structure of the proof here. All details are provided in Appendix A.3. Formally, we prove the following.

Theorem 3. Let C be a set of constraints such that

∀(c, Γ) ∈ C. ∀l, l , m, p. Γ(x) = τ l,∞ m ; τ l ,∞ p . If check_const(C) = true, then C is consistent.
We prove this theorem by first showing that the first step of the procedure preserves consistency.

Lemma 16. Consider a constraint (c, Γ) obtained by typing some processes. Let

(c, Γ) = step1 Γ (c). If c is consistent in Γ, then c is consistent in Γ.
Proof sketch. Assume c is consistent in Γ. Let c ⊆ c and Γ ⊆ Γ, such that dom(Γ ) contains all bikeys and names from dom(Γ), as well as all variables occurring in c . Let σ, σ be two substitutions such that Γ

N ,K σ ∼ σ : Γ X → c σ (for some c σ ⊆ c σ,σ ).
To prove the claim, we need to show that the frames φ Γ LL ∪ φ l ( c σ,σ )) and (φ Γ LL ∪ φ r ( c σ,σ )) are statically equivalent. The idea of the proof is to consider the constraint set c obtained by instantiating all variables with refinement types in c with the corresponding values. Since σ, σ are well-typed, they correctly instantiate such variables with the same values. Hence, c σ,σ can be seen as the instantiation of c with some σ, σ that are restrictions of σ and σ to variables without refinement types.

On the other hand, c is a subset of c, by construction, and we can show (we omit the technical details here) that σ, σ , being restrictions of σ, σ are well-typed in a subset of Γ that satisfies the conditions from the definition of consistency. From this, we get that φ Γ LL ∪ φ l ( c σ,σ )) and (φ Γ LL ∪ φ r ( c σ,σ )) are statically equivalent, which proves the claim.

It then suffices to check the consistency of the constraint and environment produced by step1 Γ (c). Provided that step2 Γ holds, we show that this constraint is saturated in the sense that any message obtained by the attacker by decomposing terms in the constraint already occurs in the constraint.

Lemma 17. Consider a constraint (c, Γ) obtained by typing some processes. Let (c, Γ) = step1 Γ (c), and assume step2 Γ (c) holds. Consider ground, well-typed instantiations σ, σ , i.e. Γ N ,K σ ∼ σ : Γ X → c σ for some c σ ⊆ c σ,σ . Also consider an attacker recipe R such that

vars(R) ⊆ dom(φ Γ LL ∪ φ l (c)). Assume R(φ Γ LL ∪ φ l ( c σ,σ ))↓ = ⊥ and R(φ Γ LL ∪ φ r ( c σ,σ ))↓ = ⊥.
Then there exists a recipe R without destructors, i.e. in which dec, adec, checksign, π 1 , π 2 , do not appear, such that

• vars(R ) ⊆ vars(R), • R(φ Γ LL ∪ φ l ( c σ,σ ))↓= R (φ Γ LL ∪ φ l ( c σ,σ )), • R(φ Γ LL ∪ φ r ( c σ,σ ))↓= R (φ Γ LL ∪ φ r ( c σ,σ )).

In addition, if

Proof sketch. This property is proved by induction on the attacker recipe R. Basically, when R starts with a constructor, the claim follows easily from the induction hypothesis. The cases of destructors are more involved. The idea is that step2 guarantees that the messages in the constraint cannot be opened by the attacker. Hence, the destructor in R is actually being applied to a message constructed by the attacker, and by removing both the constructor and the destructor, we obtain a smaller recipe that produces the same message, and to which the induction hypothesis can be applied.

We present here the case where R = dec(S, K) for some recipes S, K. Since R successfully evaluates when applied to either side of c, K must evaluate to a key when applied to it. In addition we can show (again, we omit technical details here) that the messages in a constraint obtained by typing (and thus those in c) have type LL with a subset of this constraint. By Lemma 7, K applied on either side of c is therefore a key of type LL.

In addition, by induction, we may replace S with a recipe without destructors S that produces the same messages when applied to the constraint. Since R successfully evaluates, this means S applied to either side of the constraint evaluates to an encryption with k. As k is of type LL, by step2, this encryption cannot already be present in the constraint. Thus it was constructed by the attacker: S = enc(S , K ) for some S , K without destructors (and such that K produces the correct key). When applied to the constraint, R thus produces the same result as S : using this S as the R specified in the statement of the lemma proves the claim.

In addition, if follows rather easily that if the checks in step2 succeed, then the constraint only contains messages which cannot be reconstructed by the attacker from the rest of the constraint. Indeed, they are all encryptions or signatures with secret keys, or contain a secret nonce. Using Lemma 17 and this property, we finally prove that the simple unification tests performed in step3 are sufficient to ensure static equivalence of each side of the constraint for any well-typed instantiation of the variables. Lemma 18. Consider a constraint (c, Γ) obtained by typing some processes. Let (c, Γ) = step1 Γ (c), and assume step2 Γ (c) and step3 Γ (c) hold. Consider ground, well-typed instantiations

σ, σ , i.e. Γ N ,K σ ∼ σ : Γ X → c σ for some c σ ⊆ c σ,σ . Also consider attacker recipes R, S such that vars(R) ∪ vars(S) ⊆ dom(φ Γ LL ∪ φ l (c)). Then (R(φ Γ LL ∪φ l ( c σ,σ )))↓= (S(φ Γ LL ∪φ l ( c σ,σ )))↓ ⇐⇒ (R(φ Γ LL ∪φ r ( c σ,σ )))↓= (S(φ Γ LL ∪φ r ( c σ,σ )))↓ .
Proof sketch. We only give the main ideas of this proof, and omit here all technical details. Basically, we first use Lemma 7 to take care of the case where either of the recipes evaluate to ⊥.

Then, assuming all recipes successfully evaluate, Lemma 17 allows us to consider only recipes R, S without destructors.

We then do the proof by induction on (the sum of) the sizes of R, S. Both directions of the equivalence are similar, we show (⇒). Assume (R(φ

Γ LL ∪ φ l ( c σ,σ )))↓= (S(φ Γ LL ∪ φ l ( c σ,σ )))↓.
Since R, S do not contain destructors, and successfully evaluate, this means that R(φ

Γ LL ∪ φ l ( c σ,σ )) = S(φ Γ LL ∪ φ l ( c σ,σ ))
. Therefore, we can distinguish three cases regarding R, S:

• either none of them are variables: then they necessarily start with the same symbol, which can be a name or a constructor. In the first case, the claim is trivial, and in the second case it follows by induction: indeed, if R = f (R ) and S = f (S ), we can apply the induction hypothesis to R , S to get that they produce the same message when applied on the right. It then follows that the same holds for R, S and the claim holds.

• or one of them is a variable and the other is not: this case is impossible by the observation that no message in the constraints can be reconstructed from the others.

• or both of them are variables: then the test being performed is simply an equality check between messages of the instantiated constraint. Using the fact that step3 Γ (c) holds, we can prove that this check also succeeds on the right side of the instantiated constraint.

Lemma 18 proves that, if the procedure succeeds on c, Γ, then c is consistent in Γ, where (c, Γ) = step1 Γ (c). By Lemma 16, this proves that c is then consistent in Γ, which proves the soundness result (Theorem 3).

As a direct consequence of Theorems 1 and 3, we now have a procedure to prove trace equivalence of processes without replication.

For proving trace equivalence of processes with replication, we need to check consistency of an infinite family of constraint sets, as prescribed by Theorem 2. As mentioned earlier, not only the number of constraints is unbounded, but the size of the type of some (replicated) variables is also unbounded (i.e. of the form n j=1 τ l,1 m j ; τ l ,1 p j ). We use here two ingredients: we first show that it is sufficient to apply our procedure to two constraints only. Second, we show that our procedure applied to variables with replicated types, i.e. nonce types of the form τ l,∞ n implies consistency of the corresponding constraints with types of unbounded size.

Unbounded case: two constraints suffice

Consistency of a constraint set C does not guarantee consistency of ∪ × 1≤i≤n [ C ] n i . For example, consider C = {({h(m) ∼ h(p)}, [m : τ HH,∞ m , p : τ HH,1 p ])}
which can be obtained when typing

new m : τ HH,∞ m . new p : τ HH,1 p . out(h(m)) ∼ new m : τ HH,∞ m . new p : τ HH,1 p . out(h(p)).
C is consistent: since m, p are secret, the attacker cannot distinguish between their hashes. However ∪ × 1≤i≤n [ C ] n i contains (together with some environment):

{h(m 1 ) ∼ h(p), h(m 2 ) ∼ h(p), . . . , h(m n ) ∼ h(p)}
which is not, since the attacker can notice that the value on the right is always the same, while the value on the left is not. Note however that the inconsistency of ∪ × 1≤i≤n [ C ] n i would have been discovered when checking the consistency of two copies of the constraint set only. Indeed,

[ C ] n 1 ∪ × [ C ] n
2 contains (together with some environment):

{h(m 1 ) ∼ h(p), h(m 2 ) ∼ h(p)}
which is already inconsistent, for the same reason.

Actually, checking consistency (with our procedure) of two constraints

[ C ] n 1 and [ C ] n 2 entails consistency of ∪ × 1≤i≤n [ C ] n i . Note that this does not mean that consistency of [ C ] n 1 and [ C ] n 2 implies consistency of ∪ × 1≤i≤n [ C ] n i .
Instead, our procedure ensures a stronger property, for which two constraints suffice.

Theorem 4. Let C and C be two constraint sets that

• do not share any common variable, i.e.

∀(c, Γ) ∈ C. ∀(c , Γ ) ∈ C . dom(Γ X ) ∩ dom(Γ X ) = ∅;
• only share nonces which have the same finite nonce type, i.e.

∀(c, Γ) ∈ C. ∀(c , Γ ) ∈ C . ∀m ∈ dom(Γ) ∩ dom(Γ ) ∩ N . ∃l. Γ(m) = Γ (m) = τ l,1 m ;
• only share keys which are paired in the same way and have the same types, i.e.

∀(c, Γ) ∈ C. ∀(c , Γ ) ∈ C . ∀k ∈ keys(Γ) ∩ keys(Γ ).∀k ∈ K. ((k, k ) ∈ dom(Γ) ⇔ (k, k ) ∈ dom(Γ )) ∧ ((k , k) ∈ dom(Γ) ⇔ (k , k) ∈ dom(Γ ))
and

∀(c, Γ) ∈ C. ∀(c , Γ ) ∈ C . ∀(k, k ) ∈ dom(Γ) ∩ dom(Γ ). Γ(k, k ) = Γ (k, k ). For all n ∈ N, if check_const([ C ] n 1 ∪ × [ C ] n 2 ∪ × [ C ] n 1 ) = true, then check_const(∪ × 1≤i≤n [ C ] n i )∪ × C n 1 ) = true.
Proof sketch. We only sketch the ideas of the proof here, all technical details can be found in Appendix A.4. To prove Theorem 4, we first (easily) show that if

check_const([ C ] n 1 ∪ × [ C ] n 2 ∪ × C n 1 ) = true,
then the first two steps of the procedure check_const can be successfully applied to each element of (

∪ × 1≤i≤n [ C ] n i )∪ × [ C ] n 1 .
However the case of the third step is more intricate. When applying the procedure check_const to an element of the constraint set

(∪ × 1≤i≤n [ C ] n i )∪ × [ C ] n 1 , if step3
fails, then the constraint contains an inconsistency, i.e. elements M ∼ M and N ∼ N for which the unification condition from step3 does not hold. More precisely, M and N can be unified with an acceptable (in the sense of step3) unifier, while M and N are still different once their variables with refinement and LL types are instantiated as in step3.

Then we show that we can find a similar inconsistency when considering only the first two constraint sets, i.e. in

[ C ] n 1 ∪ × [ C ] n 2 ∪ × [ C ] n 1 .
This is done by reindexing the nonces and variables. The proof actually requires a careful examination of the structure of the constraint set

(∪ × 1≤i≤n [ C ] n i )∪ × [ C ] n
1 , to establish this reindexing. More precisely, we examine the origin of the elements

M ∼ M and N ∼ N in the constraint set (∪ × 1≤i≤n [ C ] n i )∪ × [ C ] n 1 .
• If they both come from the same constraint set [ C ] n i for some i: then we can show that the same inconsistency occurs in

[ C ] n 1 , which is just a renaming of [ C ] n i .
• If they come from two sets [ C ] n i and [ C ] n j , for some i = j: then similarly the same inconsistency occurs with the corresponding elements of [ C ] n 1 and [ C ] n 2 . Note that we still need to consider two different indices (i and j, or 1 and 2) to retrieve the inconsistency. Indeed, it might be for instance that this inconsistency uses two renamings of the same element of the original C, and is thus not present in [ C ] n 1 alone.

• Finally if one of them comes from some [ C ] n i and the other from [ C ] n 1 : then similarly the same inconsistency can be found between

[ C ] n 1 and [ C ] n 2 .
Note that the rather lengthy hypotheses for this theorem only serve to ensure that the environments in all the constraint sets are compatible, but do not really change the intuition of the result. They are clearly satisfied when considering constraints produced by typechecking processes that satisfy the assumptions of Theorem 2.

We now know that checking two copies of the constraint set suffices to establish consistency of any number of copies. However, in these two copies, the infinite nonce types are still unfolded into union types of size n. The next step is to reduce the problem to checking constraints with fixed, bounded types.

Reducing the size of types

We prove that the procedure check_const applied to replicated types, i.e. nonce and refinement types with a = ∞, implies consistency of corresponding constraints with unbounded types. Theorem 4). Then:

Theorem 5. Let C, and C be two constraint sets without any common variable (with the same assumptions as in

check_const([ C ] 1 ∪ × [ C ] 2 ∪ × [ C ] 1 ) = true ⇒ ∀n. check_const([ C ] n 1 ∪ × [ C ] n 2 ∪ × [ C ] n 1 ) = true.
Proof sketch. Again here, it is rather easy to show that if check_const(

[ C ] 1 ∪ × [ C ] 2 ∪ × [ C ] 1 ) =
true then the first two steps of the procedure check_const can successfully be applied to each element of

[ C ] n 1 ∪ × [ C ] n 2 ∪ × [ C ] n 1 .
The case of step3 is more involved. The property holds thanks to the condition on the most general unifier expressed in step3. Intuitively, this condition is written in such a way that if, when applying step3 to sets of constraints in

[ C ] n 1 ∪ × [ C ] n 2 ∪ × [ C ] n 1 , two messages can be unified, then the corresponding messages (with infinite, non expanded types) in [ C ] 1 ∪ × [ C ] 2 ∪ × [ C ] 1 can
be unified with a most general unifier that also satisfies the condition. The proof uses this idea to show that if step3 succeeds on all sets in

[ C ] 1 ∪ × [ C ] 2 ∪ × [ C ] 1 , then it also succeeds on the sets in [ C ] n 1 ∪ × [ C ] n 2 ∪ × [ C ] n 1 . The detailed proof is provided in Appendix A.4.

Checking the consistency of the infinite constraint

Theorems 3, 4, and 5 prove that our procedure check_const is sound for checking consistency of replicated constraints.

Theorem 6. Let C, and C be two constraint sets without any common variable (in the sense of Theorem 4). Then check_const([

C ] 1 ∪ × [ C ] 2 ∪ × C 1 ) = true ⇒ ∀n. C n 1 ∪ × (∪ × 1≤i≤n [ C ] n i ) is consistent.
This theorem is a direct consequence of Theorems 3, 4, and 5.

It shows that it suffices to check to renamed copies of the constraints, without having to extend the types they contain, to ensure consistency of the unbounded constraints produced when typechecking replicated processes.

Conclusion

Summarising all the results presented in this chapter, we have introduced a type system that typechecks two processes, and produces constraints, as well as a procedure to check the consistency of this constraint. We have proved that the type system, together with the procedure, are sound, in the sense that they imply trace equivalence, both for processes with bounded and unbounded numbers of sessions. Formally, the following theorem summarises Theorems 2, and 6: Theorem 7. Consider processes P , Q, P ,Q such that P , Q and P , Q do not share any variable. Consider Γ, containing only keys and nonces with finite key or nonce types. Assume that P and Q only bind nonces and keys with infinite nonce types, i.e. using new m : τ l,∞ m and new k : seskey l,∞ (T ) for some label l and type T ; while P and Q only bind nonces and keys with finite types, i.e. using new m : τ l,1 m and new k : seskey l,1 (T ). Let us abbreviate by new n the sequence of declarations of each nonce m ∈ dom(Γ) and session key k such that Γ(k, k) = seskey l,1 (T ) for some l, T . If

• Γ P ∼ Q → C, • Γ P ∼ Q → C , • check_const([ C ] 1 ∪ × [ C ] 2 ∪ × [ C ] 1 ) = true, then new n. ((!P ) | P ) ≈ t new n. ((!Q) | Q ).
This constitutes an efficient way of checking trace equivalence of processes with or without replication, and even processes with a replicated and an unreplicated part.

In the next chapter, we give relevant examples where this feature is useful. In addition, we designed a prototype implementation of a typechecker for the type system, and of the procedure for consistency, to experimentally validate the efficiency of our approach.

Chapter 3

Examples and Experimental Results

Introduction

In the previous chapter, we introduced our type system for equivalence, together with the companion procedure for consistency. We will now illustrate how this type system can be used to typecheck protocols. We first study the Helios voting protocol already evoked in Section 2.1. We describe how our typesystem can be used to show that it guarantees vote secrecy, assuming the ballot box is not trusted. This case study illustrates well an interesting feature of our type system: we can consider processes involving a mix of some replicated and unreplicated parts. This is notably useful when modelling voting systems, to represent scenarios that honest voters are not allowed to revote (hence their processes are not replicated) but we still want to prove security assuming the attacker controls any number of dishonest voters (represented by replicated processes).

As a second example, we study the Private Authentication protocol already mentioned in Section 2.2. In this protocol, an agent A is trying to authenticate to another agent B, who can accept or reject this request. The protocol aims to prevent an attacker from learning whether B accepted A's request or not. Studying this property illustrates another feature of our type system: its ability to prove equivalence even in case the execution is not uniform, i.e. branches differently on the left and on the right. This models the fact that, in the equivalence we prove for Private Authentication, authentication typically succeeds on the left and fails on the right, leading to non uniform execution.

Finally, to validate experimentally the efficiency of our approach, we implemented together with Niklas Grimm a prototype of a typechecker for our type system, as well as the procedure for consistency of the constraints. We apply it to several examples of protocols, notably our two case studies, as well as several key exchange protocols from the literature, for which we prove a strong secrecy property on the exchanged key. We then compare the performance of our prototype to that of other existing automated tools for symbolic process equivalence. The source code for the implementation, as well as the files from the benchmark, are available at [1].

Helios

In this section, we apply our type system to the Helios voting protocol described in Section 2.2. We show how our type system can prove vote privacy for Helios, and present the most interesting parts of the type derivation.

Modelling vote privacy for Helios

Recall that the protocol was informally described in Section 2.2 as follows

S → V i : r i V i → S : sign(aenc( v i , r i , r i , pk(k s )), k i ) S → V 1 , . . . , V n : v 1 , . . . , v n
Voters receive a random value r i from the server (in clear and unauthenticated). They encrypt their vote with the election key pk(k s ), randomising the encryption with both r i and a fresh value r i they generate. They sign this ciphertext with their private key and send it to the server (modelling an authenticated communication channel with the server). The server receives all ballots, and removes duplicate ciphertexts (we call this operation weeding). This phase is crucial, as otherwise the protocol is subject to an attack, as explained in introduction and Section 2.2. Finally, the server, who knows the decryption key k s , decrypts the ballots, and publishes (in an arbitrary order) the list of votes in clear.

That model is an abstraction of the actual Helios protocol: in the real scheme, the voting server that collects the ballots and the tallying authority are distinct entities, and the decryption key k s is split among several trustees that form the tallying authority. We consider here the case where the talliers are honest, as well as the server (although the attacker, who controls the network has the ability to block honest ballots, or send fake ballots to the server). Hence, we use a very abstract model for the tally, that conflates the tallying authority and the voting server into a single entity who collects ballots, decrypts them and computes the result.

In addition, we model the initial phase where the election key pk(k s ) is distributed to the voters before the actual election starts. We represent this distribution by having the server generate a fresh election key, and send it to voters in an authenticated way: the key is signed with some long-term key k 0 , and we assume voters already know the verification key vk(k 0 ).

We model the role of a voter with private key k voting for candidate v by the following process V (k, v):

V (k, v) = in(x). let x k = checksign(x, vk(k 0 )) in receiving the election public key in(x r ).new r . out(sign(aenc( v, x r , r , x k ), k))
sending the signed ballot

The model of the role of the voting server is a bit more intricate. As already explained in earlier chapters (e.g. Section 2.1), we will model the privacy property by considering two honest voters Alice and Bob with secret keys k 1 and k 2 , in parallel with other, compromised, voters. We will additionally call r 1 the nonce generated by Alice, and r 2 the one from Bob. In order to be able to consider an unbounded number of compromised voters, we split the voting server into two parts: one that handles only the ballots from Alice and Bob, and that will not be replicated, and one that handles all ballots from dishonest voters, that will be replicated. In order to prevent false attacks, we require that the server only proceeds to the tallying if ballots signed by Alice and Bob have correctly been received: otherwise, the attacker could simply prevent Alice from voting, and the result would only contain Bob's vote, which trivially breaks privacy.

Then, to be able to correctly perform weeding, the voting server dedicated to dishonest voters needs to know Alice and Bob's ciphertext. Actually, for technical reasons which will become clear later on, we model the weeding as comparing the random values used to randomise the encryption, rather that the ciphertexts themselves. While this may not be possible or make sense in practice with the actual cryptographic primitive used, in our symbolic model, since the values of the random nonces generated by the voters are not published, comparing the random value or the whole ciphertext amounts to the same. Hence, we require that the voting server for Alice and Bob first receives their ballots, and sends privately to the other part of the voting server the two random values r 1 , r 2 they contain. When receiving a dishonest ballot, the second part of the voting server will then compare its random nonce to r 1 , r 2 , and discard it if it is equal to one of the two. This private communication is modelled as sending these values symmetrically encrypted using a key k that only the two parts of the voting server know. We take advantage of this step to also sends the secret key k of the election, generated by the server for Alice and Bob, to the other part of the server. This communication between the two parts of the server does not represent any real part of the protocol. It is simply a modelling artefact we need to use to represent the two parts of the server sharing their internal state, which is not natively possible in our pi-calculus.

Another point in our model is that we do not generate honest signature keys for dishonest voters. Instead, we consider that these are directly generated by the attacker, and the server for dishonest voters simply asks the attacker for a verification key to be used. For better readability, we omit this from the presentation, and simply assume here that dishonest votes are not signed. Finally, we model the publication of the result in a randomised order by simply outputting the votes in clear in a non-deterministic order, i.e. in two outputs in parallel.

The voting server for voters Alice and Bob with verification keys vk 1 , vk 2 is modelled by the following process:

S(vk 1 , vk 2 ) = new k.out(sign(pk(k), k 0 )).
generating and sending the election key new r 1 .new r 2 .out(r 1 ).out(r 2 ).

sending the random values to A and B in(x 1 ). in(x 2 ).

receiving ballots

let y 1 = checksign(x 1 , vk 1 ) in opening A's ballot let (z v1 , z r1 , z r1 ) = adec(y 1 , k) in let y 2 = checksign(x 2 , vk 2 ) in opening B's ballot let (z v2 , z r2 , z r2 ) = adec(y 2 , k) in out(enc( z r1 , z r2 , k , k ))
sending values to other server (out(z v1 ) | out(z v2 ))

publishing the result Note that when opening a ballot, we wrote the decomposition of the plaintext into three variables (z v1 , z r1 , z r1 ) as a single destructor application for clarity, while in the actual process it consists in a succession of several destructors.

The voting server handling dishonest voters is then modelled by the following process:

S = in(y). let (y r1 , y r2 , y k ) = dec(y, k ) in. receiving the values from the server in(y 3 ). receiving a dishonest ballot let (z v3 , z r3 , z r3 ) = adec(y 3 , k) in opening the ballot if z r3 = y r1 then 0 weeding else if z r3 = y r2 then 0 else out(z v3 ) publish

the vote in clear

There is no need for a process modelling dishonest voters: they are entirely controlled by the attacker. Finally we add another process Setup, in charge of publishing the public keys to the attacker:

Setup = out(vk(k 1 ), vk(k 2 ), vk(k 0 )).
Altogether, our model for Helios, with Alice voting for v 1 and Bob for v 2 is then the following process:

Helios(v 1 , v 2 ) = Setup | V (k 1 , v 1 ) | V (k 2 , v 2 ) | S(vk(k 1 ), vk(k 2 )) | !S
As explained earlier (introduction, Section 2.2), the vote privacy property states that the attacker should not be able to distinguish between Alice voting for 0 and Bob for 1 from Alice voting for 1 and Bob for 0 6 . Formally, we thus prove the following equivalence:

Helios(0, 1) ≈ t Helios(1, 0)
To help the proof go through, we actually slightly rewrite the process on the right into Helios (1, 0), which is identical to Helios(1, 0), except that in the server for Alice and Bob, the final outputs of the votes in parallel are swapped, i.e. out(z v1 ) | out(z v2 ) is replaced with out(z v2 ) | out(z v1 ). This process clearly has the same behaviours as the original one, as the parallel branching is executed in a non deterministic order. However it makes the proof easier: in practice z v1 will contain 0 on the left and 1 on the right, while z v1 will contain 1 on the left and 0 on the right. Hence this swapping makes it so that the first message (z v1 on the left, z v2 on the right) always contains 0, and the second one 1.

Typechecking Helios

A key point when proving this equivalence is that we need to keep track precisely of the value of the contents of the two variables z v1 and z v2 , to be able to typecheck the final output in the server process. The second key point is the typechecking of the weeding phase. This phase is intended to prevent the attacker from resubmitting a copy of Alice's or Bob's ballot. We need precise enough types to express that when the weeding succeeds, the ballot we are decrypting comes from the attacker, and is thus safe to output.

To do this, we annotate the key k generated in process S with the following type:

T k = seskey HH,1 ((HL * HL * τ HH,1 r 1 ) ∨ (HL * HL * τ HH,1 r 2
))

This type specifies that k is a trusted session key (label HH), that is used by honest agents (i.e. Alice and Bob) to encrypt tuples whose last component is either r 1 or r 2 . Of course, dishonest agent (i.e. the attacker) may also use it to encrypt any value (which will thus be of type LL). This type will be helpful when typechecking the weeding phase, as it gives information regarding the value of the variable being compared, i.e. the last component of the tuple. We also annotate the nonces r 1 , r 2 respectively with types τ HH,1

r 1 , τ HH,1 r 2
indicating they are secret. The nonces r 1 , r 2 are respectively annotated with τ LL,1 r 1 and τ LL,1 r 2 , indicating they may be published (as they are sent in clear on the network).

We then type the protocol using the initial environment Γ below.

Helios

Γ(k 1 , k 1 )) = eqkey HH ({ τ LL,1 0 ; τ LL,1 1 * HL * τ HH,1 r 1 } pkey(T k ) ) Γ(k 2 , k 2 ) = eqkey HH ({ τ LL,1 1 ; τ LL,1 0 * HL * τ HH,1 r 2 } pkey(T k ) ) Γ(k 0 , k 0 ) = eqkey HH (pkey(T k )) Γ(k , k ) = eqkey HH (τ HH,1 r 1 * τ HH,1 r 2 * T k )
Since, in this protocol, we do not use different keys on either side, we give all keys an eqkey HH (•) type. The type of k 1 states that it signs encryptions of vote 0 on the left and 1 on the right, together with the nonce r 1 , with a key of type pkey(T k ). Similarly, the type of k 2 states it signs encryptions of 1 on the left and 0 on the right. Indeed, these keys are only used by honest voters to encrypt their votes with k (that they received from the network). The type of k 0 states that it signs a key of type pkey(T k ): indeed in practice it signs pk(k). This type will let us know when typechecking V that the key received signed with k 0 has indeed the correct type. Finally the type of the key k used for internal communication between the two parts of the server states that it encrypts r 1 , r 2 , and k (or rather, a key with the same type).

We focus first on the voter process for Alice, i.e. V (k 1 , 0) ∼ V (k 1 , 1). We start by applying rule PIn, which requires us to typecheck the rest of the process with x : LL. Rule PLet they lets us typecheck the signature verification checksign(x, vk(k 0 )): we need to typecheck the two then-branches, and the two else-branches. The else-branches are 0 and trivially typecheck, without generating constraints 7 . In the then-branches, the type of k 0 in Γ indicates that x k has type pkey(T k ). Rule PIn then applies, followed by rule PNew, and these require us to typecheck the continuation process with x r : L and r 1 : τ HH,1 r 1 . We then apply rule POut to typecheck the last instruction, which is the output of the ballot. We must give type LL to the messages, i.e. prove Γ sign(aenc( 0, x r , r , x k ), k) ∼ sign(aenc( 1, x r , r , x k ), k) : LL where Γ is Γ extended with types for x, x k , etc. as stated above. Figure 3.1 displays the type derivation for this. Typing the ballot produces constraint

c = {M ∼ N, sign(M, k 1 ) ∼ sign(N, k 1 )} where M = aenc( 0, x r , r 1 , x k ) and N = aenc( 1, x r , r 1 , x k ).
Rule PZero ends the typing of the voting process for Alice, which thus produces constraint

C a = {(c, Γ )}
for the c and Γ defined above.

The voter process for Bob is typed similarly as the one for Alice8 , and produces

C b = {(c , Γ )}
where c is similar to c, except that the votes are swapped and are signed with k 2 instead of k 1 , and Γ is similar to Γ , with the nonce

r 2 instead of r 1 . * 1 = Γ 0 ∼ 1 : τ LL,1 0 ; τ LL,1 1 → ∅ TLR 1 Γ xr ∼ xr : HL → ∅ THigh Γ (r 1 ) = τ HH,1 r 1 Γ r 1 ∼ r 1 : τ HH,1 r 1 → ∅ TLR 1 Γ 0, xr, r 1 ∼ 1, xr, r 1 : T → ∅ TPair x2 * 2 = * 1 Γ 0, xr, r 1 ∼ 1, xr, r 1 : T → ∅ Γ (xk) = pkey(Tk) Γ xk ∼ xk : pkey(Tk) → ∅ TVar Γ M ∼ N : {T } pkey(T k ) → ∅ TAenc * 3 = Γ 0 ∼ 1 : HL → ∅ THigh Γ xr ∼ xr : HL → ∅ THigh Γ (r 1 ) = τ HH,1 r 1 Γ r 1 ∼ r 1 : τ HH,1 r 1 → ∅ TLR 1 Γ 0, xr, r 1 ∼ 1, xr, r 1 : HL * HL * τ HH,1 r 1 → ∅ TPair x2 Γ 0, xr, r 1 ∼ 1, xr, r 1 : T → ∅ TOr * 4 = * 3 Γ 0, xr, r 1 ∼ 1, xr, r 1 : T → ∅ Γ (xk) = pkey(Tk) Γ xk ∼ xk : pkey(Tk) → ∅ TVar Γ M ∼ N : {T } pkey(T k ) → ∅ TAenc Γ M ∼ N : LL → {M ∼ N } TAencH * 2 Γ M ∼ N : {T } pkey(T k ) → ∅ * 4 Γ M ∼ N : LL → c2 Γ(k1, k1) = eqkey HH (T )pkey(Tk) Γ sign(M, k1) ∼ sign(N, k1) : LL → c TSignH where c = {M ∼ N, sign(M, k 1 ) ∼ sign(N, k 1 )}, M = aenc( 0, x r , r 1 , x k ), N = aenc( 1, x r , r 1 , x k ), T = τ LL,1 0 ; τ LL,1 1 * HL * τ HH,1 r 1 , T = (HL * HL * τ HH,1 r 1 ) ∨ (HL * HL * τ HH,1 r 2
). We then proceed with the server process S. The beginning is rather straightforward: rule PNewKey stores k : T k in the environment, rule POut then requires that we give type LL to the message containing the election public key has type LL. This can be done without generating any constraints using rule TSignL. The same goes for the output of the two random values r 1 , r 2 . Then rule PIn assigns type LL to x 1 , x 2 , and we proceed to the signature verification.

The verification is typechecked using rule PLet, and the type of

k 1 inform us that y 1 has type { τ LL,1 0 ; τ LL,1 1 * HL * τ HH,1 r 1 } pkey(T k )
. Using rule PLet again (with destructor rule DAdecT'), we get in particular that z v1 has type τ LL,1 0 ; τ LL,1 1 . Similarly, after checking the signature for Bob's ballot and decrypting it, we get that z v2 has type τ LL,1 1 ; τ LL,1 0 . We then only have to typecheck the publication of the votes in clear. We then use rule PPar to typecheck the two parallel outputs separately. As explained earlier, we swap these two outputs on the right, so that we have to typecheck out(z v1 ) ∼ out(z v2 ) and out(z v2 ) ∼ out(z v1 ). These two branches are similar, we describe the first one. By rule POut, it requires us to give type LL to z v1 ∼ z v2 . This is done using rule TLRVar, which allows us to use the two variables' refinement types to give type τ LL,1 0 ; τ LL,1 0 to them. Then rule TLRL' lets us give them type LL, without generating any constraints.

The server process for honest voters S thus typechecks without generating any constraints.

We now typecheck the second part of the server process S . Again, the beginning is easy: rule

Helios

PIn assigns type LL to y, and following the type of k , rule PLetDec9 for decryption assigns types τ HH,1

r 1 , τ HH,1 r 2
and T k respectively to y r1 , y r2 , y k . The dishonest ballot y 3 is given type LL again by rule PIn. The intricate point is the decryption of this ballot and weeding. At this point, the ballot received could be either a copy of Alice's, a copy of Bob's, or a ballot generated by the attacker. Rule PLet (with destructor rule DAdecH') reflects these three cases: since we decrypt with a variable with type T k , we need to typecheck the continuation process three times, which will correspond to each of these three cases, and then combine all constraints obtained. More precisely, there are three possible types for variables z v3 , z r3 , z r3 : two from the two branches of the union type in the payload type of T k (which we split using POr), and one for the case where the ciphertext is produced by the attacker. Formally we have to typecheck the rest of the process with the following types for variables:

• once with z v3 : HL, z r3 : HL, z r3 : τ HH,1 r 1

. Then when performing the first equality check, rule PIfLR can use the refinement types of z r3 and y r1 to show that the test always succeeds. We thus only have to typecheck the then-branch, which is 0 and trivially typechecks with no constraints.

• once with z v3 : HL, z r3 : HL, z r3 : τ HH,1 r 2 . This time, rule PIfLR similarly shows that the first test fails, and the second (i.e. z r3 = y r2 ) succeeds. Similarly, we thus only have to typecheck the second then-branch, which is 0.

• once with z v3 : LL, z r3 : LL, z r3 : LL. The refinements of both y r1 and y r2 allow us to give them type HH (without constraints) using rule TLR'. Using this information, rule PIfS detects that, since z r3 has type LL, both equality checks fail, and we only have to typecheck the last else-branch, i.e. the output of z v3 . This is easily done using POut, without creating any constraints, since this variable has type LL.

Notice that the typechecking of the weeding entirely relies on the use of refinements. Indeed, in the first two cases, z v3 has type HL, and thus cannot be output. It has to be this way, since, intuitively, in that case, this variable contains the vote of Alice or Bob, which is different on the left and on the right. It is therefore crucial for the typechecking that in the first two case we can statically detect that the weeding removes this ballot, and that there is no need to typecheck the output of z v3 . This is only possible thanks to the refinements of variables z r3 , y r1 , and y r2 .

In addition, the Setup process just consists in the output of public values, which can easily be given type LL without any constraints. It then clearly typechecks with an empty constraint set using rule POut.

Altogether, after applying rule PPar, the constraint set for the non-replicated part of the process, i.e.

for Setup | V (k 1 , v 1 ) | V (k 2 , v 2 ) | S(vk(k 1 ), vk(k 2 )), is C = C a ∪ × C b .
That is to say, omitting from the environment all variables and names that do not occur in the messages:

C = { ({M ∼ N, sign(M, k 1 ) ∼ sign(N, k 1 ), M ∼ N , sign(M , k 2 ) ∼ sign(N , k 2 )}, [x r : LL, x k : T k , x r : LL, x k : T k , r 1 : τ HH,1 r 1 , r 2 : τ HH,1 r 2 ]) }
where M = aenc( 0, x r , r 1 , x k ) and N = aenc( 1, x r , r 1 , x k ) are Alice's ballots, and M = aenc( 1, x r , r 2 , x k ) and N = aenc( 0, x r , r 2 , x k ) are Bob's 10 .

The replicated part of the process, i.e. S , does not generate any constraints when typechecked. Therefore, we only need to check the consistency of C.

Consistency for Helios, and conclusion

We do not detail entirely the application of the procedure check_const to C here, but only the most relevant points.

• step1 actually leaves the constraints unchanged, since no variables in the messages have refinement types.

• step2 is satisfied on all elements in C: in particular, all encryptions are with honest keys and contain the nonce r 1 or r 2 , whose types have label HH.

• step3 is satisfied on all elements in C, as none of the messages M , M , sign(M, k 1 ), sign(M , k 2 ) (resp. N , N , sign(N, k 1 ), sign(N , k 2 ) on the right) are unifiable with one another. Indeed, M and M contain different votes (0 and 1 respectively), and thus cannot be unified, and similarly for the two signatures; and the encryptions M and M of course cannot be unified with the signatures. Hence, the check_const procedure applied to C succeeds. It also clearly succeeds on [ C ] 1 which is just a renaming of C.

Therefore, Theorem 7 proves that Helios indeed satisfies the vote privacy property, when considering two honest voters Alice and Bob, and an unbounded number of dishonest voters.

Note that this proof only holds thanks to the fact that Alice and Bob each vote only once. Having Alice vote several times would require the election public key to have a more general type, that allows it to encrypt several different ballots from Alice. When typechecking the decryption performed by the server S , we could then not discard the case where the ballot received is a copy of Alice's: we cannot statically know that the weeding test will succeed (i.e., that the ballot will be rejected) in that case. In fact, as already mentioned, there is an attack (discovered by Roenne) in case voters revote. The attacker may block one of Alice's ballots, and submit a copy of it in his name, which could not be detected by weeding, as the server has never seen it. This attack corresponds exactly to the case we could not typecheck, as we just described. However this attack is not possible if voters do not revote: our type system is able to leverage this by encoding in the types the information that each voter can only produce one ballot.

Private Authentication

We now show how our type system can be applied to type the Private Authentication protocol evoked in Section 2.2, by showing the most interesting parts of the derivation.

Modelling anonymity for Private Authentication

Recall that the protocol was informally described as follows

A → B : aenc( N a , pk(k a ) , pk(k b )) B → A : aenc( N a , N b , pk(k b ) , pk(k a )) if B accepts A's request aenc(N b , pk(k)) if B declines A's request
where aenc(N b , pk(k)) is a decoy message indicating that B refuses to communicate with A, and pk(k) is a decoy key (no one knows the private key k).

As briefly mentioned in Section 2.2, we model the role of the initiator A with key k a trying to authenticate an agent with public key pk b as the following process:

P a (k a , pk b ) = new N a .out(aenc( N a , pk(k a ) , pk b )). in(z)
We model the role of agent B with key k a willing to authenticate to an agent with public key pk b (and refusing requests from other agents) as the following process P b (k b , pk b ):

P b (k b , pk a ) = new N b . in(x). let y = adec(x, k b ) in let y 1 = π 1 (y) in let y 2 = π 2 (y) in if y 2 = pk a then out(aenc( y 1 , N b , pk(k b ) , pk a )) else out(aenc(N b , pk(k)))
The protocol aims to provide anonymity, that is, intuitively, an attacker should not be able to tell whether B is willing to accept authentication requests from agent A, or rejects them and is only willing to communicate with another honest11 agent C 12 . Following the model proposed in [START_REF] Arapinis | Analysing unlinkability and anonymity using the applied pi calculus[END_REF], we formalise this property as the following equivalence:

P a (k a , pk(k b )) | P b (k b , pk(k a )) ≈ t P a (k a , pk(k b )) | P b (k b , pk(k c ))

Typechecking Private Authentication

The key point when proving this equivalence is that the execution is not uniform. The authentication request can typically succeed on the left and fail on the right in the corresponding execution. In that case, the real response, encrypted with k b , is output in the left process, while the decoy response, encrypted with the decoy key k, is output on the right. For each possible such case, where a different key is used on either side, the typing environment must contain a binding for the corresponding bikey.

We type the protocol using the initial environment Γ presented earlier in Figure 2.1, and reproduced here. We focus first on the responder process P b . We start by applying rule PNew, which simply adds to Γ the binding N b : τ HH,1 N b . Then, rule PIn requires us to typecheck the rest of the process with x : LL. Let us write Γ = Γ, x : LL, N b : τ HH,1 N b . We then proceed with the asymmetric decryption. As we use the same key k b in both processes, we apply rule PLetAdecSame. We have Γ (x) = LL from rule PIn and Γ (k b , k b ) = key HH (HL * LL). We do not have any other entry using key k b in Γ . We hence need to typecheck the two then branches once with Γ , y : (HL * LL) and once with Γ , y : LL, as well as the two else branches (which are just 0 in this case, and are trivially typed using rule PZero).

Typing the let expressions where the message in y is projected onto its two components is straightforward using rule PLet. When typechecking with y : LL, they specify that the continuation must be typechecked with Γ , y : LL, y 1 : LL, y 2 : LL. Otherwise, when y : (HL * LL), it must be typechecked with Γ , y : (HL * LL), y 1 : HL, y 2 : LL.

In the conditional we check y 2 = pk(k a ) in the left process and y 2 = pk(k c ) in the right process. In any case, we only know at this point that y 2 has type LL. This variable is compared to messages pk(k a ) and pk(k c ), which on the contrary cannot be given type LL, as observing them would let the attacker distinguish between the two sides. Hence we cannot guarantee which branches are taken, or even if the same branch is taken in the two processes. We therefore use rule PIfAll to typecheck all four possible combinations of branches. Note that in doing this we also typecheck cases where the authentication succeeds on the right, which should not happen in real executions, as the agent C that B accepts requests from is not present. This is expected: when typechecking, we overapproximate the behaviours of the processes. With finer typing rules, we might be able to statically determine that such cases cannot happen, producing less constraints to check for consistency. Since the constraints produced here are consistent anyway, this is not an issue here, and we can still prove the property despite this overapproximation.

We now focus on the case where A's request is successful in the left process and is rejected in the right process. We then have to typecheck B's positive answer together with the decoy message: Γ aenc(

y 1 , N b , pk(k b ) , pk(k a )) ∼ aenc(N c , pk(k)) :
LL, where Γ is either Γ 1 = Γ , y 1 : HL, y 2 : LL, or Γ 2 = Γ , y 1 : LL, y 2 : LL, depending on which of the two proof obligations created by rule PLetAdecSame we are proving.

Figure 3.2 presents the type derivation for this example. We apply rule TAenc to give type LL to the two terms, adding the two encryptions to the constraint set. Using rule TAencH we can show that the encryptions are well-typed with type {HL} pkey(key HH (HL)) . The type of the payload is trivially shown with rule THigh. To type the public key, we use rule TPubKey followed by rule TKey, which looks up the type for the bikey (k a , k) in the typing environment Γ .

The other three cases can be typechecked similarly, regardless of the type of y 1 , yielding each time a constraint containing a single pair of messages: either two honest responses, a decoy message and a honest response, or two decoy messages. Altogether, typechecking the responder process thus yields the constraint set

C b = C b,1 ∪ C b,2 , where 13 C b,1 = { ({aenc( y 1 , N b , pk(k b ) , pk(k a )) ∼ aenc( y 1 , N b , pk(k b ) , pk(k c ))}, Γ 1 ), ({aenc( y 1 , N b , pk(k b ) , pk(k a )) ∼ aenc(N b , pk(k))}, Γ 1 ), ({aenc(N b , pk(k)) ∼ {aenc( y 1 , N b , pk(k b ) , pk(k c ))}, Γ 1 ), ({aenc(N b , pk(k)) ∼ aenc(N b , pk(k))}, Γ 1 ) } and C b,2 is identical to C b,1 except its elements contain Γ 2 instead of Γ 1 .
The initiator process P a is more easily typechecked: as for the responder, rule PNew first simply adds N a : τ HH,1

Na to the environment. Then we use rule POut, which requires to give type LL to the request message, i.e. Γ, N a : τ HH,1 Na aenc( N a , pk(k a ) , pk b ) ∼ aenc( N a , pk(k a ) , pk b ) : LL. This is done in the same way as the response message, and yields constraint

aenc( N a , pk(k a ) , pk b ) ∼ aenc( N a , pk(k a ) , pk b ).
The rest of the process trivially typechecks with rules PIn and PZero, and the initiator process thus typechecks with constraint

C a = {({aenc( N a , pk(k a ) , pk b ) ∼ aenc( N a , pk(k a ) , pk b )}, (Γ, N a : τ HH,1 Na , z : LL))}.
Altogether, after applying rule PPar, the constraint set for the whole process is thus

C = C a ∪ × C b , i.e. C = { ({Q ∼ Q, R ∼ R }, Γ 1 ), ({Q ∼ Q, R ∼ D}, Γ 1 ), ({Q ∼ Q, D ∼ R }, Γ 1 ), ({Q ∼ Q, D ∼ D}, Γ 1 ), ({Q ∼ Q, R ∼ R }, Γ 2 ), ({Q ∼ Q, R ∼ D}, Γ 2 ), ({Q ∼ Q, D ∼ R }, Γ 2 ), ({Q ∼ Q, D ∼ D}, Γ 2 ) } where Q = aenc( N a , pk(k a ) , pk b ) is the request, R = aenc( y 1 , N b , pk(k b ) , pk(k a )) and R = aenc( y 1 , N b , pk(k b ) , pk(k c
)) are the responses to A and C respectively, and lastly

D = aenc(N b , pk(k)) is the decoy message. Γ 1 is the environment Γ, N a : τ HH,1 Na , N b : τ HH,1 N b , x : LL, y : HL * LL, y 1 : HL, y 2 : LL, z : LL and Γ 2 is identical except that Γ 2 (y) = Γ 2 (y 1 ) = LL.

Consistency for Private Authentication, and conclusion

We do not detail entirely the application of the procedure check_const to C here, but only the most relevant points.

• step1 is actually the identity function here, as neither Γ 1 nor Γ 2 contain refinement types: it leaves the constraints unchanged.

• step2 is satisfied on all elements in C: in particular, all encryptions are with honest keys and contain the nonce N b whose type is τ HH,1 N b in both Γ 1 and Γ 2 .

• step3 is satisfied on all elements in C, as none of the messages Q, R, D are unifiable with one another (and similarly on the right for Q, R , D).

Therefore, the soundness theorems (Theorems 1 and 3) prove that Private Authentication indeed satisfies the anonymity property, when considering one session of the initiator and one session of the responder.

We may even use Theorem 7 to consider an unbounded number of sessions of both the initiator and the responder, and prove that

! (P a (k a , pk(k b )) | P b (k b , pk(k a ))) ≈ t ! (P a (k a , pk(k b )) | P b (k b , pk(k c ))).
According to the theorem, we still need to typecheck only one session to prove this equivalence: we have already done this above. The names N a and N b now have infinite types τ HH,∞ Na and τ HH,∞ N b , but this has no influence on the typechecking since no rules where this distinction matters were used.

As there is no unreplicated part here, what remains to be done is simply to ensure that

check_const([ C ] 1 ∪ × [ C ] 2 ) = true.
The reasoning for this is the same as in the bounded case for the first two steps. For the third step, the only new unifications that could potentially happen would be between the two (renamed) copies of Q, the two copies of R (or R ), or the two copies of D. However, all of these messages contain one of the nonces N a , N b . Since these now have infinite types τ HH,∞ Na and τ HH,∞ N b , they are renamed in each of the copies, and therefore prevent these unifications. Therefore the procedure succeeds, and Theorem 7 proves the equivalence above: Private authentication satisfies anonymity with an unbounded number of sessions of both the initiator and the responder.

Experimental Results

We have implemented in collaboration with Niklas Grimm a prototype type-checker for our type system, which we will call TypeEq in the following, and applied it on various examples briefly described below. Its source code, as well as the files from the examples, are available at [1].

Symmetric key protocols For the sake of comparison, we consider two symmetric key protocols taken from the benchmark of [START_REF] Cortier | SAT-Equiv: an efficient tool for equivalence properties[END_REF], and described in [START_REF] Clark | A survey of authentication protocol literature: Version 1[END_REF]: Needham-Schroeder and Yahalom-Lowe. These protocols aim at exchanging a key symmetric k. In both cases, we prove key usability of the exchanged key. Intuitively, we show that an attacker cannot distinguish between two encryptions of public constants: P.out(enc(a, k)) ≈ t P.out(enc(b, k)). Note in particular that this equivalence is immediately broken if the attacker is able to learn k.

Asymmetric key protocols In addition to the symmetric key protocols, we consider the well-known Needham-Schroeder-Lowe (NSL) protocol [START_REF] Lowe | Breaking and fixing the Needham-Schroeder public-key protocol using FDR[END_REF] and we again prove strong secrecy of the nonce sent by the receiver (Bob).

Helios

We model the Helios protocol for two honest voters and infinitely many dishonest ones, as described in Section 3.2. As emphasised in Section 2.2, Helios is secure only if honest voters vote at most once. Therefore the protocol includes non replicated processes (for voters) as well as a replicated process (to handle dishonest ballots).

BAC The Basic Access Control (BAC) protocol is one of the protocols embedded in the biometric passport [START_REF]Machine readable travel document[END_REF]. We show anonymity of the passport holder P (A) ≈ t P (B). Actually, the only data that distinguishes P (A) from P (B) are the private keys. Therefore, to make the property non-trivial, we consider an additional step where the passport sends the identity of the agent to the reader, encrypted with the exchanged key.

Private Authentication Finally, we consider the private authentication protocol, as described in the previous section.

All our experiments have been run on a single Intel Xeon E5-2687Wv3 3.10GHz core, with 378GB of RAM (shared with the 19 other cores). Actually, our own prototype does not require a large amount of RAM. However, some of the other tools we consider used more than 64GB of RAM on some examples (at which point we stopped the experiment).

Bounded number of sessions

We first compare our tool with tools designed for a bounded number of sessions. We ran our benchmarks using the latest public versions at the time of writing of SPEC [START_REF] Dawson | Automating open bisimulation checking for the spi calculus[END_REF], APTE (and its APTE-POR variant) [START_REF] Cheval | APTE: an Algorithm for Proving Trace Equivalence[END_REF][START_REF] Baelde | Partial order reduction for security protocols[END_REF], Akiss [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocols[END_REF], SAT-Equiv [START_REF] Cortier | SAT-Equiv: an efficient tool for equivalence properties[END_REF], and Deepsec [START_REF] Cheval | DEEPSEC: Deciding Equivalence Properties in Security Protocols -Theory and Practice[END_REF]. The protocol models may slightly differ due to the subtleties of each tool. For example, several of these tools require simple processes where each sub-process emits on a distinct channel. We do not need such an assumption. Moreover, Helios involves non-trivial else branches, which are not supported by all of the tools.

The number of sessions we consider denotes the number of processes (modelling protocol roles) in parallel in each scenario. For symmetric key protocols, we start with a simple scenario with only two honest participants A, B and a honest server S (3 sessions). We consider increasingly more complex scenarios (6, 10, and 14 sessions) featuring a dishonest agent C.

In the complete scenario (14 sessions) each agent among A, B (and C) runs the protocol once as the initiator, and once as the responder with each other agent (A, B, C). In the case of NSL, we similarly consider a scenario with two honest agents A, B running the protocol once (2 sessions), and two scenarios with an additional dishonest agent C, up to the complete scenario (8 sessions) where each agent runs NSL once as initiator, once as responder, with each agent. In some cases, we further increase the number of sessions (replicating identical scenarios) to better compare tools performance. For Helios, we consider 2 honest voters, and one dishonest voter only, as well as a ballot box. The corresponding results are reported in Figure 3.3.

In several cases the tools were not able to prove the protocol, for different reasons. We write TO for Time Out (we stopped the experiments after 12 hours), MO for Memory Out (we stopped the experiments when the tool used up more than 64 GB of RAM), SO for Stack Overflow, BUG in the case of APTE, when the proof failed due to bugs in the tool, and x when the tool could not handle the protocol for the reasons discussed previously. In all cases, our tool is almost instantaneous and outperforms by orders of magnitude the competitors.

Unbounded numbers of sessions

We then compare our type-checker with the latest public version of ProVerif [START_REF] Blanchet | Automated verification of selected equivalences for security protocols[END_REF] at the time of writing, for an unbounded number of sessions, on a the same examples as for the bounded case.

As expected, ProVerif cannot prove Helios secure since it cannot express that voters vote only once. This may sound surprising, since proofs of Helios in ProVerif already exist (e.g. [START_REF] Cortier | Attacking and Fixing Helios: An Analysis of Ballot Secrecy[END_REF][START_REF] Arapinis | When are three voters enough for privacy properties? In 21st[END_REF]). Interestingly, these models actually implicitly assume a reliable channel between honest voters and the voting server: whenever a voter votes, she first sends her vote to the voting server on a secure channel, before letting the attacker see it. This model prevents an attacker from reading and blocking a message, while this can be easily done in practice (by breaking the connection). The execution times are very similar between the two tools. The corresponding results are reported in Figure 3

Conclusion to Part I

We presented a novel type system for verifying trace equivalence in security protocols. It can be applied to a large class of protocols, with support for else branches, standard cryptographic primitives, dynamic key generation, non-uniform branching, as well as bounded and unbounded numbers of sessions. We believe that our prototype implementation demonstrates that this approach is promising and opens the way to the development of an efficient technique for proving equivalence properties in even larger classes of protocols.

Our type system requires a light type annotation: the user must specify the type of the keys. While it seems reasonable to expect the user to provide the label (is the key supposed to be secret or not), the type of the payload the key should encrypt or sign can be more complex. In our case study, in most cases this type simply describes the structure and security labels of the messages encrypted by the key. Such types could possibly be inferred automatically by looking at the messages the keys encrypt in the process. However the case of the Helios protocol in particular is rather intricate: the user has to write a refined type that corresponds to an overapproximation of any encrypted message. As future work on this topic, it would be interesting to develop an automatic type inference system, and in particular to explore whether such types could be inferred automatically. A possible heuristic to do this would be to start the typechecking without the information on the payload types for the keys, until we reach a point where a key is used to encrypt a message. A type for that message would then be determined, using its structure and the currently available typing environment, and added as a payload type to the key. We would then have to backtrack, and start the typechecking over with this new key type, until we encounter a message that cannot be typechecked with it. Again the type for this message would be added to the key type, we would backtrack, and so on until -hopefully -a key type is reached that lets the whole process typecheck.

We also plan to study how to add phases to our framework, in order to cover more properties, that involve several stages in the protocol. For instance, a variant of the unlinkability property could be formulated by considering the scenario where the attacker first observes and interacts with a session run by Alice, and only after this session has ended can interact with a second session, and try to determine whether that second session is also with Alice, or with another user Bob. Incorporating phases to our type system would require to generalise it, to account for the fact that the type of a key may depend on the phase in which it is used. For instance in the unlinkability case, a key could have a type specifying that, during the first phase, it only encrypts messages from Alice, while in the second phase it can additionally encrypt messages from Bob.

Several other interesting problems remain to be studied. Notably, a limitation of our type system is that it does not address processes with too dissimilar structures. Our type system goes beyond diff-equivalence (where the executions must be the same on both sides, and only the messages themselves may differ), e.g. allowing else branches to be matched with then branches.

However we cannot prove equivalence of processes where traces of P are dynamically mapped to traces of Q, depending on the attacker's behaviour. Such cases occur for example when proving unlinkability of the biometric passport. An interesting direction would be to explore how to enrich our type system with additional rules that could cover such cases, taking advantage of the modularity of the type system. Intuitively, this would require us to express for instance that a key is used in a different way, e.g. paired with a different key in a bikey, depending on which branch of a conditional we are typechecking.

Finally, another interesting problem would be the treatment of primitives with algebraic properties (e.g. Exclusive Or, or homomorphic encryption). A direction to explore would be to extend the type system with simple rules -compared to the current ones for encryption -that discharge these primitives and their difficulty to the consistency of the constraints. Algebraic properties of primitives intuitively seem easier to handle in the constraints, since they capture the static case.

Part II

Vote Privacy

Introduction to Part II

In order to carefully analyse electronic voting systems, several classes of security requirements have been defined. As explained in introduction, two of the main security properties are:

• privacy: no one should know how I voted;

• verifiability, which is typically described through the three following sub-properties.

individual verifiability: a voter can check that her ballot is counted; -universal verifiability: anyone can check that the result corresponds to the published ballots;

eligibility verifiability: only legitimate voters may vote.

These two main properties seem antagonistic. Basically, privacy requires that as little information as possible should be made public by the authorities, besides the result of the election. On the other hand, for a system to be verifiable, some information has to be published, to allow voters to verify -in some way specified by the scheme -that their vote was counted. Intuition hence seems to indicate that making a verifiable system creates a risk that some information will be revealed on the votes, causing privacy breaches.

Related work

In fact, as mentioned in introduction, an impossibility result has even been established [START_REF] Chevallier-Mames | On some incompatible properties of voting schemes[END_REF], stating that verifiability is incompatible with unconditional privacy. That notion of privacy requires that the votes remain perfectly secret even from an adversary with unlimited computational power. No such result however has been established when considering privacy notions that feature a polynomially bounded attacker. A polynomial attacker is usual when studying cryptographic protocols -most protocols achieve only such computational privacy, rather than unconditional privacy. Many game-based privacy definitions have been proposed, as surveyed in [START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF]: they all consider a polynomial adversary. [START_REF] Delaune | Coercion-resistance and receiptfreeness in electronic voting[END_REF] establishes a hierarchy between privacy, receipt-freeness, and coercion resistance, while in a quantitative setting, [START_REF] Küsters | Verifiability, Privacy, and Coercion-Resistance: New Insights from a Case Study[END_REF] shows that this hierarchy does not hold anymore. [START_REF] Cortier | Sok: Verifiability notions for e-voting protocols[END_REF] recasts several definition of verifiability in a common setting, providing a framework to compare them. Besides [START_REF] Chevallier-Mames | On some incompatible properties of voting schemes[END_REF], none of these approaches relates privacy with verifiability.

Contribution -privacy and verifiability

In the following chapters, we study the relations between these two security properties. Our first important contribution is to establish that, in fact, (computational) privacy implies individual verifiability, that is, guarantees that all the honest votes will be counted. This result holds for arbitrary primitives and voting protocols without anonymous channels. To show that this implication is not due to a choice of a very particular definition, over the next two chapters, we prove it in two very distinct contexts, namely symbolic and cryptographic models (respectively, Chapters 4 and 5). In symbolic models, such as the one we considered in Part I, messages are represented by terms and the attacker's behaviour is typically axiomatised through a set of logical formulas or rewrite rules. Cryptographic models are more precise. They represent messages as bitstrings and consider attackers that can be any probabilistic polynomial time Turing machines. Proofs of security are made by reduction to well accepted security assumptions such as hardness of factorisation or discrete logarithm. In both models, we consider a standard notion of privacy already used to analyse several protocols. In the symbolic setting, as explained in previous chapters, we express privacy as an equivalence property between two scenarios where the votes of two voters Alice and Bob are swapped. In the computational case, we use (an adaptation of) Benaloh's definition [START_REF] Benaloh | Verifiable secret-ballot elections[END_REF]. That game-based definition follows a similar intuition to the symbolic notion. The adversary wins if he can distinguish between two scenarios where the set of votes from all (honest) voters produces the same result -which generalises the symbolic case, where this set contains only Alice and Bob's votes, and is therefore the same in the two scenarios. In both settings, we establish that privacy implies individual verifiability for a (standard) basic notion of individual verifiability, namely that the result of the election must contain the votes of all honest voters.

To briefly explain our idea, let us consider a very simple protocol, not at all verifiable. In this simple protocol, voters simply encrypt their votes with the public key of the election. The ballot box stores the ballots and, at the end of the election, it provides the list of recorded ballots to the talliers, who detain the private key, possibly split in shares. The talliers compute and publish the result of the election. The ballot box is not public and no proof of correct decryption is provided so voters have no control over the correctness of the result. Such a system is of course not satisfactory but it is often viewed as a "basic" system that can be used in contexts where only privacy is a concern. Indeed, it is typically believed that such a system guarantees privacy provided that the attacker does not have access to the private key of the election. In particular, the ballot box (that is, the voting server) seems powerless. This is actually not the case. If the ballot box aims at knowing how a particular voter, say Alice, voted, he may simply keep Alice's ballot in the list of recorded ballots and then replace all the other ballots by encryptions of valid votes of his choice, possibly following a plausible distribution, to make the attack undetected. When the result of the election is published, the ballot box already knows the value of all votes but Alice's, and will therefore be able to deduce how Alice voted. We show how to generalise this idea to produce an attack on privacy from any attack on individual verifiability.

Our result may seem counter-intuitive when thinking of existing analysis of voting schemes. Indeed, if privacy implies individual verifiability, how is it possible to prove Helios [START_REF] Bernhard | How Not to Prove Yourself: Pitfalls of the Fiat-Shamir Heuristic and Applications to Helios[END_REF] or Civitas [START_REF] Backes | Automated verification of remote electronic voting protocols in the applied pi-calculus[END_REF] without even modelling the verification aspects? How can a system that is not fully verifiable like the Neuchâtel protocol be proved private [START_REF] Galindo | Neuchâtel's cast-as-intended verification mechanism[END_REF]? This apparent contradiction can be resolved by closely examining the trust assumptions we consider: we in fact prove that privacy implies individual verifiability with the same trust assumptions w.r.t. all election authorities for both properties. In previous work, verifiability is typically studied against a dishonest ballot box, while privacy notions assume a trusted ballot box.

Contribution -privacy against a dishonest ballot box

Our second contribution in this part is to propose new notions of vote privacy, in the context of an untrusted ballot box. Indeed, as pointed out above -a similar observation was made in [START_REF] Bernhard | Ballot secrecy with malicious bulletin boards[END_REF] -existing cryptographic definitions of privacy implicitly assume an honest voting ballot box. That is the case for all definitions surveyed in [START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF]: honest ballots are assumed to be properly stored and then tallied. Actually, we notice that the same situation occurs in symbolic models. Although the well adopted definition of privacy [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF] does not specify how the ballot box should be modelled, most symbolic proofs of privacy (see e.g. [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF][START_REF] Cortier | A formal analysis of the norwegian e-voting protocol[END_REF][START_REF] Cortier | Attacking and Fixing Helios: An Analysis of Ballot Secrecy[END_REF][START_REF] Backes | Automated verification of remote electronic voting protocols in the applied pi-calculus[END_REF]) actually assume that the votes of honest voters always reach the ballot box without being modified and that they are properly tallied. The reason is that the authors were aware of the fact that if the adversary may block all ballots but Alice's ballot, he can obviously break privacy. However, to avoid this apparently systematic attack, they make a very strong assumption: the ballot box needs to be honest. This means that previous cryptographic and symbolic privacy analyses only hold assuming an honest ballot box while the corresponding voting systems aim at privacy without trusting the ballot box. This seriously weakens the security analysis and attacks may be missed, like the attack of Roenne [START_REF] Roenne | [END_REF] on Helios, for which there is no easy fix.

In Chapter 6, we attempt to close that gap, by proposing a new definition for ballot privacy, that circumvents this problem and remains meaningful in the context of an untrusted ballot box. Intuitively, vote privacy tries to capture the idea that, no matter how voters vote, the attacker should not be able to see any difference. The key issue is that the result of the election does leak some information (e.g. the sum of the votes) and the adversary may notice a difference based on this. Typically, as soon as some voters do not check (in the way specified by the voting scheme) that their votes are counted, an adversary may remove these votes without being detected, which leads to the result leaking more information than it should on the remaining votes. Our idea is to solve this issue by designing a definition that allows us to acknowledge this inevitable leakage, and specifically express that we do not wish to consider it as an attack on privacy.

We actually go further than that. In some schemes, such as Helios, when voters do not verify, the adversary is even able to not only remove, but also replace their ballots with his own, containing votes of his choice. Similarly to the discussion above, this additional ability may let him obtain even more information on the remaining votes from the tally. Depending on the context and use case of the scheme, this may or may not be considered an issue. Hence we may wish to specify that such a behaviour -modifying votes of people who do not check -does or does not constitute an attack on privacy.

To handle such cases in a general way, we thus formally define a family of games for privacy against a dishonest ballot box, that explicitly exclude some adversarial behaviours -removing votes, changing them, etc.-from constituting attacks. We do this in a modular way: our definition is a cryptographic game that is parametrised by the class of behaviours we wish to allow, i.e. not to consider an attack. To show that our definition is still sufficiently robust, we relate it to a family of simulation-based notions of privacy: in these, the voting scheme must securely implement an ideal functionality, that describes precisely what power an adversary can have against the scheme. We show that each instance of our game-based notion implies simulation-based security for a corresponding ideal functionality. Finally we conduct a case study, applying our definition to several existing voting schemes, that prevent or allow different classes of adversarial behaviours, to showcase its flexibility.

Related publications

Privacy Implies Verifiability: Symbolic Model

In this chapter, we establish that privacy implies individual verifiability for voting systems in a symbolic model. We first present our model for voting protocols and the associated security properties in the symbolic setting. We then detail under which assumptions our result holds, and formally state and prove it.

Model

Let us first introduce the symbolic model we will use to represent voting systems. In this section, we consider a generalisation of the process algebra presented in Chapter 1, in the spirit of the applied pi-calculus [START_REF] Abadi | Mobile values, new names, and secure communication[END_REF].

Messages

The model here is quite similar to the one we considered earlier in Chapter 1, except we now allow any signature of function symbols, to model any cryptographic primitive, rather than the fixed set of constructors and destructors considered before.

As in Part I, we consider an infinite set of names N that model fresh values such as nonces and keys. We distinguish the set FN of free nonces (generated by the attacker) and the set BN of bound nonces (generated by the protocol agents). We also assume an infinite set of variables V = X AX where X contains variables used in processes (agent's memory) while AX contains variables used to store messages (adversary's memory). Cryptographic primitives are represented through a signature F, i.e. a set of function symbols with their arity. We assume an infinite set C ⊆ F of public constants, which are functions of arity 0.

As before, we model messages by terms: the set T (F, V, N ) of terms is inductively defined by applying functions to variables in V and names in N . The set of names (resp. variables) occurring in a term t is denoted names(t) (resp. vars(t)). A term is ground if it does not contain any variable. The set of terms T (F, AX , FN ) represents the attacker terms, that is, terms built from the messages sent on the network and stored thanks to the variables in AX . As in Part I, we call substitution a mapping from variables to messages, and we denote by tσ the application of σ to a term t, i.e. the term obtained by replacing each variable x ∈ dom(σ) occurring in t with σ(x).

Contrary to the model considered in Part I however, we do not consider a specific signature F modelling a fixed set of primitives. Instead, we leave the signature abstract, as our result is general with respect to the signature used.

Indeed, depending on the voting protocol we wish to model, the signature may need to contain symbols for cryptographic primitives not covered by the signature considered in Part I. For instance, some protocols use homomorphic encryption, so that the encrypted votes can be added together, and only the aggregated ciphertext needs to be decrypted. Another example would be randomisable encryption. In some protocols it is important that ballots can be re-randomised: ciphertexts are randomised with a random value when created, and given a ciphertext c, anyone can generate a new c encrypting the same plaintext as c by updating the random value used in c, without knowing the decryption key. This may be used for instance to have the server in the election re-randomise all ballots before publishing them, so that they still contain the same votes but can no longer be linked with voters. One last example would simply be the + operator, i.e. an associative and commutative operator, that can be used to sum all votes together to compute the result of the election. Such primitives are not covered by the signature from Chapter 1.

In addition their behaviour cannot always be modelled as a destructor application similar to the ones used in Chapter 1. Instead, the properties of the cryptographic primitives are modelled through an equational theory.

Definition 21 (Equational theory

). An equational theory E, is a finite set of equations of the form M = N , where M, N ∈ T (F, X , ∅) are messages without names.

Equality modulo E, denoted by = E , is defined as the smallest equivalence relation on terms that makes M and N equal for each equation M = N in E, and is closed under context and substitution. Formally: Definition 22 (Equality modulo an equational theory). Given an equational theory E, = E is the smallest equivalence relation on terms such that

• for all equation M = N in E, M = E N . • for all function symbol f ∈ F of arity n, for all messages M 1 , . . . M n , N 1 , . . . N n , if ∀i. M i = E N i then f (M 1 , . . . , M n ) = E f (N 1 , . . . , N n ).
• for all messages M , N , for all substitution σ, if

M = E N then M σ = E N σ.
We denote disequalities modulo E by M = E N . A consequence of this modelling, and of considering arbitrary signatures and equational theories, is that we no longer have the restriction from Chapter 1 that keys must be atomic. Example 6. Consider the signature F c ∪ F d ∪ C from Chapter 1. Recall that it contained constructors and destructors for symmetric and asymmetric encryption, signatures, and pairs. We can easily define the properties of these primitives using an equational theory, by turning the rewriting rules for destructors (from Section 1.2) into equations, as follows. We could enrich it with a + symbol representing the sum, and characterise + as an associative and commutative operator using the following equations.

x + (y + z) = (x + y) + z

x + y = y + x Homomorphic encryption could then for instance be formalised by adding a second associative and commutative operator * , and the following equation.

aenc(x, z) * aenc(y, z) = aenc(x + y, z).

Randomisable encryption could be modelled for instance by adding a third argument to the aenc symbol, that represents the randomness used, and a rerand symbol for the randomisation operation. Randomising a ciphertext that uses randomness r with a new random value r would be modelled by the equation rerand(aenc(x, r, y), r ) = aenc(x, r + r , y).

Processes

The behaviour of protocol parties is described through processes. The syntax of the process calculus is depicted in Both the syntax and semantics of the calculus are very similar to those presented in Chapter 1, with a few additions which we will now present. First, while it was useful in Part I to consider the symbolic, uninstantiated frame and the instantiation of variables, this is no longer needed here. Hence, for better readability, we combine the two together. What we will now call a frame φ is a substitution with dom(φ) ⊆ AX that contains ground messages, and represents the instantiated messages sent on the network. It corresponds to what would earlier have been ψσ, where ψ was the sequence of uninstantiated messages, and σ the instantiation of variables. -----→ ({P [Rφ/x]} ∪ P; φ)

In if R is an attacker term such that vars(R) ⊆ dom(φ) ({event(M 1 , . . . , M n ).P } ∪ P; φ) event(M 1 ,...,Mn) -----------→ ({P } ∪ P; φ) Event if ∀i. M i is a ground message ({let x = M in P } ∪ P; φ) τ -→ ({P [M/x]} ∪ P; φ) Let-In if M is ground ({if M = N then P else Q} ∪ P; φ) τ -→ ({P } ∪ P; φ) If-Then if M , N are ground messages such that M = E N ({if M = N then P else Q} ∪ P; φ) τ -→ ({Q} ∪ P; φ) If-Else if M , N are ground messages such that M = E N ({!P } ∪ P; φ) τ -→
({P, !P } ∪ P; φ) Repl Moreover, since we no longer consider a fixed set of constructor and destructors, but rather an arbitrary signature and equational theory, we no longer restrict the let construction to a fixed list of destructors. Instead, any message can be stored in any variable.

In addition, we extend the calculus with different communication channels: when sending or receiving messages, processes must now specify a channel name, that identifies which channel is used. All channels will be public: the attacker has access to all of them and can e.g. intercept messages from one channel and resend them on another. We consider different channels nevertheless to model the fact that an attacker can identify the provenance of a message. When a message is sent or received, he can now observe on which channel this action is performed, which gives him potentially useful information when trying to distinguish between two processes.

Formally, we consider an infinite set Ch of channel names, representing the channels on which the messages are exchanged. As seen in Figure 4.1, the out and in instructions now take as an additional argument a channel name. Accordingly, rules Out and In (Figure 4.2) now record in the trace the channel on which the action is performed.

Finally, we also extend the calculus with events. These are steps in the processes that do not actually model the behaviour of the protocol, but are rather used to record that participants have reached a certain step in the protocol, with some associated knowledge. Events can be emitted by processes, and can contain some messages the process wants to record. They are stored in the trace, but are invisible to the attacker. That is, in the eyes of the attacker, two traces with the same observable actions (inputs, outputs) are the same, even if they contain different events. Events are a rather standard feature in symbolic models, for instance when modelling agreement properties between two parties. Such cases can be modelled by having both parties emit an event containing the message (e.g. a session key) on which they think they agree. Basically, agreement is then modelled by requiring that, for instance, any event emitted by the responder is matched by an event emitted by the initiator containing the same message. As we will explain in the next section, we use events here to record (secretly to the attacker) which voters have voted, and for which candidate, in order to express verifiability properties.

Formally, we consider a finite set Ev of event symbols, given together with their arity. The syntax of processes (Figure 4.1) allows them to trigger an event event ∈ Ev of arity n with messages M 1 , . . . , M n by using instruction event(M 1 , . . . , M n ). As displayed in Figure 4.2, when this instruction is reached in an execution, the event, including the messages M 1 , . . . , M n , is registered in the trace. As we said, events are invisible to the attacker: formally, they are considered similarly as τ for the equality = τ . That is, two sequences w, w that only differ by adding or removing silent actions τ or events will be considered equal up to silent actions, written w = τ w .

As in Chapter 1, a trace of a process P is any possible sequence of transitions starting from P . Traces correspond to all possible executions in the presence of an attacker that may read, forge, and send messages. Formally, the set of traces trace(P ) is defined as follows.

trace(P ) = {(w, φ)|({P }; ∅) w --→ * (P; φ)}
We will in addition consider the following notion of blocking trace.

Definition 23 (blocking trace). A sequence of actions

Equivalence

We consider the same notion of trace equivalence as in Part I, rewritten here with the equational theory-based formalism. Two sequences of messages are indistinguishable to an attacker if he cannot perform any test that could distinguish them. Two processes P and Q are in equivalence if no matter how the adversary interacts with P , a similar interaction may happen with Q, with equivalent resulting frames.

Definition 24 (Static Equivalence). Two ground frames φ and φ are statically equivalent if and only if they have the same domain, and for all attacker terms R, S with variables in dom(φ) = dom(φ ), we have

(Rφ = E Sφ) ⇐⇒ (Rφ = E Sφ )
Definition 25 (Trace Equivalence). Let P , Q be two processes. We write P t Q if for all (s, φ) ∈ trace(P ), there exists (s , φ ) ∈ trace(Q) such that s = τ s and φ and φ are statically equivalent. We say that P and Q are trace equivalent, and we write

P ≈ t Q, if P t Q and Q t P .

Voting Systems and Security Properties

In this section, we present the modelling of voting protocols as pi-calculus processes we will use, as well as the formal definitions of the security properties we consider in this framework.

Notations

We start with a few notations. The multiset of elements a, a, b, c is denoted {|a, a, b, c| }. The union of two multisets S 1 and S 2 is denoted S 1 S 2 . If k ∈ N, for any value v, k • v denotes the multiset containing k instances of v. If S is a multiset, we denote S(v) the number of instances of v in S.

We assume a set V of messages representing possible votes (e.g. constants) and a set R of values representing possible results. We also assume R is equipped with an associative and commutative operator * . This operator maps two elements of R onto an element of R, and represents the operation of combining results together (e.g. adding them). This operator does not have to be a function symbol from the signature F, as illustrated in the following example.

Example 7. For instance, with the signature and equational theory from Example 6, + would be a valid choice for * , if R is e.g. the set of all messages.

If R is the set of pairs of messages, another example of a * operator would be the function

M, N , M , N → M + M , N + N .
The values in R do not necessarily have to be messages: they can be abstract values not defined in terms of the signature and equational theory considered. For instance, R could contain multisets of votes (i.e. multisets of messages). In our symbolic model, the result of the election r ∈ R will then be encoded as a term. Depending on the choice of this encoding, the same abstract result r ∈ R may have several representations, i.e. several terms may encode the same abstract result. For instance, in the case of multisets, say the signature does not contain a construction for multisets, but only for lists of terms. Then a multiset may be represented e.g. by any list containing its elements, in any order. We want our result to be independent of a particular choice of representation. Therefore, we will simply assume the existence of a representation function, that associates a result to messages representing it: Definition 26 (Representation). A representation R is a function that associates to an abstract result r ∈ R a finite set of possible representations, i.e. a finite set of messages that encode this result, with an injectivity property:

∀r = r . R(r) ∩ R(r ) = ∅
Intuitively, a result can be associated to several representations, but a given representation must be unambiguous, i.e. it can correspond to at most one result.

A counting function is a function ρ that associates a result r ∈ R to a multiset of votes. We assume that counting functions have a partial tally property: it is always possible to count the votes in two distinct multisets and then combine the results.

Definition 27 (Counting function with partial tallying). A counting function ρ has

partial tallying if ∀V, V ρ(V V ) = ρ(V ) * ρ(V )
A vote is said to be neutral if it does not contribute to the result.

V k 1 ,k 2 = v ∈ {0, 1} k | k 1 ≤ k i=0 v i ≤ k 2 ∪ {v blank }
where v blank is the null vector (0, . . . , 0), representing a blank vote. For a vote v ∈ V k 1 ,k 2 , v i being 1 means that candidate a i has been selected, and v i being 0 means it has not. In a voting scheme with mixnet-based tally, all the individual votes are shuffled before being revealed, in a random order. Thus the set R of results is the set of multisets of votes in V k 1 ,k 2 and * is the union of multisets. The corresponding counting function is

ρ mix (V ) = V , where V is a multiset of elements of V k 1 ,k 2 .
In a system with homomorphic-based tally, the votes are added together. Thus R = N k is the set of vectors of k elements, and * is the addition of vectors. The corresponding counting function is ρ hom (V ) = v∈V v.

Both ρ mix and ρ hom have the partial tally property. The vote v blank is a neutral vote w.r.t. ρ hom but not ρ mix . Indeed adding a null vector does not change the sum of the votes, but it does change the multiset of votes.

Voting protocols

We consider two disjoint, infinite subsets of C: a set A of agent names or identities, and a set V of votes. We assume given a representation function R of the result.

A voting protocol is modelled as a process. It is composed of:

• processes that represent honest voters;

• a process modelling the tally;

• possibly other processes, modelling other authorities.

Formally, we define a voting process as follows.

Definition 29 (Voting process). A voting process is a process of the form

P = new # " cred.new cred 1 . . . new cred p . ( Voter(a 1 , v a 1 , #" c 1 , # " cred, cred 1 ) | • • • | Voter(a n , v an , #" c n , # " cred, cred n ) | Tally p ( #" c , # " cred, cred 1 , . . . , cred p ) | Others p ( #" c , # " cred, cred 1 , . . . , cred p ))
where n is the number of honest voters,

a i ∈ A, v a i ∈ V, #" c i , #" c , #" c are (distinct) channels, # " cred and cred i are (distinct) names.
# " cred represents the election credentials, that all voters have access to ( e.g. a public key to encrypt their votes). cred i represents the private credential that voter i has access to ( e.g. a signature key).

A voting process may be instantiated with various voters and vote selections. Given A = {b 1 , . . . , b n } ⊆ A a finite set of voters, and a mapping α : A → V that associates a vote to each voter, we define P α by replacing a i with b i and v i with α(b i ) in P . We call such a mapping α a distribution of votes.

Moreover, P must satisfy the following properties.

• Process Voter(a, v a , #" c , # " cred, cred) models an honest voter a willing to vote for v a , using the channels #" c . credentials cred (e.g. a signing key) and election credentials # " cred. It is assumed to contain an event Voted(a, v) that models that a has voted for v. This event is typically placed at the end of process Voter(a, v a , #" c , # " cred, cred). This event cannot appear in process Tally p nor Others p .

• Process Tally p ( #" c , # " cred, cred 1 , . . . , cred p ) models the tally. It is parametrised by the total number of voters p (honest and dishonest), with p ≥ n. It is assumed to contain exactly one output action on a reserved channel c r . The term output on this channel is assumed to represent the final result of the election, in any execution trace. Formally, we require that this term is at least always the representation of some result:

∀α. ∀(tr, φ) ∈ trace(P α ). out(c r , r) ∈ tr ⇒ ∃V. φ(r) ∈ R(ρ(V ))
Tally p may of course contain other input/output actions, on other channels.

• Process Others p ( #" c , # " cred, cred 1 , . . . , cred p ) is an arbitrary process, also parametrised by p. It models the remainder of the voting protocol, for example the behaviour of other authorities. It also models the initial knowledge of the attacker by sending appropriate data (e.g. the public key of the election or dishonest credentials). To be more generic, we leave this process unspecified, and simply assume that it uses a set of channels disjoint from the channels used in Voter and Tally p .

The channel c r used in Tally p to publish the result is called the result channel of P .

Note that this notion of voting process does not assume honest authorities, e.g. a honest tally. We only require that the tally is modelled by some process, but this process does not necessarily follow the specification of the voting protocol. For instance, to model a fully dishonest tally controlled by the attacker, process Tally p could simply output its entire knowledge, including the election private key k e , to the attacker, and receive instructions from the attacker (on some channel other than c r ) regarding which result to publish on c r .

Example 9. The models of the Helios protocol presented earlier ( e.g. Sections 1. [START_REF]Ordonnance de la ChF sur le vote électronique (OVotE) du 13 décembre 2013[END_REF]

or 3.2) can easily be adapted into a model that fits this generic notion of voting process.

For clarity, we describe here a simple version with only two honest voters A and B, a dishonest voter C, and a voting server S. The protocol can be modelled by the following process.

P Helios (v a , v b ) = new k a , k b , k c , k e . (out(c, k c ).out(c, pk(k e )) | Voter(A, v a , c a , c a , k a , k e ) | Voter(B, v b , c b , c b , k b , k e ) | Tally Helios (c a , c b , c c , c s , k a , k b , k c , k e ))
Voter(a, v, c, c , k, k e ) simply sends vote v encrypted with the election public key pk(k e ). To model the fact that voters communicate with the ballot box through an authenticated channel, we assume, as before, that a voter Alice sends her ballot to the server signed with a signature key k, which we will consider as her credential. Note that this is just a modelling artefact to abstract away the underlying password-based authenticated channel. After sending her ballot, Alice triggers the Voted event to indicate she has voted.

Voter(a, v, c, c , k, k e ) = new r. out(c, sign(aenc( v, r , pk(k e )), k)). Voted(a, v).

The voting server receives ballots from voters A, B, and C, performs weeding as explained earlier, and then outputs the decrypted ballots, after some mixing, which is modelled through the + operator from Example 6.

Tally Helios (c a , c b , c c , c s , k a , k b , k c , k e ) = in(c a , x 1 ).in(c b , x 2 ).in(c c , x 3 ). let y 1 = checksign(x 1 , vk(k a )) in let y 2 = dec(x 2 , vk(k b )) in let y 3 = dec(x 3 , vk(k c )) in if x 1 = x 2 ∧ x 1 = x 3 ∧ x 2 = x 3 then out(c s , π 1 (adec(y 1 , k e )) + π 1 (adec(y 2 , k e )) + π 1 (adec(y 3 , k e )))
where we omit the null else-branches. ∧ is syntactic sugar for a succession of tests, and if M = N then P is syntactic sugar for if M = N then 0 else P .

Here, the process Others p consists in the output of the election public key, and the credential of the dishonest voter C controlled by the attacker: out(c, k c ).out(c, pk(k e )).

We can use the Voted event to read which voters voted from a trace. Formally: Definition 30 (Voters in a trace). Given a sequence tr of actions, the set of voters Voters(tr) who did vote in tr is defined as follows.

Voters(tr) = {a ∈ A | ∃v ∈ V. Voted(a, v) ∈ tr}.
The result of the election is emitted on a special channel c r , and can thus also be read from a trace. Formally: Definition 31. Given a trace (t, φ) and a multiset of votes V , the predicate result(t, φ, V ) holds if the election result in (t, φ) corresponds to V . That is, if t ends with an output on the result channel c r , and φ indicates that this output is a valid representation of ρ(V ):

result(t, φ, V ) = ∃x, t . t = t .out(c r , x) ∧ φ(x) ∈ R(ρ(V )).

Security properties

We now formally define in our model the two properties we study: individual verifiability and vote privacy.

Verifiability. Several definitions of verifiability have been proposed. In the lines of [START_REF] Küsters | Accountabiliy: Definition and relationship to verifiability[END_REF][START_REF] Cortier | Election verifiability for Helios under weaker trust assumptions[END_REF], we consider a very basic notion, that says that the result should at least contain the votes from honest voters.

Definition 32 (Symbolic individual verifiability).

Let P be a voting process with result channel c r . P satisfies symbolic individual verifiability if, for any distribution α of votes, and any trace (t, φ) ∈ trace(P α ) that ends with an output on c r , there exists a multiset of votes V c such that the result in t corresponds to V a V c , where V a is the multiset of honest votes.

That is, P is individually verifiable if

∀α. ∀(t, φ) ∈ trace(P α ). V (t, φ)
where

V (t, φ) = ∀t , x. (t = t .out(c r , x)) ⇒ ∃V c . φ(x) ∈ R(ρ({|v | ∃a. Voted(a, v) ∈ t| } V c )).
This property intuitively means that whenever a result is produced in an execution of the protocol, this result must account for at least all honest votes produced in this execution (plus some arbitrary set of dishonest ones).

Usually, individual verifiability typically guarantees that voters can check that their ballot will be counted. Our notion of individual verifiability goes one step further, requiring that the corresponding votes will appear in the result, even if the tally is dishonest. Note that this definition of verifiability does not explicitly mention any verification steps performed by voters. Typically, voting schemes specify some steps voters should take to ensure their vote is counted, such as for instance checking that their encrypted ballot correctly appears on a public bulletin board published by the authorities. Our notion does not explicitly deal with these steps, but requires instead that a vote is counted as soon as the Voted event is triggered. In some cases (depending on which protocol is modelled, and on whether the authorities are assumed honest in the model considered), this may only be achievable if the voter process correctly performs the verification steps before triggering the Voted event.

One of the first definitions of verifiability was given in [START_REF] Kremer | Election verifiability in electronic voting protocols[END_REF], distinguishing between individual, universal, and eligibility verifiability. Intuitively, our own notion of individual verifiability sits somewhere between individual verifiability and individual plus universal verifiability as defined in [START_REF] Kremer | Election verifiability in electronic voting protocols[END_REF]. A precise comparison is difficult as individual and universal verifiability are strongly tied together in [START_REF] Kremer | Election verifiability in electronic voting protocols[END_REF]. Moreover, [START_REF] Kremer | Election verifiability in electronic voting protocols[END_REF] only considers the case where all voters are honest and they all vote.

Privacy. We consider the privacy definition already presented in Section 2.2, initially proposed in [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF] and widely adopted in symbolic models: an attacker cannot distinguish when Alice is voting v 1 and Bob is voting v 2 from the scenario where the two votes are swapped.

Definition 33 (Privacy). Let P be a voting process. P satisfies privacy if, for any distribution of votes α, for any two voters a, b ∈ A\dom(α) and any two votes v 1 , v 2 ∈ V, we have

P α∪{a →v 1 ,b →v 2 } ≈ P α∪{a →v 2 ,b →v 1 }
Having formally defined the properties we consider, we can now state and prove our main result.

Main Result

We show that privacy implies verifiability under a couple of assumptions, typically satisfied in practice.

Assumptions

First, we assume a light form of determinacy: two traces with the same observable actions yield the same election result. This excludes for example cases for voters choose non deterministically how they vote. Formally, we define the notion of election determinacy.

Definition 34 (Election determinacy). We say that a voting process P with result channel c r is election determinate if, for any distribution of votes α, for any two sequences of actions t, t such that t = τ t , if (t.out(c r , x), φ) ∈ trace(P α ), and (t .out(c r , x), φ ) ∈ trace(P α ), then

∀V. φ(x) ∈ R(ρ(V ))) ⇒ φ (x) ∈ R(ρ(V ))
This assumption still supports some form of non determinism but may not hold for example in the case where voters use anonymous channels that even hide who participated in the election.

Second, we assume that it is always possible for a new voter to vote (before the tally started) without modifying the behaviour of the protocol. We formalise this assumption as the notion of voting friendliness.

Definition 35 (Voting friendliness).

A voting process P is voting friendly if for all voter a ∈ A, there exists t (the honest voting trace) such that for all α satisfying a / ∈ dom(α),

• for all (t, φ) ∈ trace(P α ), such that t = t .out(c r , x) for some t , x, for all v, there exists tr, ψ such that tr = τ t , Voted(a, v) ∈ tr, (t .tr.out(c r , x), ψ) ∈ trace(P α∪{a →v} ), and

∀V. φ(x) ∈ R(ρ(V )) ⇒ ψ(x) ∈ R(ρ(V ∪ {v})).
Intuitively, if a votes normally, her vote will be counted as expected, no matter how the adversary interfered with the other voters.

• for all t , x such that blocking(t .out(c r , x), P α ), for all v, tr, ψ such that tr = τ t , we have blocking(t .tr.out(c r , x), P α∪{a →v} ). Intuitively, the fact that a voted does not suddenly unlock the tally if it was blocked before.

In practice, most voting systems are voting friendly since voters vote independently. In particular, process P Helios modelling Helios, as defined in Example 2, is voting friendly. The voting friendly property prevents a fully dishonest tally since the first item requires that unmodified honest ballots are correctly counted. However, we can still consider a partially dishonest tally that, for example, discards or modifies ballots that have been flagged by the attacker.

Finally, we need an assumption that some vote is counted in a particular way. The reason why such an assumption is useful will become clear when proving our theorem. Formally, we identify two variants of this condition. Our result holds provided one of the two following assumptions is true:

1. There exists a neutral vote v neutral ∈ V, such that ρ({|v neutral | }) is neutral for * .

2. There exists a special vote v special ∈ V, which is counted separately in the result. That is, v special must satisfy the following properties.

Definition 36 (Special vote).

A vote v special is said to be special if

• the result associated with a multiset determines the number of instances of v special :

∀V, V . ρ(V ) = ρ(V ) =⇒ V (v special ) = V (v special ).
• and the count of v special can be simplified

∀V, V , k. ρ(V k • v special ) = ρ(V k • v special ) =⇒ ρ(V ) = ρ(V ).
For example, for ρ hom , all the votes are special, therefore this property always holds. For ρ mix , it depends on the set of valid votes. In the standard case where a vote is a selection of candidates (for example between k 1 and k 2 candidates), then a special vote could be, for instance, a vote that includes the selection of an extra candidate, not used before.

Theorem

We can now state and prove our main result about symbolic privacy and verifiability.

Theorem 8 (Privacy implies individual verifiability). Let P be a voting friendly, election determinate voting process. Assuming there exists either a neutral vote or a special vote, if P satisfies privacy then P satisfies individual verifiability.

The proof of this result intuitively relies on the fact that in order to satisfy privacy w.r.t. two voters Alice and Bob, a voting process has to guarantee that the vote of Alice is, if not correctly counted, at least taken into account to some extent. For instance, if an attacker, trying to distinguish whether Alice voted for 0 and Bob for 1, or Alice voted for 1 and Bob for 0, is able to make the tally ignore completely the vote of Alice, the result of the election is then Bob's choice. Hence the attacker learns how Bob voted, which breaks privacy. Therefore, we first prove that if a protocol satisfies privacy, then if we compare an execution (i.e. a trace) where Alice votes 0 with the corresponding execution where Alice votes 1, the resulting election results must differ by exactly a vote for 0 and a vote for 1. Formally, we show the following lemma.

Lemma 19 (Privacy implies F ). If a voting friendly, election determinate voting process P satisfies privacy, then it satisfies the following property F :

F = ∀α. ∀a ∈ A\dom(α). ∀v 1 , v 2 ∈ V. ∀t, t , φ, φ , V, V . [t = τ t ∧ (t, φ) ∈ trace(P α∪{a →v 1 } ) ∧ (t , φ ) ∈ trace(P α∪{a →v 2 } ) ∧ result(t, φ, V ) ∧ result(t , φ , V ) ] =⇒ ρ(V {|v 1 | }) = ρ(V {|v 2 | }).
Proof. We prove this by contradiction: assuming F does not hold, we construct an attack on privacy.

Assume F is false. Hence there exists a scenario where changing the vote of one agent does not change the result by one. That is to say, there exist a distribution of votes α, an agent a / ∈ dom(α), votes v 1 , v 2 ∈ V, traces (t, φ) ∈ trace(P α∪{a →v 1 } ) and (t , φ ) ∈ trace(P α∪{a →v 2 } ) such that t = τ t , and two multisets V , V , such that result(t, φ, V ), result(t , φ , V ), and ρ(V

{|v 1 | }) = ρ(V {|v 2 | }).
Since result(t, φ, V ), there exist x, t 1 such that t = t 1 .out(c r , x) and φ(x) ∈ R(ρ(V )). Similarly, there exist y, t 1 such that t = t 1 .out(c r , y) and φ (y) ∈ R(ρ(V )). Since t = τ t , x = y.

Note that we necessarily have v 1 = v 2 : indeed, assume v 1 = v 2 . Then (t, φ) and (t, φ ) are traces of the same process P α∪{a →v 1 } = P α∪{a →v 2 } . Since φ(x) ∈ R(ρ(V )), by the election determinacy assumption (Definition 34), this implies that φ (x) ∈ R(ρ(V )). Since we already know that φ (x) ∈ R(ρ(V )), and since by assumption R is injective (Definition 26), we have

ρ(V ) = ρ(V ). Thus, as v 1 = v 2 , we have ρ(V ) * ρ({|v 2 | }) = ρ(V ) * ρ({|v 1 | }), which is contradictory. Hence v 1 = v 2 .
The attack on privacy consists in the fact that, since changing a's vote does not produce a change of exactly one in the result, even in presence of another agent b whose vote is the opposite of a's, the result will be different depending on the vote of a.

Formally, let b / ∈ dom(α) ∪ {a}. By the voting friendliness assumption (Definition 35), b can cast a vote after the traces t and t . That is, there exist sequences of actions t b , t b , and frames ψ, ψ , such that

(t 1 .t b .out(c r , x), ψ) ∈ trace(P α∪{a →v 1 ,b →v 2 } ), (t 1 .t b .out(c r , x), ψ ) ∈ trace(P α∪{a →v 2 ,b →v 1 } ), Voted(b, v 2 ) ∈ t b , Voted(b, v 1 ) ∈ t b , t b = τ t b , ψ(x) ∈ R(ρ(V {|v 2 | })), and ψ (x) ∈ R(ρ(V {|v 1 | })). Since ρ(V {|v 1 | }) = ρ(V {|v 2 | })
, by the injectivity assumption on R, we have ψ(x) = ψ (x).

We have constructed two frames, obtained by the same actions in P α∪{a →v 1 ,b →v 2 } and P α∪{a →v 2 ,b →v 1 } , which yield different results for the election. Using the election determinacy assumption, this lets us prove that these two processes are not trace equivalent.

Indeed, let us denote t 2 def = t 1 .t b .out(c r , x) and t 2 def = t 1 .t b .out(c r , x). We have (t 2 , ψ) ∈ trace(P α∪{a →v 1 ,b →v 2 } ). For any trace (t 2 , ψ ) ∈ trace(P α∪{a →v 2 ,b →v 1 } ), if t 2 = τ t 2 = τ t 2 , then by election determinacy we have ψ (x) ∈ R(ρ(V {|v 1 | })). Hence, by injectivity of R, since ρ(V {|v 2 | }) = ρ(V {|v 1 | }), we have ψ (x) / ∈ R(ρ(V {|v 2 | })).
Checking whether a message belongs to R(ρ(V {|v 2 | })) is a test the attacker can perform, as this set is finite by definition of R. Since ψ(x) ∈ R(ρ(V {|v 2 | })), ψ, ψ are therefore not statically equivalent.

Thus, the trace (t 2 , ψ) of P α∪{a →v 1 ,b →v 2 } cannot be mimicked by any trace of P α∪{a →v 2 ,b →v 1 } . In other words, P α∪{a →v 1 ,b →v 2 } ≈ t P α∪{a →v 2 ,b →v 1 } . This violates P , which concludes the proof. This lemma is used as a central property to prove the theorem. Intuitively, the rest of the proof will be as follows. We apply this lemma repeatedly, changing one by one all the votes from honest voters into neutral or special votes (depending on which one we assume). Let r denote the result before this operation, and r the result after. Let V a denote the multiset of honest votes, and V b the multiset containing the same number of neutral (or special) votes. Thanks to Lemma 19, we can show that r * ρ(V b ) = r * ρ(V a ). The properties of neutral and special votes will let us prove that this implies r contains all votes in V a . The neutral case is perhaps the clearest: then V b only contains neutral votes, and we have r = r * ρ(V a ). This means that r contains all honest votes, hence the voting process satisfies individual verifiability.

Formally, we show the following lemma, that uses the property F from Lemma 19. It describes how the result changes when we turn any subset V wanted of the votes cast by honest voters into any arbitrary multiset of votes V change (with the same cardinality). Following the intuition exposed earlier, we will later on use the set of all honest votes V a as V wanted , and neutral or special votes as V change .

Lemma 20 (Privacy and F imply FF ). Consider a voting process P that is election determinate and voting friendly. Assume P satisfies privacy, and the F property from Lemma 19. Then P satisfies the following property FF :

FF def = ∀α. ∀(t, φ) ∈ trace(P α ). ∀V, V change . ∀V wanted ⊆ {|v | ∃a. Voted(a, v) ∈ t| }. result(t, φ, V ) ⇒ |V change | = |V wanted | ⇒ ∃V c . ρ(V ) * ρ(V change ) = ρ(V wanted ) * ρ(V c )
Proof. Assume that both privacy and F hold. Consider a distribution α of votes, and a trace (t, φ) ∈ trace(P α ). Let V be such that result(t, φ, V ), i.e. there exist t , x such that t = t .out(c r , x) and φ(x

) ∈ R(ρ(V )). Let V wanted ⊆ {|v | ∃a. Voted(a, v) ∈ t| }, and V change such that |V change | = |V wanted |.
To prove FF , we need to show that the result in this trace augmented with V change contains at least the subset V wanted of the (intended) votes of the honest voters. That is to say, we must show that there exists

V c such that ρ(V ) * ρ(V change ) = ρ(V wanted ) * ρ(V c ).
The idea of the proof is to compare ρ(V ) to the result ρ(V ) obtained by turning, one by one, all votes from V wanted into the votes from V change , and performing the same sequence of actions. As we will see, this is possible, otherwise privacy would break; and V V change contains more instances of the honest votes than V V wanted , since F holds.

Let us denote the Voted events appearing in t (not necessarily in that order) by

Voted(a 1 , v 1 ), . . . , Voted(a l , v l )
for some pairwise distinct agents a 1 , . . . , a l ∈ Voters(t), and some l ∈ N. By definition, each element of V wanted is associated with one of these Voted events. Let m Since, by assumption on the form of the processes, the Voted(a, v) event can only be emitted by the process Voter(a, v, c) for some credential c, we have α(a i ) = v i for all i ∈ 1, m .

For i ∈ 0, m , let α i denote the affectation of votes obtained from α by turning the first i votes from V wanted to V change , i.e.

• α i (a j ) = v j if j ∈ 1, i ; • α i (a j ) = v j if j ∈ i + 1, m ; • α i (a) = α(a) if a ∈ dom(α) is not one of the a j , j ∈ 1, m . Let β def = α m .
Note that α 0 = α, and that all the α i have the same domain. Let us show that for all i, the same actions as t can be performed in P α i with the same agents emitting Voted events, i.e. that ∀i ∈ 0, m . ∃t i . t i = τ t ∧ ¬blocking(t i , P α i ).

By contradiction, assume this property does not hold, and let i be the smallest index that falsifies it. Hence,

∀t i . t i = τ t ⇒ blocking(t i , P α i ). (4.1)
In addition, note that since the property is clearly satisfied at the 0th step, i ≥ 1. Hence, it holds for i -1, i.e. there exists t i-1 such that t i-1 = τ t, and ¬blocking(t i-1 , P α i-1 ). Since t = t .out(c r , x), we also have t i-1 = t i-1 .out(c r , x) for some t i-1 such that t i-1 = τ t .

Then, for all t i = τ t i-1 (= τ t ), by (4.1), blocking(t i .out(c r , x), P α i ) holds.

The same sequence of actions t i-1 is blocking at step i and not at step i -1, which differs only by the vote of of a i . This lets us construct an attack on privacy, which constitutes a contradiction. Indeed, by the voting friendliness assumption, we may add a voter b / ∈ dom(α), who votes for v i at step i -1, and for v i at step i, and there exists tr such that

• there exists tr = τ tr and ψ such that (t i-1 .tr .out(c r , x), ψ) ∈ trace(P α i-1 ∪{b →v i } ).

• for all t i = τ t i-1 (= τ t ), we have shown that blocking(t i .out(c r , x), P α i ), and thus for all tr = τ tr and all ψ , (t i .tr .out(c r , x), ψ ) / ∈ trace(P α i ∪{b →v i } ).

Therefore, the processes P α i ∪{b →v i } and P α i-1 ∪{b →v i } are not trace equivalent. Since they only differ by the votes of a i and b, who respectively vote for v i , v i on the left and v i , v i on the right, this breaks privacy, which contradicts the hypotheses.

Thus, for all i, there exists t i such that t i = τ t, of the form t i .out(c r , x), such that ¬blocking(t i , P α i ). In other words, there exists φ i such that (t i , φ i ) ∈ trace(P α i ). By assumption, only results may get published on c r . Hence, there exists

V i such that φ i (x) ∈ R(ρ(V i )), i.e. result(t i , φ i , V i ). Let V def = V m . Note that V 0 = V . For all i ∈ 0, m -1 , α i and α i+1 only differ by the vote of a i+1 , which is v i+1 in α i+1 and v i+1 in α i . Hence, by F , we have ρ(V i {|v i+1 | }) = ρ(V i+1 {|v i+1 | }).
That is to say, since ρ is assumed to have partial tallying, that

ρ(V i ) * ρ({|v i+1 | }) = ρ(V i+1 ) * ρ({|v i+1 | }).
Therefore, by rewriting these m equalities successively, we have

ρ(V 0 ) * ρ({|v 1 | }) * . . . * ρ({|v m | }) = ρ(V m ) * ρ({|v 1 | }) * . . . * ρ({|v m | }),
i.e., again by partial tallying,

ρ(V ) * ρ({|v i | i ∈ 1, m | }) = ρ({|v i | i ∈ 1, m | }) * ρ(V ).
By definition, this means

ρ(V ) * ρ(V change ) = ρ(V wanted ) * ρ(V )
which concludes the proof.

As announced earlier, we now apply property FF to either neutral or special votes, and use it to establish individual verifiability.

First, let us show the case of the neutral vote.

Lemma 21 (FF implies V with a neutral vote). Consider a voting process P that is election determinate and voting friendly. Assume that there exists a neutral vote v neutral . If P satisfies property FF (from Lemma 20), then P satisfies individual verifiability.

Proof. Let α be a distribution of votes, and let (t .out(c r , x), φ) ∈ trace(P α ). Let t def = t .out(c r , x). To prove individual verifiability, we need to show that the result in this trace contains at least the (intended) votes of the honest voters. That is to say, we must show that there exists

V c such that φ(x) ∈ R(ρ({|v | ∃a. Voted(a, v) ∈ t| } V c )).
By assumption, only results are published on channel c r . Hence there exists some multiset of votes V such that φ(x) ∈ R(ρ(V )). We then have result(t, φ, V ).

Let V wanted def = {|v | ∃a. Voted(a, v) ∈ t| } be the multiset of all intended honest votes in t. Let

k def = |V wanted |, and V change def = k • v neutral . By FF , there exists a multiset V c such that ρ(V ) * ρ(V change ) = ρ(V wanted ) * ρ(V c ). Since ρ is assumed to have partial tallying, ρ(V change ) = ρ({|v neutral | }) k . As v neutral is a neutral vote, ρ({|v neutral | }) is neutral for * , and thus so is ρ(V change ). Therefore, ρ(V ) = ρ(V wanted ) * ρ(V c ) = ρ(V wanted V c ), which proves the claim.
The case of a special vote is slightly more involved.

Lemma 22 (FF implies V with a special vote). Consider a voting process P that is election determinate and voting friendly. Assume that there exists a special vote v special . If P satisfies property FF (from Lemma 20), then P satisfies individual verifiability.

Proof. Let α be a distribution of votes, and let (t .out(c r , x), φ) ∈ trace(P α ). Let t def = t .out(c r , x). To prove individual verifiability, we need to show that the result in this trace contains at least the (intended) votes of the honest voters. That is to say, we must show that there exists

V c such that φ(x) ∈ R(ρ({|v | ∃a. Voted(a, v) ∈ t| } V c )).
By assumption, only results are published on channel c r . Hence there exists V such that φ(x) ∈ R(ρ(V )). We then have result(t, φ, V ).

Let V wanted def = {|v | ∃a. Voted(a, v) ∈ t ∧ v = v special | }
ρ(V ) * ρ(V change ) = ρ(V wanted ) * ρ(V c ).
We may rewrite this equality as

ρ(V k • v special ) = ρ(V wanted V c )
by the partial tallying property of ρ. Since v special is assumed to be special (Definition 36), we can deduce that

(V k • v special )(v special ) = (V wanted V c )(v special ).
Yet, V wanted (v special ) = 0 by definition. Therefore, V c (v special ) ≥ k, and we may decompose

V c into V c = V c k • v special for some V c . We then have ρ(V k • v special ) = ρ(V wanted V c k • v special ),
which implies, by definition of a special vote, that

ρ(V ) = ρ(V wanted V c ).
Since V wanted contains all the intended honest votes different from v special , it remains to be proved that V c contains sufficiently many instances of v special .

Let k def = |{|Voted(a, v special ) ∈ t | a ∈ A| }| the number of intended votes for v special in t; and

V wanted def = k • v special . Let v ∈ V such that v = v special . Let V change def = k • v. By FF , there exists V c such that ρ(V ) * ρ(V change ) = ρ(V wanted ) * ρ(V c ), i.e., by partial tallying, ρ(V k • v) = ρ(k • v special V c ).
By definition of a special vote, we then have

(V k • v)(v special ) = (k • v special V c )(v special ).
As before, since v = v special , this means that V (v special ) ≥ k . We already know that ρ(V ) = ρ(V wanted V c ). Again by definition of a special vote, we thus have (

V wanted V c )(v special ) = V (v special ) ≥ k . Since v special / ∈ V wanted , (V c )(v special ) ≥ k , i.e. V c = V c k • v special for some V c .
Therefore we have

ρ(V ) = ρ(V wanted k • v special V c ) = ρ({|v | ∃a. Voted(a, v) ∈ t| } V c ),
which concludes the proof.

Theorem 8 then directly follows from Lemmas 19, 20, 21 and 22.

We have established that privacy implies individual verifiability under some mild assumptions on the voting scheme in our symbolic model. At this point, it is interesting to note that this result holds only when considering the same trust assumptions with respect to the election authorities (ballot box, tally, . . . ) for both properties. That is, privacy against some attacker model implies verifiability against the same attacker model. Indeed, in this symbolic model, these trust assumptions are encoded in the way the voting process is written. For instance, a honest ballot box would be modelled by a process that correctly authenticates voters and stores their ballots, while a dishonest one could be modelled by giving control of this step to the attacker, and letting him propose an arbitrary list of ballots to be tallied. This would e.g. allow him to remove some ballots after they have been cast. Looking carefully at the statement of Theorem 8, the same voting process is considered for privacy and verifiability. Therefore, the encoding of the trust assumptions has to be the same for both. We will discuss this observation later on. For now, in the next chapter, we show that the same implication also holds in a computational model for cryptography.

Chapter 5

Privacy Implies Verifiability: Computational Model

In this chapter, we show that a private voting system must be individually verifiable, in a computational setting. We first describe our model for voting system, and the definitions we consider for privacy and verifiability. In a nutshell, we consider the well established definition of privacy by Benaloh [START_REF] Benaloh | Verifiable secret-ballot elections[END_REF], and a notion of individual verifiability which states that the result must account for at least all the votes cast by honest voters. We then detail a few assumptions under which our result holds, and finally prove it.

Voting Systems and Security Properties

In this section we introduce the model and terminology we consider for voting systems and security properties.

Computational models define protocols and adversaries as probabilistic polynomial-time algorithms.

Voting systems

Let us start with the terminology and notations we will use to describe voting systems. Votes are simply bitstrings. A ballot is also a bitstring, that is intended to contain a voter's vote. The exact nature of the ballots depend on the protocol we consider: for instance, they could simply be ciphertexts, or also contain some public credential identifying the voter.

During an election, ballots are typically collected by an authority, and displayed on a bulletin board.

Definition 37 (Bulletin board).

A bulletin board BB is a list of ballots. BB[j] denotes the jth element of BB.

We will also in the following use the term ballot box interchangeably with bulletin board.

As in the symbolic case presented in Chapter 4, we will call counting function a function ρ that associates a bitstring to a multiset of votes. That bitstring is intended to represent the result of the election. As before, we will in this Chapter consider counting functions with the partial tallying property, i.e. such that ∀V, V ρ(V V ) = ρ(V ) * ρ(V ), where * is an associative and commutative operation.

In addition, in our cryptographic setting, we will also assume that given an election result r and a multiset of votes V , one can decide efficiently (in polynomial time) whether r includes all the votes of V . That is, we will assume a polynomial-time algorithm algorithm D that decides whether there exists V such that r = ρ(V V ):

∀r, V. D(r, V ) = 1 ⇐⇒ ∃V . r = ρ(V V ).
This condition is satisfied by the ρ mix and ρ hom functions from Example 8, and all standard counting functions.

Notation: We will in the following consider lists containing pairs (id, x) of a voter's identity and some element x (votes, ballots,. . . ). We may for such a list L write (id, * ) ∈ L as a shorthand, meaning that there exists an element of the form (id, x) in L for some x. If V is a multiset of elements of the form (id, v), we define

ρ(V ) = ρ({|v | (id, v) ∈ V | }).
We model voting systems as follows. • Register(1 λ , id) creates a private credential c for voter id, for example a signing key. The credentials may be empty as well, if the protocol does not use any. The correspondence (id, c) is stored in a list U, used for modelling purposes. For better readability, we will sometimes refer to this list as a table, and write U[id] = c to denote that U contains a correspondence between id and c, U[id] ← c to denote that (id, c) is added to U, and U[id] to denote to the credential associated to id in U.

• Pub(c) returns the public credential associated with a credential c. For instance, this could be the associated verification key if c is a signing key. Again, depending on the protocol, this public credential might be empty.

• Vote(pk, id, c, v) constructs a ballot containing the vote v for voter id with credential c, using the election public key pk.

• Tally(BB, sk, U) uses the board BB, the election secret key sk and the list of voter identities and credentials U to compute the tally of the ballots in BB, i.e. the result of the election, and potentially proofs of correct tallying. The Tally algorithm first runs some test ValidTally(BB, sk, U) that typically checks that all ballots of BB are valid. Tally may return ⊥ if the tally procedure fails (invalid board or decryption failure for example). If Tally(BB, sk, U) = ⊥ then it must correspond to a valid result, that is, there exists V such that Tally(BB, sk, U) = ρ(V ).

• Valid(id, b, BB, U, pk) checks that a ballot b cast by a voter id is valid with respect to the board BB using the election public key pk. The nature of this check depends on the protocol considered. For example, the ballot b may be required to have a valid signature or valid proofs of knowledge. The ballot b will be added to BB only if Valid(id, b, BB, U, pk) succeeds.

We will always assume a consistent voting scheme, that is, such that tallying honestly generated ballots yields the expected result.

Definition 39 (Consistency).

A voting scheme is consistent if for all distinct voter identities id 1 , . . . , id n , for all votes v 1 , . . . , v n , for all election keys (pk, sk) produced by Setup, if for all i

c i = Register(1 λ , id i ) and U = [(id i , c i )|i ∈ 1, n ],
and

BB = [Vote(pk, id i , c i , v i )|i ∈ 1, n ],
then with overwhelming probability

Tally(BB, sk, U) = ρ({|v 1 , . . . , v n | }).
The Tally algorithm typically applies a revote policy. When voters may vote several times, the revote policy states which vote should be counted. The two main standard revote policies are 1. the last vote counts or 2. the first vote counts (typically when revote is forbidden). In what follows, our definitions are written assuming the last ballot revote policy. However, they can easily be adapted to the first ballot revote policy and all our results hold in both cases.

To apply a revote policy, the tallying authority must be able to associate each ballot to the voter who cast it. Hence, we will assume a function extract id which, given a ballot b, the election secret key sk, and the table U of registered voters and credentials, retrieves the identity associated with b. Formally, for any id, c, pk, v, with overwhelming probability extract id (vote(pk, id, c, v), sk, U) = id Depending on the scheme, this might be done directly if ballots contain the identity, e.g. if the encrypted votes are displayed to the bulletin board next to the corresponding voter's identity. In other cases, ballots may only contain the voter's public credential, e.g. their verification key, or in some cases the private credential in an encrypted form. In such cases, the list U could be used to retrieve the identity associated with a credential. Note that we do not require that the tallying authority actually has access to the table U containing the correspondence between identity and credentials, nor that it actually computes extract id . We simply require that such a function exists.

Note that some schemes do not satisfy this condition, in particular when the ballots contain no identifier. Such schemes typically assume that voters do not revote since there is no means to identify whether two ballots originate from the same voter.

Finally, we make three mild assumptions on the tallying and validity check algorithms. The first one is that the tally only counts ballots cast with registered identities, i.e. ∀BB, sk, U. Tally(BB, sk, U) = Tally(BB , sk, U)

where BB = [b ∈ BB | (extract id (b, sk, U), * ) ∈ U].
The second is that registering more voters does not change the tally: if U, U have no id in common and ∀b ∈ BB. (extract id (b, sk, U U ), * ) / ∈ U , then Tally(BB, sk, U) = Tally(BB, sk, U ∪ U ).

The last one is that a ballot being declared valid for some user only depends on that user's credential and the one contained in the ballot, and not of other users' credentials, i.e. that for all U, U , id

(U[id] = U [id] ∧ U[extract id (b, sk, U)] = U [extract id (b, sk, U)]) =⇒ Valid(id, b, BB, pk, U) = Valid(id, b, BB, pk, U ). O reg (id) if (id, * ) ∈ U then stop else c ← Register(1 λ , id) U[id] ← c return Pub(U[id]) O corr (id) if (id, * ) / ∈ U ∨ id ∈ D then stop else D ← D id return U[id]

Security properties

As usual in computational models, an adversary is any probabilistic polynomial time Turing machine (PPTM). We define verifiability and privacy through game-based properties.

Verifiability

For verifiability, we propose a simple definition, inspired from [START_REF] Küsters | Accountabiliy: Definition and relationship to verifiability[END_REF][START_REF] Cortier | Election verifiability for Helios under weaker trust assumptions[END_REF]. Intuitively, we require that the election result contains at least the votes of all honest voters. This notion was called weak verifiability in [START_REF] Cortier | Election verifiability for Helios under weaker trust assumptions[END_REF] but we will call it individual verifiability to match the terminology used in symbolic settings (Chapter 4). More sophisticated and demanding definitions have been proposed, for example controlling how many dishonest votes can be inserted [START_REF] Cortier | Election verifiability for Helios under weaker trust assumptions[END_REF] or tolerating some variations in the result [START_REF] Küsters | Accountabiliy: Definition and relationship to verifiability[END_REF].

The main missing part (in terms of security) is that our definition does not control ballot stuffing: arbitrarily many dishonest votes may be added to the result. The reason is that ballot stuffing seems unrelated to privacy. Moreover, our definition assumes an honest tally, and thus does not capture universal verifiability aspects. The main reason is that existing privacy definitions in computational settings assume an honest tally, and we compare the two notions under the same trust assumptions.

Verifiability is defined through the game Exp verif V,A (λ) displayed in Figure 5.2. In a first step 14 , the adversary may use oracles O reg (id) and O corr (id) (defined in Figure 5.1) to respectively register a voter and get her credential (in this case, the voter is said to be corrupted, or dishonest). Private credentials are stored in list U, and public credentials are published by O reg . O corr stores the list of corrupted voter identities in D. Then the adversary may ask an honest voter id to vote for a given vote v through oracle O v vote (id, v). In this case, the adversary sees the corresponding ballot. The fact that id voted for v is registered in the list Voted, replacing id's previous votes if necessary, to apply the revote policy. The adversary may also cast an arbitrary ballot b in the name of a dishonest voter id through oracle O cast (id, b). Provided b is valid w.r.t. BB, it is added to the ballot box.

Finally, once the adversary gives control back to the challenger, the election result is computed. The adversary wins if the result does not contain all the honest votes registered in Voted.

Definition 40 (Individual verifiability). A voting system is individually verifiable if for any adversary A,

P Exp verif V,A (λ) = 1 is negligible. Exp verif V,(A1,A2) (λ) (pk, sk) ← Setup(1 λ ) U, D ← [] A Oreg,Ocorr 1 (pk) BB, Voted ← [] A O v vote ,Ocast 2 (pk) r ← Tally(BB, sk, U) if r = ⊥ ∧ ∀V c (finite) . r = ρ({v i } 1≤i≤k V c ) then return 1 where Voted = {(id 1 , v 1 ), . . . , (id k , v k )} O v vote (id, v) if (id, * ) ∈ U ∧ id / ∈ D then b ← Vote(pk, id, U[id], v) BB ← BB b Voted ← Voted (id, v) return b
where Voted is obtained from Voted by removing all previous instances of (id, * ) As mentioned in introduction of Part II, [START_REF] Chevallier-Mames | On some incompatible properties of voting schemes[END_REF] shows an impossibility result between (unconditional) privacy and verifiability. [START_REF] Chevallier-Mames | On some incompatible properties of voting schemes[END_REF] considers another aspect of verifiability, namely universal verifiability, that is, the guarantee that the result corresponds to the content of the ballot, even in presence of a dishonest tally. Interestingly, the same incompatibility result holds between individual verifiability and unconditional privacy, for the same reasons. Exactly like in [START_REF] Chevallier-Mames | On some incompatible properties of voting schemes[END_REF], a powerful adversary (i.e. not polynomial) could tally BB and BB where BB is the ballot box from which Alice's ballot has been removed and infer Alice's vote by difference. More generally, unconditional privacy is lost as soon as there exists a function of the votes that is meaningfully related to the result, which is implied by individual verifiability.

O cast (id, b) if id ∈ D ∧ Valid(id, b, BB, U, pk) then BB ← BB b

Privacy

For privacy, we consider the old, well established definition of Josh Benaloh [START_REF] Benaloh | Verifiable secret-ballot elections[END_REF], that we slightly extend and adapt to fit our model and notations. More sophisticated definitions are been proposed later. Notably, [START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF] surveys existing game-based notions of vote privacy, and propose and a unifying definition, which we present and extend in the next chapter. These aim in particular at getting rid of the partial tally assumption (needed in [START_REF] Benaloh | Verifiable secret-ballot elections[END_REF]). Note however that they all assume an honest ballot box. Since we also assume partial tally, the original Benaloh definition is sufficient for our needs.

Intuitively, a voting system is private if, no matter how honest voters vote, the adversary cannot see any difference. The game for privacy will formalise this intuition by letting the adversary propose two possible choices of votes for each honest voter. One will be used, and the adversary will try to guess which. However, the adversary always sees the election result, that leaks how the group of honest voters voted (altogether). Therefore, we can only require that the adversary cannot guess which of the two vote choices was used provided that the election result w.r.t. the honest voters remains the same for both choices. More formally, in a first step, the adversary uses oracles O reg (id) and O corr (id) (Figure 5.1) to respectively register a voter and corrupt one to get her credential. As before, in that case, the voter is then said to be corrupted.

The adversary may then request an honest voter id to vote either for v 0 or v 1 through oracle O p vote (id, v 0 , v 1 ). Voter id will vote v β depending on the bit β. The adversary may also cast an arbitrary ballot b in the name of a dishonest voter id through oracle O cast (id, b). The election will be tallied and shown to the adversary only if the set V 0 of votes v 0 yields the same result than the set V 1 of votes v 1 (where only the last vote is counted). Finally, the adversary wins if he correctly guesses β. Formally, privacy is defined through the game Exp priv,β V,A (λ) displayed on Figure 5.3.

Exp priv,β V,A (λ) (pk, sk) ← Setup(1 λ ) U, D ← [] A Oreg,Ocorr (pk) BB, V 0 , V 1 ← [] A O p vote ,Ocast (pk) if ρ(V 0 ) = ρ(V 1 ) then r ← Tally(BB, sk, U) β ← A(pk, r) return β O p vote (id, v 0 , v 1 ) if (id, * ) ∈ U ∧ id / ∈ D then b ← Vote(pk, id, U[id], v β ) BB ← BB b V 0 ← V 0 (id, v 0 ) V 1 ← V 1 (id, v 1 ) return b where V 0 (resp. V 1 ) is obtained from V 0 (resp. V 1 )

Definition 41 (Privacy [24]). A voting system is private if for any adversary A,

P Exp priv,0 V,A (λ) = 1 -P Exp priv,1 V,A (λ) = 1 is negligible.
Note that this definition of vote privacy implicitly assumes that voters do not communicate with the ballot box through an anonymous channel: indeed, the voting oracle lets the adversary know which voter produced which ballot.

Main Theorem

We show that privacy implies individual verifiability, under a few assumptions.

Assumptions

As for the symbolic case, we assume the existence of a neutral vote v neutral , that does not contribute to the result (Definition 28).

We also require that the tallying of ballots can be performed piecewise, which is a similar requirement to the partial tallying property of the counting function on votes. That is, informally, as soon as two boards BB 1 , BB 2 are independent then Tally(BB 1 BB 2 ) = Tally(BB 1 ) * Tally(BB 2 ). This property is satisfied by most voting schemes. Typically it holds as soon as the tallying algorithm correctly implements a counting function that has the partial tallying operation. Formally, we characterise this notion of "independence" using the extract id function defined in the previous section.

Definition 42 (Piecewise tally).

A voting scheme has the piecewise tally property if for any two boards BB 1 and BB 2 that contain ballots registered for different agents and such that BB 1 BB 2 is valid, that is, for all key sk generated by Setup and list of users U created by Register, if (5.1)

ValidTally(BB 1 BB 2 , sk, U) ∧ ∀b ∈ BB 1 . ∀b ∈ BB 2 . extract id (b, sk, U) = extract id (b , sk, U), Exp ValidTally V,A (λ) (pk, sk) ← Setup(1 λ ) U, D ← [] A Oreg,Ocorr (pk) (BB, id, v) ← A O vt vote (pk) if (id, * ) / ∈ U then stop; b ← Vote(pk, id, U[id], v) if id / ∈ D ∧ (∀b ∈ BB. extract id (b , sk, U) = id) ∧ ValidTally(BB, sk, U) ∧ ¬ValidTally(BB||b, sk, U) then return 1 O vt vote (id, v) if (id, * ) ∈ U ∧ id / ∈ D then return Vote(pk, id, U[id], v)
We say that a voting scheme is strongly correct if whatever valid board the adversary may produce, adding a honestly generated ballot still yields a valid board. A similar assumption was introduced in [START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF]. For example, Helios is strongly correct.

Definition 43 (Strong correctness). A voting scheme V is strongly correct if for any adversary A,

P Exp ValidTally

Theorem

We can now state and prove our main result about computational privacy and verifiability.

Theorem 9 (Privacy implies individual verifiability). Let V be a consistent and strongly correct voting scheme that has the piecewise tally property. If V is private, then V is individually verifiable.

Let us first give the general intuition of the proof of this theorem. This proof is inspired by the same intuition as in the symbolic case from Chapter 4. If an attacker manages to break verifiability, that is, to obtain that not all votes from the honest voters are counted correctly, then there also exists an attack against privacy. Indeed, consider a scenario with additional, new voters, whose votes should compensate those cast by the initial voters. By performing the attack on verifiability for the initial voters, the attacker reaches a state where, in the result of the election, they are no longer compensated by the new votes. This allows the attacker to break privacy.

More precisely, the general idea of the proof is as follows. Consider an attacker A that breaks individual verifiability, i.e. wins the game Exp verif V with non negligible probability. We construct an attacker B that breaks privacy, i.e. wins Exp priv,β V . B starts by registering, and corrupting, the same voters as A, using oracles O reg and O corr . Let id 1 , . . . , id n be this first set of voters. B then registers another set of n voters id 1 , . . . , id n , where the id i are fresh identities, that A does not use.

B then simulates A, using the oracle O p vote to simulate A's calls to O v vote . Specifically, when A calls O v vote (id, v), B calls the oracle O p vote (id, v, v blank ), where v blank is a neutral vote. Once B is done simulating A, it triggers the new voters id i to vote, by calling the oracle O p vote (id i , v blank , v i ), where v i is the (last) vote cast by id i . The vote of each id i compensates the vote of id i , so that the condition ρ(V 0 ) = ρ(V 1 ) from Exp priv V holds. B then obtains the result r of the election, which is equal to r 1 * r 2 , where r 1 is the tally of the ballots cast by A, and r 2 the tally of the additional ballots cast by B. Then:

• if β = 0: then all the votes cast by the id i were v blank , and the result is thus r = r 1 . Since A breaks individual verifiability, r 1 does not contain the honest votes, i.e., for all multiset

V c of votes, r = ρ(v 1 , . . . , v n ) * ρ(V c ).
• if β = 1 however, the votes cast by the id i were the v i , and the partial tally r 2 is therefore

r 2 = ρ(v 1 , . . . , v n ).
Hence, the result r does contain the honest votes.

Therefore, by observing whether the final result of the election contains the honest votes, B is able to guess β, and wins Exp priv V .

We now give the detailed proof of the theorem.

Proof. Let A = A 1 , A 2 be an adversary that breaks individual verifiability, i.e. wins Exp verif V . We construct the adversary B = B 1 , B 2 , B 3 that attacks privacy, i.e. plays Exp priv,β V , as follows.

• B

Oreg,Ocorr 1 (pk) first simulates A Oreg,Ocorr 1 (pk). B 1 registers and corrupts the same identities as A using its own oracles. B 1 keeps a list I 1 of the identities it registers by calling O reg . Once A 1 returns, B 1 calls O reg another |I 1 | times, on fresh identities that are simply bitstrings of length λ drawn uniformly and independently at random.It keeps a list I 2 of these fresh identities. Let us denote U = U 1 U 2 the list of identities and credentials in the Exp priv,β V game at this point, where U 1 and U 2 respectively contain the credentials of the identities in I 1 and I 2 . Note that the list D of dishonest identities is the same in Exp priv,β V,B and the corresponding execution of Exp verif V,A .

• B

O p vote ,Ocast 2 (pk) maintains a list L, initially empty, which will be used to record the calls to

O p vote . B 2 internally runs A O v vote ,Ocast 2
(pk), answering its queries to the oracles as follows.

-When A 2 calls O v vote (id, v), provided id ∈ I 1 , B calls O p vote (id, v, v neutral )
. B 2 then applies the revote policy to list LL: it removes any previous couple (id, v ) (for any v ) from L, and then appends (id, v) to L.

If O p vote (id, v, v neutral ) returns a ballot b, B returns it to A 2 . -When A 2 calls O cast (id, b), provided id ∈ I 1 , B calls O cast (id, b).
If at any point during the simulation A 2 blocks or fails, B stops the simulation. At this point, it is clear that if β = 0, A has been accurately simulated. Indeed in that case A is shown a board where the votes it wanted to cast have indeed been cast. Let then Voted be the list of the votes in L: Voted = [v for (id, v) ∈ L]. Let also BB a be the value of the board BB in game Exp priv,β

V,B at that point. By the previous observation, if β = 0, then BB a is also equal to the value of BB in game Exp verif V,A at this point.

Let us show that, except with a negligible probability that we will denote p 1 (λ), BB a contains no ballots with identities from U 2 , i.e. ballots b such that extract id (b, sk, U) ∈ I 2 .

There exists a polynomial q(λ) that bounds A's running time. Consider a game Exp rand C (λ), where q(λ) bitstrings of length λ are drawn uniformly independently at random, and the adversary C must propose a bitstring, and wins if this guess is one of the q(λ) randomly drawn strings. It is clear that there no adversary C has a non-negligible probability to win that game. If I 1 ∩ I 2 = ∅, an adversary C for game Exp rand could simply run A internally (running the Setup and Register algorithms by itself) and propose at random any of the (at most q(λ)) identities in I 1 . Assimilating the identities drawn at random by B with those drawn by Exp rand , C would win as soon as it picked an id ∈ I 1 ∩ I 2 . Thus, I 1 ∩ I 2 = ∅ except with negligible probability. Now, for each b ∈ BB a :

either b was added to BB by a call B made to O p vote . By definition of B, such a call is O p vote (id, v 0 , v 1 ) for some id ∈ I 1 and some votes v 0 , v 1 . Thus, b = Vote(pk, id, U[id], v β ), and by assumption on extract id we have extract id (b, sk, U) = id ∈ I 1 . Thus, unless

I 1 ∩ I 2 = ∅, id / ∈ I 2 .
or b was added to BB by a call made by B to O cast (id, b) for some id. Hence, by definition of this oracle, id ∈ D and Valid(id, b, BB, pk). Assume there exists such a b that does not satisfy extract id (b, sk, U) / ∈ I 2 . Let us consider the first such ballot b 0 that is cast by A. Consider an adversary C for Exp rand , that runs an election by itself, i.e. running the Setup, Register, etc. algorithms by itself. C does just as B, except that it does not draw and register the identities in I 2 : from the point of view of C, the strings drawn by the game Exp rand , that C does not have access to, will play the role of I 2 . C thus only has access to U 1 . C continues the execution of B: the only point (before tallying) where C would need to use U 2 is when running the Valid algorithm to answer B's calls to Ocast. C instead uses U 1 when that situation arises. C chooses at random one of the polynomially many calls to O cast (id, b) that B makes, and returns extract id (id, b, sk, U). With non-negligible probability, the call chosen was O cast (id 0 , b 0 ). In that case, the execution of C accurately follows that of B. Indeed, as explained, the only point where that execution might not be accurate is when C has run Valid using U 1 instead of U 1 ∪ U 2 . By assumption, up to that point, no ballots that extract to an identity in I 2 were submitted. By assumption, the validity of a ballot depends on no other credential that those of the id under which it is submitted and of the id it extracts to. Thus, only using U 1 up to the O cast (id 0 , b 0 ) call yields the same execution as using U 1 ∪ U 2 . Therefore, the ballot returned by C is indeed the b 0 created by A such that extract id (b 0 , sk, U) ∈ I 2 , and C wins Exp rand . This establishes that, except with negligible probability, all ballots b cast by A satisfy extract id (b, sk, U) = id / ∈ I 2 .

B 2 then calls O p vote (id 1 , v neutral , v 1 ), . . . , O p vote (id l , v neutral , v l ), where v 1 , . . . , v l are the elements of Voted, and id 1 , . . . , id l are pairwise distinct identities from I 2 . Note that this is possible since all identities in L are distinct and in I 1 : l = |L| is hence smaller than

|I 1 | = |I 2 |. Let then BB b = [b 1 , . . . , b l ]
be the set of new ballots added to the board by these l calls, i.e. ballots for v neutral if β = 0 and v 1 , . . . , v l if β = 1.

At this point, we have BB = BB a BB b . By construction, except with negligible probability p 2 (λ), BB b only contains ballots with identities from U 2 , i.e. ballots b such that extract id (b, sk, U) ∈ I 2 .

B 2 then returns.

• Exp priv V will then check that ρ(V 0 ) = ρ(V 1 )
, where V 0 and V 1 are the lists it keeps, which contain the last votes O p vote has been called on for each id. Considering the definition of B 2 , at this point we always have

ρ(V 0 ) = ρ(V 1 ) = ρ(v 1 , . . . , v l , v neutral , . . . , v neutral l times )
Hence this check necessarily succeeds, and Exp priv V computes Tally(BB, sk, U).

• B 3 obtains a result r. If r = ⊥, B 3 returns 1. If A 2 blocked previously during its simulation, B 3 also returns β = 1. Indeed, as explained earlier, when β = 0, A is accurately simulated. Hence, intuitively, whenever A wins Exp verif V , the simulated A 2 failing means that β = 1. Otherwise, B computes D(r, Voted) and:

-if ∃V c . r = ρ(Voted) * ρ(V c ) then B returns β = 1 -otherwise, B returns β = 0.
We will now prove that if A breaks individual verifiability, then B wins the privacy game except with negligible probability.

Let us first establish that if ValidTally(BB a , sk, U 1 ) holds, then ValidTally(BB a BB b , sk, U 1 ∪U 2 ) also holds, except with negligible probability.

We construct an adversary C, who plays the strong correctness game Exp ValidTally V as follows.

• C 1 is identical to B 1 . • C 2 first
(id, v 0 , v 1 ), C returns (BB, id, v β ).
The adversary C is polynomial, i.e. there exists a polynomial q(λ) bounding its number of operations.

For any β, assume ValidTally(BB a , sk, U 1 ) holds and ValidTally(BB a BB b , sk, U 1 ∪ U 2 ) does not. Let us write U 2 = [(id 1 , c 1 ), . . . , (id l , c l )]. Hence, there exists a smallest k ∈ 1, l such that = 1 since l ≤ q(λ). Let us denote p 3 (λ) this probability. By the strong correctness assumption, it is negligible.

ValidTally(BB a [b 1 , . . . , b k-1 ], sk, U 1 ∪ U 2 ) holds and ValidTally(BB a [b 1 , . . . , b k ], sk, U 1 ∪ U 2 ∪ [(id k , c id k )]) does not, where U 2 = [(id 1 , c 1 ), . . . , (id k-1 , c k-1 )].
As noted earlier, BB a contains no ballots cast for identities in I 2 (except with probability p 1 (λ)) and BB b only ballots for identities in I 2 (except with probability p 2 (λ)). In addition, I 1 ∩ I 2 = ∅, except with some negligible probability p 4 (λ). Thus, by the piecewise tallying assumption, if ValidTally(BB a BB b , sk, U 1 ∪ U 2 ), then we have (regardless of β) r = Tally(BB, sk, U) = Tally(BB a BB b , sk, U) = Tally(BB a , sk, U) * Tally(BB b , sk, U)

In addition, by assumption, registering more users does not change the tally, i.e. Tally(BB a , sk, U) = Tally(BB a , sk, U 1 ).

Hence, if ValidTally(BB a BB b , sk, U 1 ∪ U 2 ), then r = Tally(BB a , sk, U 1 ) * Tally(BB b , sk, U)

except with some negligible probability p 5 (λ).

• If β = 0: then Exp priv,0 V,B (λ) = 1 if and only if B 3 returns 1 in this game, which happens either when A (simulated by B) blocks, or when it does not and ∃V c . r = ρ(Voted) * ρ(V c ) or r = ⊥.

Assume ValidTally(BB a , sk, U 1 ) ⇒ ValidTally(BB a BB b , sk, U), which, as we have established, holds except with probability p 3 (λ).

Let us first examine the case where A does not block and r = ⊥. Since r = ⊥, ValidTally(BB a , sk, U 1 ) holds. Hence, ValidTally(BB a BB b , sk, U) also holds, and as explained previously we thus know that r = Tally(BB a , sk, U 1 ) * Tally(BB b , sk, U) (except with probability p 5 (λ)). Since β = 0, BB b only contains ballots for v neutral . Hence, by consistency of the voting scheme, Tally(BB b , sk, U) = ρ(v neutral ) l = ρ(v neutral ). Thus r = Tally(BB a , sk, U 1 ).

The condition ∃V c . r = ρ(Voted) * ρ(V c ) is therefore equivalent to ∃V c . Tally(BB a , sk, U 1 ) = ρ(Voted) * ρ(V c ). Since, in this case, A has been accurately simulated without blocking, does not return ⊥, and BB a is the board after its execution, this is exactly the condition under which Exp verif V,A (λ) does not return 1.

Hence Exp priv,0 V,B (λ) = 1 if and only if either A (simulated by B) blocks, or constructs a board whose tally is ⊥, or it does not and Exp verif V,A (λ) = 1.

Since Exp verif V,A (λ) also does not return 1 when A blocks or when the tally is ⊥, this implies that (except with probability at most p 3 (λ) + p 5 (λ)) Exp priv,0 V,B (λ) = 1 if and only if Exp verif V,A (λ) = 1. Thus P Exp priv,0 V,B (λ) = 1 -P Exp verif V,A (λ) = 1 ≤ p 3 (λ) + p 5 (λ).

(5.2)

• If β = 1: then Exp priv,1 V,B (λ) = 1 if and only if B 3 returns 1 in this game, which happens either when A (simulated by B) blocks, or when it does not and ∃V c . r = ρ(Voted) * ρ(V c ) or r = ⊥.

Assume ValidTally(BB a , sk, U 1 ) ⇒ ValidTally(BB a BB b , sk, U), which, as we have established, holds except with probability p 3 (λ). Let us first examine the case where A does not block and r = ⊥. As in the β = 0 case, we thus have r = Tally(BB a , sk, U 1 ) * Tally(BB b , sk, U) (except with probability p 5 (λ)). Since β = 1, BB b contains ballots for v 1 , . . . , v l , i.e. for Voted. Hence, by consistency, Tally(BB b , sk, U) = ρ(Voted), and therefore r = Tally(BB a , sk, U 1 ) * ρ(Voted). By definition of Tally, there exists V such that Tally(BB a , sk, U 1 ) = ρ(V ). Hence the condition ∃V c . r = ρ(Voted) * ρ(V c ) necessarily holds. Therefore, except with probability at most p 3 (λ) + p 5 (λ), Exp priv,1

V,B (λ) = 1 if and only if either A (simulated by B) blocks, or it does not and returns a board whose tally is ⊥, or it does not and returns a board whose tally is not ⊥. Hence

1 -P Exp priv,1 V,B (λ) = 1 ≤ p 3 (λ) + p 5 (λ). (5.3)
We thus have, using 5.2 and 5.3:

P Exp verif V,A (λ) = 1 = P Exp priv,0 V,B (λ) = 1 -P Exp verif V,A (λ) = 1 + P Exp priv,1 V,B (λ) = 1 -P Exp priv,0 V,B (λ) = 1 + 1 -P Exp priv,1 V,B (λ) = 1 ≤ P Exp priv,1 V,B (λ) = 1 -P Exp priv,0 V,B (λ) = 1 + 2(p 3 (λ) + p 5 (λ))
Therefore, if A breaks individual verifiability, i.e. if P Exp verif V,A (λ) = 1 is not negligible, then B breaks privacy, which proves the theorem.

Note that, in these reductions, for each id in U 1 , B makes at most as many calls to O p vote as A makes to O v vote , and at most as many calls to O cast as A makes to O cast . In addition, for each id in U 2 , B makes at most one call to O p vote , and no call to O cast . Thus, the exact same proof proves that the result also holds if both the games Exp priv We have shown that, with a standard game-based definition for privacy and an intuitive notion of individual verifiability, under some mild assumptions on the voting scheme, privacy implies individual verifiability.

As we already observed in the previous chapter regarding symbolic models, this implication only holds when considering the same trust assumptions w.r.t. the election authorities for both properties. In fact, Benaloh's definition for privacy assumes a honest ballot box. In the game, as soon as a ballot is emitted by a honest voter, it is added to the ballot box, and cannot be removed by the adversary: the adversary can only add new ballots to the ballot box, but not control it. For this reason, we considered a definition for verifiability that also assumes a honest ballot box. This assumption is actually shared by almost all existing game-based definitions for vote privacy. As we discuss in the following Chapter, this highlights a gap in existing definitions. Indeed, voting protocols typically aim at being private without having to trust the ballot box, but the privacy notions usually considered assume it to be honest, and are thus too weak.

Conclusion on Privacy and Verifiability

In Chapters 4 and 5, we have shown a subtle relation between privacy and verifiability, namely that privacy implies individual verifiability, which is rather counter-intuitive. Our result holds in a cryptographic as well as a symbolic setting, for various trust assumptions.

As we have explained, if an adversary who controls the ballot box wishes to learn the vote of some voter Alice, he can simply remove all ballots except Alice's from the list of recorded ballots, and replace all of them with encryptions of valid votes of his choice. When seeing the result of the election, the adversary, who already knows the value of all votes except Alice's -he chose them himself -will deduce how Alice voted.

As noted in previous chapters, our result holds when the same trust assumptions are made regarding the election authorities, i.e. when the same entities (ballot box, channels, tallying authority, etc.) are trusted for privacy and verifiability. Our findings thus point out that if voters wish for their vote to be private without having to trust some authorities, then the system must also ensure that their votes are counted without trusting these same authorities. That is, an entity that has the power to cheat on the result, and make it so that the votes are not counted correctly, also has the power to learn information about how voters voted, even for entities that do not have access to the secret keys.

Limitations. Individual verifiability is only one part of verifiability. It does not account for universal nor eligibility verifiability. So our result cannot be used to conclude that a private voting scheme ensures all desirable verifiability properties. Instead, it demonstrates that there is no hope to design a private voting system if it does not include some degree of verifiability, namely individual verifiability at least.

Our result assumes counting functions that have the partial tally property. The proof technique does not extend immediately to more complex counting functions such as STV or Condorcet, but as we will see in the next chapter, the implication still holds at least in some cases without this assumption. Also, our results implicitly discard anonymous channels: our computational model does not account for anonymous channels while our election determinism assumption discards at least some use of anonymous channels. Intuitively, in presence of such channels, an attacker may be able to modify a ballot without being able to tell which one, hence breaking verifiability without breaking privacy. It would be interesting to identify which kind of anonymous channels and, more generally, which form of non determinism can still be tolerated.

Dishonest ballot box.

As discussed earlier (see introduction of Part II), the apparent contradiction between our result and the fact that known protocols have been proved private without being verifiable (e.g. Helios without verification steps) is explained by closely looking at the trust assumptions.

Our main theorem states that privacy implies individual verifiability with the same trust assumptions. Verifiability is typically studied against a dishonest ballot box. However, the privacy definition introduced by Benaloh assumes an honest ballot box, as well as most existing game-based privacy definitions of the literature [START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF] that are used to study protocols. Therefore, our main theorem in the computational model shows that whenever a voting scheme is private w.r.t. an honest ballot box, then it is also individually verifiable w.r.t. an honest ballot box, which is of course a rather weak property.

This highlights a crucial need for a ballot privacy definition in the context of a dishonest ballot box, in a cryptographic setting. So far, privacy has only been proved assuming an honest ballot box, which forms a very strong trust assumption that was probably never made clear to voters nor election authorities: voting schemes aim at being private without needing to trust the ballot box.

As already pointed out in Introduction of Part II, defining privacy against a dishonest ballot box is hard, as naïvely adapting usual definitions typically yields properties that are too strong, and can never be satisfied. This problem is the subject of the next chapter.

Chapter 6

Privacy against a Dishonest Ballot Box

Introduction

Electronic voting systems usually try to ensure that the votes remain private. Typically, votes are encrypted with a public key, and the associated decryption key is shared among several trustees, so that at least a certain number of them are required in order to decrypt and compute the tally. In particular, a typical design choice is not to give access to this secret key to the ballot box, i.e. the server in charge of collecting the ballots from all voters. The idea behind this choice is that it should ensure that even if this server is not trusted, it should not be able to learn any information on the votes, i.e. to break the voters' privacy. However, as we pointed out in the previous chapters, this trust assumption is not captured properly by existing game-based security definitions. A similar observation has been made e.g. in [START_REF] Culnane | A Peered Bulletin Board for Robust Use in Verifiable Voting Systems[END_REF][START_REF] Bernhard | Ballot secrecy with malicious bulletin boards[END_REF]. In brief, existing definitions (e.g. [START_REF] Benaloh | Distributing the power of a government to enhance the privacy of voters[END_REF][START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF][START_REF] Chondros | Ddemos: A distributed, end-to-end verifiable, internet voting system[END_REF]) consider a game where the adversary controls the votes cast by honest parties but cannot control the resulting ballots: these get placed on the bulletin board before it is tallied and cannot ever be modified or removed. In other words, current security notions allow to prove security of schemes only under the assumption that the bulletin board is honest, even if they are designed (and claimed) to resist a dishonest voting server.

This gap between security goals and security definitions has recently been confirmed by Roenne [START_REF] Roenne | [END_REF] in the case of Helios [START_REF] Adida | Helios: Web-based open-audit voting[END_REF]. As already described e.g. in Chapter 3, the attack shows that a malicious board can break privacy of votes if users are allowed to revote. Furthermore, it seems non-trivial to prevent it even if voters and external auditors carry out additional checks (e.g. forbidding duplicate ballots, a.k.a. weeding). Even detecting the attack would require unrealistic countermeasures where every voter carefully records any of her ballots, even the ones that failed to reach the ballot box.

In this chapter we propose a way to fill that gap. We design novel security definitions which allow the rigorous study of privacy of electronic voting in presence of a malicious bulletin board, study relations between the notions which we propose, and apply them to several well-established schemes.

In [START_REF] Cortier | Voting: You Can't Have Privacy without Individual Verifiability[END_REF], we made a first attempt at modelling privacy against a dishonest board, where we assumed that all honest voters perform the verifications specified by the protocol. Such an assumption was unrealistic: in a realistic setting, it is more likely that a (small) fraction of honest voters perform the required tests while the others stop after casting their vote. The notion of privacy we propose in this chapter is much more precise and general than that initial definition, which we will thus not present here.

Before we outline our results it is useful to discuss the security of Helios against an adversary who can control the bulletin board. Recall that in Helios voters encrypt their vote and send their encrypted ballot to a bulletin board, that displays them. The tally is done through mixnets or using the homomorphic property of the encryption. Importantly, voters can and should in fact check that their ballot appears on the bulletin board. First, notice that by changing the board an adversary may influence the final result and indirectly learn information about the votes of the honest party. This can be easily seen by considering the extreme case, already discussed earlier, where the adversary culls all but one ballot from the board: the tally then reveals the value of the underlying vote. The following three scenarios show that different usages of Helios, defined by how voters cast/check their ballots, lead to different security guarantees.

• The scheme offers the strongest guarantees when all honest voters vote and check that their vote appears on the ballot box. In this case the result of the election contains all of the honest votes plus at most as many votes as the number of voters controlled by the adversary. However, such assumptions on honest voters are unrealistic -in practice, only a small fraction of voters perform the checks.

• Assume now that not all honest voters vote. Then the security of Helios decreases. Indeed, a malicious board may use absentee voters to place ballots of her choice. So the privacy of the election is as good as what an attacker can learn from a result formed from the honest voters that did vote and any choice of votes from the remaining voters (dishonest or not).

• Finally, the most common scenario is that not all honest voters vote and only a fraction of them actually conduct the suggested verification steps. In this case the security of Helios decreases further. Indeed, a malicious board may now selectively remove ballots that have been cast by voters that do not check. Hence a malicious board has now even more control on the result, that may leak more information since it may contain fewer votes (at the will of the adversary).

What does this example tell us? The strongest security is only achieved under unreasonable assumptions and more plausible uses lead to weaker guarantees. Furthermore, the level of control the adversary has on the board (and therefore over the verifiability of the scheme/the election result) may vary considerably not only between schemes, but even between different usage scenarios of the same scheme. Therefore, as already hinted at in the previous chapters, taking into account the verification mechanisms, and the fact that only some of the voters would actually perform them, seems inevitable if one aims to characterise the privacy of a voting scheme. One crucial conclusion of this brief discussion is that it is difficult to pin down "the right" level of privacy. Instead, an appropriate security definition should account for the possibility of a spectrum of privacy levels derived from varied trust assumption and usage scenarios.

Another important observation is that the distinction between the different levels of guarantees can be quite subtle, and the associated security implications difficult to evaluate. From this perspective, not only it is difficult to define security but it is also very hard to compare voting schemes and select the ones that should be used, if a malicious board is a concern. All of these concerns highlight the need for a framework that allows for a systematic analysis of existing schemes.

Contributions and outline of the chapter.

We make several contributions which address the challenges outlined above. We first provide a family of rigorous game-based definitions for ballot privacy against malicious bulletin boards. Different instantiations capture different levels of ballot privacy and in particular we can accurately capture the distinct levels of security discussed above.

Next, we introduce a family of ideal functionalities for defining simulation-based security. Over the typical functionality which collects the votes and applies a result function, our notions permit adversarial control over the result of the computation (see below for the details). These functionalities specify precisely the expected abilities (and therefore the limitations) of an adversary who tampers with the ballot box, so that the resulting level of security can be more easily evaluated than for game based security definitions.

We then relate these two families of privacy notions: we show that under mild assumptions the former imply the latter. Our proof for this implication is generic in that we do not relate members of the two families of definitions instance by instance.

Then, we use our definitions to study the security of several well established protocols. One aspect of our work which is worth discussing is that it reflects the subtle interplay between verifiability and privacy exposed in the previous chapters. Our different flavours of ideal functionalities reflect different adversarial capabilities to modify honest votes. Is this a privacy or a verifiability property? Intuitively, ballot privacy says that the adversary should not learn more information about the votes than the result itself. Hence, whether or not the adversary can remove or alter honest votes, or add more votes, gives more control to the adversary over the result, which interferes with the level of privacy offered by the voting scheme. Actually, we show that our privacy notion, as soon as a sufficiently strong instance of it is considered, implies individual verifiability against a dishonest ballot box. This confirms the results from the previous chapters. Interestingly, this proof is completely different than the previous ones: we leverage the relation we prove between our notion and simulation-based security to prove directly in the ideal world that individual verifiability holds, which is much easier.

Finally, we try to get a better insight on how to compare different instances of our family of ideal functionalities, and on what level of privacy they guarantee. To do this we quantify the amount of information they allow to be leaked to the adversary, by exploring the notion of entropy. Following the formalism proposed in [START_REF] Bernhard | Measuring vote privacy, revisited[END_REF], we consider votes as random variables, and assume the adversary is trying to make some specific observation on them. This observation is expressed by a target function, i.e. a function that associates a list of votes to some value intended to represent the information the adversary tries to determine. We then compute the conditional entropy on the target function (applied to the votes), given the view of the adversary, i.e. all the messages it receives and his internal state. We compare that entropy for different ideal functionalities, and discuss our findings.

More details about our privacy notion. We build upon the security notion BPRIV introduced in [START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF]. To understand our approach it helps to recall the general idea behind BPRIV, and more generally existing game-based definitions. Essentially, the adversary has to distinguish between two situations. The first is a situation where honest voters submit ballots containing votes selected by the adversary. The second is where the ballots submitted by the honest voters are "fake". In BPRIV these are simply ballots of some value, also chosen by the attacker. In the process the adversary is allowed to learn the result of the tally process. Ignore for the moment the ballots cast by dishonest parties. In the case of an honest bulletin board (where all ballots are placed on the bulletin board to be tallied) we always return to the adversary the tally corresponding to the real ballots. If no adversary can tell the two situations apart then the ballots themselves, together with the result learned by the adversary, do not leak information about the underlying votes.

We capture security against an adversary who can tamper with the bulletin board, by requiring that there exists a recovery algorithm which, essentially, can detect how the adversary has tampered with the ballots issued by the honest users. The output of the recovery algorithm can be thought a small program, written in a small programming language with commands that act on the bulletin board (delete honest votes, modify votes, re-order votes, etc.). If such a recovery algorithm exists, we return to the adversary the tally of the real ballots but after the tampering program has been applied. A voting scheme is said to satisfy mb-BPRIV -shorthand for "BPRIV against a malicious ballot box" -when no adversary can distinguish the real world from the fake one.

The typical definition for simulation based security involves a functionality which collects the list of votes of all parties (honest and corrupt) and simply returns the result of the election determined by the list. To capture the setting where an adversary can to some extent tamper with the bulletin board (and therefore the list of votes that is tallied) we modify the ideal functionality to reflect this adversarial ability. We now give a high level (and imprecise) sketch of how we proceed as follows. The functionality is parametrised by a what we could call a "guard" P , that is, a predicate that limits what power the functionality gives to the adversary. After it collects the votes, but before it returns the result, the functionality allows the adversary to tamper with the list of votes via an arbitrary program f . However, it will only accept to compute the result if that program satisfies the predicate P . Roughly, showing that a voting scheme implements this ideal functionality for a given guard P therefore guarantees that no adversary against the scheme can have more power than what P specifies.

We can then establish a link between security w.r.t. mb-BPRIV parametrised by recovery algorithm f and idealised security with respect to an ideal functionality parametrised by guard P . If f and P are compatible, that is, roughly, if the tampering that f can detect are allowed by P , then any scheme which is mb-BPRIV secure and strongly consistent -a notion introduced in [START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF] -is secure with respect to the ideal functionality. As observed by [START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF], mb-BPRIV alone is not sufficient for simulation-based security, as it does not account for the case where a badly conceived tallying algorithm leaks some unwanted information on the votes: indeed, since the tally is always computed on the real ballots, such a leakage would not help the adversary to distinguish between the real and fake ballots, i.e. to break mb-BPRIV. Hence [START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF] introduced the notion of strong consistency, which demands that the tally reveals only the desired result function on the votes (and no additional information). [START_REF] Bernhard | Ballot secrecy with malicious bulletin boards[END_REF]. Their definition extends Benaloh's approach [START_REF] Benaloh | Distributing the power of a government to enhance the privacy of voters[END_REF]. The adversary submits a board and the tally is performed only if the ballots on the board that come from honest voters are such that the subtally does not differ in the "left" and "right" worlds. This somehow corresponds to one possible instance of our recovery algorithm in mb-BPRIV, where the attacker may remove any honest vote and add an arbitrary number of votes, independently of whether honest voters do check their ballot and independently of the number of dishonest voters. Note that [START_REF] Bernhard | Ballot secrecy with malicious bulletin boards[END_REF] requires that ballots cannot be modified at all (e.g. they cannot contain a tag such as the date). Perhaps the most important technical difference from our approach is that Benaloh's definitional approach does not seem to allow a formal link with a simulation-based notion of security. In brief, Benaloh's definition does not allow to construct a simulator which can simulate on the fly a fake board towards an adversary: the global consistency requirement between the subtally of the real votes seems to preclude an on-line simulator which can fake a board. Furthermore, this approach assumes that the counting function admits partial tally, which discards many modern counting functions such as Condorcet or STV. The shortcomings that stem from the use of Benaloh's approach are also shared by [START_REF] Cortier | Voting: You Can't Have Privacy without Individual Verifiability[END_REF]. This definition can be again seen as an extension of Benaloh's definition but which assumes that all honest voters check that their ballot appears on the bulletin board. Recently, Bursuc, Dragan and Kremer [START_REF] Bursuc | Private votes on untrusted platforms: models, attacks and provable scheme[END_REF] have studied the security of encryption schemes where ballots can be partially modified, for example by a malicious device. They propose a variant of BPRIV that accounts for such behaviours. The case of a malicious board corresponds to the case where ballots can be fully modified. Then for malicious boards, vote privacy defined in [START_REF] Bursuc | Private votes on untrusted platforms: models, attacks and provable scheme[END_REF] can be seen as an instance of mb-BPRIV where the recovery algorithm lets the adversary tamper arbitrarily with the honest ballots. However, in such a case, all schemes would be declared insecure. So the model of [START_REF] Bursuc | Private votes on untrusted platforms: models, attacks and provable scheme[END_REF] does not seem suitable to reason about malicious boards in general. Instead, it addresses a class of schemes where security is due to the part of the ballot that is securely transmitted to the (honest) board, despite the adversary tampering with the other parts of the ballot.

Related work. The first game-based definition which considers a malicious board has been proposed by Bernhard and Smyth

Background

The computational model we consider for voting protocols is the same as in the previous chapter, with a few extensions and additional assumptions that we describe in this section. We also present the original BPRIV notion that we build upon.

Notations

In the previous chapter, corruption of voters was dynamic: the adversary had access to a registration oracle to generate credentials for any number of voters, and a corruption oracle, to corrupt any of them.

Instead, we now fix beforehand the identities of voters. We consider a finite set I = H ∪ D of voter identities, partitioned into the sets H and D of honest and dishonest voters. H is further partitioned into sets H check and H check , meant to contain the identities of voters who verify their vote (resp. do not verify).

The interest of fixing voter identities will become clear later in the chapter. Basically, we will relate two notions of vote privacy, showing that one implies the other. Having fixed the sets of honest and corrupted voters beforehand will then let us know that this implication holds when considering the same number of adversary-controlled voters for both notions, which would not be the case if the voters were dynamically corrupted. In a model with dynamic corruption, we could only prove the weaker claim that the implication holds with potentially different numbers of corrupted voters for each notion.

We study schemes for which the adversary can tamper with the bulletin board, which, as before, is simply a list of ballots. We make an additional mild assumption regarding the format of the ballots: we assume them to be pairs of bitstrings.

Definition 44 (Bulletin board).

A bulletin board BB is a list of pairs of bitstrings which we call ballots. For a ballot (p, b), we call the bitstring p a public credential and the bitstring b is a ciphertext. BB[j] denotes the jth element of BB.

We will also call extended bulletin board a board where elements are associated to an identity, i.e. a list of elements of the form (id, (p, b)).

While the exact nature of the ballots, i.e. public credentials and ciphertexts, depends on the protocol considered, we intuitively intend the public credential to link to the identity of the voter who casts the ballot, and the ciphertext to contain the vote expressed by the ballot.

As in the previous chapters, we call counting functions the functions which calculate the result of an election. To be more general, we no longer assume a partial tallying property. In addition, we will no longer explicitly encode the revote policy in the games defining properties (e.g. having ballots cast by oracles replace previous ballots, to encode that the last vote counts). Instead, the revote policy will be encoded in the counting function. That is, we now consider counting functions that 1. take the identities of voters into account, 2. apply to lists rather than multisets of votes. This way, any revote policy can be expressed by a counting function. We will express our results generically (for an arbitrary unspecified counting function ρ), so that they are independent of the choice of a particular revote policy.

Definition 45 (Counting function). A counting function ρ is a mapping that takes as input a sequence S of pairs (id, v), where id ∈ I and v is a vote, and returns a value (bitstring) intended to represent the result of tallying the votes in S. It may use the ids contained in S to apply a revote policy.

We assume a special value ⊥, intended to represent an invalid identity and vote ( e.g. obtained by decrypting a ballot that was incorrectly generated), that should not be counted. Formally, we require that counting functions ignore this value, i.e. that for all l, l , ρ(l||⊥||l ) = ρ(l||l ).

Original BPRIV notion

As mentioned in introduction, the privacy notion we propose in the next section builds upon the definition for ballot privacy BPRIV introduced by Bernhard et al [START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF]. To provide some context, in this section we briefly present this existing definition (adapted to the notations and model we use here), as well as some associated properties. Finally we recall the result from [START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF], which states that BPRIV together with the associated notions imply a simulation-based notion of privacy. We take this opportunity to make explicit an assumption required for this result that was missing from the original paper.

Ballot privacy states that ballots themselves do not reveal information about the underlying votes (even after tallying).

The original BPRIV notion models an honest ballot box whereas we consider a malicious one. To distinguish between the two notions we will from now on refer to the original one as hb-BPRIV security (for "honest ballot box") and to the notion we introduce in the next section as mb-BPRIV (for "malicious ballot box"). hb-BPRIV. Essentially, in hb-BPRIV, the adversary is interacting with an execution of the voting protocol, and sees either the real ballots, or fake ballots containing fake votes, depending on a secret bit β. Using oracles, he can choose the values of the real and fake votes, and cast any ballot he can construct (in the name of a corrupted voter). In the end, regardless of β, the adversary is shown the result of tallying the real ballots. He must then guess β, and the privacy property is that he should not be able to correctly do so. Intuitively, this notion of ballot privacy

Exp hb-BPRIV,β A,V (λ) BB 0 , BB 1 ← ∅ (pk, sk) ← Setup(1 λ ) for all id ∈ I do c ← Register(1 λ , id) U[id] ← c, PU[id] ← Pub(c) for all id ∈ D do CU[id] ← U[id] A OvoteLR (pk, CU, PU) d ← A Otally BB 0 ,BB 1 () output d. OvoteLR(id, v 0 , v 1 ) for id ∈ H (p 0 , b 0 ) ← Vote(pk, id, U[id], v 0 ) (p 1 , b 1 ) ← Vote(pk, id, U[id], v 1 ) if Valid(id, (p β , b β ), BB β , pk) = ⊥ then return ⊥ else BB 0 ← BB 0 (p 0 , b 0 ); BB 1 ← BB 1 (p 1 , b 1 ) return (p β , b β ).
Otally BB 0 ,BB 1 () for β = 0 (r, Π) ← Tally(BB 0 , sk) return (r, Π) means that when interacting with the election, all honest voters' ballots might as well contain fake votes, and the adversary would not notice: thus no information on the votes is leaked.

Otally BB 0 ,BB 1 () for β = 1 (r, Π) ← Tally(BB 0 , sk) Π ← SimProof(BB 1 , r) return (r, Π )
There is however an issue: in many protocols, the Tally algorithm does not only publish the result, but also associated data, e.g. zero-knowledge proofs intended to guarantee that the result correctly corresponds to the tally of the bulletin board. As explained above, the adversary always gets to see the result of tallying the real ballots. Hence, showing him a correct tallying proof would always let him distinguish between the two scenarios. Indeed, when he sees fake ballots, the result he sees does not match the tally of the bulletin board he observes, which would become apparent if the adversary had access to the real proofs of correct tallying. To solve this problem, the authors in [START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF] require that the challenger in the hb-BPRIV game is able to simulate these proofs. That is, there must exist an algorithm SimProof(BB, r) that intuitively returns a simulated proof that r is the correct result for BB. This algorithm is used to produce a fake proof to show the adversary when he sees the fake ballots. Note that the SimProof algorithm is not explicitly assumed to produce a convincing fake proof, but if it does not then the hb-BPRIV property will most likely be unsatisfiable. Also note that the SimProof algorithm only has access to public data that the adversary sees, and not to e.g. the election private key: this ensures it cannot leak such confidential data to the adversary. Typically, the challenger can implement such a simulator for zero-knowledge proofs by manipulating the random oracle, when considering the random oracle model. We abstract from such details here, and will simply require the existence of the SimProof algorithm, regardless of how it is implemented.

Formally, the hb-BPRIV property is defined as follows.

Definition 46 (hb-BPRIV [START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF]). Let V be a voting scheme. Consider the game Exp hb-BPRIV,β A,V defined in Figure 6.1. V satisfies hb-BPRIV if for any polynomial adversary A,

|P(Exp hb-BPRIV,0 A,V (λ) = 1) -P(Exp hb-BPRIV,1 A,V (λ) = 1)| is negligible in λ.
In [START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF], the authors introduce two additional properties of voting systems, that are required alongside hb-BPRIV to actually guarantee vote privacy.

Strong consistency.

The first one is strong consistency. This property can be seen as a stronger version of the consistency assumption we made in the previous chapter. It intuitively states that the result computed by the Tally algorithm on some board BB is always equal to the counting function applied to the votes contained in the ballots in BB. This should hold even if BB has been produced by the adversary, as long as he only proposes ballots that satisfy some validity sub-condition ValidInd, that is a consequence of the actual validity check Valid. Informally, strong consistency ensures that the Tally algorithm itself only computes the counting function, and cannot accept some commands from the adversary encoded in dishonest ballots, that would trigger it e.g. to leak unwanted information or consider a bulletin board invalid. Formally, strong consistency is defined as follows.

Definition 47 (Strong consistency [START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF]). A voting scheme V is strongly consistent if there exist algorithms extract and ValidInd such that: • For any adversary A that only returns boards BB such that ValidInd(p, b) = for each (p, b) ∈ BB, the advantage P(Exp SC A,V (λ) = 1) is negligible, where Exp SC A,V is defined as the following game:

•
Exp SC A,V (λ) (pk, sk) ← Setup(1 λ ) for all id ∈ I do U[id] ← Register(id) BB ← A(pk, U) (r, Π) ← Tally(BB, sk) if r = ρ(extract(sk, U, p 1 , b 1 ), . . . , extract(sk, U, p n , b n )) where BB = [(p 1 , b 1 ), . . . , (p n , b n )]
then return 1 else return 0

Strong correctness. The second companion property to hb-BPRIV introduced in [START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF] is strong correctness. This property basically ensures that no matter what ballot the adversary manages to cast to the ballot box, honestly generated ballots can always be accepted afterwards.

Definition 48 (Strong correctness [26]). A voting scheme satisfies strong correctness if for any adversary A the advantage P[Exp SCor

A,V (λ) = 1] is negligible, where Exp SCor A,V is defined by

Exp SCor A,V (λ) (pk, sk) ← Setup(1 λ ) for all id ∈ I do U[id] ← Register(id) (BB, id, v) ← A(pk, U) (p, b) ← Vote(pk, id, U[id], v) if Valid(id, (p, b), BB, pk) =
then return 1 else return 0

Ideal functionality. The authors of [START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF] show that if a voting scheme is hb-BPRIV, strongly consistent and strongly correct, then it satisfies a simulation-based notion of vote privacy. Informally, assuming an honest ballot box, the scheme then securely implements an ideal functionality, that describes a system where honest voters secretly send their votes to the functionality. In this ideal system, the adversary can only add his own dishonest votes and see the result as computed by the counting function, but he has no way of learning the honest voters' votes.

We will formally define such simulation-based properties in the following sections, as we prove that our mb-BPRIV notion implies stronger variants of this property.

Missing assumption. While designing our definition, it came to our attention that the authors of [START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF] missed an assumption that is necessary for their proof that hb-BPRIV implies simulationbased security. This property is a correct authentication notion, that requires that the protocol correctly ensures that voters are authenticated when they cast their votes. We capture this by requiring that the Valid algorithm that is run before adding a ballot to the ballot box ensures that the identity used to cast the ballot is the same as the one that can be extracted from it, as defined below.

Definition 49 (Correct authentication). A voting scheme has the correct authentication property if P[Exp auth

A,V (λ) = 1] is negligible for any adversary A, where

Exp auth A,V (λ) = (pk, sk) ← Setup(λ) (BB, id, (p, b)) ← A Oreg,Ocorr (pk) (id , v) ← extract(p, b, sk, U) If Valid(id, b, BB, U, pk) ∧ id = id then return 1 else return 0.
Indeed, in a scheme that does not guarantee this property, the adversary might be able to cast ballots in the name of honest voters. This would intuitively let him break the verifiability property, and, following the same ideas as in the previous chapters, the privacy property. Consider for instance a scheme where voters send ballots formed of their encrypted vote together with their identity in clear, but the server does not ensure that the ballot contains the correct identity. Assume a "last vote counts" revote policy is applied, based on the identities in ballots. For instance, in an election with two honest voters Alice and Bob, the tally of BB = [(Alice, 0), (Bob, 1), (Alice, 1)] would be {|1, 1| }, as only the last vote of Alice is counted. Note that, as there is no correct authentication, the second ballot (Alice, 1) could very well have been cast by the adversary. Such a scheme should therefore intuitively not be deemed private. Indeed, if the adversary wishes to learn Bob's vote, he could simply cast the ballot (Alice, 1) (in the name of a dishonest voter he controls), and replace Alice's real vote with 1, as shown above. The result then immediately lets him know that Bob voted 1.

However, this very simple attack is not caught by the original hb-BPRIV. Indeed, an adversary trying to perform it would e.g. call OvoteLR(Alice, 0, 1) and OvoteLR(Bob, 1, 0), to make honest voters Alice and Bob vote. The adversary would then cast the ballot intended to replace Alice's: Ocast(Charlie, (Alice, 1)) (where Charlie is a dishonest voter). As before, since no authentication check is performed, this ballot is accepted. The board that is tallied, both on the left and on the right (i.e. when β = 0 and β = 1) is then [(Alice, 0), (Bob, 1), (Alice, 1)], and the associated result is thus {|1, 1| } on both sides. This does not let the adversary distinguish between both sides. This attack can only be captured by requiring that the protocol has the correct authentication property, which is clearly not the case here.

We proved that this additional assumption indeed fixes the problem, i.e. that it is sufficient (along with strong consistency and correctness) to ensure that hb-BPRIV implies simulation-based security. A corresponding technical report is currently being written. We will not detail this any more here, as it is not relevant to the case we consider, of a dishonest ballot box. Indeed, the correct authentication property only makes sense if the ballot box is trusted: we cannot require that an untrusted ballot box still properly authenticates voters. Hence, as we will see in the next sections, we do not make this assumption when studying our mb-BPRIV notion.

The next subsection presents how we adapt our model of voting systems to the case of a dishonest ballot box.

Model

We consider the same computational model for voting protocols as in the previous chapter, except for a few extensions. Following the insight on the links between privacy and verifiability from the previous chapters, we will incorporate the verification mechanisms of the protocols in our privacy definition. Indeed, as we pointed out previously, when considering a dishonest ballot box, not modelling these mechanisms defeats any hope of proving a voting scheme private: if no verification at all is performed, the adversary could simply remove all ballots but one from the ballot box, and the result would let him learn the content of that one ballot. From now on, we thus extend our model with a Verify algorithm modelling the verification steps voters should perform. To do that, the voter may need some knowledge they obtained when creating the ballot (e.g. the ballot itself, a verification code, . . . ). Thus the Vote algorithm now returns a state modelling this knowledge. We will however not assume that all voters actually perform the verifications: such an assumption would be unrealistic in general. Instead, in our model, an arbitrary, fixed subset H check of the honest voters will perform them, while the others H check will not.

In addition, since we will consider an untrusted ballot box, we have no guarantee that any validity condition will be checked on ballots before them being added to the bulletin board. Thus, there is no longer a point to consider a Valid(id, b, BB, pk) algorithm that, as before, determines whether id can validly cast a ballot b in BB. Instead, we will from now on simply assume a ValidBoard(BB, pk) algorithm, that is applied to the whole bulletin board BB before tallying, to check that the board is valid. Potentially, this algorithm could correspond to successively applying Valid to each ballot in BB, but we do not require this, and just leave ValidBoard abstract. Definition 50 (Voting scheme). A voting scheme is a collection of seven algorithms: V = (Setup, Register, Pub, Vote, ValidBoard, Tally, Verify).

• Setup(1 λ ) computes a pair of election keys (pk, sk) given a security parameter λ.

• Register(1 λ , id) generates a private credential c for voter id and stores the correspondence (id, c) in a list U, used for modelling purposes.

• Pub(c) returns the public credential associated with a credential c. • ValidBoard(BB, pk) checks that the board BB is valid.

• Tally(BB, sk) uses the board BB and the secret election key sk to compute the result of the election, and potentially proofs of good tallying.

• Verify(id, state, BB) represents the checks a voter id, with local state state, should perform on a board BB to ensure her vote is counted.

With this new, extended model for voting protocols, we can now formalise our privacy notion.

Game-based Security against a Dishonest Ballot Box: mb-BPRIV

In this section we detail two security notions for voting schemes. Ballot privacy ensures that ballots do not reveal information about the underlying votes. Strong consistency guarantees that the result calculated by the tally does not reveal any additional information beyond what is revealed by the counting function which the scheme should implement. We start with the latter.

Strong consistency

As briefly explained in the previous section, strong consistency demands that the tallying process behaves as expected, i.e. it returns the result of tallying the votes which underly the ballots on any given board, even a dishonestly produced one. In particular, strong consistency excludes insecure tally functions that would e.g. remove the first ballot if it corresponds to a vote for candidate A, hence breaking privacy of the first voter. We slightly adapt the notion introduced by Bernhard et al [START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF], and presented in Section 6.2. As before, the property considers an adversary who is given the public key for the election, as well as public information for a set I of registered users. The adversary returns an arbitrary bulletin board. The definition uses an efficient algorithm which from any given ballot can extract a vote and an identity. Strong consistency requires that tallying the board returns the same result as running the desired counting function on the votes underlying the ballots on the board. However, since in our model we no longer consider that validity checks are performed on ballots before they are cast, the strong consistency property no longer imposes any conditions regarding the validity algorithm. The next definition formalises these ideas.

Definition 51 (Strong consistency).

A voting scheme V is strongly consistent if there exist two algorithms extract id , extract v such that: • For any adversary A, the advantage P(Exp SC A,V (λ) = 1) is negligible, where Exp SC A,V is defined as the following game: We also write extract(sk, U, BB) the list obtained by removing all ⊥ elements from extract(sk, U, BB). Note that, by definition of a counting function (Definition 45), we have ρ(extract(sk, U, BB)) = ρ(extract(sk, U, BB)).

•
Exp SC A,V (λ) (pk, sk) ← Setup(1 λ ) for all id ∈ I do U[id] ← Register(id) BB ← A(pk, U) (r, Π) ← Tally(BB, sk) if r = ρ(extract(sk, U, p 1 , b 1 ), . . . , extract(sk, U, p n , b n )) where BB = [(p 1 , b 1 ), . . . , (p n , b n )]

mb-BPRIV

We start with a high level discussion of the notion which we introduce in this section, discuss its salient features over hb-BPRIV, and then provide a formal definition.

We consider a game which pits an adversary A against a voting scheme. Just as in hb-BPRIV, the adversary has partial information about honest users' votes: for each such user he selects a left-or-right challenge consisting of two votes v 0 and v 1 . The game computes the ballots corresponding to the votes but returns to the adversary the ballot which corresponds to v β , for some hidden bit β which the adversary needs to determine. The game keeps track of both BB 0 and BB 1 (the ordered list of ballots calculated in response to the adversary's queries) -the adversary sees, essentially, BB β .

The adversary then creates a public bulletin board BB, by using the honest votes and arbitrary other votes it creates (potentially, using the voting credentials of the set of corrupt voters). This models the adversary being in control of the ballot box, and is a crucial difference with hb-BPRIV: A can now manipulate the contents of the ballot box in any way he wants, by submitting any sequence of ballots he can construct, rather than only being allowed to add his own ballots to it.

Following the insights from our result on privacy and verifiability from the previous chapters, we now model the verification steps of the protocol. Before we get to the tallying phase, voters in H check will perform these steps, which are intuitively intended to check that their votes are indeed represented in the board BB provided by the adversary. If some of these verifications fail, the election is called off and no tally is computed. This will turns out to be most important: since the adversary now controls the ballot box, he could potentially manipulate its content, e.g. removing ballots. These verifications mean that if he wants to see the result, he has to be careful not to upset the voters in H check . As we will see later on, this intuitively introduces a distinction between the privacy level that voters who check and do not check get. Of course, H check can be set to the empty set if we do not want to consider any verification steps. Provided all voters in H check are satisfied with BB, the game then proceeds to the tallying phase.

The key aspect of the definition is how the game computes the tally it returns to the adversary. When the adversary is in the "real" world where he sees BB 0 the game simply tallies BB (as in hb-BPRIV). The case of the "fake" world where he sees BB 1 is much more complex. In hb-BPRIV, the intuition was that he should still see the tally from the "real" board. However, there is no longer a real and a fake board (as was the case in hb-BPRIV): the only board we have is the one produced by the adversary.

Therefore, our key idea is that we need to determine how the adversary manipulated the votes on BB 1 to produce the board he returned to be tallied. That is, we need to somehow (efficiently) determine which of the honest ballots have been cast, on which position on the bulletin board, and which ones have been removed. Once this transformation is determined, the game applies it to BB 0 , tallies the resulting board and returns the result to the adversary. We explain a bit later how an insecure scheme would allow a distinguishing attack in the game we outlined above.

Technically, we represent the transformation which describes how the adversary constructs BB from BB 1 as a selection function, and we formalise the process of recovering this transformation as a recovery algorithm.

Definition 52 (Selection function). For m, n ≥ 1, a selection function for m, n is any mapping

π : 1, n -→ 1, m ∪ ({0, 1} * × {0, 1} * )
Intuitively, π represents the process used by an adversary to construct a bulletin board BB of n ballots from a given board BB 1 of m ballots. For i ∈ 1, n , π(i) indicates how to construct BB[i]:

• π(i) = j ∈ 1, m means this element is the jth from BB 1 ; • π(i) = (p, b) means that this element is (p, b).
A bit more formally:

Definition 53 (Applying a selection function to a board). Consider a selection function π for m, n ≥ 1. The function π associated to π maps an extended board BB 0 of length m to a board π(BB 0 ) of length n such that for any j ∈ 1, n ,

π(BB 0 )[j] = (p, b) if π(j) = i and BB 0 [i] = (id, (p, b)) (p, b) if π(j) = (p, b) .
The "recovery" algorithm which recovers the selection function used by the adversary takes as input two boards and some additional data d (intuitively, this piece of data contains the link between voter identities and public credentials).

Definition 54 (Recovery algorithm). We call recovery algorithm any algorithm Recover that, given a board BB, an extended board BB 1 , and some additional data d as input, returns a selection function for |BB 1 |, n for some n.

We discuss the role of Recover and how it can be interpreted after we provide our formal definition for mb-BPRIV.

The following definition formalises ballot privacy of some scheme V in a setting where the adversary A controls the ballot box. Recall that we consider some fixed set of voter identities I partitioned between two sets H and D of honest and dishonest voters. We also assume that some fixed subset H check of H of users perform whatever checks the scheme expects to be executed before the tally is performed. The execution described in Figure 6.2 starts with the generation of a public key for the election and its associated secret key (to be used for tallying). Next, a number of voters from an arbitrary set I are registered. As before, we keep this aspect of the execution fairly abstract: we assume the registration algorithm/protocol is executed for each user id ∈ I and we only record the secret credential c and its associated public credential Pub(c). We use respectively arrays U and PU to record these. We also use array CU to record the secret credentials for some (arbitrary) set of dishonest users D.

The adversary gets as input the public data pk, PU, and the corrupt credentials CU. It also gets access to a left-right voting oracle. On input an identity id and two potential votes v 0 and v 1 , the oracle computes two ballots for id, one for each adversarially selected vote. It records the first ballot in list BB 0 and the second in list BB 1 . Recall that we model a voting algorithm which is stateful. This is a necessary feature if one wants, as we do, to consider voters who perform additional actions after they have voted (e.g. checking that their ballot has been cast). For each user, we store the resulting state (for both worlds) in arrays V 0 and V 1 , respectively. This phase corresponds to the voting phase where the users submit their ballots. Then, the adversary prepares a bulletin board BB which it would like to be tallied. If the bulletin board does not pass the validity test then the tallying does not occur and the adversary needs to output his guess at this point.

Otherwise, the adversary gets control over the users who check via the oracle Overify, to which it submits arbitrary identities. The oracle records the set of users who have checked in variable Checked and the set of users for which the check was successful in variable Happy.

To force the adversary to trigger verifications for all of the voters who should check, the game halts without letting A output his guess if Checked does not contain H check .

If all of the voters who should check do check successfully, then the adversary gets to see the tally of the election. Otherwise, i.e. if some voters are not satisfied with their verifications, the election is called off, i.e. the adversary must produce his guess without seeing the tally.

Finally, a crucial aspect of our definition is how the experiment calculates the tally. In the real execution (i.e. β = 0) the tally is simply executed on BB. In the fake execution (i.e. β = 1) the tally first employs the Recover algorithm which parametrises the game to determine how the adversary has tampered with the votes it has seen (i.e. BB 1 ) to produce the board it asks to be tallied. We explain later precisely how the choice of the Recover algorithm influences the security level guaranteed by this definition. Then the game applies the transformation obtained this way to BB 0 . The resulting board is tallied and the result, together with a simulated proof (as in hb-BPRIV), is returned to the adversary.

Exp mb-BPRIV,Recover,β A,V (λ) V 0 , V 1 , Checked, Happy ← ∅ (pk, sk) ← Setup(1 λ ) for all id ∈ I do c ← Register(1 λ , id) U[id] ← c, PU[id] ← Pub(c) for all id ∈ D do CU[id] ← U[id] BB ← A OvoteLR (pk, CU, PU) if H check ⊆ V 0 , V 1 then return ⊥; if ValidBoard(BB, pk) = ⊥ then d ← A(); output d A Overify BB () if H check ⊆ Checked then return ⊥ if H check ⊆ Happy then d ← A(); if H check ⊆ Happy then d ← A Otally BB,BB 0 ,BB 1 () output d. OvoteLR(id, v 0 , v 1 ) if id / ∈ H then return ⊥ (p 0 , b 0 , state 0 ) ← Vote(pk, id, U[id], v 0 ) (p 1 , b 1 , state 1 ) ← Vote(pk, id, U[id], v 1 ) V 0 [id] ← state 0 , V 1 [id] ← state 1 BB 0 ← BB 0 (id, (p 0 , b 0 )) BB 1 ← BB 1 (id, (p 1 , b 1 )) return (p β , b β ). Overify BB (id) for id ∈ H check Checked ← Checked ∪ {id} if Verify(id, V β [id], BB) = then Happy ← Happy ∪ {id}
Otally BB,BB 0 ,BB 1 () for β = 0 (r, Π) ← Tally(BB, sk)

return (r, Π)
Otally BB,BB 0 ,BB 1 () for β = 1

π ← Recover U (BB 1 , BB) BB ← π(BB 0 ) (r, Π) ← Tally(BB , sk) Π ← SimProof(BB, r)
return (r, Π )

A,V (λ) = 1) -P(Exp mb-BPRIV,Recover,1 A,V (λ) = 1)| is negligible in λ.
Our definition is parametrised by a recovery algorithm, which is a rather non-standard feature. We explain the role it plays through an example. One way to think about the recovery algorithm is that it aims to detect the actions which the adversary took when tampering with the board. That is, informally, Recover tries to understand how each ballot on the bulletin board to be tallied has been created, i.e. was it submitted by an honest user, was it created by the adversary, was it submitted by an honest user but modified by the adversary, etc. We will now describe the role of the recovery algorithm, but let us first emphasise that its presence does not restrict the adversary's abilities. The adversary may still perform any (polynomial-time) computation to obtain the bulletin board he submits to the game. Depending on the recovery algorithm we choose, and on the scheme we consider, it may or may not be possible for the adversary to have behaviours against this scheme that the recovery algorithm cannot detect.

Our main idea is that, as explained in introduction on the Helios example, depending on the context (trust assumptions, usage scenario,. . . ) we may wish to consider that some of the possible behaviours of the adversary -some ways in which he manages, against the studied scheme, to tamper with the votes, e.g. remove votes, modify them, and so on -should not constitute an attack. We use the recovery algorithm to finely specify which such behaviours are considered an attack against mb-BPRIV, and which are not. More precisely, as we explain later on, for a given recovery algorithm, any behaviour that is correctly detected by it will not be considered an attack against mb-BPRIV, while any behaviour that is not will constitute an attack.

The following example sheds some light on how Recover plays this role. We show how an adversary can win mb-BPRIV when interacting with a voting scheme that fails to prevent him from tampering with the board in a way undetected by Recover.

Assume a voting scheme that is flawed, in the sense that it fails to prevent the adversary from copying the vote underlying a ballot. To win mb-BPRIV against that scheme, the adversary can proceed as follows. First, he submits (id, 1, 0) to the voting oracle. The game calculates b 0 and b 1 and returns b β to the adversary (for legibility, we omit the public credentials here). The adversary returns for tallying a board containing b β , b β , where the adversary turned b β into an equivalent ballot b β , which contains the same vote as b β . In the left world, the tally returns 2. What happens in the right world depends on which recovery algorithm we consider. If we pick a recovery algorithm that does not detect that b β is a duplicate of b β , then it interprets b β as a fresh adversarial ballot. The board which will be tallied is then b 0 , b 1 , so the result would be 1. The result would differ from the left world, and the adversary would win the game. Our flawed scheme would thus be declared insecure for this recovery algorithm: as expected, the behaviour not detected by Recover is considered an attack. Conversely, if we instead pick a recovery that detects that b 1 is a copy of b 1 , then the board submitted to tally would be b 0 , b 0 , where b 0 is obtained from b 0 using the same action the adversary used on b 1 , so the result would also be 2, and it would not help the adversary to distinguish. The scheme, although flawed, would then be declared mb-BPRIV for this recovery algorithm, which detects the copying action. That is, the adversarial behaviour made possible by the flaw would not be considered an attack against mb-BPRIV with that recovery algorithm. Intuitively, such a variant of mb-BPRIV corresponds to studying privacy when we already know that copying attacks are feasible, but are considered tolerable. In that case we wish to know whether other attacks exist.

We see here that the Recover we choose determines which adversarial behaviours, if they are possible against the scheme considered, constitute an attack against mb-BPRIV. In other words, Recover determines the security level provided by mb-BPRIV. Our example of a scheme that fails to prevent ballots from being copied would be declared insecure for a Recover that does not detect copied ballots, as this Recover is unable to detect what the adversary did. However it would be secure for a Recover that does detect copies. The second Recover detects more possible actions from the adversary, and hence allows the adversary to do more against the scheme without breaking mb-BPRIV. Therefore, this variant of recovery algorithm yields weaker security guarantees. More generally, only transformations which Recover can detect will be "acceptable" behaviours from the adversary against the scheme, i.e. will not be considered attacks. An adversary that manages, against the considered scheme, to perform some actions that Recover does not detect will break mb-BPRIV, as in the example. Thus, proving a given voting scheme mb-BPRIV for a Recover that detects less behaviours from the attacker gives stronger security guarantees: it means that the scheme prevents any behaviour not detected by Recover, otherwise mb-BPRIV would be violated.

Finally, coming back to our examples, it is instructive to consider the case where the scheme itself correctly detects and discards such ballot copies (to offer better privacy). Then, even if we pick the first recovery algorithm, the one that does not detect that b β is a duplicate of b β , the scheme would satisfy mb-BPRIV. Indeed, as the scheme itself detects and prevents the adversary from copying ballots, that behaviour will not be possible against the scheme, and cannot be used to break mb-BPRIV, even if Recover does not detect this behaviour. Just as intuition should say, such a scheme would be mb-BPRIV with a recovery algorithm that detects less, which ensures a stronger level of security.

In the case of the Helios protocol, the scheme does not prevent an adversary from modifying the votes of voters who do not verify. As explained in introduction, depending on the usage scenario, this may or may not be an issue. Hence we may want it to be considered an attack or not, depending on the context. In a context where this should constitute an attack, we would study the scheme with a recovery algorithm that is unable to detect ballots that have been modified, and simply discards such ballots. If however we want to specifically exclude this behaviour as an attack, we would pick a recovery algorithm that detects this modification, and applies it on the real board. In the first case, a scheme such as Helios would be considered insecure. In contrast, in the second case it could be secure, provided it prevents any adversarial behaviours other than the one we specifically allowed -e.g. it still must prevent the adversary from changing the votes of voters who do verify. We present examples of such recovery algorithms in the next subsection.

Instantiations of mb-BPRIV

In this section we describe three instantiations of mb-BPRIV with a few relevant recovery algorithms, that will later on be used for the schemes of our case study. Recall that the recovery algorithm aims to determine how the adversary tampered with the board. For clarity, in our examples we indicate in the indices of the recovery algorithms the actions which we expect each recovery algorithm to be able to detect. For example, Recover del,reorder would be expected to detect, for each vote in turn, if the adversary has blocked it from appearing in the final tally, or if it has changed the order in which it was cast. We detail this recovery algorithm and discuss how it works. We then provide two variations: one which detects adds an additional class of adversarial behaviours (and thus makes the associated mb-BPRIV variant weaker) and one which restricts the power of the recovery algorithm, detecting fewer adversarial behaviours (and thus makes the associated variant stronger).

Recovery that detects del + reorder

We start with a recovery algorithm that detects adversarial behaviours where the adversary changes the order of the votes in the ballot box, and removes the votes of the voters who do not run the verification algorithm. However this recovery algorithm does not accept the adversary replacing these votes with other votes of his own choosing. In other words, analysing a scheme with mb-BPRIV using this recovery algorithm means that we consider that even if the scheme does not prevent the adversary from reordering and removing votes, this does not constitute not an attack. However, the scheme not preventing the adversary from changing votes will be.

Below, we informally describe the transformation the recovery algorithm recovers (as it is applied to the board in the right world).

Given BB 1 and BB, when applied to BB 0 , Recover del,reorder will construct a board BB where

• Each ballot in BB that comes from BB 1 is replaced with the ballot at the same position in BB 0 .

Recover del,reorder U (BB 1 , BB) • The other ballots in BB are considered to be cast, provided they do not belong to a honest voter, i.e. if they do not extract to a honest identity. They are added to BB as is.

L ← []; for (p, b) ∈ BB do if ∃j, id. BB 1 [j] = (id, (p, b)) then L ← L j (in case several such j exist, pick the first one) else if extract id (U, p) / ∈ H then L ← L (p, b) L ← [i|BB 1 [i] = (id, (p, b)) ∧ id ∈ H check ∧ (p, b) / ∈ BB] L ← L L return (λi. L [i])
• In addition, all ballots in BB 0 created by honest voters who check their votes are added to BB , regardless of whether these voters' ballots actually occur in BB.

The details of the Recover del,reorder algorithm are in Figure 6.3.

Recovery that detects del + change + reorder

Here we describe a recovery algorithm that accepts adversarial behaviours where the adversary changes the order of the votes in the ballot box, or removes or changes the votes of the voters who do not verify. The associated variant of mb-BPRIV hence considers that the adversary managing to reorder, remove, or change these votes against the scheme does not constitute an attack. Intuitively, given BB 1 and BB, when applied to BB 0 , algorithm Recover del,reorder,change will construct a board BB where • Each ballot in BB that comes from BB 1 is replaced with the corresponding ballot from BB 0 .

• The other ballots in BB are considered to be cast, even if they belong to an honest voter.

They are added to BB as is.

• All the ballots registered for voters who check in BB 0 are added to BB , regardless of whether these voters' ballots actually occur in BB.

Formally, Recover del,reorder,change is defined in Figure 6.4.

Ideal recovery algorithm

We finally describe a recovery algorithm that, so to speak, does not accept any adversarial behaviour. That is, it will always discard any modification (removing, blocking, reordering. . . ) performed by the adversary on any honest vote, rather than detecting it and applying it to the left board. Studying a voting scheme with this recovery intuitively means that we wish to consider the scheme insecure as soon as it fails to prevent the adversary from tampering in any way with the honest votes -even of voters who do not verify. Of course, such a strong notion of security will typically be impossible to achieve unless we consider a scenario where every honest voter verifies. Intuitively, given BB 1 and BB, when applied to BB 0 , Recover ∅ will construct a board BB where

Recover del,reorder,change U (BB 1 , BB) L ← []; for (p, b) ∈ BB do if ∃j, id. BB 1 [j] = (id, (p, b)) then L ← L j (if several such j exist, pick the first one) else if extract id (U, p) / ∈ H check then L ← L (p, b) L ← [i|BB 1 [i] = (id, (p, b)) ∧ id ∈ H check ∧ (p, b) / ∈ BB] L ← L L return (λi. L [i])
• Each ballot in BB 0 is added to BB , in the same order, regardless of whether the corresponding ballot from BB 1 actually occurs in BB.

• The other ballots in BB that belong to a dishonest voter are considered to be cast, and are added to BB as is.

Formally, the Recover ∅ algorithm is displayed in Figure 6.5. We have stated several times by now that the class of transformations a recovery algorithm can detect relates to the level of security provided by the protocol. To express formally this notion of "level of security", we introduce in the next section a family of simulation-based notions of privacy, which specify precisely what power an adversary has against a voting system.

Recover ∅ U (BB 1 , BB) L ← [1, . . . , |BB 1 |]; for (p, b) ∈ BB do if extract id (U, p) / ∈ H then L ← L (p, b) return (λi. L[i])

Simulation-based Security

In this section we introduce simulation based definitions for the security of voting systems. As usual, we describe a real and an ideal execution scenario for the protocol. The definitions are fairly standard in terms of the underlying communication models, and to a large extent in terms of the ideal functionalities we consider. A major departure from functionalities used in the literature, e.g. [START_REF] Groth | Evaluating security of oting schemes in the universal composability framework[END_REF][START_REF] Bernhard | A comprehensive analysis of game-based ballot privacy definitions[END_REF], is that our ideal functionalities explicitly allow the adversary to influence the list of votes to be tallied, so that they can be implemented by voting schemes where such behaviours are known to be possible, especially when the ballot box is untrusted.

Real execution

We describe the real execution of the protocol in a hybrid model where the protocol is implemented using ideal functionalities for registration and for tallying. As for our game based approach, some parameters are fixed. These include the sets H and D of honest and corrupt voters and the set H check of voters who check. All these parameters are assumed hardwired in the algorithms defining the execution. We illustrate in Figure 6.6 the execution setting. It comprises:

• The environment E is in charge of deciding on the execution phases of the protocol (setup, vote, tally); the environment also decides on the votes of the honest users.

• The adversary A: it receives the ballots of the honest users, controls the corrupt users and produces the bulletin board to be tallied. The adversary is controlled by the environment via a direct communication channel.

• An entity H models the honest parties in the system. In particular it models the honest voters (for simplicity we do not consider separate entities for each individual voter in the system) and the generation of keys for the election.

• The functionality for registration R, in charge of generating and distributing credentials to voters.

• The functionality for tallying T .

The execution consists of three phases (a setup phase, a voting phase, and a tallying phase). The environment E sends commands to H to trigger these phases. H then informs the other entities of the phase change.

Setup phase. During the setup phase, H runs the Setup algorithm to generate the election keys (pk, sk), sends pk to the other entities, and sk to T . H also asks R to generate credentials. R runs the Register algorithm to generate credentials for each voter. It returns the secret credentials of all voters to H, who forwards the secret credentials of voters in D to A. It also sends the list of public credentials (computed with Pub) to all other entities (not represented in Figure 6.6). Once this is done, H returns the control to E.

Voting and checking phase. During the voting phase, E may send any number of vote(id, v) to H, for honest voters id ∈ H. When receiving such a command, H runs the Vote algorithm to obtain a ballot for id containing v, it records the state returned by the voting algorithm and sends id and the ballot to A. Voters in H check are supposed to perform some verifications later on, which only makes sense if they have cast a vote. Hence, we only consider environments E that sends at least one vote(id, v) command for each id ∈ H check . At some point, E notifies H that the voting phase is done. At that point, H asks A to provide a board BB. H checks that ValidBoard(BB, pk) = , and continues the execution. If the check fails, it informs E that no result will be published. H then performs the verifications of honest voters. It asks A in which order the voters should verify. H then runs the Verify algorithm on BB for each voter in H check , in the order specified by A. If all of these checks succeed, it continues the execution. Otherwise, it informs E that no result will be published.

Ideal voting functionality and ideal execution

The ideal execution replaces the honest participants and the functionalities for registration and tallying with a single idealised functionality F v . The resulting structure of the system is illustrated in Figure 6.7. It comprises

• The environment E: as in the real execution the environment decides changes between the different phases of the execution, decides on the votes of the honest parties, and communicates with the ideal world adversary. As in the real case, we will only consider environments that choose to make each voter in H check vote at least once.

• The ideal world adversary S, also called the simulator;

• The ideal voting functionality F v : this component captures the idealised voting scheme. Very roughly, it receives the votes from the honest parties and, when queried, it returns the result of the election. We give a precise description of the voting functionality in the next section. As in the real execution the environment decides when to switch between the three phases of the execution (setup, vote and check, tally) and decides on the votes of the honest parties via messages it sends to H . In this world H is simply a forwarding channel between the environment and the ideal functionality (we explain below how the functionality operates). At some point the environment outputs a bit β which is also the output of idealexec(E||S||F v ).

Next we describe the ideal functionality which is the key component of the execution, and which encapsulates the level of security guaranteed.

Ideal voting functionality. We consider several ideal functionalities which share the same basic design idea: they collect the votes of the honest parties (in a way which hides them from the adversary). Nonetheless, since we treat the setting where the adversary controls the bulletin board, and can therefore influence what is being tallied, our functionalities reflect this ability. The difference between the functionalities we consider is reflected in how permissive they are with respect to this step.

The functionality F del,reorder v (ρ) is displayed in Figure 6.8. In brief, 1. it ensures that an adversary only learns who voted, and learns the result of the election, computed using ρ, but not what the votes were; 2. it ensures that the votes of honest voters who verify are not removed (though they may be reordered); 3. it allows an adversary to delete the votes of voters who do not verify, but not to change them.

Technically, the functionality maintains a list L of votes submitted by honest voters. Once the voting phase is over, it allows the ideal world adversary S to submit a vote tampering function, i.e. a function that describes how S wishes to manipulate the votes in L, and needs to satisfy a couple of restrictions. Formally: Definition 56 (Vote tampering function). A vote tampering function is a function f with domain 1, n for some n, such that for any i, f (i) is either an index j, or a pair (id, v) of an identity and a vote.

Similarly to selection functions introduced in the previous chapter, f is intended to describe how S wishes to construct a list of n = |dom(f )| votes using the votes in L. Basically, f (i) describes how to obtain the ith element in this list: if f (i) = j, it should be the jth element from L, and otherwise f (i) = (id, v) and it should be (id, v).

Definition 57 (Applying a tampering function). Applying a vote tampering function f (with domain 1, n ) to the list L of honest votes results in list f (L) of length n defined by

∀i ∈ 1, n . f (L)[i] = L[j] if f (i) = j is an index (id, v) if f (i) = (id, v) for some id, v
Note that, in F del,reorder v (ρ), the function f is applied only if it satisfies the requirements outlined above on how it affects the votes corresponding to the honest voters who check. That is, as specified in Figure 6.8, all votes of voters who check must be kept (although not necessarily in order), and no honest votes can be modified (but they can be simply removed). Otherwise, f is rejected, i.e. no result is computed and the functionality returns no tally instead.

Next, we define F del,reorder,change v (ρ), a more permissive functionality for voting schemes. This functionality is similar to the previous F del,reorder v (ρ) but it allows an adversary to change (and not only delete) the votes of honest voters, as long as they do not verify. Technically, F del,reorder,change v (ρ) accepts the same commands as F del,reorder v (ρ), and answers them identically, except for the modif(f ) command. In that case, in F del,reorder,change v (ρ), the checks performed before computing the result are:

• f keeps the votes of all voters who check (as before):

∀i. ∀id ∈ H check . ∀v. L[i] = (id, v) =⇒ ∃j. f (j) = i.
• no votes from voters who verify are modified by f :

∀i, id, v. f (i) = (id, v) =⇒ id ∈ D ∪ H check .
Note that the simulator is thus allowed by F del,reorder,change v (ρ) to modify the vote of any honest voter who does not verify.

Finally we define a functionality F ∅ v (ρ), that gives the strongest security guarantees, as it does not allow the adversary to delete, change, nor reorder the votes of honest voters, even if they do not verify. All the adversary may do is cast votes in the name of dishonest voters. This functionality is similar to the previous two, except it checks a stronger condition before computing the result. More precisely, F ∅ v (ρ) is identical to F del,reorder v (ρ), except that the test performed before computing ρ(f (L)) on command modif(f ) is that: F del,reorder v (ρ) accepts the following commands:

• on setup from H : send setup to S.

• on voting from H : send voting to S.

• on voting done from H : send voting done to S.

• on vote(id, v) (for id ∈ H) from H : L ← L (id, v); send ack(id) to S.

• on tally from H : send modif? to S.

• on modif(f ) from S: (only once, after tally) -if f keeps the votes of all voters who check:

∀i. ∀id ∈ H check . ∀v. L[i] = (id, v) =⇒ ∃j. f (j) = i.
and if no honest votes are modified by f :

∀i, id, v. f (i) = (id, v) =⇒ id ∈ D.
Then let r = ρ(f (L)) else let r = no tally.

Send result(r) to S.

• on res-ok from S: (only once, after modif) send r to H .

• on res-block from S: (only once, after modif) send no tally to H . • f keeps the votes of all honest voters in the same order:

[f (j), j = 1 . . . |dom(f )| | f (j) ∈ N] = [1, . . . , |L|]
• and no honest votes are modified by f :

∀i, id, v. f (i) = (id, v) =⇒ id ∈ D.
This functionality enforces that no honest votes can be deleted or even reordered. Intuitively, in the presence of a malicious ballot box, this level of security can be guaranteed only if we assume all honest voters verify their votes.

Simulation

As is usual for simulation-based notions, we define security by demanding that environments cannot distinguish between the interaction with the real protocol, or with the ideal functionality (together with some simulator). However, as the motivating examples from the introduction show, the level of security guaranteed depends on the fact that (some) voters (i.e. those in H check ) check that their vote had been cast. Our security definition captures this by considering certain restrictions. Specifically, as mentioned earlier, we will only consider environments who direct all voters in H check to cast at least one vote, so that it makes sense for this vote to be verified. We call such an environment well-behaved.

Definition 58 (Secure implementation). We say that a voting scheme V securely implements an ideal functionality F v if for any adversary A there exists a simulator S such that for any wellbehaved environment E the distributions of the outputs of realexec(E||A||V) and idealexec(E||S||F v ) are computationally indistinguishable. That is, no probabilistic polynomial-time algorithm should be able to distinguish between these two outputs.

mb-BPRIV implies Simulation-based security

Our main technical result, detailed in this section, is that for strongly consistent voting schemes, game-based ballot privacy implies simulation security with respect to a suitable ideal functionality. Both our game-based security notion and the ideal functionalities are parametrised. The former is parametrised by a recovery algorithm which aims to "detect" how the adversary has tampered with the bulletin board. The latter allows the adversary to submit a tampering function, but only allows certain tampering functions. We show that the two parameters are closely related: mb-BPRIV with respect to some specific recovery algorithm implies simulation-based security, if the tampering function recovered by the recovery algorithm is permitted by the ideal functionality.

Warm-up

To make this relatively complex statement more palatable, we start by writing it in a particular case: we state a warm-up theorem, which establishes this type of relation between the three instantiations of mb-BPRIV from Section 6.3.3 and simulation based security which uses the three ideal functionalities from Section 6.4.2, respectively. Then, we provide a powerful, general theorem which links mb-BPRIV with simulation based security under an abstract assumption on their parameters.

Before we provide our warm-up theorem, we motivate and introduce a mild assumption required by the scheme. All of the recover algorithms considered earlier in this chapter identify the ballots on the board by matching them with the specific calls to the voting oracle which produced them. For this reason, a precondition for the recovery algorithms to work as intended is that distinct calls to the Vote algorithm produce two different ballots (except with negligible probability). We say that a scheme with this property does not produce duplicate ballots. Formally: Definition 59 (Voting scheme without duplicate ballots). A voting scheme V does not produce duplicate ballots if for all adversary A, the following probability is negligible in λ.

P[ (pk, sk) ← Setup(1 λ ); U ← Register(1 λ , I); (id, v, id , v ) ← A(pk, U); (p, b, s) ← Vote(pk, id, U[id], v); (p , b , s ) ← Vote(pk, id , U[id ], v ); (p, b) = (p , b )] P ∅ (L, f ) = iff:
• f keeps the votes of all honest voters in the same order:

[f (j), j = 1 . . . |dom(f )| | f (j) ∈ N] = [1, . . . , |L|]
• and no honest votes are modified by f :

∀i, id, v. f (i) = (id, v) =⇒ id ∈ D.
P del,reorder (L, f ) = iff:

• f keeps the votes of all voters who check:

∀i. ∀id ∈ H check . ∀v.

L[i] = (id, v) =⇒ ∃j. f (j) = i.
• and no honest votes are modified by f :

∀i, id, v. f (i) = (id, v) =⇒ id ∈ D.
P del,reorder,change (L, f ) = iff:

• f keeps the votes of all voters who check:

∀i. ∀id ∈ H check . ∀v. L[i] = (id, v) =⇒ ∃j. f (j) = i.
• and no votes from voters who check are modified by f : Note that this assumption is only required by the specific Recover algorithms described earlier, but is not necessary in general.

∀i, id, v. f (i) = (id, v) =⇒ id ∈ D ∪ H check .
We can now state the following warm-up theorem.

Theorem 10. Consider a strongly consistent voting scheme V for counting function ρ which does not produce duplicate ballots. Let power ∈ {∅, (del, reorder), (del, reorder, change)}. If V satisfies mb-BPRIV with Recover power , then V securely implements F power v (ρ). This theorem will be proved later on, as a particular case of our general theorem, that we explain next.

Parametric ideal functionality.

The three ideal voting functionalities from Theorem 10, F ∅ v (ρ), F del,reorder v (ρ), and F del,reorder,change v (ρ), differ only by the check they perform on the tampering function provided by the simulator. They can be seen as instances of a more general functionality, which is parametrised by a predicate P that expresses this check. In other words, P characterises the ability of the simulator to manipulate the votes. The predicate P takes as inputs a list L of pairs (id, v), where id is a voter identity and v is a vote, and a tampering function f . It returns or ⊥, indicating whether the modifications specified by f are allowed on L or not. For instance, in the case of F del,reorder v (ρ), the predicate P del,reorder (f, L) checks that f keeps from L the votes of all voters who check, and that it does not modify the votes of any honest voters. If f does not satisfy these two conditions, P del,reorder (f, L) = ⊥.

The generalisation is then straightforward: we consider the functionality F P v (ρ) with the same interface and mostly the same internal behaviour as F del,reorder v (ρ) (Figure 6.8). The only distinction is that the checks performed on f before applying it to L are replaced with a single check that P (L, f ) = .

The three functionalities from Section 6.4 are then instances of the parametric functionality F P v (ρ), with the predicates P ∅ , P del,reorder and P del,reorder,change displayed in Figure 6.9.

Our generic theorem links mb-BPRIV w.r.t. some recovery algorithm Recover with an ideal functionality which allows tampering satisfying some predicate P whenever the Recover algorithm returns 15 (with overwhelming probability) only tampering functions which satisfy P . Below, we develop the technical machinery that captures these ideas.

First we relate selection functions (which are the type of functions returned by recovery algorithms) with tampering functions (the functions the simulators provide to the ideal functionalities). This definition can be seen as the analogous definition of applying a selection function to a bulletin board, except that now we operate at vote level (rather than ballot level). In particular, this requires that we recover the votes underlying ballots in the selection function.

Definition 60 (Tampering function associated to a selection function). Assume a strongly consistent voting scheme V. Let (pk, sk) be a pair of keys generated by the Setup algorithm, and U be a list of credentials issued by Register. Let π be a selection function for two integers m, n. Let then L be the list of length n defined by

∀i ∈ 1, n . L[i] = π(i) if π(i) ∈ 1, m extract(sk, U, p, b) if π(i) = (p, b) for some p, b
The vote tampering function mod sk,U (π) associated to π for sk and U is the function λi. L [i] (with L denoting L where ⊥ elements have been removed).

As explained above we want to relate mb-BPRIV with some Recover algorithm with an ideal functionalities which put restrictions on how the adversary (the simulator) can tamper with the list of votes collected by the functionality. Which restrictions we can consider depends on the Recover algorithm we choose. As explained previously, the intuition is that if a scheme is mb-BPRIV for a recovery algorithm, then this necessarily entails that the scheme prevents the adversary from performing actions that are not detected by that Recover. Hence, mb-BPRIV will guarantee simulation security w.r.t. any ideal functionality that allows such actions to the simulator.

We capture this intuition by the notion of compatibility, which we first express on individual selection functions (in practice, produced by Recover). Basically, such a function is compatible with the testing predicate associated to the functionality if the associated vote tampering function is allowed by this predicate.

Definition 61 (Selection function compatible with a testing predicate). Let (pk, sk) be a pair of keys generated by the Setup algorithm, and U be a list of credentials issued by Register. Let P be a predicate, and π be a selection function for m, n. Let L id be a list of ids of length m. We say that π is compatible with P w.r.t. sk, U, and L id if for any list L of pairs of the form

(id, v) such that [id | (id, v) ∈ L] = L id , we have P (L, mod sk,U (π)) = .
This notion of compatibility can then be extended from individual selection functions to recovery algorithms which return selection functions. As explained in the paragraph above, the general intuition we want to capture is that Recover is compatible with P if Recover (almost) always returns selection functions compatible with P in normal executions of the scheme (i.e. where parameters and ballots are generated honestly).

Definition 62 (Recovery algorithm compatible with a testing predicate). Let P be a predicate, and Recover be a recovery algorithm. We say that Recover is compatible with P if for any adversary A, the advantage P(Exp comp,P,Recover A,V (λ) = 1) is negligible, where Exp comp,P,Recover A,V is defined as the following game.

Exp comp,P,Recover A,V (λ) (pk, sk) ← Setup(1 λ ) for all id ∈ I do c ← Register(1 λ , id) U[id] ← c, PU[id] ← Pub(c) for all id ∈ D do CU[id] ← U[id] BB ← A Ovote (pk, CU, PU) Ovote(id, v) for id ∈ H (p, b, s) ← Vote(pk, id, U[id], v) BB 0 ← BB 0 (id, (p, b)); L id ← L id id; return (p, b). if ValidBoard(BB, pk) = ⊥ ∨ H check ⊆ L id then return 0 π ← Recover U (BB 0 , BB) if π is not compatible with P w.r.t. sk, U, L id then return 1 else return 0
For example, we will show later on that the algorithms Recover ∅ , Recover del,reorder , and Recover del,reorder,change presented earlier are respectively compatible with P ∅ , P del,reorder , P del,reorder,change .

Using the notion of compatibility to relate recovery algorithms and ideal functionality (via their testing predicates), we can now state and prove our general theorem.

General theorem

Our main technical result regarding mb-BPRIV establishes a relation between game-based and simulation-based security for voting, under a minimal compatibility between the parameters of the respective definitions.

Theorem 11 (mb-BPRIV implies simulation). Let P be a predicate, and Recover a recovery algorithm compatible with P . Let V be a strongly consistent voting scheme for counting function ρ.

If V satisfies mb-BPRIV w.r.t. Recover, then V securely implements F P v (ρ).

Before we get to the proof of this result, it is interesting to note that, since we considered arbitrary fixed sets of voters (honest, corrupt, who verify their votes), it means that mb-BPRIV with any such sets of voters entails simulation-based security with the same sets of voters. In particular, for an adversary against the scheme that controls n dishonest voters, the secure implementation property guarantees the existence of a simulator (i.e. ideal adversary) that only needs to control the same number n of dishonest voters. This would not be possible if we had considered a dynamic corruption scenario: the theorem would then only have established the existence of a simulator, that could possibly choose to corrupt more voters than the real adversary does. An interesting question is to study e.g. how the proportion of voters who verify among honest voters influences the security of the scheme. Since we relate the real and ideal systems with the same numbers of honest voters, corrupt voters, and voters who verify their vote, it is meaningful to perform this study directly on the ideal system, which we do in a later section.

Proof. Let us first explain the intuition of this result, before detailing its proof. We prove this theorem by constructing a simulator S that, given black-box access to a real adversary A, ensures that for any well-behaved environment E, the outputs of realexec(E||A||V) and idealexec(E||S||F P v (ρ)) are indistinguishable. The idea is to have S run A internally, letting A communicate with E through S, and simulate the real execution of the voting scheme to A. To do this, S generates election keys and credentials on its own, and shows them to A. S then needs to provide A with ballots when E makes voters vote, to obtain a board BB from A. Finally S must determine which vote tampering function it should submit to F P v (ρ) to get the tally of BB that A expects to see. The issue is that S does not have access to the actual votes of the voters: F P v (ρ) only informs S of who voted, but not of the values of the votes. Hence S cannot construct ballots containing the real votes to show to A. Instead, S will construct fake ballots, containing always the same arbitrary fixed fake vote v * .

After the voting phase is over the adversary returns a bulletin board BB and demands to see the result of the tally. At this point, S uses the Recover algorithm on the board BB (and its own list of ballots) to determine how A manipulated the ballots. The recovery algorithm returns a selection function (which encodes how A has tampered with the honest votes). S submits the associated vote tampering function to F P v (ρ). Notice that from the adversary's point of view the simulation is as in the experiment that defines compatibility of Recover and P (Definition 62). So P , and therefore F P v (ρ), will accept the output of Recover. The functionality will return a result to S, who will forward it to the (internally simulated) adversary A, together with a fake proof calculated using the SimProof algorithm on (r, BB).

Intuitively, when adversary A is placed in the real execution (i.e. is in realexec(E||A||V)), its view is as in Exp mb-BPRIV,Recover,0 V : the ballots contain the "real" votes for honest parties, and the tally is the tally of the board it provides. When A is run internally by S when executing idealexec(E||S||F P v (ρ)), the view of the adversary is as in Exp mb-BPRIV,Recover,1 V : the ballots contain "fake" votes, and the tally is a fake tally (with a simulated proof). Strong consistency ensures that the result for which S simulates the proof is exactly the result seen by the adversary in Exp mb-BPRIV,Recover,1 V . Note that strong consistency is a separate assumption from mb-BPRIV: it can be defined independently from mb-BPRIV, but both properties are needed to entail simulation security.

Since security with respect to mb-BPRIV guarantees that the adversary cannot tell the two situations apart, the environment cannot distinguish between realexec(E||A||V) and idealexec(E||A||V). This will conclude the proof: this simulator S can simulate any real adversary A in the eyes of any well-behaved environment.

A bit more formally, we proceed to construct S by a succession of game hops, progressively going from realexec(E||A||V) to the ideal execution against S. Game 0. is just the real execution realexec(E||A||V).

Game 1. is a variant of realexec(E||A||V), where A does not see ballots for the actual votes chosen by E, but rather fake ballots containing an arbitrary fixed vote v * . The execution of Game 1 follows that of Game 0, except that • on vote(id, v) from E for some id ∈ H:

H generates two ballots: a real one for v, and a fake one for v * . That is, if c id is the credential generated for id by R during the setup phase, H runs (p, b, state id ) = Vote(pk, id, c i d, v) • on tally from E: After obtaining the board BB and the order in which to verify from A, when H is performing the verification for a voter id ∈ H check , it runs Verify(id, state id , BB) (instead of Verify(id, state id , BB) in Game 0).

• During the tallying phase: if all verifications have succeeded, H does not send BB to T for tallying, but rather BB = π(BB 0 ), where π = Recover U (BB 1 , BB), and U is the association between identities and secret credentials, that H knows from the setup phase.

• When H gets a result (r, Π) from T in the tallying phase: it simulates a proof Π = SimProof(r, BB), and sends (r, Π ) to A (instead of (r, Π) in Game 0).

We now show that, for any A and E, the outputs of Game 0 and Game 1 are indistinguishable, using the assumption that V is mb-BPRIV. As explained above, the intuition is that Game 0 corresponds to the execution of Exp mb-BPRIV,Recover,β A,V when β = 0, and Game 1 to the execution when β = 1. Since V is mb-BPRIV, we are able to show that the outputs of E in Games 0 and 1 are indistinguishable.

More formally, assume there exists a distinguisher D for the outputs of Game 0 and Game 1. We then construct an adversary B playing the game Exp mb-BPRIV,Recover,β B,V . B runs A and E internally as follows.

• When B is first allowed to run in Exp mb-BPRIV,Recover,β B,V , it receives pk, CU and PU. It sends pk, CU and PU to A, simulating the setup phase. B then returns the control to E.

• When E wishes to send the command vote(id, v) to H, B uses its voting oracle by calling OvoteLR(id, v, v * ). B receives a ballot (p, b), and sends (id, (p, b)) to A.

• Once E sends voting done, B asks A for a board. A responds with some BB, which B returns to the game Exp mb-BPRIV,Recover,β B,V .

• If the Exp mb-BPRIV game finds BB invalid, B is then asked to guess a bit. It sends no tally to E, who will output a bit. B applies the distinguisher D to E's output, and returns the result to Exp mb-BPRIV .

• Otherwise, B is then provided by Exp mb-BPRIV,Recover,β

B,V
with an oracle Overify BB to make voters verify. B obtains from A the order in which verifications should be performed, and calls Overify BB on each voter in H check following this order. If some verifications have failed, here too, B is asked for its guess for the bit β, which it obtains by sending no tally to E, and applying D to E's output.

• Otherwise the game goes on to the tallying phase, and B is provided with the tallying oracle. B calls the tallying oracle, and obtains a result (r, Π). B sends (r, Π) to A, asking if the result should be published. Depending on A's response, B either sends r or no tally to E, and waits for its output.

• During the execution, B forwards between E and A any messages they wish to exchange.

• When E stops, B runs the distinguisher D on the output of E, and answers to the game Exp mb-BPRIV,Recover,β B,V the guess D returns.

It is clear from the definitions of realexec and Exp mb-BPRIV,Recover,β B,V that, if β = 0, B provides the E and A it runs internally with the same view they would have in the corresponding execution of realexec(E||A||V). Similarly, if β = 1, the views of E and A as run by B are the same as their view in Game 1. Hence, the output of E (run by B) is the output of Game 0 or Game 1, depending on β. Thus, whenever D correctly distinguishes Game 0 and Game 1, B correctly guesses β. Therefore, the advantage of a distinguisher between the outputs of Game 0 and Game 1 is at most the advantage of an adversary in Exp mb-BPRIV,Recover,β V , and is thus negligible. Game 2. establishes an invariant on BB . It is as Game 1, but has H store, in addition to BB 0 and BB 1 , the list of votes submitted in clear in BB 2 . Once H has determined π, it additionally computes the associated tampering function f = mod sk,U (π), and applies it to BB 2 to obtain a list BB 2 . It then checks that BB 2 correctly contains the votes in the ballots of BB . Only in that case H lets the execution go through.

More precisely, Game 2 is identical to Game 1, except:

• on vote(id, v) from E for some id ∈ H: in addition to computing ballots for v, v * and sending them to the other parties, H also stores (id, v) into a list BB 2 .

• on obtaining the board BB from A:

H computes f = mod sk,U (π) (recall that π = Recover U (BB 1 , BB)). H then lets BB 2 = f (BB 2 )
. Before sending BB to T for tallying, H checks that BB 2 = extract(sk, U, BB ), and if not, halts the execution.

Game 1 and 2 can only be distinguished when the added check BB 2 = extract(sk, U, BB ) fails. We show by the first point of strong consistency that this has only negligible probability.

We actually show the stronger statement that BB 2 = extract(sk, U, BB ) except with negligible probability, where BB 2 = f (BB 2 ), and f is such that for all i, f (i) = extract(sk, U, π(i)) if π(i) is a ballot, and

f (i) = π(i) otherwise. Note that by construction, f = λi.L [i], where L = [f (i), i ∈ dom(f )|f (i) = ⊥]
is the list obtained by removing all ⊥ elements from f . Hence, BB 2 is obtained from BB 2 by removing all ⊥ elements. Since, by definition, extract(sk, U, BB ) is also obtained from extract(sk, U, BB ) by removing all ⊥ elements, BB 2 = extract(sk, U, BB ) indeed implies BB 2 = extract(sk, U, BB ).

We construct an adversary B that breaks strong consistency with the same probability as the probability that BB 2 = extract(sk, U, BB ) in Game 2.

B runs Game 2 internally, simulating E, A, H, . . . by itself. If BB 2 = extract(sk, U, BB ), B retrieves a ballot (p, b) ∈ BB that makes this test fail. That is, BB [i] = (p, b) for some i, and BB 2 [i] = extract(sk, U, p, b). B then simply returns this ballot.

Intuitively, this ballot cannot be a dishonest one, as BB 2 contains their extraction by construction; it is thus a honestly constructed ballot, whose extraction is not the vote used to construct it. This breaks strong consistency.

Formally, π is Recover U (BB 1 , BB). By definition of Recover, either π(i) = j for some j, or π(i) is a ballot. The second case is actually impossible: indeed, in that case, BB [i] = π(i) by definition of π, and

f (i) = extract(sk, U, p, b) by definition of f . Hence BB 2 [i] = f (i) = extract(sk, U, p, b), This contradicts the assumption that BB 2 [i] = extract(sk, U, p, b).
Hence, π(i) = j for some j. By construction, BB = π(BB 0 ). Thus by definition of π, BB 0 [j] = (id, BB [i]) = (id, (p, b)) for some id. By construction of f , we also have f (i) = j. Then, since BB 2 = f (BB 2 ), we have BB 2 [i] = BB 2 [j] = (id , v) for some id , v. By construction of BB 0 and BB 2 , BB 2 [j] = (id , v) was added to BB 2 by H at the same time (id, (p, b)) was added to BB 0 , which means that id = id , and (p, b) was generated by voter id calling Vote(pk, id, U[id], v). Since extract(sk, U, p, b) = BB 2 [j], we have extract(sk, U, p, b) = (id, v), which breaks strong consistency.

Therefore, the advantage of a distinguisher between the outputs of Game 1 and Game 2 is at most the advantage of an adversary against strong consistency, and is thus negligible. Game 3. then makes use of this invariant: it is as Game 2 except H directly computes the result as r = ρ(BB 2 ), instead of calling T . Since this was the only action performed by T in Game 2, T is actually absent from Game 3.

By the previous invariant, and the second point of the strong consistency property, this yields the correct result except with negligible probability, and the two games are indistinguishable.

Indeed, the invariant introduced in Game 2 ensures that the tally is only computed if BB 2 = extract(sk, U, BB ). The outputs of Game 2 and Game 3 then only differ if r = r, where (r , Π ) = Tally(BB , sk), that is, if r = ρ(extract(sk, U, BB )).

We can construct an adversary B that breaks strong consistency with the same probability as this occurring. B receives the key pk and the credentials U. It internally runs the setup and voting phases of Game 3 using pk and U, running E, A, H by itself. B retrieves the board BB in this execution, and returns it: the condition r = ρ(extract(sk, U, BB )) is exactly the condition under which B wins the strong consistency game.

Hence, the advantage of an adversary distinguishing the outputs of Game 2 and Game 3 is at most the advantage of an adversary against strong consistency, and is thus negligible. Game 4. removes the invariant introduced in Game 2. It is identical to Game 3, except that H does not check that BB 2 = extract(sk, U, BB) before computing the result.

The outputs of Game 3 and Game 4 are indistinguishable thanks to the first point of the strong consistency assumption, which follows from exactly the same reasoning as the hop between Game 1 and Game 2. Game 5. entirely removes the ballots containing the real votes, as these are now no longer used to compute the result. H now only keeps track of BB 1 and BB 2 , but not BB 0 : andsends (id, (p , b )) to A), and not Vote(pk, id, c id , v). As in Game 4, H still updates the lists BB 1 (with (id, (p , b ))) and BB 2 (with (id, v)), but no longer keeps BB 0 .

• on vote(id, v) from E for id ∈ H: H only computes (p , b , state id ) = Vote(pk, id, c id , v * ) (
As these ballots were unused, removing them has no bearing on the execution, and Game 5 is thus indistinguishable from Game 4. To sum up, the execution of Game 5 is as follows.

1. E sends setup to H to start the setup phase. H performs the setup: it generates (pk, sk)

using Setup, and sends pk to the other entities A, R. For each id ∈ I, H then sends register(id) to R.

3. Once all voters have been registered, H sends the list of (id, Pub(c id )) for all id to A. H also sends all dishonest credentials [(id, c id )|id ∈ D] to A, and gives control back to E.

4. E then sends voting to H (and gets control back), starting the voting phase. It may then send any number of messages vote(id, v) to H for any v and id ∈ H.

5. On vote(id, v) from E, H computes a fake ballot (p , b , state id ) = Vote(pk, id, c id , v * ), stores (id, (p , b )) in BB 1 and (id, v) in BB 2 , and sends (id, (p , b )) to A.

6. At some point, E sends voting done to H. H then asks A for a board. A computes some bulletin board BB, and sends it to H.

7. H then checks whether ValidBoard(BB, pk) = . If so, it continues the execution, otherwise it sends no tally to E.

8. H then obtains from A the order in which to verify. For each id ∈ H check , in the specified order, H successively runs Verify(id, state id , BB).

9. Once all verifications have been performed, if any of them failed, H sends no tally to E.

Otherwise, H computes π = Recover U (BB 1 , BB), f = mod sk,U (π), and BB 2 = f (BB 2 ). H then computes r = ρ(BB 2 ) and Π = SimProof(r, BB).

10. H then sends (r, Π ), tally? to A.

11.

A may then answer either res-ok or res-block to H.

12. Following A's request, H then either sends r or no tally to E.

13.

Finally, E outputs a bit β. This bit is the output of Game 5.

Ideal adversary.

We can now finally define the simulator S, that runs A internally as a black-box, taking care by itself of most of the actions that were performed by H and R in Game 5, i.e. the cryptographic setup of keys and credentials, generation of fake ballots, computing of π and f . The only thing S cannot do on its own is store BB 2 and apply f to it, as it does not know the real votes. Instead S sends the tampering function f to F P v (ρ), who accepts it as Recover is allowed by P . F P v (ρ) will then apply f to the list of honest votes, and compute the result, that S will show A together with a simulated proof.

Formally S answers commands as follows:

• On setup from F P v (ρ): S runs Setup to obtain (pk, sk), and Register(id) for each id ∈ I. It stores the generated secret and public credentials (computed with Pub) in tables U, PU. It also stores the credentials of dishonest voters into CU. S internally runs A in this simulated election: it transmits pk, CU and PU to A.

• On voting from F P v (ρ): S gives control back to E.

• On ack(id) from F P v (ρ) during the voting phase: S generates a fake ballot for id: (p , b , state id ) = Vote(pk, id, U[id], v * ). S records state id , transmits (id, (p , b )) to A, and stores (id, (p , b )) in BB 1 .

• On voting done from F P v (ρ): S gives control back to E.

• On modif? from F P v (ρ): S asks A for a board, and obtains BB. S then checks that the board is valid, i.e. ValidBoard(BB, pk) = , and, if so, asks A for the order in which verifications should be performed. S then runs Verify(id, state id , BB) for each id ∈ H check , in the order chosen by A. If the validity check on the board and all voter verifications succeed, S will then compute the tally (next point).

Otherwise, S must prevent the publication of the result. S sends modif(f ∅ ) to F P v (ρ), where f ∅ is the empty tampering function f ∅ : ∅ → ∅. Either the functionality accepts this tampering function, and computes a result, or it refuses it. In either case, S receives result(r) from F P v (ρ) for some r (which may be no tally). S then answers res-block to F P v (ρ). H , and then the environment E, will then receive no tally.

• If all verifications succeeded, S must compute the tally, to simulate it for A. S computes π = Recover U (BB 1 , BB), and f = mod sk,U (π). S then sends modif(f ) to F P v (ρ). Let L id be the list of ids contained in BB 1 . By construction of BB 1 , L id is the list of the identities of all honest voters for whom vote queries were submitted, in the same order. Note that, since E is well-behaved, if this point is reached, E has requested each voter in H check to vote at least once. Hence BB 1 , and L id as well, contain at least one entry for each id ∈ H check .

In addition, by definition of the ideal execution, L id is also the list of all ids occurring in the list L of votes recorded by F P v (ρ). By assumption, Recover is compatible with P . Hence, by definition, since BB is valid, π is compatible with P w.r.t. sk, U, and L id , except with negligible probability. Indeed, an adversary could otherwise win the Exp comp,P,Recover V game by running internally E, A, S, and submitting to the game the board BB. Thus, P (L, f ) = , except with negligible probability, which means F P v (ρ) accepts the modifications submitted by S.

• On result(r) from F P v (ρ), for some result r = no tally: S computes Π = SimProof(r, BB), and sends (r, Π ), tally? to A. A either answers res-ok or res-block. S forwards this message to F P v (ρ).

• In addition, during the whole execution, S forwards between E and A any message they wish to exchange.

It is clear that in the ideal execution with this simulator S, both E and A have the same view as in Game 5, provided π is compatible with P w.r.t. sk, U. As explained above, this condition holds except with negligible probability. Hence, the outputs of Game 5 and idealexec(E||S||F P v (ρ)) are indistinguishable, which concludes the proof. Therefore, the outputs of idealexec(E||S||F P v (ρ)) and realexec(E||A||V) are indistinguishable, which concludes the proof.

We can also state a variant of this theorem, for the case where revote is not allowed.

Theorem 12. Let P be a predicate, and Recover a recovery algorithm compatible with P . Let V be a strongly consistent voting scheme for counting function ρ.

If V satisfies mb-BPRIV w.r.t. Recover with the restriction that the adversary may only call oracle OvoteLR at most once for each id, then V securely implements F P v (ρ), when considering only environments E that make each voter vote at most once.

Proof. The proof of this theorem is exactly the same as for the previous one, except that in the hop between Games 0 and 1 we need to make sure that the adversary B that plays game Exp mb-BPRIV,Recover,β B,V makes at most one call to oracle OvoteLR for each id. By definition of B, a call to OvoteLR(id, v, v * ) is made whenever E sends a query vote(id, v), and only then. By assumption on E, E does not make voters revote, and therefore indeed makes at most one such query for each id.

The warm-up theorem stated earlier (Theorem 10) is a particular case of our main theorem (Theorem 11), applied to the predicates P ∅ , P del,reorder , P del,reorder,change and the associated recovery algorithms Recover ∅ , Recover del,reorder , Recover del,reorder,change .

It directly follows from Theorem 11, provided we show that each of these recovery algorithms is compatible with the corresponding predicate.

Lemma 23 (Compatibility of the example recovery algorithms). Consider a strongly consistent voting scheme V for counting function ρ which does not produce duplicate ballots. For each power ∈ {∅, (del, reorder), (del, reorder, change)}, Recover power is compatible with P power .

Proof. We prove this property, in all three cases, by considering an adversary A, that will play the game Exp comp,P power ,Recover power A,V . Following this game (the three games follow the same structure), let (pk, sk)

← Setup(1 λ ), U ← Register(1 λ , I), CU ← [U[id]|id ∈ D], and PU ← [Pub(U[id])|id ∈ I].
A has access to the Ovote oracle, to generate honest ballots, that get stored in a board BB 1 . For each (id, (p, b)) ∈ BB 1 , by construction, (p, b) was constructed by calling Vote(pk, id, U[id], v) for some v. Let BB be the board returned by A in the game. Note that, by the assumption that Vote creates no duplicate ballots, BB 1 contains no duplicate ballots either, except with negligible probability. If BB is not valid, or BB 1 does not contain at least one entry for each id ∈ H check , A loses the game.

Otherwise, let π 1 = Recover ∅ U (BB 1 , BB), π 2 = Recover del,reorder U (BB 1 , BB), and lastly π 3 = Recover del,reorder,change U (BB 1 , BB). Let us show that π 1 , π 2 , π 3 are compatible respectively with P ∅ , P del,reorder , P del,reorder,change , w.r.t. sk, U, L id , except with negligible probability. Assume BB 1 contains no duplicate ballots, which, as explained, holds with overwhelming probability.

1. We first show that for any L such that [id|(id, v) ∈ L] = L id , P ∅ (L, mod sk,U (π 1 )) = .

Consider the list LL constructed by the following process:

LL ← [1, . . . , |BB 1 |]; for (p, b) ∈ BB do if extract id (U, p) / ∈ H then LL ← LL extract(sk, U, p, b) By definition, mod sk,U (π 1 ) is λi.LL [i],
where LL is the list obtained obtained by removing all ⊥ elements from LL. We have to show that P ∅ (L, mod sk,U (π 1 )) = . That is, that

• No honest votes are modified by mod sk,U (π 1 ):

∀i. ∀(id, v). mod sk,U (π 1 )[i] = (id, v) =⇒ id ∈ D.
Let i, id, v be such that mod sk,U (π 1 )[i] = (id, v). Hence LL[j] = (id, v) for some j. Thus, by construction of LL, id ∈ D.

• mod sk,U (π 1 ) keeps the votes of all honest voters in the same order:

[mod sk,U (π 1 )(j) | mod sk,U (π 1 )(j) ∈ N] = [1, . . . , |L|]
that is, since the non-⊥ elements in LL and LL are in the same order,

[LL[j] | LL[j] ∈ N] = [1, . . . , |L|]
which clearly holds by construction of LL.

We now show that for any

L such that [id|(id, v) ∈ L] = L id , P del,reorder (L, mod sk,U (π 2 )) = .
Consider the lists LL, LL , LL constructed by the following process:

LL ← []; for (p, b) ∈ BB do if ∃j, id. BB 1 [j] = (id, (p, b)) then LL ← LL j (by assumption on BB 1 , this j is unique) else if extract id (U, p) / ∈ H then LL ← LL extract(sk, U, p, b) LL ← [i|BB 1 [i] = (id, (p, b)) ∧ id ∈ H check ∧ (p, b) / ∈ BB] LL ← LL LL By definition, mod sk,U (π 2 ) is λi.LL [i],
where LL is the list obtained obtained by removing all ⊥ elements from LL . We have to show that P del,reorder (L, mod sk,U (π 2 )) = . That is, that

• No honest votes are modified by mod sk,U (π 2 ):

∀i. ∀(id, v). mod sk,U (π 2 )[i] = (id, v) =⇒ id ∈ D.
Let i, id, v be such that mod sk,U (π 2 )[i] = (id, v). Hence LL[j] = (id, v) for some j. Thus, by construction of LL, id ∈ D.

• mod sk,U (π 2 ) keeps the votes of all honest voters who check:

∀i. ∀id ∈ H check . ∀v. L[i] = (id, v) =⇒ ∃j. mod sk,U (π 2 )(j) = i, that is, ∀i. ∀id ∈ H check . ∀(p, b). BB 1 [i] = (id, (p, b)) =⇒ ∃j. LL [j] = i. Let i, p, b, id ∈ H check such that BB 1 [i] = (id, (p, b)). Either (p, b) /
∈ BB, and then by definition of LL , i ∈ LL . Or (p, b) ∈ BB, and by construction i ∈ LL. In any case, i ∈ LL .

3. We finally show that for any L such that [id|(id, v) ∈ L] = L id , P del,reorder,change (L, mod sk,U (π 3 )) = .

Consider the lists LL, LL , LL constructed by the following process:

LL ← []; for (p, b) ∈ BB do if ∃j, id. BB 1 [j] = (id, (p, b)) then LL ← LL j (by assumption on BB 1 , this j is unique) else if extract id (U, p) / ∈ H check then LL ← LL extract(sk, U, p, b) LL ← [i|BB 1 [i] = (id, (p, b)) ∧ id ∈ H check ∧ (p, b) / ∈ BB] LL ← LL LL By definition, mod sk,U (π 3 ) is λi.LL [i],
where LL is the list obtained obtained by removing all ⊥ elements from LL . We have to show that P del,reorder,change (L, mod sk,U (π 3 )) = . That is, that

• No votes from voters who verify are modified by mod sk,U (π 3 ):

∀i. ∀(id, v). mod sk,U (π 3 )[i] = (id, v) =⇒ id ∈ D. Let i, id, v be such that mod sk,U (π 2 )[i] = (id, v). Hence LL[j] = (id, v) for some j. Thus, by construction of LL, id ∈ D ∪ H check .
• mod sk,U (π 3 ) keeps the votes of all honest voters who check:

∀i. ∀id ∈ H check . ∀v. L[i] = (id, v) =⇒ ∃j. mod sk,U (π 3 )(j) = i, that is, ∀i. ∀id ∈ H check . ∀(p, b). BB 1 [i] = (id, (p, b)) =⇒ ∃j. LL [j] = i. Let i, p, b, id ∈ H check such that BB 1 [i] = (id, (p, b)). Either (p, b) /
∈ BB, and then by definition of LL , i ∈ LL . Or (p, b) ∈ BB, and by construction i ∈ LL. In any case, i ∈ LL .

Application to voting schemes

We use the general framework developed in previous sections to study the resilience of three protocols of the literature, namely Helios [START_REF] Cortier | Voting: You Can't Have Privacy without Individual Verifiability[END_REF], Belenios [START_REF] Cortier | Election verifiability for Helios under weaker trust assumptions[END_REF], and Civitas [START_REF] Clarkson | Civitas: Toward a secure voting system[END_REF], in the presence of malicious boards. For each of them, we identify which ideal functionalities they achieve. Interestingly, the guarantees differ depending on the revote policy in place and the counting function ρ.

We consider security with respect to the three functionalities introduced in Section 6.4.2 plus a new functionality we introduce here. F ∅ v is the very ideal functionality where honest votes are registered and processed exactly as they are received, F del v (which is the functionality associated with the predicate P del defined in Figure 6.10) lets the adversary remove some honest votes (from voters that do not check), but requires that the votes of voters who check are kept and not reordered, while F del,reorder v further lets the adversary reorder the votes. Finally, F del,reorder,change v even lets the adversary modify honest votes, from voters who do not verify. P del (L, f ) = iff:

• f keeps the votes of all voters who check, in the same order for each voter:

∀id ∈ H check . [i ∈ 1, |L| |∃v. L[i] = (id, v)] = [f (j), j = 1 . . . |dom(f )||∃v. L[f (j)] = (id, v)]
• and no honest votes are modified by f :

∀i, id, v. f (i) = (id, v) =⇒ id ∈ D.

Overview of the protocols

Helios. Helios is the simple voting protocol we already presented and studied in earlier chapters (e.g. Chapter 3). It aims at guaranteeing privacy and verifiability in a low-coercion environment.

It has been used in several elections, e.g. to elect the president of the university of Louvain-la-Neuve [START_REF] Adida | Electing a university president using open-audit voting: Analysis of real-world use of helios[END_REF], or for student elections at Princeton [START_REF] Olivier-Pereira | Real-World Electronic Voting: Design, Analysis and Deployment, chapter Internet Voting with Helios[END_REF].

In Helios, voters cast a vote by computing a ballot Vote(id, pk, c, v) = (s, id, (enc(v, pk), π)), where the state s records the ciphertext (enc(v, pk), π) and id is the identity of the voter (or possibly a pseudonym). If the voter id votes again then the state is updated with the new ciphertext. The ciphertext is simply formed of an ElGamal encryption enc(v, pk) of v under the public key of the election pk, together with π, a zero-knowledge proof that guarantees that v is a valid vote. Helios does not use credentials, hence c is not used. The check Verify(id, s, BB) done by a voter id consists in verifying that the ciphertext recorded in s appears on BB.

The ValidBoard algorithm checks all the zero-knowledge proofs in each ballot in BB. In addition Helios features a weeding process, i.e. the operation of rejecting duplicate ciphertexts, as already described in Chapter 3. We leave this process to the adversary, and encode this by simply having the ValidBoard algorithm reject any board submitted by the adversary that contains duplicate ciphertexts. In cases where we want to consider an election where revote is not allowed, the ValidBoard algorithm will also reject any board with several ballots for the same voter identity.

Finally, the tally can either be mixnet-based or homomorphic. In the mixnet case, it performs a random permutation of the ballots, decrypts all of them and returns the multiset of the votes they contain. In the homomorphic mode, the tally homomorphically computes the sum of the ciphertexts in the ballots in BB, decrypts the resulting ciphertext and returns the result. Moreover, the tally returns a proof of correct decryption. [START_REF] Cortier | Election verifiability for Helios under weaker trust assumptions[END_REF] enhances Helios with credentials, so that a compromised voting server cannot add votes. It has been launched in 2016 and used in more than 200 elections [START_REF] Cortier | Belenios: a simple private and verifiable electronic voting system[END_REF]. At registration, each voter id receives a signing key k id , with an associated verification key pk id . The voting procedure Vote(id, pk, (k id , pk id ), v) produces the state and ballot (s, pk id , (signElGamal(v, pk, k id ), π)), where signElGamal(v, pk, k id ) denotes the ElGamal encryption of v, signed with k id . The other algorithms are modified as expected.

Belenios. Belenios

To ease the verification step made by voters, in Helios and Belenios, only the last ballot for each voter is presented in the bulletin board. This can be modelled by a Verify(id, s, BB) algorithm that checks that the last ballot recorded in s is the last ballot appearing in BB for voter id.

Formally, we model the scheme as the following algorithms.

• Register(id) generates a pair (k id , pk id ) of a secret signing key k id and the associated verification key pk id .

• Pub(k id , pk id ) = pk id is simply the public verification key.

• Vote(id, pk, (k id , pk id ), v) = (s, pk id , (signElGamal(v, pk, k id ), π)). The state s records the ballot. The public credential/pseudonym is the public key pk id . π is a zero-knowledge proof that v is a valid vote.

• ValidBoard(BB, pk) checks for each (p, b) in BB the zero-knowledge proof in b, and ensures that p is a valid verification key, and that b is indeed signed with the associated signing key.

When modelling a situation where revote is forbidden, it would finally check that BB does not contain several ballots (p, b), (p, b ) that use the same public key, i.e. such that p = p .

• Tally can either run the ballots through a mixnet, decrypt them, and publish the decrypted votes; or homomorphically compute the sum of all ballots, before decrypting and publishing the result.

• Verify(id, s, BB) checks whether the last ballot recorded in s, i.e. the last ballot generated by id, is the last ballot that appears next to the public key of id in BB, or, equivalently when the board is valid, the last ballot signed with id's key in BB.

Civitas. Civitas [START_REF] Clarkson | Civitas: Toward a secure voting system[END_REF] has been designed to protect voters against coercion. Each voter privately receives a credential, and can produce a fake credential when she is under coercion. Ballots cast with invalid credentials are removed thanks to plaintext equality tests (PET), after some mixing phase, to avoid a coercer noticing that his ballots have been excluded.

• Register(id) generates a private credential c id

• Pub(c) = enc(c, pk) encrypts the credential c

• Vote(id, pk, c, v) = (s, enc(c, pk), (enc(v, pk), π 1 , π 2 )). The state s records the ballot. The public credential/pseudonym is enc(c, pk). π 1 is a zero-knowledge proof that v is a valid vote, and π 2 is a zero-knowledge proof that the agent generating the ballot knows both c and v. In Civitas, the voting server can no longer select the "last" ballot for each voter since ballots cannot be properly linked to an identity. So when revote is allowed, a voter who revotes should additionally link her new ballot to the previous one (e.g. adding a copy of the previous ballot, or its hash), and prove (with zero-knowledge proofs) that she knows the credential and the choices used in both ballots.

• ValidBoard(BB, pk) checks for each (p, b) in BB the zero-knowledge proofs in b, and ensures that p is a valid public credential, using Pub(U) and a PET. In case we model a situation where revote is not allowed, it additionally checks, also with a PET, that BB does not already contain several ballots (p, b), (p , b ) where p and p encrypt the same credential.

• Tally only keeps the parts of the ballots containing the encrypted votes. These are then run through a mixnet, decrypted, and published.

• Verify(id, s, BB) checks whether the ballot recorded in s, i.e. the last ballot generated by id, appears on BB.

Voting scheme

F ∅ v F del v F del,reorder v F del,reorder,change v General case H check = H Helios -without revote if ρ stable ∧ id-blind if ρ id-blind Helios -revote Belenios -without revote if ρ stable Belenios -revote if ρ stable ∧ ρ = last if ρ = last if ρ = last if ρ = last Civitas -without revote if ρ stable Civitas -revote if ρ stable Figure 6
.11: Case study.

Our findings

The results of our study are gathered in Figure 6.11. For each protocol, we distinguish the case where revote is allowed from the case where it is not. When revote is not allowed then we assume that (honest) voters do not revote. As we will discuss in this section, this is not equivalent, security-wise, to the case where voters may revote but only the first vote is counted.

(in)security of Helios. As mentioned already in introduction, Helios is subject to an attack [START_REF] Roenne | [END_REF] if the attacker controls the bulletin board (or simply the communication channel between the voter and the server). Indeed, an attacker may block and copy the first ballot b A sent by Alice, say for candidate 0. The attacker can then pretend that the communication was lost, so that Alice starts over the procedure and sends again a ballot, b A , still for candidate 0 (there is no reason that she changes her mind). Then since ballots are not cryptographically authenticated in Helios, the attacker may submit b A as his own ballot, introducing a bias in the result. This attack cannot be prevented, even if the auditors check for duplicates before the tally. Therefore Helios with revote does not satisfy any of the four functionalities. Assume now that there is no revote. Since in Helios the identity of a voter is not strongly linked to the ciphertext containing her vote, an adversary is able to swap two voters' ciphertexts, e.g. replacing

[(A, b A ), (B, b B )] with [(A, b B ), (B, b A )]
. This is fine as long as the counting function processes the votes independently of the actual identity of a voter, so that attributing Alice's vote to Bob and vice versa does not change the result. We call this property id-blindness. Most voting functions enjoy this property but not all of them. For example, for elections with weighted votes, which can be done homomorphically [START_REF] Adida | Electing a university president using open-audit voting: Analysis of real-world use of helios[END_REF], each vote is associated to a weight depending on the status of the voter. For example, it could be the case that Alice's vote is counted 10 times while Bob's vote is counted only 3 times. For id-blind counting functions, then Helios satisfies F del,reorder,change v , the weakest functionality, since an attacker may reorder votes and remove and even modify the ballots of voters that do not check.

No revote vs ρ = f irst. Interestingly, the Helios example illustrates why it is not possible to properly emulate the "no revote" policy by letting voters revote and considering a function ρ where only the first ballot is counted for each voter. In fact, if voters may revote then the adversary has more power. In particular, Helios with revote is still subject to Roenne's attack, even if only the first ballot is counted.

No reordering in Civitas. Our findings highlight that Civitas is the only scheme that prevents an adversary from reordering the votes, thanks to the link made by voters between their ballots. Note that if the attacker controls the board, then he can always permute Alice and Bob's ballots without anyone noticing. However, this does not influence the result for all the result functions ρ we know, namely stable functions, that is counting functions where reordering the votes does not influence the result (provided that the for each voter id, the order of all the votes of id is preserved). Formally, we say that ρ is stable if ρ(L 1 ) = ρ(L 2 ) for any two lists L 1 and L 2 such that, for any voter id, if (id, v 1 ), . . . , (id, v n ) is the sequence of votes from voter id in L 1 , then (id, v 1 ), . . . , (id, v n ) is also the sequence of votes from voter id in L 2 (in the same order). We believe that all existing result functions are stable, since intuitively whether Alice voted before Bob or after Bob should not influence the result.

So now the question is: which schemes can prevent an adversary from reordering the votes of a given voter? This would be a priori a real attack since it does change the result. Our results show that only Civitas protects again such a re-ordering, thanks to the chain between ballots cast by the same voter. Belenios provides weaker security guarantees since the adversary may reorder the votes. However, this does not affect the result as long as only the last ballot is counted, since Alice checks that her last ballot appears in the final board. To render Belenios suitable for arbitrary (stable) counting functions, we would need to require that each voter records her ballots in order, and checks that they appear in the same order in the final board. This would of course not be realistic. Alternatively, the most reasonable approach is probably to chain ballots thanks to an additional zero-knowledge proof, like in Civitas. Note however that this chain is only briefly sketched in [START_REF] Clarkson | Civitas: Toward a secure voting system[END_REF] for Civitas, and no proper definition is provided.

"Perfect" functionality F ∅ v .
As one might expect, none of the three schemes satisfy in general the strongest ideal functionality, where the attacker cannot tamper at all with honest votes. This is due to the fact that an adversary can always drop the ballots of voters that do not check. This limitation applies to many other schemes as well. If we assume now that all honest voters actually vote and conduct all required checks, the three schemes (except Helios with revote) satisfy F ∅ v . This requirement is however not realistic in practice.

Proofs.

To establish security with respect to ideal functionalities in Figure 6.11 we leverage the framework we have developed in this chapter in two distinct ways. On the one hand, for each scheme in turn we prove game based security with respect to appropriately chosen recovery algorithms and then employ Theorem 11 (or Theorem 12 when revote is forbidden) to conclude simulation-based security. Depending on the protocol considered, we define additional recovery algorithm, that are associated to the same ideal functionality (i.e. compatible with the same predicate), but are better suited to the protocol studied. Examples of such algorithms, as well as the proofs for all examples in our case study, can be found in appendix B. Interestingly, we also employ reasoning about ideal functionalities directly. Specifically, we show that

F del v ∧ ρ stable ∧ H = H check ⇒ F ∅ v )
and the desired results in the column H = H check (under the F ∅ v heading) follow from those in column with heading F del v . The formal statement and the proof of this result are provided in appendix B.1.

Comparing privacy

We also take this opportunity to compare our mb-BPRIV notion with different existing notions of privacy, with and without an honest ballot box, on the three protocols listed above, as well as the Neuchâtel protocol [START_REF] Galindo | Neuchâtel's cast-as-intended verification mechanism[END_REF]. We first briefly introduce that protocol, and then describe the different notions of privacy we compare.

The Neuchâtel protocol

In that protocol, used in Switzerland, voters privately receive a code sheet, where each candidate is associated to a (short) code. To cast a vote, voters send their encrypted votes to the ballot box, similarly to Helios. The ballot box then provides a return code allowing the voter to check that the ballot has been received and that it encrypts their candidate, as intended. This offers a protection against a dishonest voting client (e.g. if the voter's computer is corrupted). No revote is allowed. Since the bulletin board is not published, voters cannot check that their ballots really belong to the final board (used for tally). Voters have to trust the entity generating the return code on this aspect. The model for voting systems we consider here cannot accurately describe voters having to receive a return code from some authority. Hence our mb-BPRIV definition cannot be applied as-is to that voting scheme, which is why we did not include it in the case study above.

Different notions of privacy

We compare mb-BPRIV to privacy against a honest board (as formalised by Benaloh's definition or hb-BPRIV), as well as the naïve adaptation of Benaloh's definition to a dishonest board we described earlier, which we denote PrivDis-Naive. In that naïve definition, the adversary A may propose two possible affectations of votes for honest voters through an oracle OvoteLR, and then propose any board BB. Provided the votes submitted to the oracle yield the same tally on both sides, A obtains the tally of BB. He is then asked to guess which of the two affectations was used.

To our knowledge, the only other definition of privacy with a dishonest ballot box is the privacy notion introduced by Bernhard and Smyth [START_REF] Bernhard | Ballot secrecy with malicious bulletin boards[END_REF], which we discuss below.

Bernhard and Smyth's definition

As we discussed in introduction of this chapter, that definition is similar in spirit to Benaloh's definition (presented in Chapter 5). We recall it in Figure 6.12 (PrivacyBS). It takes the form of a game where the adversary A may propose two possible affectations of votes, i.e. has access to an oracle O bs vote (id, v 0 , v 1 ), that returns to A a ballot for either v 0 or v 1 , depending on a secret bit β. The adversary is asked to produce a ballot box BB, and, as in Benaloh's definition -but contrary to mb-BPRIV -the tally is always computed on BB (i.e. on both sides). To avoid trivial attacks, following the same idea as Benaloh's definition, the tally is only performed provided that, looking at honest ballots that appear in BB, counting the corresponding left and right votes yields the same result.

The main interest of [START_REF] Bernhard | Ballot secrecy with malicious bulletin boards[END_REF] is to highlight the fact that previous definitions implicitly assume an honest ballot box. That attempt at defining privacy w.r.t. a dishonest ballot box (PrivacyBS) however has several limitations. First, it strongly assumes that the ballots that appear in the ballot box are exactly the same than the cast ballots. This is not the case for example of the ThreeBallots protocol [START_REF] Rivest | Three Voting Protocols: ThreeBallot, VAV and Twin[END_REF] where the ballot box only contains two shares (out of three) of the original ballot. It is not applicable either to a protocol like BeleniosRF [START_REF] Chaidos | BeleniosRF: A non-interactive receipt-free electronic voting scheme[END_REF] where ballots are re-randomised before their publication. Second, it requires ballots to be non-malleable [START_REF] Bernhard | Ballot secrecy with malicious bulletin boards[END_REF]. This means that, as soon as a ballot includes a malleable part (for example the voter's id like in Helios, or a timestamp), privacy cannot be satisfied. This severely restricts the class of protocols that can be considered. Third, PrivacyBS does not account for a revote policy. As soon as revote is allowed (for example in Helios), then PrivacyBS is broken since some ballots may not be counted. Indeed, an attacker may call O bs vote (id 1 , 1, 0), followed by O bs vote (id 1 , 0, 1), obtaining ballots b 1 , b 1 , and return the board BB = [b 1 , b 1 ]. The equality condition on the number of ballots in BB produced by O bs vote holds, since for v = 0, 1:

|{b ∈ BB|∃v . (b, v, v ) ∈ L}| = |{b ∈ BB|∃v . (b, v , v) ∈ L}| = 1 Exp BS,β A (λ) (pk, sk) ← Setup(1 λ ) U, D ← [] A Oreg,Ocorr (pk) L ← [] A O bs vote (pk) if ∀v. |{b|b ∈ BB ∧ ∃v . (b, v, v ) ∈ L}| = |{b|b ∈ BB ∧ ∃v . (b, v , v) ∈ L}| if ρ(I 0 ) = ρ(I 1 ) then r ← Tally(BB, sk, U) β ← A(r) return β O bs vote (id, v 0 , v 1 ) if (id, * ) ∈ U ∧ id / ∈ D then b ← Vote(pk, id, U[id], v β ) L ← L (b, v 0 , v 1 ) return b O reg (id) if (id, * ) ∈ U then stop else c ← Register(1 λ , id) U[id] ← c return Pub(U[id])
O corr (id) Hence the tally is computed. According to the revote policy, only b 1 is counted, and the result is β, which lets the attacker win Exp BS .

Comparison We summarise our findings in Figure 6.13. All of our four protocols satisfy privacy against an honest ballot box. We rely here on previous results of the literature. Regarding dishonest boards, we first consider the naïve extension of Benaloh's definition to a dishonest board (PrivDis-Naive), described above. As explained earlier, it is immediately violated for any protocol. We also include Bernhard and Smyth's PrivacyBS notion [START_REF] Bernhard | Ballot secrecy with malicious bulletin boards[END_REF], which we also discussed above. Finally, we recall in the last column the strongest ideal functionality our mb-BPRIV notion allowed us to establish for each protocol in our case study.

We do not know whether the Neuchâtel protocol satisfies PrivacyBS -the protocol was never studied with that definition. Moreover that protocol cannot be accurately represented in our model -our definition does not apply to it. As discussed above, PrivacyBS is immediately violated as soon as revote is allowed.

In addition, we indicate in the rightmost column of Figure 6.13 whether, in our opinion, the protocol should be considered secure in the context of a malicious board. This is of course a subjective matter, but we think that Belenios and Civitas do satisfy privacy in that threat model, with or without revote. On the other hand, it is our opinion that Helios does not -when revote is allowed, Helios is subject to Roenne's attack, for which no easy fix is known. Even without revote, an attacker against Helios is able to replace ballots from honest voters who do not verify with any ballot for arbitrary vote. Such a behaviour is prevented by both Belenios and Civitas, and we think that it should be considered an issue when the ballot box is not trusted. Regarding the Neuchâtel protocol, the situation is less clear: it seems to depend on whether we consider that the entity issuing the return codes is a part of ballot box -and thus untrusted -or not.

This comparison first shows that mb-BPRIV is much more precise than the other definitions, allowing to finely describe what security protocols guarantee. For instance, it does not broadly declare Helios (without revote) insecure, but rather allow us to show that, although it does not achieve the strongest guarantees, it still provide some security if we wish to consider that changing votes of voters who do not verify is not an attack. It also seems to indicate that our intuition for a secure scheme more or less corresponds to the ideal functionality F del v , that prevents the adversary from removing, changing, or reordering votes of voters who do verify, and additionally from changing the votes of voters who do not. While this is one of the stronger functionalities we consider, it is still achievable, as shown by our case study, and seems like a reasonable goal in a context where the board is not trusted, and not all voters verify their vote.

mb-BPRIV implies verifiability

We established in Chapter 4 that (under reasonable assumptions) privacy implies individual verifiability, for Benaloh's privacy notion, that considers a honest ballot box. Interestingly, this implication still holds in the case of a malicious ballot box for our new mb-BPRIV notion, although not with the same proof.

Intuitively, the simulation-based notion of security means that a voting scheme implements the parametric ideal functionality F P v (ρ) we defined earlier. While we designed this functionality with privacy in mind, it actually captures stronger guarantees than just privacy. It guarantees that the adversary cannot tamper with the votes in any other way than those authorised by the predicate P . With a well-chosen P , that forbids changing or removing the votes from voters who verify, this functionality thus also provides individual verifiability guarantees. In turn, by our main Theorem 11, mb-BPRIV also entails individual verifiability, provided the recovery algorithm considered is compatible with such a predicate.

Properties and assumptions

To prove this result formally, we first need to define individual verifiability against a malicious ballot box. We adapt the game-based definition from the previous chapter (Section 5.1.2), that modelled the case of an honest ballot box. Basically, as we did earlier for privacy, we modify the game so that the adversary can submit an arbitrary board, rather than only giving him access to the board through oracles. This yields the game Exp mb-verif displayed in Figure 6.14. As before, the after the setup phase, the adversary is given access to all public information, as well as the credentials of corrupt voters, and an oracle to choose the votes of honest voters. When a honest voter id votes for v, a ballot for v is honestly generated using id's credential, and returned to the adversary. The voter's identity and internal state are recorded in V, and in addition, if id ∈ H check , then (id, v) is recorded in Voted. The adversary is asked to provide a board BB. If this board is invalid, or if not all voters supposed to verify have voted, the game halts. Otherwise, the adversary is given access to oracle Overify BB (id), that triggers voter id's Definition 64 (Verification-friendly predicate). A predicate P is verification-friendly if it ensures that the votes of all voters in H check are not removed, reordered, nor modified. That is, if for all L and f such that P (L, f ) = we have

∀id ∈ H check . [i ∈ 1, |L| |∃v. L[i] = (id, v)] = [f (j), j = 1 . . . |dom(f )||∃v. L[f (j)] = (id, v)] and ∀i, id, v. f (i) = (id, v) =⇒ id / ∈ H check .
For instance, the predicates P del and P ∅ defined in earlier sections satisfy this property, while P del,reorder and P del,reorder,change do not, since they allow votes to be reorder. With the additional assumption that voters do not revote, this reordering issue disappear, and P del,reorder and P del,reorder,change would be verification-friendly.

For stable counting functions, the following property confirms that the verification-friendliness correctly formalises the intuition that P enforces verifiability.

Lemma 24. Consider a stable counting function ρ and a verification-friendly predicate P . Let L be a sequence of identities and votes, and f a vote tampering function such that P (L, f ) = . Let L check = [(id, v) ∈ L | id ∈ H check ] be the sublist of L containing only the votes from voters in H check .

Then there exists a sequence V c such that

∀(id, v) ∈ V c . id / ∈ H check and ρ(f (L)) = ρ(L check V c ).
Proof. This property follows immediately from the definition of f (L) and the assumptions on P and ρ. Indeed, the verification-friendliness of P means that f keeps all votes from voters in H check in the same order as in L, and does not modify any vote for these voters. Thus f (L) contains L check as a sublist (possibly interleaved with other votes), and the remaining elements of f (L) are pairs (id, v) such that id / ∈ H check . By stability of ρ, permuting the elements of f (L) so that L check is upfront does not change the result, which proves the claim.

We then lift this property to recovery algorithms as follows:

Definition 65 (Verification-friendly recovery). A Recover algorithm is verification-friendly if there exists a verification-friendly predicate P such that Recover is compatible with P .

Note that the notion of individual verifiability considered here is a rather basic one, which only requires that votes from voters who verify are counted. In particular it does impose any restrictions on the number of dishonest votes that can be added, or on what happens to the votes of voters who do not verify. A stronger notion of individual verifiability could e.g. require that the adversary cannot add more dishonest votes than the number of corrupt voters, to express that the protocol protects against ballot stuffing. This would be done in the game e.g. by bounding the size of the list V c of dishonest votes. A way to further strengthen the property would be to require that the votes of honest voters who do not verify can be removed, but not arbitrarily modified -Belenios provides such guarantees for instance. It would likely be possible to prove that mb-BPRIV implies such stronger notions of verifiability, by considering accordingly a stronger notion of verification-friendliness for predicates.

Results

Armed with these properties, we can now formally state and prove the claim from the beginning of the section.

Theorem 13 (Simulation security implies individual verifiability). Consider a strongly consistent voting scheme V, for a stable counting function ρ, and let P be a verification-friendly predicate.

If V securely implements F P v (ρ), then V is individually verifiable against a dishonest ballot box.

Proof. By contraposition, consider an adversary A that wins the individual verifiability game Exp mb-verif A,V with non-negligible probability. We then construct an adversary B and an environment E for the real execution realexec(E||B||V), such that B cannot be simulated in the eyes of E by a simulator S in the ideal execution idealexec(E||S||F P v (ρ)). Intuitively, E will run A internally, and instruct B how to tamper with the ballot box following A's behaviour. In the end, E will check whether verifiability is broken or not. Since A wins the verifiability game, in the real execution it will be; however no simulator will be able to break it in the ideal world.

B and E's executions is as follows. E runs A internally, and starts by asking H to start the setup phase. During that phase, B receives from H the public parameters of the election (the key pk, and the public credentials of all voters), and the private credentials of corrupt voters. B transmits those to E, who in turn transmits them to A. E then asks H to start the voting phase, and continues to run A. Whenever A calls oracle Ovote(id, v), E sends vote(id, v) to H. B then obtains the corresponding ballots from H, transmits it to E, who returns it to A. During this process, E records the sequence Voted of identities and votes chosen by A for voters in H check . Once A returns some board BB, E transmits it to B, and asks H to end the voting phase. H then retrieves BB from B, checks its validity, and asks B for the verification order. E continues to internally run A, and transmits the order in which it makes Overify queries to B. B returns this order to H, who runs the verifications. If they succeed, H asks T to tally BB, and asks B whether to publish the result. B agrees to publish it, and H sends the result r to E. E runs D(r, Voted), and outputs 0 if r contains Voted (or is ⊥), and 1 if it does not. If at any point in its execution E does not receive the expected messages from B, it returns 0 when asked for a guess. In addition, if A did not make all voters in H check vote (and later verify), E ends its execution, and answers 0 as a guess.

It is clear that the real execution realexec(E||B||V) follows the execution of game Exp mb-verif A,V , and therefore that P(realexec(E||B||V) = 1) = P(Exp mb-verif A,V = 1).

Consider now any simulator S for the ideal execution idealexec(E||S||F P v (ρ)). For E to output 1 in that execution, it needs to receive a result r = ⊥ such that D(r, Voted) = 0. At some point in this execution, S submits a tampering function f to F P v (ρ). If f is rejected by P , E does not get any result, and thus answers 0. The only way for E to guess 1 is that P (L, f ) = , where L is the list of votes recorded by the functionality. F P v (ρ) will then compute r = ρ(f (L)), and S must accept this result so that E receives it from H , otherwise E answers 0. By Lemma 24, we have r = ρ(Voted V c ) for some V c that does not contain identities in H check , since Voted is the sequence of votes submitted by E for voters in H check . Therefore, D(r, Voted) = 1, and E still answers 0.

Hence in the ideal execution, with any possible simulator, E can never answer 1, while it returns 1 with the non-negligible probability P(Exp mb-verif A,V = 1) in the real execution with B. Therefore, B cannot be accurately simulated, and V does not securely implements F P v (ρ), which proves the theorem. This result extends to mb-BPRIV thanks to Theorem 11.

Theorem 14 (mb-BPRIV implies individual verifiability). Consider a strongly consistent voting scheme V, for a stable counting function ρ, and let Recover be a verification-friendly algorithm.

If V is mb-BPRIV w.r.t. Recover, then V is individually verifiable against a dishonest ballot box.

Proof. This directly follows from the previous theorem regarding the ideal functionality. Indeed, by definition, there exists a verification-friendly predicate P with which Recover is compatible. Thus by Theorem 11, V securely implements F P v (ρ), and thus by the previous theorem, V is individually verifiable.

Entropy

In the parametric ideal functionality we defined, the simulator (i.e. the ideal adversary) is allowed to tamper with the votes of honest voters, via a tampering function. As explained before, allowing such tampering even in the ideal world is necessary when considering a malicious ballot box. Indeed, in a real system, the ballot box can typically remove the ballots of voters provided they do not verify their vote. Therefore, if one wants to consider the more complex, but realistic, scenario where not everyone performs the verification steps, the adversary must be given at least some power over the honest votes even in the ideal world.

Designing the ideal functionality in a parametric way as we have done has the advantage of letting us characterise precisely in what way the adversary can tamper with the votes in the scheme we consider, which, again, is mandatory if we want to model a dishonest ballot box. The downside, however, is that even against the ideal system, the adversary is not powerless. That makes it somewhat difficult to understand to what extent exactly a given instance of our ideal functionality guarantees privacy.

For instance, it is pretty clear that the very restrictive functionality F ∅ v (from Section 6.5.2) provides a high level of privacy: recall that this functionality requires that, regardless of which voters verify, no honest votes can ever be removed, reordered, or modified in any way. The adversary can only add dishonest votes, and see the result. At the other end of the scope, consider the most permissive functionality F v , associated with the predicate that is always true. This functionality allows the adversary to tamper with the votes in any way he wishes, no matter which voters verify. Here it is quite easy to see that this functionality does not provide any privacy: a simulator who wishes to know some voter Alice's vote can simply remove every vote but hers, and of course the result lets him learn Alice's vote. Between those two extremes however, it is much less clear what exactly the adversary can learn about the votes. For example, consider a functionality such as F del,reorder v (Section 6.5.2) where the adversary cannot change the 6.8. Entropy value of any honest vote, and in addition cannot remove the votes from the voters who verify 16Say the adversary is trying to learn Alice's vote, and Alice has verified her vote. There the adversary can no longer remove all votes except hers. However he can remove all votes from voters who did not verify. The result then only contains the votes of voters in H check . This does not let the adversary learn Alice's vote, but intuitively it leaks some information on her vote, or more precisely, it leaks more information than if no votes at all were removed. It is not quite clear a priori what privacy Alice gets in this setting.

In the same vein, it is not trivial in our model to understand precisely how different ideal functionalities compare. Consider for instance functionality F del,reorder,change v (Section 6.5.2). It is similar to F del,reorder v except the adversary can now also modify the value of the votes from honest voters, provided they do not verify (while these can only be removed, but not changed, in F del,reorder v ). It seems intuitively clear that the adversary can learn at least as much information on Alice's vote in F del,reorder,change v as in F del,reorder v , as the functionality is more permissive. However, it is not clear at all how much more information about this vote he can get. In fact, it is not even obvious that he can obtain strictly more information: how exactly does the additional power he gets compared to F del,reorder v help him? One natural tool to try to quantify the information available to the adversary, and thus to compare the ideal functionalities, is the notion of entropy. The question then becomes: how much entropy is left in Alice's vote (or any information the adversary is trying to learn) once the adversary sees the result? Or more precisely: what is the minimal value of this entropy, when considering all possible simulators against a given ideal functionality?

In this final section, we propose to explore how the notion of entropy can be used to get a better insight on the privacy our ideal functionality provide, by trying to compare F del,reorder v and F del,reorder,change v . Bernhard, Cortier, Pereira and Warinschi introduced in [START_REF] Bernhard | Measuring vote privacy, revisited[END_REF] a framework to formalise these questions. In what follows, we present an adaptation this framework to our model, and establish a general result to help compare the entropy for our family of ideal functionalities. We then answer at least partially the previous question regarding the comparison of F del,reorder v and F del,reorder,change v . Finally, we compute (by numerical simulation) the entropy in various examples, and discuss our observations.

Entropy for voting protocols

Let us first recall some standard notions and notations regarding entropy.

Entropy

Entropy is a concept from information theory, that intuitively intends to measure the quantity of information contained in a random variable. A well-established notion of entropy is Rényi entropy, which constitutes a family of entropy functions parametrised by a real number α, defined as follows:

Definition 66 (Rényi entropy). Let X be a random variable with values in X . For α ∈ [0, ∞[\{1}, the Rényi entropy with parameter α of X is

H α (X) = 1 1 -α log x∈X P(X = x) α .
We extend the definition to the cases of α = 1 and α = ∞ by passing to the limit.

Some particular values of α yield some well-known entropy functions:

• For α = 0, Hartley entropy, which measures the number of possible values for X:

H 0 (X) = log(|X |).
• For α = 1, Shannon entropy intuitively measures the average over the value x of X of the size in bits needed to store the information that X = x:

H 1 (X) = - x∈X P(X = x) log(P(X = x)).
• For k = ∞, min-entropy measures the probability that the "best guess" as to the value of X, i.e. the x that maximises P(X = x), is correct:

H ∞ (X) = -log(max x∈X (P(X = x))).
For a given Rényi entropy function H α , if X is a random variable and A some event, we denote H α (X|A) the conditional entropy of X given A, which is defined just as H(X), except the probability P(X = x) is replaced with the conditional probability P(X = x|A).

We will next need to define the conditional entropy of X given Y, which intuitively measures the entropy left in X once the value of Y is known. This does not trivially follow from H α (X|A), since "the value of Y" is not an event: for any y, "Y = y" is and the previous definition applies to H α (X|Y = y), but we need to define how to combine these over all values of y. In [START_REF] Bernhard | Measuring vote privacy, revisited[END_REF], the authors consider three possible ways of doing this, which we reproduce here. [27] then considers a general notion of conditional entropy, which all previous examples are instances of.

Entropy

Definition 70 (Conditional entropy). A conditional entropy measure is a function H mapping two random variables X, Y to a positive real number such that

• If X can be computed as a probabilistic function of Y, then H(X|Y) = 0.

• If Y, Y are two random variables such that Y can be computed as a function of Y, then for any X, H(X|Y ) ≥ H(X|Y).

In the following we consider an arbitrary, fixed conditional entropy H.

Execution model and view of the adversary

We now present the model we use to characterise the entropy of the votes from the point of view of the adversary, which is inspired from [START_REF] Bernhard | Measuring vote privacy, revisited[END_REF].

Consider the ideal functionality F P v (ρ), for a given predicate P and counting function ρ. Let E be an environment, S a simulator, and consider the ideal execution of F P v (ρ) with E and S idealexec(E||S||F P v ). In this execution, we denote V the random variable whose value is the list of votes chosen by E for the honest voters (in a fixed order). We also denote V the set of possible votes: V thus has values in V |H| (recall that H is the set of honest voters).

We also call view of S, and denote View(S, E, F P v (ρ)), the sequence of the random coins used by S and all messages received by S during the execution. View(S, E, F P v (ρ)) is a random variable, that depends on (i.e. can be computed as a function of) the random coins of E and S. Notably, it contains the result (or absence of result) of the election, that is sent to S by the functionality during the execution.

For the purposes of computing entropy on the votes, they need to be random variables that follow a certain probability distribution, intuitively representing the information known a priori on the voters' intentions. We make a few assumptions here, for simplicity. First, we will consider that voters vote only once, and that all votes follow the same distribution, and are independent. While not necessarily always accurate in real life -we might know a priori that a certain group of voters have a tendency to vote the same for instance -this seems like a reasonable assumption for a first look at how entropy can be useful in our setting. In addition, we will also assume that the environment is not deliberately helping the adversary/simulator by sending him information on the votes. By doing so, we model the case where all honest voters are trying to keep their votes secret. Again, this may not reflect all real life scenarios -in a more complete study we might for instance want to model the case where some voters, while honest, deliberately make their choice public for instance -but is a reasonable assumption to simplify our study.

Formally, we now consider a restricted class of environments E D , parametrised by a probability distribution D on votes. E D tells H to start the setup and then voting phases, then draws the vote of each of the honest voters (in a fixed order) independently according to D, and submits all these votes to the functionality (through H ). E D then tells H to end the voting phase and start the tallying, and sends no further messages to any of the other entities.

We also restrict the class of ideal functionalities F P v (ρ) we consider, by requiring that for any L, f , P (L, f ) can be computed (efficiently) using only the list of identities in L, and not L itself. This way, in an execution, P (L, f ) can be computed from the view of S. We denote P the set of such predicates P . This class of predicates covers all examples described earlier: the restriction is intuitively that whether a voter's vote can be modified or not does not depend the exact value of that vote, but only on the voter's identity (typically, on whether that voter checks or not). Here again, while it might be interesting to investigate cases where the adversary is able to tamper with a vote only for certain values of that vote, this seems like a reasonable assumption for a first study.

It is clear that with such environments and functionalities, the view View(S, E, F P v (ρ)) can be computed from only the random coins of S and the result of the election.

Finally we split the simulators we will consider into several classes. For a fixed γ ∈ 0, |H| , we denote S γ the set of all simulators S that keep exactly γ votes unmodified. That is, simulators S such that in any execution, if L is the list of votes recorded by

F P v , S returns a tampering function f such that |{i ∈ dom(f ) | f [i] ∈ N}| = γ.

Entropy for voting systems

Following [START_REF] Bernhard | Measuring vote privacy, revisited[END_REF], we consider the following notion of target function that characterises what information the adversary is trying to learn on the votes. Definition 71 (Target function). We call target function any function T : V |H| → T , for some set T . Such a function will represent the information the adversary is trying to get on the list V of honest votes.

We can now define the entropy of the target from the point of view of the best possible simulator as follows.

Definition 72 (Entropy on the target function). Consider a probability distribution on votes D, a target function T, an ideal functionality F P v (ρ), a number of voters γ ∈ 0, |H| . The entropy of T (V) when keeping γ votes is

H P,ρ D,γ (T(V)) = min S∈Sγ H(T(V)|View(S, E D , F P v (ρ))).
This notion is what we will use to quantify the privacy of voters. For instance, if we consider a target function that picks the vote from one specific voter Alice from the list, it measures the minimum entropy that is left in Alice's vote, given the view of any possible simulator (that leaves γ votes untouched). That is, intuitively, how much uncertainty regarding their votes the best adversary still has. We can for instance compare the value of this entropy for different functionalities, or different result functions.

Comparing entropies

General results

With this notion of entropy, we can formally prove the intuitive claim that a more permissive functionality, i.e. one with a more permissive predicate, that gives more power to the simulator, leaks more information about the votes. That is, the entropy left in any target given the result is lower for the more permissive functionality.

Theorem 15. Consider a counting function ρ, and two predicates P , P in P, such that P is more permissive than P , i.e. ∀L, f. P (L, f ) ⇒ P (L, f ). Recall that V is the random variable consisting in the list of all honest votes. Then ∀T. ∀γ. ∀D. H P,ρ D,γ (T(V)) ≤ H P,ρ D,γ (T(V)).

Entropy

Proof. Let T be a target function, let γ ∈ 0, |H| , and let D be a probability distribution on votes. Let S ∈ S γ be a simulator for F P v (ρ). We construct a simulator S ∈ S γ for F P v (ρ) as follows. S internally runs S , acting as an interface and forwarding the messages between S and the other entities, until the point where S wishes to send a tampering function f to the functionality. During the execution, S records in a list I the identities id for which it receives an acknowledgement ack(id) from H .

At that point, let L be the list of identities and votes kept by the functionality F P v (ρ) in the execution idealexec(E D ||S||F P v (ρ)). Since, up to this point in the execution, F P v (ρ) and F P v (ρ) are identical, S has accurately simulated the execution of S in idealexec(E D ||S ||F P v (ρ)). Thus L is also the list recorded by F P v (ρ) in that execution. S then computes P (L, f ). By assumption, S can compute this value using only the list of identities in L, i.e. I.

If P (L, f ) = ⊥, S sends no tally to S , and stops. Otherwise, S sends f to F P v (ρ). Since P is more permissive than P , P (L, f ) = . F P v (ρ) thus accepts f , computes the result r = ρ(f (L)), and sends it to S. S forwards this message to S , and answers to the functionality what S answers.

It is clear that the simulated S sees the result if and only if S actually sees it in the corresponding execution of idealexec(E D ||S ||F P v (ρ)), and that in that case the result S sees is the same in both executions. In other words, the view of the simulated S is the same as the view View(S , E D , F P v (ρ)) that S has in idealexec(E D ||S ||F P v (ρ)). Since S was able to simulate such an S , the view View(S , E D , F P v (ρ)) of S can therefore be computed from the view View(S, E D , F P v (ρ)) of S. Thus, by the assumptions on the conditional entropy H, we have Applied to the functionalities F del,reorder v and F del,reorder,change v , this theorem proves the intuition that the former provides at least as much privacy as the latter to voters. As discussed previously, the natural question is then: does it actually provide strictly more privacy or not? Thanks to the following result, that generalises Theorem 15, we can partially answer this question.

H(T(V)|View(S , E D , F P v (ρ))) ≥ H(T(V)|View(S, E D , F P v (ρ))).
Theorem 16. Consider a counting function ρ, and two predicates P , P in P. Assume there is a way of turning a vote tampering function accepted by P into a tampering function accepted by P without losing information. That is, there exist polynomial algorithms A and B such that • A turns a function f accepted by P into a function A(f ) accepted by P : ∀L, f. P (L, f ) =⇒ P (L, A(f )).

• In addition, the function returned by A always contains the same number of unchanged votes as its input:

∀f. |{i ∈ dom(A(f )) | A(f )(i) ∈ N}| = |{i ∈ dom(f ) | f (i) ∈ N}|.
• B is able to compute the tally obtained when applying the tampering f , from the one obtained when applying A(f ). That is

∀L, f. ρ(f (L)) = B(f, ρ(A(f )(L))).
Then F P v leaks at least as much information as F P v on any target:

∀T. ∀γ. ∀D. H P ,ρ D,γ (T(V)) ≤ H P,ρ D,γ (T(V)). Proof. Let T be a target function, let γ ∈ 0, |H| , and let D be a probability distribution on votes. Let S ∈ S γ be a simulator for F P v (ρ). This proof follows a similar intuition to the previous one. As before, we construct a simulator S ∈ S γ for F P v (ρ), that will internally run S in order to internally compute its view, as follows. S internally runs S, acting as an interface and forwarding the messages between it and the other entities, until the point where S wishes to send tampering function f . During the execution, S records the list I the identities for which it receives an acknowledgement.

At that point, let L be the list of identities and votes kept by the functionality F P v (ρ) in the execution idealexec(E D ||S ||F P v (ρ)). As noted before, up to this point in the execution, F P v (ρ) and F P v (ρ) are identical, and thus S has accurately simulated the execution of S in idealexec(E D ||S||F P v (ρ)). Thus L is also the list recorded by F P v (ρ) in that execution. S then computes P (L, f ), which it can do using only f and I by assumption. If P (L, f ) = ⊥, S sends no tally to S, and halts. Otherwise, S computes f = A(f ), and sends it to F P v (ρ). Since P (L, f ) = , by assumption on A, P (L, f ) = . F P v (ρ) thus accepts f , computes the result r = ρ(f (L)), and sends it to S . S then computes r = B(f, r). By assumption on B, we have r = ρ(f (L)).

S then sends r to S, and forwards its response to the functionality. It is clear that the simulated S sees the result if and only if S actually sees it in the corresponding execution of idealexec(E D ||S||F f v (ρ)), and in that case sees the same result. In other words, the view of the simulated S is the same as the view View(S, E D , F P v (ρ)) that S has in idealexec(E D ||S||F P v (ρ)). Since S was able to simulate such an S, the view View(S, E D , F P v (ρ)) of S can therefore be computed from the view View(S , E D , F P v (ρ)) of S . Thus, by the assumptions on the conditional entropy H, we have

H(T(V)|View(S, E D , F P v (ρ))) ≥ H(T(V)|View(S , E D , F P v (ρ)))
. By assumption on A, f contains the same number of unmodified votes as f , which means that S ∈ S γ . Hence,

∀S ∈ S γ . ∃S ∈ S γ . H(T(V)|View(S, E D , F P v (ρ))) ≥ H(T(V)|View(S , E D , F P v (ρ))), which implies min S∈Sγ H(T(V)|View(S, E D , F P v (ρ))) ≥ min S ∈Sγ H(T(V)|View(S , E D , F P v (ρ))),
i.e. H P,ρ D,γ (T(V)) ≥ H P ,ρ D,γ (T(V)).

Entropy

We can note that Theorem 15 is a particular case of Theorem 16, where A and B are simply the identity functions: A(f ) = f and B(f, r) = r.

Comparing F del,reorder,change v and F del,reorder v Consider now the application of Theorem 16 to predicates P del,reorder,change and P del,reorder . Assume the counting function ρ has the partial tallying property, defined in earlier chapters.

We can in that case define algorithms A and B that satisfy the requirements of the theorem. A(f ) removes from f all votes cast by the simulator in the name of honest voters, since those are not allowed by P del,reorder . That is, A(f ) returns a function f = λi.L [i], where

L = [f (i), i = 1..|dom(f )| | f (i) ∈ N ∨ ∃id / ∈ H.∃v ∈ V. f (i) = (id, v).
B(f, r) then computes r * ρ(L ), where L is the list of votes cast by the simulator for honest voters in f , i.e.

L = [f (i), i = 1 . . . |dom(f )| | ∃id ∈ H.∃v ∈ V. f (i) = (id, v).
That is, B adds back to r the tally of all votes A discarded.

With these A and B, it is clear that the conditions of Theorem 16 are fulfilled. This proves that the entropy for P del,reorder is lower than the entropy for P del,reorder,change .

Since, on the other hand, P del,reorder,change is clearly more permissive than P del,reorder , by Theorem 15, the converse inequality also holds. Together, these two observations thus establish that these entropies are equal, as formally stated in the following theorem: That is, the most information a simulator that leaves exactly γ votes unchanged can obtain on T(V) is the same regardless of whether this simulator is allowed to change the votes of voters that do not verify, or only to drop them.

That result may be surprising, as it intuitively seems that the adversary has much more power in the first case. The confusion stems from the distinction between privacy and verifiability.

The result does not mean that the two functionalities F del,reorder v and F del,reorder,change v are equivalent. F del,reorder v describes a system which guarantees that even if I do not perform any verification, my vote cannot be modified, but only removed. As our case study showed earlier, this can be realised in practice e.g. by signing the ballots as is done in Belenios. This gives strictly stronger guarantees from the point of view of verifiability that F del,reorder,change v . Although, as proven in the previous section, both functionalities guarantee individual verifiability since we consider here a case without revote, they are not the same. Indeed, for F del,reorder v , we could have proven the stronger version of verifiability described earlier, that prevents changing votes even when voters do not check. F del,reorder,change v on the other hand does not guarantee this stronger verifiability.

However, this result means that, purely from the point of view of privacy, F del,reorder v does not give stronger guarantees than F del,reorder,change v , at least in the case of a counting function with partial tallying. For such counting functions, ensuring that votes cannot be changed even for voters who do not verify (as is done e.g. in Belenios) does not provide more privacy than letting an adversary change these votes (as is the case e.g. in Helios).

A natural question is then: what if the counting function does not have the partial tallying property? We do not have a general answer to this question, however in the next subsection we investigate it on a few examples.

Experiments

A typical example of a function that does not have the partial tallying property is the winner function. That is, the case where the result is simply the name of the winner, i.e. the candidate that received the majority of votes, without any indication regarding the number of votes for each candidate. Indeed, even if we know that candidate 1 got the majority of votes among the first half of voters, and that candidate 2 got the majority among the other half, that does not let us compute who is the winner when counting all the votes. Intuitively, in that case, it seems that being able to change votes may leak more information to the adversary. While just seeing the winner only tells him that that candidate has more than 50% of votes, changing some of the votes may give information about the margin by which the winner wins. For instance, the intuition seems to indicate that turning 10% of the votes from voters who did not check into votes for the losing candidate would let the adversary learn whether the winner actually had more than 60% of votes; while simply removing these votes would not.

Even in simple cases, computing an exact expression for the entropy can be difficult. It indeed requires to compute the probability distribution of the target function given the result of the election, which seems to often lead to quite complex combinatorics problems, that we did not study here. In what follows, we instead perform numerical simulations to approximate the entropy in some examples involving the winner function, to get some insight on how changing votes influences privacy in that case.

Setting

Concretely, we consider the following simplified setting:

• All voters are honest, i.e. the adversary does not control any voter. A number α of voters verify their vote, and β voters do not. When considering the random variable V, we will order them, first numbering the voters who verify from 1 to α, and then the others from α + 1 to n = α + β.

• Votes are vectors of d integers (in our examples we use d = 2, 3 or 4). Typically, this could model an election with d candidates: a vote for candidate i would then be a vector v such that v i = 1 and v j = 0 for j = i.

• We consider two result functions:

the sum: summing all votes component by component, i.e.

ρ sum (v 1 , . . . , v k ) = ( i v i,1 , . . . , i v i,d )
If votes are for one candidate as described above, the sum gives the number of votes for each candidate.

Entropy

the winner: the index of the candidate with the most votes, i.e.

ρ winner (v 1 , . . . , v k ) = argmax l ( i v i,l )
or, equivalently, the corresponding vote, i.e. the vector with a 1 at that index.

• We consider two examples of target functions:

-The value of a fixed voter's vote, say the first voter, i.e. τ first (v 1 , . . . , v n ) = v 1 . The order specified above means that this voter verifies.

-The boolean "are at least a proportion p of the votes from the α voters who verify for the first candidate?", for a fixed p ∈ [0, 1], i.e.

τ p (v 1 , . . . , v n ) = 1 if 1≤i≤α v i,1
≥ pα, and 0 otherwise.

This function may seem strange, as it can trivially be observed from the result when the counting function is ρ sum . However, it cannot when the function is ρ winner , and in that case it formalises the intuition about learning information on the margin exposed above.

The authors in [START_REF] Bernhard | Measuring vote privacy, revisited[END_REF] argue that the most relevant notion of entropy to study is the average min-entropy. We did not dispute this claim, and in most cases we used this notion. However in some cases we also had a look at the conditional Shannon entropy.

In addition we will only consider deterministic simulators. Hence, their view will only depend on the tally they receive (which of course depends on the votes drawn at random by the environment). We therefore compute an approximation of H(T(V) | ρ(V)) for a given simulator, V being a list of n votes, each drawn from the same distribution. To do this, we wrote a small program that simulates many elections, drawing votes at random (following a specified distribution). We fix a simulator, for which we wish to compute the entropy. Each time, the program applies the tampering function that simulator would propose to the functionality. It then records the value of the target T(V) and the result ρ(V). The entropy is then computed using the expressions from the beginning of this section, using frequencies from the experiments rather than probabilities. More experiments are run until the computed value stabilises (i.e., until its variations pass under an arbitrary threshold).

We are of course aware that this is in no way a proof, and gives no guarantee that we compute the correct value for the entropy. This experiment was only a means to try to get a better intuition on what happens in the scenario we considered. However, we still report these results, as they lead to somewhat interesting observations. Does ρ sum leak more information than ρ winner ?

First we consider the case of an adversary (simulator) that does not try to change any votes, but deletes all β votes from the voters who do not verify, as is allowed by both F del,reorder,change v and F del,reorder v . Hence the result is computed only on α votes that the adversary does not control. Intuitively, removing these β votes is always a better choice for an adversary than leaving them, as the targets we considered only count the α votes from those who verify.

For this adversary, we investigate the difference between the counting functions ρ sum and ρ winner . Intuitively, the first seems to give strictly more information to the adversary than the second. However, we observe that this is not always true.

Consider first that the target is the first vote τ first , and a simple setting where there are two candidates (d = 2), and the environment makes voters pick at random among them following a uniform distribution. Of course, the amount of information learnt by the adversary from the result depends on the number α of voters who verify (since only their votes are counted): the more voters there are, the more a specific vote is hidden in the result. Plotting the average min-entropy of τ first (V) knowing the result yields the following graph.

Contrary to what one would expect, it appears that the average min-entropy is the same for the sum and winner functions ρ sum and ρ winner . Doing more experiments, with other numbers of candidates and other distributions produces the same observations. However, computing the conditional Shannon entropy rather than the average min-entropy yields a different result, as displayed on the following graph.

Here we see a difference between the two counting function: as expected, the winner function leaks less information, leading to a higher entropy.

While this may be surprising, it can be explained in a fairly intuitive way. The intuition is that the average min-entropy evaluates the average (over all results) of the probability of the best possible guess (given the result) being correct. Here, knowing the sum, i.e. the number of votes for each candidate, the best guess is always the candidate with the most votes. Knowing the sum

Entropy

does not provide any additional information that would help an adversary guess the first vote, compared to just knowing the winner. Therefore, the best guess regarding the first vote only depends on the winner, and the probability of it being correct is, on average, the same whether we know the sum or just the winner. The average min-entropy is thus the same in both cases.

The difference between the two cases is only in the confidence the adversary has in his guess: while, on average, the best guess is as likely to be true whether we know the sum or the winner, for a given sum, we know exactly how likely it is, while knowing the winner does not gives us this information. This means that, as reflected by the conditional Shannon entropy, the sum function does indeed leak more information than the winner function, however, as reflected by the average min-entropy, this additional information does not help an adversary make a better guess (on average) regarding the value of one specific vote.

Does changing votes give more power to the adversary w.r.t. privacy?

We finally investigate whether the adversary may gain information about the votes by changing votes, i.e. whether or not he has strictly more power against privacy with F del,reorder,change v than with F del,reorder v .

We have proved that this is not the case when considering a counting function with partial tallying: we will thus consider the winner function ρ winner . Following the intuition exposed earlier in this section, we study the case of the target function τ p . That is, the adversary is trying to determine whether or not a proportion at least p of the voters who verify voted for the first candidate. Of course, if p = 0.5, the result immediately let the adversary know this with absolute certainty. In what follows, we will rather use p = 0.1.

We consider the scenario where

• the election involves two candidates (d = 2), and the initial distribution of votes (used by the environment to draw the votes at random) is 10% for the first candidate, and 90% for the second. That is, one candidate is a priori unpopular, and the adversary is trying to determine whether that candidate had more support among people who verify than the initial distribution would indicate.

• α voters verify, and thus their votes are unmodified;

• β voters do not check, and the adversary may change or remove their votes arbitrarily;

• there are no dishonest voters.

We first consider the particular case where the adversary chooses to remove all β votes, which seems to be the best he can do when interacting with F del,reorder v . Plotting the entropy of the target given the result, for different values of α, yields the following graph.

Of course, the more voters there are, the less information the result reveals about the target. We can see that the entropy seems to be slightly lower with a high number of voters: we believe this is simply an artefact of our simulation. Now, let us consider an adversary interacting with F del,reorder,change v , i.e. who can now change the value of the votes from the β voters who do not verify. Following our intuition from before, we consider the strategy that consists in turning δ of these votes into votes for the first candidate, and remove all others. Thus the result now contains α votes uncontrolled by the adversary, and δ votes for the first candidate. Here are the graphs obtained for a few values of δ (assuming β is large enough), plotted for α ∈ 0, 1000 : δ = 0.75α: As we expected, we see that by choosing δ well, the adversary does gain more information by adding votes. By adding votes, the information the winner provides can be made closer to the target function, and the closer it is, the lower the entropy. By adding δ = 0.8α votes for the first candidate, the winner gives exactly the information the adversary seeks, and the entropy is 0. Indeed if k denotes the number of honest votes (among the α) for the first candidate, the winner lets the adversary learn whether (k + 0.8α) ≥ 0.5 * (α + 0.8α), i.e. whether k ≥ 0.1α, which is exactly the target. Thus, against F del,reorder,change v , when β is large enough, the best strategy is to turn 0.8α of the β votes into votes for the first candidate, and delete the others. Otherwise, the best strategy seems to be to turn all β votes into votes for the first candidate. On the other hand, against F del,reorder v , the most the adversary could do seems to be removing all β votes. With these strategies, for α = 1000, plotting the average min-entropy on the target given the result as a function of the proportion β α+β of voters who do not verify their votes, we obtain:

This shows an important difference between the two functionalities in the case of a non-partial tallying counting function, which was our goal.

In summary, these experiments with entropy show us first that, perhaps surprisingly, having the result reveal the amount of votes for each candidate may not lead to a greater loss of privacy than just revealing the winner, depending on what measure of privacy we consider (average min-entropy vs. conditional Shannon entropy). It also shows that, while we have proven before that the functionality F del,reorder,change v does not give more power to the adversary regarding privacy than F del,reorder v in the case of counting functions with partial tallying, the same is not true (or at least, not always) when the counting function does not have this property. In the case of the winner function, provided that sufficiently many voters do not verify their votes, the adversary can learn relevant information on the votes of those who do with F del,reorder,change v , but not with F del,reorder v . To conclude this more experimental section about entropy, it appears that entropy can be a powerful tool when comparing the privacy different ideal functionality actually provide, although expressing general claims seems difficult, as this comparison largely depends on which counting function, and which target we choose to study.

Conclusion to Part II

Having studied the subtle relations between privacy and verifiability, we have proposed a flexible definition for ballot privacy against a dishonest board, that accounts for the way the adversary may try to tamper with the bulletin board. This definition describes finely the abilities of the adversary, to characterise precisely what power he has. This is not only important to analyse different schemes with various security levels but also useful when analysing a given scheme under different trust assumptions, as exemplified by our case analysis. We formally relate mb-BPRIV (with strong consistency) with a family of ideal functionalities, whose level of security is easier to understand. In the course of Chapter 6, we have considered four possible ideal functionalities, but of course other functionalities could be defined, depending on the voting scheme. Our general theorem still applies and mb-BPRIV can be proved by adapting the Recover algorithm.

Interestingly, the ideal functionalities we have proposed do not only capture vote privacy (nothing is leaked but the result) but also some form of verifiability: honest votes are deemed to be counted, at least for voters that verify. This means that mb-BPRIV can also be used to prove a certain level a verifiability. We have proved formally that these ideal functionalities, and therefore mb-BPRIV, imply a simple notion of individual verifiability against a dishonest ballot box. It would be interesting to investigate this further: which properties are missed? For instance, how does our property relate to universal verifiability? That property seems out of reach of the current definition, since we explicitly assume the tallying authority to be honest -universal verifiability aims to protect voters from dishonest talliers who attempt to tamper directly with the result itself, rather than the ballots or ballot box. A possible extension would then be to explore how to incorporate a model of dishonest talliers to our security notion. A difficulty would be that dishonest tallying authorities trivially break privacy -they know the election secret key. This makes the design of a property that could express both privacy and universal verifiability challenging. A possible approach to explore would be to design a more precise model the talliers, by representing the different trustees as separate entities, who each have only a share of the election key. Some of them would then be dishonest, i.e. the adversary would know their share of the key and control them, while others would remain honest, i.e. represented by an oracle in the game.

Another direction in which we could extend the scope of our definition is the incorporation of a distinction between humans and machines. Currently, we consider that voters are either fully dishonest -controlled by the adversary -or completely honest -i.e. all their computations are performed by an oracle. A scenario that is plausible in real life, but not accurately reflected in our model, is the case of a voter who is honest, but is using a compromised device to vote. Some protocols (e.g. BeleniosVS [START_REF] Cortier | BeleniosVS: Secrecy and Verifiability against a Corrupted Voting Device[END_REF], D-Demos [START_REF] Chondros | D-DEMOS: A distributed, end-to-end verifiable, internet voting system[END_REF]) aim to protect the voter's privacy in such a case, e.g. by distributing some paper election material, containing voting codes that voters must enter on their devices to vote, rather than inputting directly their votes in clear. We could try to model such a scenario in our game by separating the oracle representing the voter from the computation that produces the ballot. For instance, the voter (oracle) could, using some private data known only to the voter, produce some data (representing e.g. a voting code) that is provided to the adversary, who can use it to compute a ballot. The difficulty would then be to adapt our recovery algorithms to that setting: given a board produced by the adversary, how to determine the computation the adversary performed to obtain it from the data produced by the voters?

Finally, note that while our current definition reflects that the adversary controls the ballots cast by honest voters (to the extent permitted by the checks in place), it implicitly assumes that the voters and the auditors running the ValidBoard algorithm all have access to the same board, right before the tally. In practice, voters check their ballot whenever they wish to, typically right after they voted. So not only voters should always see the same board but it should grow consistently during the election. Most voting schemes assume such a setting while eluding on how to achieve this. Recent work [START_REF] Kiayias | On the security properties of e-voting bulletin boards[END_REF][START_REF] Culnane | A Peered Bulletin Board for Robust Use in Verifiable Voting Systems[END_REF][START_REF] Chondros | Ddemos: A distributed, end-to-end verifiable, internet voting system[END_REF] study this issue and propose to distribute the board. Another interesting future work would be to investigate whether guarantees ensured by mb-BPRIV for a given voting scheme are preserved when implementing it with some distributed board. To study that question, we could leverage the relation we established between mb-BPRIV and simulation-based security to build a modular proof. The first step would be to prove that a scheme, with a centralised board, is mb-BPRIV. That would imply that, with such a board, it securely implements a matching ideal functionality. That is, any execution of the scheme with the centralised board can be simulated in the ideal world. The remaining step would then be to show that the scheme using a distributed board securely implements the same scheme using the centralised board, i.e. that any execution with the distributed board can be simulated by an execution with a central board.

Conclusion

In this thesis we have studied different aspects of the security of remote electronic voting systems. On the one hand, the problem of automatic verification of equivalence properties, in the symbolic model. On the other hand, we also studied the definitions of vote privacy and verifiability properties, and more specifically the relations between them. Several lines of research remain to be explored to build upon the results we obtained.

Type system for equivalence

Part I of this thesis presents our work on the design of a type system for protocol equivalence. Our approach consists in typechecking together the two processes which we want to prove equivalent. The types we use encode information regarding the level of secrecy and integrity of messages, their structure, and even their value. Typechecking ensures the processes have the same observable behaviours. A subtlety is that this is not sufficient for them to be equivalent: the sequences of messages they produce must also be indistinguishable. This can only be enforced by having a global view of these messages, while our typing rules only apply locally to the part of the process being currently typechecked. Hence our type system collects the messages output in a constraint, that provides this global view. We then define a consistency condition to check on the constraint, that ensures the messages exchanged do not break equivalence. Our type system is sound: if two processes typecheck with consistent constraints, then they are equivalent -whether they feature bounded or unbounded numbers of sessions.

We implemented, together with Niklas Grimm, a prototype typechecker, and compared it to other tools on several examples. Our approach is much faster than most other tools in the bounded case, and on the same level of performance as ProVerif in the unbounded case, even being able to prove vote privacy for Helios, which ProVerif is unable to do, as its overapproximation leads to reporting a false attack.

Future work

As mentioned in conclusion of Part I, several extensions seem relatively accessible as short-term goals: notably, extending the process algebra and type system to handle processes with phases, or designing a type inference system, to automatically infer the types of keys.

Extension to stateful protocols Other interesting problems are more open-ended and longterm goals. Recent developments of the ProVerif tool have extended it to better deal with stateful protocols, that use a global state. Such protocols were previously out of reach of ProVerif, due to its overapproximation being to coarse to properly handle global states. Progress has been made recently in the case of trace properties, although it does not yet apply to equivalence properties. Our type system shares that limitation. It typically fails to prove equivalence of protocols with global states, as the types do not currently allow us to express stateful information: the key types for instance simply encode information on the messages encrypted, but cannot reflect the fact that one message is encrypted before another, or that some message is only decrypted once. A possible direction to overcome this limitation would be to enrich our types to express the fact that an event is "consumed", taking ideas from linear logic.

Computational soundness Lastly, a possible line of work would be to explore how our type system could be adapted to prove computational indistinguishability, rather than symbolic equivalence. Computational soundness results for symbolic models, following the approach initially proposed by Abadi and Rogaway [START_REF] Abadi | Reconciling two views of cryptography[END_REF], typically consist in first relating each computational execution of the protocol to a symbolic trace, i.e. defining an interpretation of symbolic executions in the computational world, and showing that each computational trace is the interpretation of a symbolic trace. The second step is then roughly to show that symbolic equivalence of the messages exchanged implies the computational indistinguishability of their computational counterparts. It seems, intuitively, that our typing rules for processes impose strong conditions on the behaviours of processes, which could be sufficient, in the first step of a computational soundness proof, to ensure that the computational executions of both protocols match. The second part, regarding messages, seems more tricky. We would need to show that the typechecking of messages and consistency of the constraints entail their computational indistinguishability. Basically, our typing rules open the messages as much as an attacker possibly could, and the consistency procedure ensures the resulting subterms are cannot be distinguished. Here our approach seems somewhat similar in spirit to [START_REF] Abadi | Reconciling two views of cryptography[END_REF], which replaces messages with patterns where all parts an attacker cannot decrypt are hidden. This brings hope a similar technique could be adapted to prove the soundness of our system. Another possible approach to the problem of computational soundness would be to try to relate our system to the computationally sound symbolic attacker model from Bana and Comon. The advantage here is that rather than directly proving the computational soundness of our type system, we would show that our type system entails indistinguishability in that model, and rely on its soundness, that is already established. The idea is that this model, being symbolic, is much closer to ours than computational ones. In the Bana-Comon model, the attacker is modelled by a set of first order axioms restricting his abilities, and security is established by proving that an attacker satisfying these axioms cannot falsify a first-order formula expressing indistinguishability. A possibility to explore would be to try to relate each of our typing rules to proof steps in that logic, so that the complete typing derivation would build such a proof.

Privacy and individual verifiability

In Part II we have presented our work on the definitions of vote privacy and verifiability. We obtained the surprising result that privacy in fact implies individual verifiability. We proved this implication both in symbolic and computational models, to further establish that it is not a modelling artefact, but is rather a consequence of the way the privacy and verifiability properties are understood. The counter-intuitive aspect of this result may be explained by closely examining the trust assumptions. We show that privacy implies individual verifiability with the same trust assumptions w.r.t. the various election authorities. In contrast, verifiability is usually studied against a dishonest ballot box, while almost all existing game-based privacy definitions assume a trusted ballot box. This observation leads to our last contribution.

We proposed mb-BPRIV, a new game-based definition for vote privacy against a malicious

Privacy and individual verifiability

ballot box. Our definition is parameterised, actually forming a family of privacy notions -the parameter characterises finely which adversarial behaviours we wish not to consider as attacks.

To better show that our privacy definition is still sufficiently strong and meaningful, we proved it implies a simulation-based formulation of privacy, which requires that the voting system securely implements an ideal voting functionality. We finally conducted a case study on three existing voting schemes -Helios, Belenios, and Civitas -that showcases how the flexibility of our definition lets us describe finely what guarantees are provided by each protocol.

Future work

Several interesting problems remain to be studied regarding our work on vote privacy.

Finer model of schemes and attackers First, as discussed in the conclusion of Part II, several extensions to our mb-BPRIV definition could be considered in order to cover a larger class of protocols and attackers. Notably, modelling a (partially) dishonest tallying authority, where some of the trustees are controlled by the adversary, would yield guarantees in a stronger threat model. Introducing a distinction between voters and their devices they use to vote would let us study schemes that aim to protect voters' privacy even when using a compromised voting device.

Another such extension would be to tweak our property to model more finely protocols where the voting process is interactive and consists in an exchange of messages (e.g. the Neuchâtel protocol [START_REF] Galindo | Neuchâtel's cast-as-intended verification mechanism[END_REF]), rather than just an algorithm running locally on the voter's machine. As mentioned in the conclusion of Part II, all of these extensions could be made by considering a more complex game, with additional oracles, yielding a finer model: separating the tallying authority into several oracles (representing each trustee); separating the voting oracle into the parts representing the voter, and the role of the device; and into several steps modelling an exchange of messages with the voting server,etc.

Receipt-freeness and coercion-resistance All of these extensions would yield a finer model of both the voting scheme and the adversary when expressing the same vote privacy property. Another direction to explore would be to consider different properties. As we have seen, the current mb-BPRIV already ensures more than just vote privacy: it implies that the system securely implements an ideal functionality, which has allowed us to show (under some assumptions) that it also enforces individual verifiability. An interesting line of work would be to go even further, and explore how to extend it to additionally model receipt-freeness/coercion resistance. These can be seen as stronger variants of privacy, that require that my vote remains secret even if I am forced -or willing -to give any secret data I have (credentials, passwords, etc.) to the adversary. In [START_REF] Juels | Coercion-resistant electronic elections[END_REF], Juels, Catalano and Jakobsson propose a game-based definition for coercion-resistance to study the scheme they design -JCJ, which is the basis for the Civitas protocol. Their definition however seems rather tailored to that scheme, and it is not clear that it could be used to study other protocols in general. Delaune, Kremer and Ryan [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF] propose definitions for coercion-resistance and receipt-freeness in the symbolic model. These definitions are based on the one for vote privacy -secrecy of the vote is expressed as the equivalence of two scenarios where the votes are swapped. They additionally require that in the left process, Alice provides all her secret data to the attacker, while on the right process (where votes are swapped) she may provide fake data. The intuition is that the attacker should not be able to know whether real or fake data was provided, nor to use that data to learn information on the votes. An interesting future work would be to adapt this approach to our mb-BPRIV notion. Adapting the idea of voters providing real or faked data and credentials seems rather straightforward. However, an additional subtlety arises compared to the privacy definition by swapping. Indeed, in that case, both sides of the equivalence are "symmetric" -votes are simply swapped, and thus having the real/fake credentials being provided on either side amounts to the same. In contrast, for mb-BPRIV, there already are a real and a fake scenario -regarding the ballots the adversary sees. There are thus two ways of writing the property: either show the adversary real ballots and data on the left, and fake them both on the right; or show him real ballots and fake data on the left, and fake ballots but real data on the right. It is not clear at all a priori whether these two definitions express the same property, or which one is stronger -or, in fact, whether they are incomparable or not. Further study would be required regarding this question.

Modularity All these potential extensions share a common issue though: they add more technical machinery and complexity to the definition. The mb-BPRIV game we propose is already quite complex, and extending it in such various ways would produce an even more complex definition. While not necessarily an issue when simply writing the game, the risk is that we would end up with a definition that is unusable in practice to study real protocols. What is really needed in practice is a modular definition, that is easy to adapt to many voting schemes and trust assumptions, rather than a large monolithic game that covers all possible use cases. Maybe a game-based model like ours is not the right way to proceed. An idea would be to turn more towards simulation properties -they tend to provide more modular properties, and in such models the ideal functionality makes it somewhat easier to express the guarantees they provide while abstracting from the details of the scheme. A possibility would be to design a modular simulation-based definition -with different blocks to model extensions such as those mentioned above, that would be proved separately using specific games, rather than one monolithic game as in our current definition.

6. ∀T 1 , T 2 . T 1 * T 2 <: LL =⇒ T 1 <: LL ∧ T 2 <: LL 7. ∀T 1 , T 2 . T 1 * T 2 <: HH =⇒ T 1 <: HH ∨ T 2 <: HH 8. ∀T 1 , T 2 , T 3 . T 1 <: (T 2 ) T 3 =⇒ (∃T 4 <: T 2 . T 1 = (T 4 ) T 3 ) 9. ∀T 1 , T 2 , T 3 . T 1 <: {T 2 } T 3 =⇒ (∃T 4 <: T 2 . T 1 = {T 4 } T 3 ) 10. ∀T 1 , T 2 , T 3 . (T 1 ) T 2 <: T 3 =⇒ T 3 = HL ∨ T 3 = LL ∨ (∃T 4 .T 1 <: T 4 ∧ T 3 = (T 4 ) T 2 ) 11. ∀T 1 , T 2 , T 3 . {T 1 } T 2 <: T 3 =⇒ T 3 = HL ∨ T 3 = LL ∨ (∃T 4 .T 1 <: T 4 ∧ T 3 = {T 4 } T 2 ) 12. ∀T 1 , T 2 . (T 1 ) T 2 <: LL =⇒ T 1 <: LL ∧ (T 2 = LL ∨ (∃T 3 .T 2 <: key LL (T 3 )) 13. ∀T 1 , T 2 . {T 1 } T 2 <: LL =⇒ T 1 <: LL ∧ (T 2 = LL ∨ (∃T 3 , T 4 , l.T 2 = pkey(T 3 ) ∧ T 3 <: eqkey l (T 4 )) 14. ∀T, m, n, l, l . T <: τ l,a m ; τ l ,a n =⇒ T = τ l,a m ; τ l ,a n 15. ∀T, m, n, l, l . τ l,a m ; τ l ,a n <: T =⇒ T = HL ∨ T = τ l,a m ; τ l ,a n 16. ∀T 1 , T 2 . T 1 <: T 2 =⇒ neither T 1 nor T 2 are union types unless T 2 = HL or T 1 = T 2 .
17. ∀T, l, T . T <: key l (T ) =⇒ T = key l (T ) ∨ T = eqkey l (T ) ∨ ∃a.T = seskey l,a (T ).

18. ∀T, l, T . T <: eqkey l (T ) =⇒ T = eqkey l (T ) ∨ T = seskey l,a (T ).

19. ∀T, l, a, T . T <: seskey l,a (T ) =⇒ T = seskey l,a (T ).

∀T, T . T <: pkey(T ) =⇒ T = pkey(T ).

∀T, T . T <: vkey(T ) =⇒ T = vkey(T ).

22. ∀T 1 , T 2 , l. key l (T 1 ) <: T 2 =⇒ T 2 = l ∨ T 2 = HL ∨ T 2 = key l (T ).

∀T

1 , T 2 , l. eqkey l (T 1 ) <: T 2 =⇒ T 2 = l ∨ T 2 = HL ∨ T 2 = key l (T ) ∨ T 2 = eqkey l (T ). 24. ∀T 1 , T 2 , l. seskey l,a (T 1 ) <: T 2 =⇒ T 2 = l ∨ T 2 = HL ∨ T 2 = key l (T ) ∨ T 2 = eqkey l (T ) ∨ T 2 = seskey l,a (T ). 25. ∀T 1 , T 2 . pkey(T 1 ) <: T 2 =⇒ T 2 = HL ∨ T 2 = LL ∨ T 2 = pkey(T 1 ). 26. ∀T 1 . pkey(T 1 ) <: LL =⇒ ∃T 3 , l. T 1 <: eqkey l (T 3 ). 27. ∀T 1 , T 2 . vkey(T 1 ) <: T 2 =⇒ T 2 = HL ∨ T 2 = LL ∨ T 2 = vkey(T 1 ).
28. ∀T 1 . vkey(T 1 ) <: LL =⇒ ∃T 3 , l. T 1 <: eqkey l (T 3 ). Proof. All these properties have simple proofs by induction on the subtyping derivation.

• the induction hypothesis for the conditions of the form Γ P ∼ Q → C . In this case, the induction hypothesis produces a C ⊆ C , which can then be used to show C ⊆ C, since C and C are usually respectively C and C with some terms added.

We detail here the cases of rules POut, PPar, and POr. The other cases are similar, as explained above.

If the last rule is POut, then we have P = out(M ).P , If the last rule is PPar, then we have

Q = out(N ).Q , C = C ∪ ∀ c for some P , Q , M , N , C , c, such that Γ P ∼ Q → C
P = P 1 | P 2 , Q = Q 1 | Q 2 , C = C 1 ∪ × C 2 for some P 1 , P 2 , Q 1 , Q 2 , C 1 , C 2 such that Γ P 1 ∼ Q 1 → C 1 and Γ P 2 ∼ Q 2 → C 2 .
Thus by applying the induction hypothesis twice, we have Γ

P 1 ∼ Q 1 → C 1 and Γ P 2 ∼ Q 2 → C 2 with C 1 ⊆ C 1 and C 2 ⊆ C 2 . Therefore by rule PPar, Γ P 1 | P 2 ∼ Q 1 | Q 2 → C 1 ∪ × C 2 , and since C 1 ∪ × C 2 ⊆ C 1 ∪ × C 2 (= C), this proves the claim.
If the last rule is POr, then there exist Γ , x, T 1 , T 2 , C 1 and C 2 such that Γ = Γ , x :

T 1 ∨ T 2 , C = C 1 ∪C 2 , Γ , x : T 1 P ∼ Q → C 1 and Γ , x : T 2 P ∼ Q → C 2 . By definition of branches, it is clear that branches(Γ) = branches(Γ , x : T 1 ∨ T 2 ) = branches(Γ , x : T 1 )∪branches(Γ , x : T 2 ).
Thus, since Γ ∈ branches(Γ), we know that Γ ∈ branches(Γ , x : T 1 ) or Γ ∈ branches(Γ , x : T 2 ). We write the proof for the case where Γ ∈ branches(Γ , x : T 1 ), the other case is analogous. By applying the induction hypothesis to Γ , x :

T 1 P ∼ Q → C 1 , there exists C 1 ⊆ C 1 such that Γ P ∼ Q → C 1 . Since C 1 ⊆ C, this proves the claim.
Lemma A.8 (Environments in the constraints). For all Γ, C, for all processes P , Q, if

Γ P ∼ Q → C then for all (c, Γ ) ∈ C, dom(Γ ) ⊆ dom(Γ) ∪ bvars(P ) ∪ bvars(Q) ∪ nnames(P ) ∪ nnames(Q) ∪ (nkeys(P ) ∪ nkeys(Q)) 2
(where bvars(P ), nnames(P ), nkeys(P ) respectively denote the sets of bound variables, names, and key names in P ).

Proof. We prove this lemma by induction on the typing derivation of Γ P ∼ Q → C.

If the last rule applied in this derivation is PZero, we have C = {(∅, Γ)}, and the claim clearly holds.

In the PPar case, we have

P = P 1 | P 2 , Q = Q 1 | Q 2 , and C = C 1 ∪ × C 2 for some P 1 , P 2 , Q 1 , Q 2 , C 1 , C 2 such that Γ P 1 ∼ Q 1 → C 1 and Γ P 2 ∼ Q 2 → C 2 . Thus any element of C is of the form (c 1 ∪ c 2 , Γ 1 ∪ Γ 2 ) where (c 1 , Γ 1 ) ∈ C 1 , (c 2 , Γ 2 ) ∈ C 2 , and Γ 1 , Γ 2 are compatible. By the induction hypothesis, dom(Γ 1 ) ⊆ dom(Γ) ∪ bvars(P 1 ) ∪ bvars(Q 1 ) ∪ nnames(P 1 ) ∪ nnames(Q 1 ) ∪ (nkeys(P 1 ) ∪ nkeys(Q 1 )) 2 ⊆ dom(Γ) ∪ bvars(P ) ∪ bvars(Q) ∪ nnames(P ) ∪ nnames(Q) ∪ (nkeys(P ) ∪ nkeys(Q)) 2 ,
and similarly for Γ 2 . Therefore, since dom(Γ 1 ∪ Γ 2 ) = dom(Γ 1 ) ∪ dom(Γ 2 ) (by definition), the claim holds.

× . If (c, Γ) ∈ C 1 ∪ × C 1 , there exists (c 1 , Γ 1 ) ∈ C 1 , (c 1 , Γ 1 ) ∈ C 1 such that (c, Γ) = (c 1 ∪ c 1 , Γ 1 ∪ Γ 1 ) (and Γ 1 , Γ 1 are compatible). Since C 1 ⊆ C 2 , (c 1 , Γ 1 ) ∈ C 2 . Similarly, (c 1 , Γ 1 ) ∈ C 2 . Therefore (c, Γ) ∈ C 2 ∪ × C 2 .
Points 5 and 6 follow from the definitions of • σ,σ , ∪ × , ∪ ∀ .

Point 7 follows from the definitions of • σ,σ , and of consistency. Indeed, let (c , Γ ) ∈ C σ,σ . There exists c such that c = c σ,σ , and (c , Γ ) ∈ C. Let c 1 ⊆ c , and Γ 1 ⊆ Γ such that Γ 1N ,K = Γ N ,K and vars(c 1 ) ⊆ dom(Γ 1 ). Let θ, θ , c θ be such that (Γ 1 ) N ,K θ ∼ θ : (Γ 1 ) X → c θ , and c θ ⊆ c 1 θ,θ .

Note that since σ, σ are ground, c is also ground. Since c = c σ,σ , there exists c 2 ⊆ c such that c 1 = c 2 σ,σ . If we show that there exists

c 3 such that Γ N ,K σθ ∼ σ θ : Γ X → c 3 and c 3 ⊆ c 2 ∪ c σθ,σ θ , then it will follow from the consistency of C∪ ∀ c that φ Γ 2 LL ∪ φ l (c 2 ∪ c)σθ and φ Γ 2 LL ∪ φ r (c 2 ∪ c)σ θ are statically equivalent, where Γ 2 = Γ 1 ∪ Γ ⊆ Γ . Since Γ 1N ,K = Γ N ,K and Γ ⊆ Γ , we have φ Γ 2 LL = φ Γ 1 LL . Hence φ Γ 1 LL ∪ φ l (c 1 ∪ c)θ and φ Γ 1
LL ∪ φ r (c 1 ∪ c)θ will be statically equivalent. Therefore, φ Γ 1 LL ∪ φ l (c 1 )θ and φ Γ 1 LL ∪ φ r (c 1 )θ will also be statically equivalent, which proves the consistency of C σ,σ .

It only remains to be proved that there exists c 3 such that Γ N ,K σθ ∼ σ θ : Γ X → c 3 and

c 3 ⊆ c 2 ∪ c σθ,σ θ .
Since σ is ground, σθ = σ ∪ θ| dom(Γ 1 )\dom(Γ) , and similarly for σ θ . By assumption, Γ

N ,K σ ∼ σ : Γ X → c and (Γ 1 ) N ,K θ ∼ θ : (Γ 1 ) X → c θ . Hence there exists c 3 ⊆ c ∪ c θ such that (Γ 2 ) N ,K σθ ∼ σ θ : (Γ 2 ) X → c 3 .
Since c θ ⊆ c 1 θ,θ , and c is ground, we have

c 3 ⊆ c ∪ c 1 θ,θ = c ∪ c 2 σθ,σ θ = c 2 ∪ c σθ,σ θ
which concludes the proof.

Lemma A.12 (Environments in constraints contain a branch of the typing environment). For all Γ, C, for all processes P , Q, if Γ P ∼ Q → C then for all (c, Γ ) ∈ C, there exists Γ ∈ branches(Γ) such that Γ ⊆ Γ .

Proof. We prove this property by induction on the type derivation of Γ P ∼ Q → C. In the PZero case, C = {(∅, Γ)}, and by assumption branches(Γ) = {Γ}, hence the claim trivially holds.

Proof. We prove point 1 by induction on the proof of Γ sign(M, k) ∼ N : T → c. Because of the form of the terms, the last rule applied can only be THigh, TOr, TEncH, TEncL, TAencH, TAencL, TSignH, TSignL, TLR', TLRL' or TSub.

The THigh, TLR', TOr cases are actually impossible by Lemma A.1, since T <: LL. In the TSub case, we have Γ sign(M 1 , M 2 ) ∼ N : T → c for some T such that T <: T . By transitivity of <:, T <: LL, and the induction hypothesis proves the claim. In all other cases, T = LL and the claim holds.

We prove point 2 by induction on the proof of Γ sign(M 1 , M 2 ) ∼ N : LL → c. Because of the form of the terms and of the type (i.e. LL) the last rule applied can only be TEncH, TEncL, TAencH, TAencL, TSignH, TSignL, TLRL' or TSub.

The TLRL' case is impossible, since by Lemma A.14 it would imply that sign(M 1 , M 2 ) is a variable or a nonce.

In the TSub case, we have Γ sign(M 1 , M 2 ) ∼ N : T → c for some T such that T <: LL. By point 1, T = LL, and the premise of the rule thus gives a shorter derivation of Γ sign(M 1 , M 2 ) ∼ N : LL → c. The induction hypothesis applied to this shorter derivation proves the claim.

The TEncH, TEncL, TAencH and TAencL cases are impossible, since the condition of the rule would then imply Γ sign(M 1 , M 2 ) ∼ N : (T ) T → c (or {T } T ) for some T , T , c , which is not possible by Lemma A.15.

Finally, in the TSignH and TSignL cases, the premises of the rule directly proves the claim.

The symmetric properties, as described in point 3, have analogous proofs.

Lemma A.17 (Pair types). For all environment Γ, for all M , N , T , c:

1. For all T 1 , T 2 , if Γ M ∼ N : T 1 * T 2 → c then • either there exist M 1 , M 2 , N 1 , N 2 , c 1 , c 2 such that M = M 1 , M 2 , N = N 1 , N 2 , c = c 1 ∪ c 2 , and Γ M 1 ∼ N 1 : T 1 → c 1 and Γ M 2 ∼ N 2 : T 2 → c 2 ;
• or M and N are variables.

For all

M 1 , M 2 , if T <: LL and Γ M 1 , M 2 ∼ N : T → c then either T = LL or there exists T 1 , T 2 such that T = T 1 * T 2 . 3. For all M 1 , M 2 , if Γ M 1 , M 2 ∼ N : LL → c then there exist N 1 , N 2 , c 1 , c 2 , such that c = c 1 ∪ c 2 , N = N 1 , N 2 , Γ M 1 ∼ N 1 : LL → c 1 and Γ M 2 ∼ N 2 : LL → c 2 .
4. The symmetric properties to the previous two points ( i.e. when the term on the right is a pair) also hold.

Proof. Let us prove point 1 by induction on the typing derivation Γ M ∼ N :

T 1 * T 2 → c.
Because of the form of the type, and by well-formedness of Γ, the only possibilities for the last rule applied are TVar, TPair, and TSub.

The claim clearly holds in the TVar and TPair cases.

In the TSub case, Γ M ∼ N : T → c for some T <: T 1 * T 2 , and by Lemma A.1, T = T 1 * T 2 for some T 1 , T 2 such that T 1 <: T 1 and T 2 <: T 2 . Therefore, by applying the induction hypothesis to Γ M ∼ N : T 1 * T 2 → c, M and N are either two variables, and the claim holds; or two pairs, i.e. there exist Similarly, we prove point 2 by induction on the derivation of Γ M ∼ N : pkey(T ) → c. Indeed, by the form of the type, and since Γ is well-formed, the last rule can only be TPubKey, TVar, or TSub. In the TPubKey and TVar cases the claim clearly holds. In the TSub case, we have T <: pkey(T ) such that Γ M ∼ N : T → c with a shorter derivation. By Lemma A.1, T = pkey(T ). We conclude the proof by applying by the induction hypothesis to the shorter derivation of Γ M ∼ N : T → c.

M 1 , M 2 , N 1 , N 2 , c 1 , c 2 such that M = M 1 , M 2 , N = N 1 , N 2 , c = c 1 ∪ c 2 , and for i ∈ {1, 2}, Γ M i ∼ N i : T i → c i . Hence, by subtyping, Γ M i ∼ N i : T i → c i ,
Point 3 has a similar proof to point 2.

We prove point 4 by induction on the derivation of Γ k ∼ N : l → c. Because of the form of the terms and type, and by well-formedness of Γ, the last rule applied can only be TCstFN, TEncH, TEncL, TAencH, TAencL, TLR', TLRL' or TSub.

In the TCstFN case, k = N ∈ FK and the claim holds. The TEncH, TEncL, TAencH, TAencL cases are impossible since they would imply that Γ k ∼ N : (T ) k ,k → c (or {T } k ,k ) for some T , k , k , c , which is impossible by Lemma A.15.

The TLR' and TLRL' cases are impossible. Indeed in these cases, we have Γ k ∼ N : τ l,a m ; τ l ,a n → ∅ for some m, n. Lemma A.14 then implies that m = k (and n = N ), which is contradictory.

Finally, in the TSub case, we have Γ k ∼ N : T → c for some T such that T <: l. By Lemma A.1, this implies that T is either a pair type, an encryption type, a public or verification key type, a key type, or l. The pair, encryption, public and verification key cases are impossible, respectively by Lemma A.17, Lemma A.15, and point 2, since k ∈ K. The last case is trivial by the induction hypothesis. Only the case where T <: key l (T ) (for some T ) remains. By point 1, in that case, since k is not a variable, we have N ∈ K and Γ(k, N ) <: key l (T ), and therefore the claim holds.

Similarly, we prove point 5 by induction on the derivation of Γ pk(M ) ∼ N : LL → c. Because of the form of the terms and type, and by well-formedness of Γ, the last rule applied can only be TEncH, TEncL, TAencH, TAencL, TLRL', TPubKeyL or TSub.

The TEncH, TEncL, TAencH, TAencL cases are impossible since they would imply that Γ pk(M ) ∼ N : (T ) k → c (or {T } k ) for some T , k, c , which is impossible by Lemma A.15.

(b) R 1 φ↓ = ⊥ ∧ R 2 φ↓ = ⊥ In this case, by the induction hypothesis, we also have R 1 φ ↓ = ⊥ ∧ R 2 φ ↓ = ⊥, and we also know that there exist c 1 ⊆ c and c

2 ⊆ c such that Γ R 1 φ↓∼ R 1 φ ↓: LL → c 1 and Γ R 2 φ↓∼ R 2 φ ↓: LL → c 2 .
Thus, by the rule TPair followed by TSub, Γ Rφ↓∼ Rφ ↓: LL → c 1 ∪ c 2 . Since c 1 ∪ c 2 ⊆ c, this proves the case.

6. R = enc(S, K) We apply the induction hypothesis to K and distinguish three cases.

(N ) ⊆ dom(Γ) ∪ dom(σ) ∪ keys(Γ) ∪ F N ∪ F K, therefore names(M σ) ∪ names(N σ ) ∪ vars(M σ) ∪ vars(N σ ) ∪ keys(M σ) ∪ keys(N σ ) ⊆ dom(Γ) ∪ keys(Γ) ∪ F N ∪ F K.
In addition, since M ↓ = ⊥, and ∀x ∈ dom(σ), σ(x)↓= σ(x), we have M σ ↓ = ⊥. Similarly, N σ ↓ = ⊥. Therefore, rule THigh may be applied to obtain Γ M σ ∼ N σ : HL → ∅.

The claim follows directly from the induction hypothesis in all other cases except the TVar and TLRVar cases, which are the base cases.

In the TVar case, the claim also holds, since M = N = x for some variable x ∈ dom(Γ) ∪ dom(Γ ). If x ∈ dom(Γ), then xσ = xσ = x, and T = Γ(x). Thus, by rule TVar, Γ ∪ Γ xσ ∼ xσ : Γ(x) → ∅ and the claim holds. If x ∈ dom(Γ ), then T = Γ (x), and, since by hypothesis the substitutions are well-typed, there exists c Proof. First, it is easy to see by induction on the type derivation that for all ground terms M , N , for all c, if Γ M ∼ N : HH → c then either

x ⊆ c σ,σ such that (Γ ∪ Γ ) N ,K σ(x) ∼ σ (x) : Γ (x) → c x . Thus, since (Γ ∪ Γ ) N ,K = Γ N ,K ,
• M is a nonce m ∈ N such that Γ(m) = τ HH,a m
for some a ∈ {∞, 1};

• or M is a key and there exist k ∈ K and T such that Γ(M, k) <: key HH (T );

• or Γ M ∼ N : HH * T → c for some T , c ;

• or Γ M ∼ N : T * HH → c for some T , c .

• TEnc, TAenc: these two cases are similar, we write the proof for the TEnc case. The form of this rule application is:

Π Γ M ∼ N : T → c Π Γ M ∼ N : T → c Γ enc(M, M ) ∼ enc(N, N ) : (T ) T → c ∪ c
for some T , T such that (T ) T <: LL. By Lemma A.1, T <: LL and T <: LL. We conclude the proof of this case similarly to the TEncL case.

• TSignL: the form of this rule application is:

Π Γ M ∼ N : LL → c Π Γ M ∼ N : LL → c Γ sign(M , M ) ∼ sign(N , M ) : LL → c ∪ c
with M = sign(M , M ), N = sign(N , N ). Thus by applying the induction hypothesis to the two hypotheses of the rule, i.e. Γ M ∼ N :

LL → c and Γ M ∼ N : LL → c there exist R, R such that M = R(φ l (c)∪φ Γ LL ), N = R(φ r (c)∪φ Γ LL ), M = R (φ l (c )∪φ Γ LL ), and N = R (φ r (c ) ∪ φ Γ LL )
. Therefore, the claim holds with the recipe sign(R, R ).

Lemma A.25 (Low frames with consistent constraints are statically equivalent). For all ground φ, φ , for all c, Γ, if

• Γ φ ∼ φ : LL → c
• and c is consistent in Γ N ,K , then φ and φ are statically equivalent.

Proof. We can first notice that since φ and φ are ground, so is c (this is easy to see by examining the typing rules for terms). Let R, R be two attacker recipes, such that vars(R) ∪ vars(R ) ⊆ dom(φ)(= dom(φ )).

For all x ∈ dom(φ)(= dom(φ )), by assumption, there exists c x ⊆ c such that Γ φ(x) ∼ φ (x) : LL → c x . By Lemma A.24, there exists a recipe R x such that φ

(x) = R x (φ l (c x ) ∪ φ Γ LL ) and φ (x) = R x (φ r (c x ) ∪ φ Γ LL ). Since c x ⊆ c, we also have φ(x) = R x (φ l (c) ∪ φ Γ LL ) and φ (x) = R x (φ r (c) ∪ φ Γ LL ).
Let R and R be the recipes obtained by replacing every occurence of x with R x in respectively R and R , for all variable x ∈ dom(φ)(= dom(φ )).

We then have Rφ

= R(φ l (c) ∪ φ Γ LL ) and R φ = R (φ l (c) ∪ φ Γ LL ); and similarly Rφ = R(φ r (c) ∪ φ Γ LL ) and R φ = R (φ r (c) ∪ φ Γ LL )
. Since c is ground, and consistent in Γ N ,K , by definition of consistency, the frames φ l (c) ∪ φ Γ LL and φ r (c) ∪ φ Γ LL are statically equivalent. Hence, by definition of static equivalence,

R(φ l (c) ∪ φ Γ LL ) = R (φ l (c) ∪ φ Γ LL ) ⇐⇒ R(φ r (c) ∪ φ Γ LL ) = R (φ r (c) ∪ φ Γ LL ) i.e. Rφ = R φ ⇐⇒ Rφ = R φ
Therefore, φ and .φ are statically equivalent.

c σ = c σ ). In particular, the consistency of the constraints follows from the consistency hypothesis. Indeed,

(∪ × j =i C j )∪ × C i ∪ ∀ c φ = (∪ × j =i C j )∪ × {(∅, Γ)}∪ ∀ c φ = (∪ × j =i C j )∪ ∀ c φ ,
since Γ is already contained in the environments appearing in each C j (by Lemma A.12). Thus

(∪ × j C j )∪ ∀ c φ σ P ,σ Q = (∪ × j C j )∪ ∀ c φ σ P ,σ Q • PPar: then P i = P 1 i | P 2 i , Q i = Q 1 i | Q 2 i .
Hence, the reduction rule applied to P is Par:

(P, φ P , σ 1 P ) τ -→ (P\{P i } ∪ {P 1 i , P 2 i }, φ P , σ 1 P ). We choose Γ = Γ.
In addition

Π i = Π 1 Γ P 1 i ∼ Q 1 i → C 1 i Π 2 Γ P 2 i ∼ Q 2 i → C 2 i Γ P i ∼ Q i → C i = C 1 i ∪ × C 2 i .
The same reduction rule can be applied to Q:

(Q, φ Q , σ 1 Q ) τ -→ (Q\{Q i } ∪ {Q 1 i , Q 2 i }, φ Q , σ 1 Q )
In this case again, the claims on the substitutions and frames, as well as the claim that

c σ ⊆ c φ σ 2 P ,σ 2 Q
, hold since they do not change in the reduction. Moreover the processes in P and Q are still pairwise typably equivalent. Indeed, all the processes from P and Q are unchanged, except for P i and Q i which are reduced to P 1 i , P 2 i , Q 1 i , Q 2 i , and those are typably equivalent using Π 1 and Π 2 .

Finally the constraint set is still consistent, since:

(∪ × j C j )∪ ∀ c φ σ P ,σ Q = (∪ × j =i C j )∪ × C 1 i ∪ × C 2 i ∪ ∀ c φ σ P ,σ Q = (∪ × j C j )∪ ∀ c φ σ P ,σ Q • PNew: then P i = new n : τ l,a n .P i and Q i = new n : τ l,a n .Q i . P i is reduced to P i by rule New: (P, φ P , σ 1 P ) τ -→ (P\{P i } ∪ {P i }, φ P , σ 1 P ).
In addition

Π i = Π i Γ, n : τ l,a n P i ∼ Q i → C i Γ P i ∼ Q i → C i .
We choose Γ = Γ, n : τ l,a n . The same reduction rule can be applied to Q:

(Q, φ Q , σ 1 Q ) τ -→ (Q\{Q i } ∪ {Q i }, φ Q , σ 1 Q )
The claim clearly holds. Indeed the processes are still pairwise typable: these substitutions such that either σ P = σ P and σ Q = σ Q ; or σ P = σ P ∪ {M/x} and σ Q = σ Q ∪ {N/x} for some messages M , N . In all cases, it is clear from the reduction rules that M↓ = ⊥ and N↓ = ⊥. We will then only need to check the well-typedness condition on variable x, i.e. Γ N ,K σ P (x) ∼ σ Q (x) : Γ (x) → c x for some c x . We can then choose c σ = c σ ∪ c x . As we will see in the proof, we will always have c x ⊆ c φ σ P ,σ Q ∪ c σ .

In addition, c φ = c φ , and by assumption, x cannot appear in c φ , thus c φ σ P ,σ Q = c φ σ P ,σ Q .

Therefore, since by assumption c σ ⊆ c φ σ P ,σ Q , the claim that c σ ⊆ c φ σ P ,σ Q will always hold.

c) the new processes obtained by reducing P i and Q i are typably equivalent in Γ , with a constraint C i , such that

(∪ × j =i C j )∪ × C i ∪ ∀ c φ σ P ,σ Q is consistent.
The actual claim, from the statement of the lemma, is that

(∪ × j =i C j )∪ × C i ∪ ∀ c φ σ P ,σ Q
is consistent, but we can show that the previous condition is sufficient.

In the case where Γ = Γ , we have σ P = σ P , σ Q = σ Q , C j = C j for j = i, and c σ = c σ . Thus the proposed condition is clearly sufficient (it is even necessary in this case).

In the case where Γ = Γ, x : T for some T which is not a union type, and the substitutions σ P , σ Q are σ P , σ Q extended with a term associated to x, the proof that the condition is sufficient is more involved. First, we show that (∪

× j =i C j )∪ × C i = (∪ × j =i C j )∪ × C i . Indeed, if S denotes the set (∪ × j =i C j )∪ × C i , we have S = {( j c j , j Γ j ) | ∀j. (c j , Γ j ) ∈ C j ∧ ∀j, j . Γ j and Γ j are compatible)} = {(c i ∪ j =i c j , Γ i ∪ j =i (Γ j , x : T ) | (c i , Γ i ) ∈ C i ∧ (∀j = i. (c j , Γ j ) ∈ C j ) ∧ (∀j = i, j = i. (Γ j , x : T ) and (Γ j , x : T ) are compatible) ∧ (∀j = i. Γ i and (Γ j , x : T ) are compatible))} since we already know that for j = i, C j = {(c, Γ c ∪ {x : T })|(c, Γ c ) ∈ C j }.
Assuming we show that Γ, x : T P i ∼ Q i → C i , by Lemma A.12, we will also have that all the Γ i appearing in the elements of C i contain x : T (since T is not a union type). Hence:

S = {(c i ∪ j =i c j , Γ i ∪ ( j =i Γ j ) | (c i , Γ i ) ∈ C i ∧ (∀j = i. (c j , Γ j ) ∈ C j ) ∧ (∀j = i, j = i. Γ j and Γ j are compatible) ∧ (∀j = i. Γ i and Γ j are compatible))} = (∪ × j =i C j )∪ × C i Let φ = {M σ P /x, M σ P /y} and φ = {N σ Q /x, N σ Q /y}. We then have Γ N ,K φ ∼ φ : LL → c ∪ c .
Let us prove that c ∪ c is consistent in some typing environment. By hypothesis, σ P , σ Q are ground and Γ N ,K σ P ∼ σ Q : Γ X → c σ . Hence, by Lemma A.4, there exists Γ ∈ branches(Γ) such that Γ N ,K σ P ∼ σ Q : Γ X → c σ . By Lemma A.13, there exists

(c 1 , Γ ) ∈ C i such that Γ ⊆ Γ . Since C i = (C i ∪ C ⊥ i )∪ ∀ (c ∪ c ), c 1 is of the form c 2 ∪ c ∪ c for some c 2 .
As we noted previously,

C i σ P ,σ Q ∪ ∀ c σ is consistent. Therefore, by Lemma A.11, the constraint {( c ∪ c σ P ,σ Q ∪ c σ , Γ )} is consistent. Hence, by the same Lemma, c ∪ c is also consistent in Γ .
Thus, by Lemma A.25, φ and φ are statically equivalent. Hence, in particular,

M σ P = M σ P ⇐⇒ N σ Q = N σ Q .
Therefore, if rule If-Then is applied to P i then it can also be applied to reduce Q i into Q i , and if the rule applied to P i is If-Else then it can also be applied to reduce Q i into Q ⊥ i . This proves point a). We prove here the If-Then case. The If-Else case is similar.

We choose Γ = Γ. We have σ 2 P = σ 1 P and σ 2 Q = σ 1 Q . Since the substitutions and environments do not change in this reduction, point b) trivially holds.

Moreover, by hypothesis,

(∪ × j =i C j )∪ × (C i ∪ C ⊥ i )∪ ∀ (c ∪ c ∪ c φ ) σ P ,σ Q is consistent. Thus by Lemma A.11, (∪ × j =i C j )∪ × (C i ∪ C ⊥ i )∪ ∀ c φ σ P ,σ Q is also consistent. Since, using C i = C i and C i = (C i ∪ C ⊥ i )∪ ∀ (c ∪ c ), (∪ × j =i C j )∪ × C i ∪ ∀ c φ σ P ,σ Q ⊆ (∪ × j =i C j )∪ × (C i ∪ C ⊥ i )∪ ∀ c φ σ P ,σ Q , we have by Lemma A.11 that (∪ × j =i C j )∪ × C i ∪ ∀ c φ σ P ,σ Q is consistent.
Π and this fact prove point c) and conclude this case.

The case where M σ P ↓= N σ Q ↓= ⊥ or M σ P ↓= N σ Q ↓= ⊥ remains. In that case, the rule applied to P i is necessarily If -Else, and this rule can also be applied to Q i . We conclude the proof similarly to the previous case.

• PIfLR:

P i = if M 1 = M 2 then P i else P ⊥ i and Q i = if N 1 = N 2 then Q i else Q ⊥ i
for some Q i , Q ⊥ i . P i reduces to P i which is either P i via the If-Then rule, or P ⊥ i via the If-Else rule. In addition

Π i = Π Γ M 1 ∼ N 1 : τ l,1 m ; τ l ,1 n → ∅ Π Γ M 2 ∼ N 2 : τ l ,1 m ; τ l ,1 n → c b = (τ l,1 m ? = τ l ,1 m ) b = (τ l ,1 n ? = τ l ,1 n ) Π Γ P b i ∼ Q b i → C i Γ P i ∼ Q i → C i = C i
Thus the reduction rule applied to P i is If-Then and P i = P i . On the other hand, rule If-Then can also be applied to reduce Q i into Q i = Q i . This proves point a).

Note that we still need to type the other branch, even though it is not used here, as when replicating the process this test may fail if M 1 , N 1 and M 2 , N 2 are nonces from different sessions.

We choose Γ = Γ. We have σ 2 P = σ 1 P and σ 2 Q = σ 1 Q . Since the substitutions and environments do not change in this reduction, point b) trivially holds.

Moreover, Π and the fact that, with

C i = C i , (∪ × j =i C j )∪ × C i ∪ ∀ c φ σ P ,σ Q ⊆ (∪ × j =i C j )∪ × (C i ∪ C ⊥ i )∪ ∀ c φ σ P ,σ Q = (∪ × j C j )∪ ∀ c φ σ P ,σ Q prove point c
) and conclude this case.

• PIfLR'*:

P i = if M 1 = M 2 then P i else P ⊥ i and Q i = if N 1 = N 2 then Q i else Q ⊥ i
for some Q i , Q ⊥ i . P i reduces to P i which is either P i via the If-Then rule, or P ⊥ i via the If-Else rule. In addition

Π i = Π Γ M 1 ∼ N 1 : τ l,a m ; τ l ,a n → c 1 Π Γ M 2 ∼ N 2 : τ l ,a m ; τ l ,a n → c 2 τ l,a m = τ l ,a m τ l ,a n = τ l ,a n Π Γ P ⊥ i ∼ Q ⊥ i → C i Γ P i ∼ Q i → C i = C i
We have α = τ in any case. In addition, by assumption, tσ P = tσ 1 P for t ∈ {M 1 , M 2 } and t σ Q = t σ 1 Q for t ∈ {N 1 , N 2 }. By hypothesis, σ P , σ Q are ground and Γ N ,K σ P ∼ σ Q : Γ X → c σ . Hence, by Lemma A.22, using Π, there exists c such that Γ N ,K M 1 σ P ∼ N 1 σ Q : τ l,a m ; τ l ,a n → c . Therefore by Lemma A.14, M 1 σ P = m and N 1 σ Q = n. Similarly, using Lemma A.14, we can show that M 2 σ P = m and N 2 σ Q = n . Moreover, since τ l,a m = τ l ,a m , we know that m = m (by well-formedness of the processes), and similarly n = n .

Hence, M

1 σ P = M 2 σ P and N 1 σ Q = N 2 σ Q .
Thus the reduction rule applied to P i is If-Else and P i = P ⊥ i . On the other hand, rule If-Else can also be applied to reduce

Q i into Q i = Q ⊥ i .
This proves point a). We choose Γ = Γ. We have σ 2 P = σ 1 P and σ 2 Q = σ 1 Q . Since the substitutions and environments do not change in this reduction, point b) trivially holds.

Moreover, Π and the fact that

(∪ × j =i C j )∪ × C i ∪ ∀ c φ σ P ,σ Q = (∪ × j C j )∪ ∀ c φ σ P ,σ Q
prove point c) and conclude this case.

• PIfAll: then

P i = if M = M then P i else P ⊥ i and Q i = if N = N then Q i else Q ⊥ i
for some Q i , Q ⊥ i . P i reduces to P i which is either P i via the If-Then rule, or P ⊥ i via the If-Else rule. In addition

Π i = Π , Γ P i ∼ Q i → C , i Π ,⊥ Γ P i ∼ Q ⊥ i → C ,⊥ i Π ⊥, Γ P ⊥ i ∼ Q i → C ⊥, i Π ⊥,⊥ Γ P ⊥ i ∼ Q ⊥ i → C ⊥,⊥ i Γ if M = M then P i else P ⊥ i ∼ if N = N then Q i else Q ⊥ i → C i = C , i ∪ C ,⊥ i ∪ C ⊥, i ∪ C ⊥,⊥ i
In addition, by hypothesis, tσ P = tσ 1 P for t ∈ {M, M } and t σ Q = t σ 1 Q for t ∈ {N, N }. Four cases are possible:

-M σ P ↓ = ⊥, M σ P ↓ = ⊥, N σ Q ↓ = ⊥, N σ Q ↓ = ⊥, M σ P = M σ P and N σ Q = N σ Q ; -or M σ P ↓ = ⊥, M σ P ↓ = ⊥, M σ P = M σ P and (N σ Q = N σ Q or N σ Q ↓= ⊥ or N σ Q ↓= ⊥); -or N σ Q ↓ = ⊥, N σ Q ↓ = ⊥, N σ Q = N σ Q and (M σ P = M σ P or M σ P ↓= ⊥ or M σ P ↓= ⊥); -or (M σ P = M σ P or M σ P ↓= ⊥ or M σ P ↓= ⊥) and (N σ Q = N σ Q or N σ Q ↓= ⊥ or N σ Q ↓= ⊥).
In any case, we have α = τ . These four cases are similar, we detail the proof for the second case, where M σ P = M σ P and N σ Q = N σ Q .

Since M σ P = M σ P , M σ P ↓ = ⊥, and M σ P = M σ P , the reduction applied to P i can only be If-Then, and P i is reduced to

P i . Since N σ Q = N σ Q , N σ Q ↓= ⊥, or N σ Q ↓= ⊥, rule If-Else can be applied to reduce Q i into Q ⊥ i .
This proves point a). We choose Γ = Γ. We have σ 2 P = σ 1 P and σ 2 Q = σ 1 Q . Since the substitutions and environments do not change in this reduction, point b) trivially holds.

Moreover, by hypothesis,

(∪ × j =i C j )∪ × (C , i ∪ C ,⊥ i ∪ C ⊥, i ∪ C ⊥,⊥ i )∪ ∀ c φ σ P ,σ Q is consistent. Since, using C i = C ,⊥ i , (∪ × j =i C j )∪ × C i ∪ ∀ c φ σ P ,σ Q ⊆ (∪ × j =i C j )∪ × (C , i ∪ C ,⊥ i ∪ C ⊥, i ∪ C ⊥,⊥ i )∪ ∀ c φ σ P ,σ Q , we have by Lemma A.11 that (∪ × j =i C j )∪ × C i ∪ ∀ c φ σ P ,σ Q is consistent. Π ,⊥
and this fact prove point c) and conclude this case.

Theorem A.1 (Typing implies trace inclusion). For all processes P , Q, for all φ P , φ Q , σ P , σ Q , for all multisets of processes P, Q for all constraints C, for all sequence s of actions, for all Γ containing only keys, if

Γ P ∼ Q → C,
and if C is consistent, then P t Q that is, if ({P }, ∅, ∅) s -→ * (P, φ P , σ P ),
then there exists a sequence s of actions, a multiset Q, a frame φ Q , a substitution σ Q , such that

• s = τ s • ({Q}, ∅, ∅) s --→ * (Q, φ Q , σ Q ),
• φ P σ P and φ Q σ Q are statically equivalent.

Proof. We successively apply Lemma A.26 to each of the reduction steps in the reduction ({P }, ∅, ∅) s -→ * (P, φ P , σ P ).

The lemma can indeed be applied successively. At each reduction step of P we obtain a sequence of reduction steps for Q with the same actions, and the conclusions the lemma provides imply the conditions needed for its next application.

It is clear, for the first application, that all the hypotheses of this lemma are satisfied.

In the end, we know that there exist Γ , some constraint sets C i , some c φ , c σ , and a reduction

({Q}, ∅, ∅) s --→ * (Q, φ Q , σ Q )
with s = τ s , such that (among other conclusions)

• σ P , σ Q are ground, and there exist ground

σ P ⊇ σ P , σ Q ⊇ σ Q such that -(dom(σ P )\dom(σ P )) ∩ (vars(P) ∪ vars(φ P )) = ∅, -(dom(σ Q )\dom(σ Q )) ∩ (vars(Q) ∪ vars(φ Q )) = ∅, and
-Γ N ,K σ P ∼ σ Q : Γ X → c σ ,
for all x ∈ dom(σ P ), σ P (x)↓= σ P (x), and similarly for σ Q ,

• c σ ⊆ c φ σ P ,σ Q , • Γ φ P ∼ φ Q : LL → c φ , • dom(φ P ) = dom(φ Q ), • ∀i, Γ P i ∼ Q i → C i ,
• for all i = j, the sets of bound variables in P i and P j (resp. Q i and Q j ) are disjoint, and similarly for the bound names;

• (∪ × i C i )∪ ∀ c φ σ P ,σ Q is consistent.
the processes or environments considered. We will denote by N 0 the set of unindexed names and by N i the set of indexed names. We similarly assume that for all the variables x appearing in the processes, the set X of all variables also contains variables {x i | i ∈ N}. We denote X 0 the set of unindexed variables, and X i the set of indexed variables. Finally, we assume for all key k declared in the processes with type seskey l,∞ (T ) that the set BK contains keys {k i | i ∈ N}.

Lemma A.27 (Typing terms with replicated names). For all Γ, M , N , T and c, if

Γ M ∼ N : T → c
then for all i, n ∈ N such that 1 ≤ i ≤ n, for all Γ ∈ branches([ Γ ] n i ),

Γ [ M ] Γ i ∼ [ N ] Γ i : [ T ] n → [ c ] Γ i Proof.
Let Γ, M , N , T , c be such as assumed in the statement of the lemma. Let i, n ∈ N such that 1 ≤ i ≤ n. Let Γ ∈ branches([ Γ ] n i ). We prove this property by induction on the proof Π of Γ M ∼ N : T → c.

There are several possible cases for the last rule applied in Π. Therefore by rule TEncH, we have

Γ [ M ] Γ i ∼ [ N ] Γ i : LL → c Γ i ∪ {[ M ] Γ i ∼ [ N ] Γ i } = [ c ] Γ i
• TPubKey, TVKey, TEnc, TEncL, TAenc, TAencH, TAencL,TSignH, TSignL, as well as TPair, TOr,THash, THashL: Similarly to the TEncH case, the claim is proved directly by applying the induction hypothesis to the type judgement appearing in the conditions of the last rule in these cases.

• TVar: then M = N = x for some x ∈ X , and Π = Γ(x) = T Γ x ∼ x : T → ∅ .

We Let us distinguish the case where a is 1 from the case where a is ∞.

If a is 1: by applying the induction hypothesis to Π , since τ l,a m ; τ l,a p n = τ l,1 m ; τ l,1 p , we have Γ [ M ] Γ i ∼ [ N ] Γ i : τ l,a m ; τ l,a p → [ c ] Γ i . Thus by rule TLR', we have

[ Γ ] n i [ M ] Γ i ∼ [ N ] Γ i : l → [ c ] Γ i .
If a is ∞: by applying the induction hypothesis to Π , since τ l,a m ; τ l,a p n = 1≤j≤n τ l,1 m j ; τ l,1 p j ,

we have Γ [ M ] Γ i ∼ [ N ] Γ i : 1≤j≤n τ l,1 m j ; τ l,1 p j → [ c ] Γ i .
Thus, by Lemma A.5, there exists j ∈ 1, n and a proof Π of

Γ [ M ] Γ i ∼ [ N ] Γ i : τ l,1 m j ; τ l,1 p j → [ c ] Γ i .
Thus, by rule TLR',

Γ [ M ] Γ i ∼ [ N ] Γ i : l → [ c ] Γ
i , which proves the claim.

• TLRVar: this case is similar to the TLR' case, but only the case where a is 1 is possible. By applying the induction hypothesis to Π , we have

Γ [ M ] Γ i ∼ [ N ] Γ i : T n → [ c ] Γ i .
Since it is clear by induction on the subtyping rules that T <: T implies that [ T ] n <: [ T ] n , the TSub rule can be applied and proves the claim.

• Lemma A.28 (Typing destructors with replicated names). For all Γ, t, t , T , if

Γ t ∼ t : T then for all i, n ∈ N such that 1 ≤ i ≤ n, [ Γ ] n i [ t ] Γ i ∼ t Γ i : [ T ] n
Proof. Immediate by examining the typing rules for destructors. Consequently if for some C, C Γ ⊆ C for all Γ , then there exists C ⊆ C such that

Γ P ∼ Q → C .
Proof. The first point is easily proved by successive applications of rule POr.

The second point is a direct consequence of the first point.

Lemma A.31 (Expansion and union).

• For all constraint sets C, C , such that ∀(c, Γ) ∈ C ∪ C . branches(Γ) = {Γ}, i.e. such that Γ does not contain union types, and names(c) ⊆ dom(Γ) ∪ FN , and Γ only nonce types with names from N 0 ( i.e. unindexed names), we have

C∪ × C n i = [ C ] n i ∪ × C n i
• For all C, c, Γ, such that names(c) ⊆ dom(Γ) and ∀(c, Γ ) ∈ C. Γ N ,K ⊆ Γ , we have

[ C∪ ∀ c ] n i = [ C ] n i ∪ ∀ [ c ] Γ i
Proof. The first point follows from the definition of [ • ] n i and ∪ × . Indeed, if C, C are as assumed in the claim, we have:

[ C∪ × C ] n i = {([ c ] Γ i , Γ )|∃Γ. (c, Γ) ∈ C∪ × C ∧ Γ ∈ branches([ Γ ] n i )} = {([ c 1 ∪ c 2 ] Γ1∪Γ2 i , Γ )|∃Γ 1 Γ 2 . (c 1 , Γ 1 ) ∈ C ∧ (c 2 , Γ 2 ) ∈ C ∧ Γ 1 , Γ 2 are compatible ∧ Γ ∈ branches([ Γ 1 ∪ Γ 2 ] n i )} = {([ c 1 ] Γ1 i ∪ [ c 2 ] Γ2 i , Γ )|∃Γ 1 Γ 2 . (c 1 , Γ 1 ) ∈ C ∧ (c 2 , Γ 2 ) ∈ C ∧ Γ 1 , Γ 2 are compatible ∧ Γ ∈ branches([ Γ 1 ] n i ∪ [ Γ 2 ] n i )} = {([ c 1 ] Γ1 i ∪ [ c 2 ] Γ2 i , Γ ∪ Γ )|∃Γ 1 Γ 2 . (c 1 , Γ 1 ) ∈ C ∧ (c 2 , Γ 2 ) ∈ C ∧ Γ 1 , Γ 2 are compatible ∧ Γ ∈ branches([ Γ 1 ] n i ) ∧ Γ ∈ branches([ Γ 2 ] n i ) ∧ Γ, Γ are compatible}
The last step is proved by directly showing both inclusions.

On the other hand we have:

[ C ] n i ∪ × [ C ] n i = {(c ∪ c , Γ ∪ Γ )|(c, Γ) ∈ [ C ] n i ∧ (c , Γ ) ∈ [ C ] n i ∧ Γ, Γ are compatible} = {([ c 1 ] Γ 1 i ∪ [ c 2 ] Γ 2 i , Γ ∪ Γ )|∃Γ 1 Γ 2 . (c 1 , Γ 1 ) ∈ C ∧ (c 2 , Γ 2 ) ∈ C ∧ Γ ∈ branches([ Γ 1 ] n i ) ∧ Γ ∈ branches([ Γ 2 ] n i ) ∧ Γ, Γ are compatible} = {([ c 1 ] Γ 1 i ∪ [ c 2 ] Γ 2 i , Γ ∪ Γ )|∃Γ 1 Γ 2 . (c 1 , Γ 1 ) ∈ C ∧ (c 2 , Γ 2 ) ∈ C ∧ Γ ∈ branches([ Γ 1 ] n i ) ∧ Γ ∈ branches([ Γ 2 ] n i ) ∧ Γ, Γ are compatible ∧ Γ 1 , Γ 2 are compatible}
This last step comes from the fact that if (c 1 , Γ 1 ) ∈ C and (c 2 , Γ 2 ) ∈ C , then by assumption Γ 1 and Γ 2 do not contain union types. This implies that if Γ ∈ branches([ Γ 1 ] n i ) and Γ ∈ branches([ Γ 2 ] n i ) are compatible, then Γ 1 and Γ 2 are compatible. Indeed, let x ∈ dom(Γ 1 ) ∩ dom(Γ 2 ). Hence x i ∈ dom(Γ) ∩ dom(Γ ), and since they are compatible, Γ(x i ) = Γ (x i ). That is to say that there exists T ∈ branches([ Γ 1 (x) ] n ) ∩ branches([ Γ 2 (x) ] n ).

If Γ 1 (x) = τ l,∞ m ; τ l ,∞ p (for some m, p, l, l ), then [ Γ 1 (x) ] n = 1≤j≤n τ l,1 m j ; τ l ,1 p j , and thus there exists j ∈ 1, n such that T = τ l,1 m j ; τ l ,1 p j . Hence, τ l,1 m j ; τ l ,1 p j ∈ branches([ Γ 2 (x) ] n ). Because of the definition of [ • ] n , and since Γ 2 (x) is not a union type (by assumption), this implies that Γ 2 (x) = τ l,∞ m ; τ l ,∞ p , and therefore Γ 1 (x) = Γ 2 (x). If Γ 1 (x) is not of the form τ l,∞ m ; τ l ,∞ p (for some m, p, l, l ), then neither is Γ 2 (x) (by contraposition, following the same reasoning as in the previous case). Γ 1 (x) and Γ 2 (x) are not of the form T ∨ T either, by assumption. Therefore, neither [ Γ 1 (x) ] n nor [ Γ 2 (x) ] n are union types (from the definition of [ • ] n ). This implies that T = [ Γ 1 (x) ] n = [ Γ 2 (x) ] n , which implies Γ 1 (x) = Γ 2 (x).

In both cases Γ 1 (x) = Γ 2 (x), and Γ 1 , Γ 2 are therefore compatible.

Hence [ C ] n i ∪ × [ C ] n i = [ C∪ × C
] n i , which proves the claim.

The second point directly follows from the definition of [ • ] n i and ∪ ∀ . Indeed, for all C, c, Γ satisfying the assumptions, we have:

[ C∪ ∀ c ] n i = {([ c ] Γ i , Γ )|∃Γ . (c , Γ ) ∈ C∪ ∀ c ∧ Γ ∈ branches([ Γ ] n i )} = {([ c ∪ c ] Γ i , Γ )|∃Γ . (c , Γ ) ∈ C ∧ Γ ∈ branches([ Γ ] n i )} = {([ c ] Γ i ∪ [ c ] Γ i , Γ )|∃Γ . (c , Γ ) ∈ C ∧ Γ ∈ branches([ Γ ] n i )} = {([ c ] Γ i ∪ [ c ] Γ i ,
Γ P ∼ Q → C
then for all i, n ∈ N such that 1 ≤ i ≤ n, there exists C ⊆ [ C ] n i such that

[ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C
Proof. We prove this theorem by induction on the derivation Π of Γ P ∼ Q → C. We distinguish several cases for the last rule applied in this derivation. Thus, by applying rule POr as many times as necessary to split [ Γ ] n i into all of its branches, followed by rule PZero, we have [ Γ ] n i

[ P ] Γ i ∼ [ Q ] Γ i → [ C ] n i .
• POut: then P = out(M ).P , Q = out(N ).Q for some messages M , N and some processes P , Q , and

Π = Π Γ P ∼ Q → C Π Γ M ∼ N : LL → c Γ P ∼ Q → C = C ∪ ∀ c
.

By
Γ i ∼ [ Q ] Γ i → C Γ ∪ ∀ [ c ] Γ i ⊆ C ∪ ∀ [ c ] Γ i .
Thus by Lemma A.30, there exists

C 1 ⊆ C ∪ ∀ [ c ] Γ i such that [ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C 1 . Finally, [ C ] n i = [ C ∪ ∀ c ] n i = [ C ] n i ∪ ∀ [ c ] Γ i (
[ P ] Γ i ∼ [ Q ] Γ i → C ⊆ [ C ] n i .
• PNew: then P = new m : τ l,a m .P , Q = new m : τ l,a m .Q for some m, l, a and some processes P , Q , and

[ P ] Γ i ∼ [ Q ] Γ i → C ⊆ [ C ] n i .
• PNewKey: this case is similar to the PNew case.

• PPar: then P = P | P , Q = Q | Q for some processes P , Q , P , Q , and

Π = Π Γ P ∼ Q → C Π Γ P ∼ Q → C Γ P ∼ Q → C = C ∪ × C .
Γ i = [ Q | Q ] Γ i = [ Q ] Γ i | [ Q ] Γ i . Finally, [ C ] n i = [ C ∪ × C ] n i = [ C ] n i ∪ × [ C ] n i
, by Lemma A.31 (using Lemma A.9 to ensure the condition that the environments do not contain union types). Therefore, using Π , Π and rule PPar, we have [ Γ ] n i

[ P ] Γ i ∼ [ Q ] Γ i → C ∪ × C ⊆ [ C ] n i .
• POr: then Γ = Γ , x : T ∨ T for some Γ , some x ∈ X and some types T , T , and Thus by rule POr, we have

Π = Π T Γ , x : T P ∼ Q → C Π T Γ , x : T P ∼ Q → C Γ P ∼ Q → C = C ∪ C .
Γ n i , x i : [ T ] n ∨ T n [ P ] Γ i ∼ [ Q ] Γ i → C 1 ∪ C 2 ⊆ C n i ∪ C n i = [ C ] n i . Since [ Γ ] n i = [ Γ , x : T ∨ T ] n i = [ Γ ] n i , x i : [ T ] n ∨ [ T ]
n , this proves the claim in this case.

• PLet: then P = let x = t in P else P , Q = let x = t in Q else Q for some variable x and some processes P , Q , P , Q , and

Π = Π d Γ t ∼ t : T Π Γ, x : T P ∼ Q → C Π Γ P ∼ Q → C Γ P ∼ Q → C = C ∪ C . Since [ Γ, x : T ] n i = [ Γ ] n i , x i : [ T ] n ,
Γ i = let x i = [ t ] Γ i in [ P ] Γ i else [ P ] Γ i = let x i = [ t ] Γ i in [ P ] Γ,x:T i else [ P ] Γ i . Similarly, [ Q ] Γ i = let x i = [ t ] Γ i in [ Q ] Γ,x:T i else [ Q ] Γ i .
Therefore, using Π and rule PLet, we have

[ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C ∪ C ⊆ [ C ] n i .
• PLetDec: then P = let x = dec(y, k 1 ) in P else P , and Q = let x = dec(y, k 2 ) in Q else Q for some variable x, some keys k 1 , k 2 , and some processes P , Q , P , Q , and

) in Q else Q → C ∪ C ∪ ( k3 C k3 ) ∪ ( k3 C k3 )
Let us write the proof for the case where Γ(k 1 , k 2 ) = seskey HH,∞ (T ). The other case is similar, although the keys are renamed, and slightly easier, since by well-formedness of Γ there are no k 3 satisfying the assumptions of the last two premises.

We thus have [

k 1 ] Γ i = k 1 , [ k 2 ] Γ i = k 2 ,
P Γ i ∼ Q Γ i → C 1 .
Similarly, for each k 3 = k 2 such that Γ(k 1 , k 3 ) = key HH (T ) for some T , there exist

C k 3 ,1 ⊆ [ C k 3 ] n i and a proof Π 1,k 3 1 of [ Γ ] n i , x i : T n P Γ i ∼ Q Γ i → C k 3 ,1 .
Similarly, for each k 3 = k 1 such that Γ(k 3 , k 2 ) = key HH (T ) for some T , there exist

C k 3 ,1 ⊆ C k 3 n i and a proof Π 2,k 3 1 of [ Γ ] n i , x i : T n P Γ i ∼ Q Γ i → C k 3 ,1 .
Moreover, by definition, [ Γ ] n i (y i ) = LL, and for all l, T , and all keys k, k that are either k 1 , k 2 , or a k 3 such as in the premises of the rule, if Γ(k, k ) <: key l (T ) then [ Γ ] n i (k, k ) <: key l ([ T ] n ). In addition,

[ P ] Γ i = [ let x = dec(y, k 1 ) in P else P ] Γ i = let x i = dec(y i , k 1 ) in [ P ] Γ i else [ P ] Γ i ,
i.e.

[ P ] Γ i = let x i = dec(y i , k 1 ) in P Γ,x:T i else

P Γ i . Similarly, [ Q ] Γ i = let x i = dec(y i , k 2 ) in [ Q ] Γ,x:T i else [ Q ] Γ i .
Therefore, using Π 1 , Π 1 , the Π 1,k 3 1 and Π 2,k 3 1 , and rule PLetDec, we have [ Γ ] n i

[ P ] Γ i ∼ [ Q ] Γ i → C 1 ∪ C 1 ∪ ( k 3 C k 3 ,1 ) ∪ ( k 3 C k 3 ,1 ) ⊆ [ C ] n i .
• PLetAdecSame, PLetAdecDiff: these cases are similar to the PLetDec case.

• PLetLR: then P = let x = d(y) in P else P , Q = let x = d(y) in Q else Q for some variable x ∈ X and some processes P , Q , P , Q , and Π = Γ(y) = τ l,a m ; τ l ,a p ∨ Γ(y) <: key l (T )

Π Γ P ∼ Q → C Γ P ∼ Q → C
for some m, p.

By applying the induction hypothesis to Π , there exists

C ⊆ [ C ] n i and a proof Π of [ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C . We have [ P ] Γ i = [ let x = d(y) in P else P ] Γ i = let x i = d(y i ) in [ P ] Γ i else [ P ] Γ i . Similarly, [ Q ] Γ i = let x i = d(y i ) in [ Q ] Γ i else [ Q ] Γ i .
Let us first prove the case where Γ(y) = τ l,a m ; τ l ,a p .

We distinguish two cases, depending on whether the types in the refinement τ l,a m ; τ l ,a p are finite nonce types or infinite nonce types, i.e. whether a is 1 or ∞.

-If a is 1: Then by definition of [ Γ ] n i , we have [ Γ ] n i (y i ) = τ l,1 m ; τ l ,1 p . Therefore, using Π and rule PLetLR, we have [ Γ ] n i

[ P ] Γ i ∼ [ Q ] Γ i → C ⊆ [ C ] n i .
-If a is ∞: Then by definition of [ Γ ] n i , we have [ Γ ] n i (y i ) = 1≤j≤n τ l,1 m j ; τ l ,1 p j . Let Γ ∈ branches([ Γ ] n i ). By definition, there exists j ∈ 1, n , such that Γ (y i ) = τ l,1 m j ; τ l ,1 p j . Using Π and Lemma A.7, there exist C Γ ⊆ [ C ] n i and a derivation Π Γ of Γ

[ P ] Γ i ∼ [ Q ] Γ i → C Γ .
Therefore, using rule PLetLR, we have, for all Γ ∈ branches(

[ Γ ] n i ), Γ [ P ] Γ i ∼ [ Q ] Γ i → C Γ ⊆ [ C ] n i .
Thus, by Lemma A.30, we have

[ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C ,
where C ⊆ [ C ] n i , which proves the claim in this case.

We now prove the case where Γ(y) <: key l (T ). By Lemma A.1, we thus have Γ(y) ∈ {seskey l,∞ (T ), seskey l,1 (T ), eqkey l (T ), key l (T )}.

In all cases we have Γ(y i ) <: key l ([ T ] n ). Hence using Π and rule PLetLR, we have

[ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C .
• PIfL: then P = if M = M then P else P , Q = if N = N then Q else Q for some messages M , N , M , N , and some processes P , Q , P , Q , and

Π = Π Γ P ∼ Q → C Π Γ P ∼ Q → C Π 1 Γ M ∼ N : LL → c Π 2 Γ M ∼ N : LL → c Γ P ∼ Q → C = (C ∪ C )∪ ∀ (c ∪ c )
.

By
Γ i ∼ [ N ] Γ i : LL → [ c ] Γ i . In addition, [ P ] Γ i = if M = M then P else P Γ i = if [ M ] Γ i = M Γ i then P Γ i else P Γ i . Similarly, [ Q ] Γ i = if [ N ] Γ i = [ N ] Γ i then [ Q ] Γ i else [ Q ] Γ i .
Therefore, using Π 1,Γ , Π 2,Γ , Π 1,Γ , Π 2,Γ and rule PIfL, we have

Γ [ P ] Γ i ∼ [ Q ] Γ i → (C Γ ∪ C Γ )∪ ∀ ([ c ] Γ i ∪ c Γ i ) ⊆ (C ∪ C )∪ ∀ ([ c ] Γ i ∪ c Γ i ).
Thus by Lemma A.30, there exists • PIfP: then P = if M = t then P else P , Q = if N = t then Q else Q for some messages M , N , some t ∈ K ∪ N ∪ C, and some processes P , Q , P , Q , and

C 1 ⊆ (C ∪ C )∪ ∀ ([ c ] Γ i ∪ [ c ] Γ i ) such that [ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C 1 . Finally, [ C ] n i = [ (C ∪ C )∪ ∀ (c ∪ c ) ] n i = ([ C ] n i ∪[ C ] n i )∪ ∀ ([ c ] Γ i ∪[ c ] Γ i ) (
Π = Π Γ P ∼ Q → C Π Γ P ∼ Q → C Π 1 Γ M ∼ N : LL → c Π 2 Γ t ∼ t : LL → c Γ P ∼ Q → C = C ∪ C
.

By
Γ i = if [ N ] Γ i = [ N ] Γ i then [ Q ] Γ i else [ Q ] Γ i .
Therefore, using Π 1,Γ , Π 2,Γ , Π 1,Γ , Π 2,Γ and rule PIfP, we have for all Γ ∈ branches([ Γ ] n i )

Γ [ P ] Γ i ∼ [ Q ] Γ i → C Γ ∪ C Γ ⊆ C ∪ C .
Thus by Lemma A.30, there exists

C 1 ⊆ (C ∪ C ) such that [ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C 1 . Finally, [ C ] n i = [ C ∪ C ] n i = [ C ] n i ∪[ C ] n i (
Γ i = [ if M 1 = M 2 then P else P ⊥ ] Γ i = if [ M 1 ] Γ i = [ M 2 ] Γ i then [ P ] Γ i else [ P ⊥ ] Γ i . Similarly, [ Q ] Γ i = if [ N 1 ] Γ i = [ N 2 ] Γ i then [ Q ] Γ i else [ Q ⊥ ] Γ i .
Therefore, using Π Γ , Π 1,Γ , Π 2,Γ and rule PIfLR, we have for all Γ ∈ branches([ Γ ] n i )

Γ [ P ] Γ i ∼ [ Q ] Γ i → C Γ ⊆ C ⊆ [ C ] n i .
Thus by Lemma A.30, there exists

C 1 ⊆ [ C ] n i such that [ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C
1 , which proves the claim.

• PIfS: then P = if M = M then P else P , Q = if N = N then Q else Q for some messages M , N , M , N , and some processes P , Q , P , Q , and

Π = Π Γ P ∼ Q → C Π 1 Γ M ∼ N : LL → c Π 2 Γ M ∼ N : HH → c Γ P ∼ Q → C .
By applying the induction hypothesis to Π , there exists

[ M ] Γ i ∼ [ N ] Γ i : HH → [ c ] Γ i . In addition, [ P ] Γ i = if M = M then P else P Γ i = if [ M ] Γ i = M Γ i then P Γ i else P Γ i . Similarly, [ Q ] Γ i = if [ N ] Γ i = [ N ] Γ i then [ Q ] Γ i else [ Q ] Γ i .
Therefore, using Π Γ , Π 1,Γ , Π 2,Γ and rule PIfS, we have for all Γ ∈ branches([ Γ ] n i )

Γ [ P ] Γ i ∼ [ Q ] Γ i → C Γ ⊆ C ⊆ [ C ] n i .
Thus by Lemma A.30, there exists

C 1 ⊆ [ C ] n i such that [ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C
1 , which proves the claim.

• PIfI: then P = if M = M then P else P , Q = if N = N then Q else Q for some messages M , N , M , N , and some processes P , Q , P , Q , and there exist types T , T , and names m, p, such that

Π = Π Γ P ∼ Q → C Π 1 Γ M ∼ N : T * T → c Π 2 Γ M ∼ N : τ l,
Γ i = if [ M ] Γ i = M Γ i then P Γ i else P Γ i . Similarly, [ Q ] Γ i = if [ N ] Γ i = [ N ] Γ i then [ Q ] Γ i else [ Q ] Γ i .
We distinguish two cases.

-If a is 1: Then τ l,1 m ; τ l ,1 p n = τ l,1 m ; τ l ,1 p , and using Π Γ , Π 1,Γ , Π 2,Γ and rule PIfI, we have for all Γ ∈ branches([ Γ ] n i )

Γ [ P ] Γ i ∼ [ Q ] Γ i → C Γ ⊆ C ⊆ [ C ] n i .
Thus by Lemma A.30, there exists

C 1 ⊆ [ C ] n i such that [ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C 1 ,
which proves the claim in this case.

-If a is ∞: Moreover, by applying Lemma A.5 to Π 2,Γ , there exists a type

T ∈ branches( τ l,∞ m ; τ l ,∞ p n ),
such that there exists a proof Π 2,Γ of Γ

[ M ] Γ i ∼ [ N ] Γ i : T → [ c ] Γ i . By definition,
τ l,∞ m ; τ l ,∞ p n = 1≤j≤n τ l,1 m j ; τ l ,1 p j . Therefore, by definition of branches, there exists j such that T = τ l,1 m j ; τ l ,1 p j . Hence, using Π Γ , Π 1,Γ , Π 2,Γ , by rule PIfI, we have for all Γ ∈ branches([ Γ ] n i ) that

Γ [ P ] Γ i ∼ [ Q ] Γ i → C Γ ⊆ C ⊆ [ C ] n i .
Thus by Lemma A.30, there exists

C 1 ⊆ [ C ] n i such that [ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C 1
which proves the claim in this case.

• PIfLR*: then P = if M 1 = M 2 then P else P ⊥ , Q = if N 1 = N 2 then Q else Q ⊥ for some messages M 1 , N 1 , M 2 , N 2 , and some processes P , Q , P ⊥ , Q ⊥ , and there exist m, p, l, l such that

Π = Π 1 Γ M 1 ∼ N 1 : τ l,∞ m ; τ l ,∞ p → ∅ Π 2 Γ M 2 ∼ N 2 : τ l,∞ m ; τ l ,∞ p → ∅ Π Γ P ∼ Q → C 1 Π ⊥ Γ P ⊥ ∼ Q ⊥ → C 2 Γ P ∼ Q → C = C 1 ∪ C 2 .
By applying the induction hypothesis to Π , there exist

C ⊆ [ C 1 ] n i ⊆ [ C ] n i and a proof Π of [ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C .
2,Γ of Γ [ M 2 ] Γ i ∼ [ N 2 ] Γ i : 1≤j≤n τ l,1 m j ; τ l ,1 p j → [ c ] Γ i . Let Γ ∈ branches([ Γ ] n i )
. By Lemma A.5, there exists T ∈ branches( 1≤j≤n τ l,1 m j ; τ l ,1 p j ) such that there exists a proof Π 1,Γ of Γ

[ M 1 ] Γ i ∼ [ N 1 ] Γ i : T → [ c ] Γ i .
Similarly, there exists T ∈ branches( 1≤j≤n τ l,1 m j ; τ l ,1 p j ) such that there exists a proof Π 2,Γ of Γ [

M 2 ] Γ i ∼ [ N 2 ] Γ i : T → [ c ] Γ i .
By definition of branches, there exist j, j such that T = τ l,1 m j ; τ l ,1 p j and T = τ l,1 m j ; τ l ,1 p j . In addition,

[ P ] Γ i = [ if M 1 = M 2 then P else P ⊥ ] Γ i = if [ M 1 ] Γ i = [ M 2 ] Γ i then [ P ] Γ i else [ P ⊥ ] Γ i . Similarly, [ Q ] Γ i = if [ N 1 ] Γ i = [ N 2 ] Γ i then [ Q ] Γ i else [ Q ⊥ ] Γ i .
Therefore, using Π ,Γ , Π ⊥,Γ , Π 1,Γ , Π 2,Γ and rule PIfLR, either j = j and we have

Γ [ P ] Γ i ∼ [ Q ] Γ i → C 1,Γ (⊆ [ C ] n i )
or j = j and we have Γ

[ P ] Γ i ∼ [ Q ] Γ i → C 2,Γ (⊆ [ C ] n i ).
This holds for any Γ ∈ branches([ Γ ] n i ). Thus by Lemma A.30, there exists

C ⊆ [ C ] n i such that [ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C
which proves the claim in this case.

• PIfLR'*: then P = if M 1 = M 2 then P else P ⊥ , Q = if N 1 = N 2 then Q else Q ⊥ for some messages M 1 , N 1 , M 2 , N 2 , and some processes P , Q , P ⊥ , Q ⊥ , and there exist names m, p, m , p such that

Π = Π 1 Γ M 1 ∼ N 1 : τ l,a m ; τ l ,a p → ∅ Π 2 Γ M 2 ∼ N 2 : τ l ,a m ; τ l ,a p → ∅ Π Γ P ⊥ ∼ Q ⊥ → C Γ P ∼ Q → C .
By applying the induction hypothesis to Π , there exist C ⊆ [ C ] n i and a proof Π of the judgement [ Γ ] n i if a and a are both 1: Then this rule is a particular case of rule PIfLR, and the result is proved in a similar way.

[ P ⊥ ] Γ i ∼ [ Q ⊥ ] Γ i → C .
if a is 1 and a is ∞: Then τ l,a m ; τ l ,a

Γ i = [ if M 1 = M 2 then P else P ⊥ ] Γ i = if [ M 1 ] Γ i = [ M 2 ] Γ i then [ P ] Γ i else [ P ⊥ ] Γ i . Similarly, [ Q ] Γ i = if [ N 1 ] Γ i = [ N 2 ] Γ i then [ Q ] Γ i else [ Q ⊥ ] Γ i . For any j ∈ 1, n , τ l,1 m = τ l ,1 m j
; and τ l ,1 p = τ l ,1 p j .

Therefore, using Π Γ , Π 1,Γ , Π 2,Γ and rule PIfLR, we have

Γ [ P ] Γ i ∼ [ Q ] Γ i → C Γ (⊆ [ C ] n i ).
This holds for any Γ ∈ branches([ Γ ] n i ). Thus by Lemma A.30, there exists

C ⊆ [ C ] n i such that [ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C
which proves the claim in this case.

if a is ∞ and a is 1: This case is similar to the symmetric one.

if a and a both are ∞: This case is similar to the case where a is 1 and a is ∞.

Proof. Let c be a set of constraints and Γ be a typing environment such that c ⊆ c, Γ ⊆ Γ, Γ N ,K = Γ N ,K and vars(c ) ⊆ dom(Γ ). Let σ, σ be two substitutions such that Γ N ,K σ ∼ σ : Γ X → c σ (for some set of constraints c σ ⊆ c σ,σ ).

To prove the claim, we need to show that the frames φ Γ LL ∪ φ l ( c σ,σ )) and (φ Γ LL ∪ φ r ( c σ,σ )) are statically equivalent. Let D denote dom(Γ X )(= dom(σ) = dom(σ )).

For all x ∈ F ∩ D, by definition of F , there exist m, n, l, l such that Γ(x) = τ l,1 m ; τ l ,1 n . Thus, by well-typedness of σ, σ , there exists c x such that Γ σ(x) ∼ σ (x) : τ l,1 m ; τ l ,1 n → c x . Hence, by Lemma A. Proof. Let M ∼ N ∈ c σ,σ . By definition there exist M ∼ N ∈ c such that M = M σ and N = N σ . Since step2 Γ (c) = true, there are four cases for M and N : they can be symmetric or asymmetric encryptions, hashes, or signatures. These four cases are similar, we write the proof for the asymmetric encryption case.

In this case, there exist M 1 , M 2 , N 1 , N 2 such that M = aenc(M 1 , M 2 ) and N = aenc(N 1 , N 2 ). Let us show that M σ ∼ N σ satisfies the conditions for step2 Γ ( c σ,σ ).

Since step2 Γ (c) = true we know that M 1 and N 1 contain directly under pairs

• a nonce n such that Γ(n) = τ HH,a n

• or a secret key k such that ∃T, k .Γ(k, k ) <: key HH (T ) or Γ(k , k) <: key HH (T ),

• or a variable x such that ∃m, n, a.Γ(x) = τ HH,a m ; τ HH,a n ,

• or a variable x such that ∃T.Γ(x) <: key HH (T ).

In the fist two cases, M 1 σ (resp. N 1 σ ) clearly contains the same nonce or keys under pairs. The last two cases are similar, we write the proof for the case of a variable x such that Γ(x) = τ HH,a m ; τ HH,a n . Either x / ∈ dom(σ), and thus x still appears under pairs in M 1 σ; or x ∈ dom(σ). In that case, σ(x) appear directly under pairs in M 1 σ (resp. σ (x) in N 1 σ ). By assumption, there exists c such that Γ σ(x) ∼ σ (x) : τ HH,a m ; τ HH,a n → c . Hence, by Lemma A.14, σ(x) = m (resp. σ (x) = n) and Γ(n) = τ HH,a n (resp. Γ(m) = τ HH,a m ). Therefore, in all cases, M 1 σ and N 1 σ satisfy the required conditions.

In addition, since step2 Γ (c) = true we also know that M 2 and N 2 are either For all h ∈ 1, n and all i = j ∈ 1, n , such that i = 2 and j = 1, let (c i,j h , Γ i,j h ) = (c h , Γ h )δ 1 i δ 2 j .

Similarly, for all h ∈ 1, n and all i ∈ 1, n , let

(c i,i h , Γ i,i h ) = (c h , Γ h )δ 1 i .
Finally, for all i ∈ 1, n , let Γ i be the typing environment such that dom(Γ i ) = dom(Γ ) and ∀x ∈ dom(Γ i ). Γ i (x) = Γ (x)δ 1 i . Since (c i , Γ i ) ∈ [ C ] n i , we can show that (c i,j i , Γ i,j i ) ∈ [ C ] n 1 . Indeed, recall that there exists (c i , Γ i ) ∈ C such that c i = [ c i ] Γ i i and Γ i ∈ branches([ Γ i ] n i ). c i only contains variables, keys and names indexed by i or unindexed, hence it is clear that c i,j i = [ c i ] Γ i 1 . Moreover, since Γ i ∈ branches([ Γ i ] n i ), it is clear that Γ i,j i ∈ branches([ Γ i ] n i δ 1 i δ 2 j ). By definition, indexed nonces, variables, or keys appear in [ Γ i ] n i only in its domain, and as parts of union types of the form τ l,1 m 1 ; τ l ,1 p 1 ∨ . . . ∨ τ l,1 mn ; τ l ,1 pn . This union type is left unchanged by δ 1 i δ 2 j : since i = j, i = 2, and j = 1, δ 1 i δ 2 j is indeed only performing a permutation of the indices. Hence, [ Γ i ] n i δ 1 i δ 2 j = [ Γ i ] n 1 . Thus Γ i,j i ∈ branches([ Γ i ] n 1 ). Therefore, (c i,j i , Γ i,j i ) ∈ [ C ] n 1 . Note that dom(Γ i,j i ) only contains variables indexed by 1; and that, since vars(c i ) ⊆ dom(Γ i ), we have vars(c i,j i ) ⊆ dom(Γ i,j i ). Similarly, if j = i, i = 2 and j = 1, (c i,j j , Γ i,j j ) ∈ [ C ] n 2 . Note that dom(Γ i,j j ) only contains variables indexed by 2; and that vars(c i,j j ) ⊆ dom(Γ i,j j ). Similarly, we also have (c , Γ i ) ∈ [ C ] n 1 . By assumption, for all (c, Γ) ∈ C and for all (c , Γ ) ∈ C , dom(Γ X ) ∩ dom(Γ X ) = ∅, and Γ, Γ give the same types to the nonces and keys they have in common. Hence for all (c , Γ ) ∈ [ C ] n 1 , and all (c , Γ ) ∈ [ C ] n 1 , we know that Γ and Γ are compatible. In particular this applies to all the Γ i,j i and Γ (as well as Γ i,j i and Γ i ). Moreover, for all (c , Γ ) ∈ [ C ] n 2 , and all (c , Γ ) ∈ [ C ] n 1 , since dom(Γ ) ⊆ {x 1 | x ∈ X }, and dom(Γ ) ⊆ {x 2 | x ∈ X }, Γ and Γ are also compatible. This in particular applies to Γ i,j j for all i = j ∈ 1, n and Γ (as well as Γ i,j j and Γ i ). If C is empty, then so is ∪ × 1≤i≤n [ C ] n i and the claim clearly holds. Let us now assume that C is not empty. Hence for all i ∈ 1, n , [ C ] n i is not empty. The procedure for c, Γ is as follows:

1. We compute step1 Γ (c). Following the notations used in the procedure, we have For all h, i, j ∈ 1, n , such that either i = j and i = 2 and j = 1, or i = j, let us also denote (c i,j h , Γ i,j h ) def = step1 Γ i,j h (c i,j h ). Similarly, for all i ∈ 1, n , let also (c i , Γ i ) def = step1 Γ i (c ).

Since, for i = j, (c i,j h , Γ i,j h ) = (c h , Γ h )δ 1 i δ 2 j , it can easily be shown (by induction on the terms) that (c i,j h , Γ i,j h ) = (c h , Γ h )δ 1 i δ 2 j . Similarly, (c i,i h , Γ i,i h ) = (c h , Γ h )δ 1 i . Finally, we similarly also have (c i , Γ i ) = (c , Γ )δ 1 p .

2. We check that step2 Γ (c) holds, i.e. that each M ∼ N ∈ c has the correct form (with respect to the definition of step2). In particular, M ∼ N ∈ c has the correct form.

• In the second case, M ∼ N ∈ c i for some i ∈ 1, n .

Let M = M δ 1 i and N = N δ 1 i . Since c i,i i = c i δ 1 i , we have M ∼ N ∈ c i,i i . By assumption, [ C ] n 2 is not empty, hence there exists (c , Γ )

∈ [ C ] n 2 . Thus, (c i,i i ∪ c ∪ c , Γ i,i i ∪ Γ ∪ Γ ) ∈ [ C ] n 1 ∪ × [ C ] n 2 ∪ × [ C ] n
1 (as noted previously, Γ i,i i , Γ , and Γ are compatible). Hence, by assumption, check_const({(c i,i i ∪ c ∪ c , Γ i,i i ∪ Γ ∪ Γ )}) succeeds. If c = f st(step1 Γ (c )), then c i,i i ∪c ∪c = f st(step1 Γ i,1 ∪Γ ∪Γ (c i,i i ∪c ∪c )). Therefore, step2 Γ (c i,i i ∪ c ∪ c ) holds. In particular, M ∼ N ∈ c i,i i , has the correct form. By examining all the cases and using the fact that for all m i , m j , if m i is associated with the type τ l,a m i and m j with τ l ,a m j then l = l , and similarly for keys; it follows that M ∼ N also has the correct form.

Therefore, step2 Γ (c) holds. We have to prove that N 1 α = N 2 α.

Since we already have c = (∪ 1≤i≤n c i ) ∪ c , we know that:

• either there exists i ∈ 1, n such that M 1 ∼ N 1 ∈ c i ;

• or M 1 ∼ N 1 ∈ c ; and

• either there exists j ∈ 1, n such that M 2 ∼ N 2 ∈ c j ;

• or M 2 ∼ N 2 ∈ c .

Let us first prove the case where there exist i, j ∈ 1, n such that M 1 ∼ N 1 ∈ c i and M 2 ∼ N 2 ∈ c j . We distinguish two cases.

• if i = j: The property to prove is symmetric between M 1 ∼ N 1 ∈ c and M 2 ∼ N 2 ∈ c. Hence without loss of generality we may assume that i = 2 and j = 1. Let then

M 1 = M 1 δ 1 i δ 2 j , N 1 = N 1 δ 1 i δ 2 j , M 2 = M 2 δ 1 i δ 2 j , N 2 = N 2 δ 1 i δ 2 j . Since c i,j i = c i δ 1 i δ 2 j , we have M 1 ∼ N 1 ∈ c i,j i .
Similarly, M 2 ∼ N 2 ∈ c i,j j . Since M 1 and M 2 are unifiable, then so are M 1 and M 2 , with a most general unifier µ which satisfies µ(x) = t ⇔ µ (xδ 1 i δ 2 j ) = tδ 1 i δ 2 j . Let then α be the restriction of µ to {x ∈ vars(M 1 ) ∪ vars(M 2 ) | (Γ i,j i ∪ Γ i,j j )(x) = LL ∧ µ (x) ∈ N is a nonce}. Similarly α is such that ∀x ∈ dom(α ).∀n. α(x) = n ⇔ α (xδ 1 i δ 2 j ) = nδ 1 i δ 2 j , i.e. δ 1 i δ 2 j α δ 1 i δ 2 j = α. By assumption, check_const({(c i,j i ∪ c i,j j ∪ c , Γ i,j i ∪ Γ i,j j ∪ Γ )}) succeeds since (c i,j i ∪ c i,j j ∪ c , Γ i,j i ∪ Γ i,j j ∪ Γ )

∈ [ C ] n 1 ∪ × [ C ] n 2 ∪ × [ C ] n
1 . Thus, step3 Γ i,j i ∪Γ i,j j ∪Γ (c i,j i ∪ c i,j j ∪ c ) holds, and since {M 1 ∼ N 1 , M 2 ∼ N 2 } ⊆ c i,j i ∪ c i,j j ∪ c , we know that since M 1 , M 2 are unifiable, N 1 α = N 2 α . Thus N 1 α δ 1 i δ 2 j = N 2 α δ 1 i δ 2 j , i.e., since i = j, and δ 1 i δ 2 j α δ 1 i δ 2 j = α, N 1 α = N 2 α. Therefore the claim holds in this case.

• if i = j then let M 1 = M 1 δ 1 i , N 1 = N 1 δ 1 i , M 2 = M 2 δ 1 i , N 2 = N 2 δ 1 i . Since c i,i i = c i δ 1 i , we have M 1 ∼ N 1 ∈ c i,i i .
Similarly, M 2 ∼ N 2 ∈ c i,i i . Since M 1 and M 2 are unifiable, then so are M 1 and M 2 , with a most general unifier µ which satisfies µ(x) = t ⇔ µ (xδ 1 i ) = tδ 1 i . Let then α be the restriction of µ to {x ∈ vars(M 1 )∪vars(M 2 ) | Γ i,i i (x) = LL ∧ µ (x) ∈ N is a nonce}. Similarly α is such that ∀x ∈ dom(α ).∀n. α(x) = n ⇔ α (xδ 1 i ) = nδ 1 i , i.e. δ 1 i α δ 1 i = α. By assumption, [ C ] n 2 is not empty, hence there exists (c , Γ ) ∈ [ C ] n 2 . Thus, (c i,i i ∪c ∪ c , Γ i,i i ∪Γ ∪Γ )

∈ [ C ] n 1 ∪ × [ C ] n 2 ∪ × [ C ] n 1 .
Hence, by assumption, check_const({(c i,i i ∪ c ∪ c , Γ i,i i ∪ Γ ∪ Γ )}) succeeds. If c = f st(step1 Γ (c )), then c i,i i ∪ c ∪ c = f st(step1 Γ i,i i ∪Γ ∪Γ (c i,i i ∪ c ∪ c )). Thus, step3 Γ i,i i ∪Γ ∪Γ (c i,i i ∪c ∪c ) holds, and since {M 1 ∼ N 1 , M 2 ∼ N 2 } ⊆ c i,i i ∪c ∪c , we know that N 1 α = N 2 α . Thus N 1 α δ 1 i = N 2 α δ 1 i , i.e., since δ 1 i α δ 1 i , N 1 α = N 2 α. Therefore the claim holds in this case.

Let us now prove the case where there exists i ∈ 1, n such that M 1 ∼ N 1 ∈ c i , and M 2 ∼ N 2 ∈ c . The symmetric case, where M 1 ∼ N 1 ∈ c and there exists j ∈ 1, n such that M 2 ∼ N 2 ∈ c j , is similar.

Let then M 1 = M 1 δ 1 i , N 1 = N 1 δ 1 i , M 2 = M 2 δ 1 i , N 2 = N 2 δ 1 i . Since c i,i i = c i δ 1 i , we have M 1 ∼ N 1 ∈ c i,i i . Similarly, M 2 ∼ N 2 ∈ c i .
Since M 1 and M 2 are unifiable, then so are M 1 and M 2 , with a most general unifier µ which satisfies µ(x) = t ⇔ µ (xδ 1 i ) = tδ 1 i . Let then α be the restriction of µ to {x ∈ vars(M 1 ) ∪ vars(M 2 ) | (Γ

i,i i ∪ Γ i )(x) = LL ∧ µ (x) ∈ N is a nonce}.
Similarly α is such that ∀x ∈ dom(α ).∀n. α(x) = n ⇔ α (xδ 1 i ) = nδ 1 i , i.e. δ 1 i α δ 1 i = α. By assumption, [ C ] n 2 is not empty, hence there exists (c , Γ ) ∈ [ C ] n 2 . Moreover, as noted previously, (c

, Γ i ) ∈ [ C ] n 1 . Thus, (c i,i i ∪ c ∪ c , Γ i,i i ∪ Γ ∪ Γ i ) ∈ [ C ] n 1 ∪ × [ C ] n 2 ∪ × [ C ] n 1 . Hence, by assumption, check_const({(c i,i i ∪ c ∪ c , Γ i,i i ∪ Γ ∪ Γ i )}) succeeds. If we have c = f st(step1 Γ (c )), then c i,i i ∪ c ∪ c i = f st(step1 Γ i,i i ∪Γ ∪Γ i (c i,i i ∪ c ∪ c )).
Thus, step3 Γ i,i i ∪Γ ∪Γ i (c i,i i ∪ c ∪ c i ) holds, and since

{M 1 ∼ N 1 , M 2 ∼ N 2 } ⊆ c i,i i ∪ c ∪ c i ,
we know that N 1 α = N 2 α .

Thus N 1 α δ 1 i = N 2 α δ 1 i , i.e., since δ 1 i α δ 1 i = α, N 1 α = N 2 α. and let Γ ∈ branches(Γ ).

The procedure check_const({(c, Γ )}) is as follows:

We have to prove that N 1 α = N 2 α.

Let x ∈ vars(M 1 ) ∪ vars(M 2 ) such that there exist m, p, l, l such that Γ(x) = τ l,∞ m ; τ l ,∞ p , i.e. x ∈ F . By definition of σ l (point 1), there exists i ∈ 1, n such that xσ l = m i (and xσ r = p i ). Hence, we have As we have just shown, for all x ∈ dom(θ ), there exists i ∈ 1, n such that xσ l = m i and xσ r = p i , and µ (x) is either m i or a variable. By definition of dom(θ ), only the case where µ (x) = m i is actually possible, and we have θ (x) = p i .

Thus, ∀x ∈ dom(θ ). σ r (x) = θ (x).

It then is clear from the definitions of the domains of θ and σ r that there exists τ such that σ r = θ τ .

Thus, since we have shown that N 1 α θ = N 2 α θ , we have (N 1 α θ )τ = (N 2 α θ )τ , that is to say N 1 α σ r = N 2 α σ r , i.e., since α and σ r have disjoint domains, and are both ground, N 1 α = N 2 α .

Moreover, we have shown that for all x ∈ vars(M 1 ) ∪ vars(M 2 ) such that Γ(x) = LL and µ (x) ∈ N , µ(x) = µ (x). That is to say that for all x ∈ dom(α ), µ(x) = α (x).

In addition, it is clear from the definition of σ l that In any case, the claim holds, which concludes the proof.

B.3.6 Conclusion on Belenios with revote

Theorem B.18. Assume Belenios, with revote allowed, is strongly consistent, has non-malleable ballots and credentials, that the proofs of correct tallying are zero-knowledge, that different random oracles are used for these proofs and the rest of the protocol, and that ρ encodes the "last vote counts" revote policy.

Then Belenios securely implements the three ideal functionalities F del v (ρ), F del,reorder v (ρ) and F del,reorder,change v (ρ).

Proof.

• It directly follows from Theorems 11, B.16, and B.17 that, under these assumptions, Belenios securely implements the functionality F del v (ρ).

• It is also clear that F del v (ρ) is stronger than F del,reorder v (ρ), in that it gives less power to the simulator. Indeed these two functionalities are the same, except that F del,reorder v (ρ) allows more modification functions from S than F del v (ρ). Any simulator S running with F del v (ρ) can thus be accurately simulated by a simulator S running with F del,reorder v (ρ), that runs S internally, checks whether its proposed modification function f is accepted by P del , then submits f if so, and blocks the result otherwise. (Note S can check this condition using only f and the sequence of the ids of voters who submitted votes, but does not need to know the votes themselves, by definition of P del ). Therefore, any voting scheme that securely implements F del v (ρ) also securely implements F del,reorder v (ρ), which proves the claim that Belenios implements this functionality.

• With a similar reasoning, it appears that F del v (ρ) is also stronger than F del,reorder,change v (ρ), which implies that Belenios also securely implements F del,reorder,change v (ρ).

B.4 Case study: Civitas with revote

We show here that, under reasonable assumptions, Civitas with revote is mb-BPRIV w.r.t. Recover del (described below), and that this implies it realises F del v . Consequently it also realises the weaker F del,reorder v and F del,reorder,change v .

Figure 1 . 1 :

 11 Figure 1.1: Syntax for processes.

Figure

  Figure 1.2: Semantics

  key HH (HL * LL) initial message uses same key on both sides Γ(k a , k) = key HH (HL) authentication succeeded on the left, failed on the right Γ(k, k c ) = key HH (HL) authentication succeeded on the right, failed on the left Γ(k a , k c ) = key HH (HL) authentication succeeded on both sides Γ(k, k) = key HH (HL) authentication failed on both sides

Figure 2 . 1 :

 21 Figure 2.1: Key types for the private authentication protocol

Figure 2 . 2 :

 22 Figure 2.2: Types for terms

  SPair) HH * T <: HH (SPairS) T * HH <: HH (SPairS') key l (T ) <: l (SKey) eqkey l (T ) <: key l (T ) (SEqKey) seskey l,a (T ) <: eqkey l (T ) (SSesKey) T <: eqkey l (T ) pkey(T ) <: LL (SPubkey) T <: eqkey l (T ) vkey(T ) <: LL (SVkey)

TLRVar)Figure 2 . 4 :

 24 Figure 2.4: Rules for Messages

Figure 2 . 5 :

 25 Figure 2.5: Well-formedness of the typing environment

Figure 2 . 6 :

 26 Figure 2.6: Rules for processes (1)

Figure 2 . 7 :

 27 Figure 2.7: Rules for processes (2)

  y) : LL (DAdecL') Γ(k, k) = seskey l,a (T ) Γ(x) = {T } pkey(seskey l,a (T )) Γ adec(x, k) ∼ adec(x, k) : T (DAdecT) Γ(y) = seskey l,a (T ) Γ(x) = {T } pkey(seskey l,a (T ))

Figure 2 . 8 :

 28 Figure 2.8: Destructor Rules

Lemma 5 (

 5 Soundness of destructor rules). Consider destructors d, d , and Γ, T , c such that Γ d ∼ d : T . Let σ, σ be ground substitutions such that dom(σ) = dom(σ ) = vars(d)∪vars(d ), and

  where Γ and C are obtained from Γ and C by exchanging the left and right terms in constraints, as well as the left and right types in refinement types, and the left and right keys in bikeys. It is clear from the definition of consistency that consistency of C and C are equivalent.

  step2 Γ (c) := check that for all M ∼ N ∈ c, M and N are both • enc(M , M ), enc(N , N ) where M , N are either keys k, k where ∃T. Γ(k, k ) <: key HH (T ); -or a variable x such that ∃T. Γ(x) <: key HH (T ); • or encryptions aenc(M , M ), aenc(N , N ) where -M and N contain directly under pairs a nonce n such that Γ(n) = τ HH,a n or a secret key k such that ∃T, k . Γ(k, k ) <: key HH (T ) or Γ(k , k) <: key HH (T ), or a variable x such that ∃m, n, a. Γ(x) = τ HH,a m ; τ HH,a n , or a variable x such that ∃T. Γ(x) <: key HH (T ); -M and N are either * public keys pk(k), pk(k ) where ∃T. Γ(k, k ) <: key HH (T ); * or public keys pk(x), pk(x) where ∃T. Γ(x) <: key HH (T ); * or a variable x such that ∃T, T . Γ(x) = pkey(T ) and T <: key HH (T ); • or hashes h(M ), h(N ), where M , N similarly contain a secret value under pairs; • or signatures sign(M , M ), sign(N , M ) where M , N are either keys k, k where ∃T. Γ(k, k ) <: key HH (T ); -or a variable x such that ∃T. Γ(x) <: key HH (T ); step3 Γ (c) := If for all M ∼ M and N ∼ N ∈ c such that M , N are unifiable with a most general unifier µ, and such that

Figure 2 . 9 :

 29 Figure 2.9: Procedure for checking consistency.

Figure 3 . 1 :

 31 Figure 3.1: Type derivation for the ballot of Alice

  Γ(k b , k b ) = key HH (HL * LL) initial message uses same key on both sides Γ(k a , k) = key HH (HL) authentication succeeded on the left, failed on the right Γ(k, k c ) = key HH (HL) authentication succeeded on the right, failed on the left Γ(k a , k c ) = key HH (HL) authentication succeeded on both sides Γ(k, k) = key HH (HL) authentication failed on both sides We also annotate the declarations of N a and N b respectively with type τ HH,1 Na and τ HH,1 N b , specifying they should be secret. We of course first apply rule PPar, to typecheck independently the initiator and responder processes, i.e. P a (k a , pk(k b )) ∼ P a (k a , pk(k b )) and P b (k b , pk(k a ) ∼ P b (k b , pk(k c ). * = y1, Nb, pk(kb) , Nb well formed Γ y1, Nb, pk(kb) ∼ Nb : HL → ∅ THigh * Γ(ka, k) = key HH (HL) Γ ka ∼ k : key HH (HL) → ∅ TKey Γ pk(ka) ∼ pk(k) : pkey(key HH (HL)) → ∅ TPubKey Γ aenc( y1, Nb, pk(kb) , pk(ka)) ∼ aenc(Nb, pk(k)) : {HL} pkey(key HH (HL)) → ∅ TAenc Γ aenc( y1, Nb, pk(kb) , pk(ka)) ∼ aenc(Nb, pk(k)) : LL → c TAencH where c = {aenc( y1, Nb, pk(kb) , pk(ka)) ∼ aenc(Nb, pk(k))}.

Figure 3 . 2 :

 32 Figure 3.2: Type derivation for the response to A and the decoy message

Figure 3 . 3 :

 33 Figure 3.3: Experimental results for the bounded case

Figure 3 . 4 :

 34 Figure 3.4: Experimental results for an unbounded number of sessions

  Chapter 4 and Chapter 5 are based on the results from the article [64], written with Véronique Cortier and published at the CCS'18 conference (ACM Conference on Computer and Communications Security). Chapter 6 presents yet unpublished work, which was conducted with Véronique Cortier and Bogdan Warinschi.

  dec(enc(x, y), y) = x adec(aenc(x, pk(y)), y) = x checksign(sign(x, y), vk(y)) = x π 1 ( x, y ) = x π 2 ( x, y ) = y 4.1. Model Processes: P, Q ::= 0 | new n.P for n ∈ BN (n bound in P ) | out(c, M ).P | in(c, x).P for x ∈ X (x bound in P ) | event(M 1 , . . . , M n ).P for event ∈ Ev of arity n | P ||Q | let x = M in P for x ∈ X (x bound in P ) | if M = N then P else Q | !Pwhere M, N, M 1 , . . . , M n are messages and c ∈ Ch is a channel.

Figure 4 . 1 :

 41 Figure 4.1: Syntax for processes.

Figures 4 .1 and 4 . 2 .

 442 As usual, we identify processes up to α-renaming, to avoid capture of bound names and variables.As in Chapter 1, the semantics of processes is given through a transition relation α -→ on configurations, given in Figure 1.2, where α is the action associated to the transition. We still denote by w --→ * the reflexive transitive closure of α -→, where w is the concatenation of all actions.

({P 1

 1 ||P 2 } ∪ P; φ) τ -→ ({P 1 , P 2 } ∪ P; φ) Par ({0} ∪ P; φ) τ -→ (P; φ) Zero ({new n.P } ∪ P; φ) τ -→ ({P } ∪ P; φ) New ({out(c, M ).P } ∪ P; φ) new axn.out(c,axn) ------------→ ({P } ∪ P; φ ∪ {M/ax n }) Out if M is a ground term, ax n ∈ AX and n = |φ| + 1 ({in(c, x).P } ∪ P; φ) in(c,R)

Figure 4 . 2 :

 42 Figure 4.2: Semantics

def=

  |V wanted |. Without loss of generality, we may assume that V wanted = {|v 1 , . . . , v m | }. Note that |V change | is also equal to m by assumption. Let us then denote V change def = {|v 1 , . . . , v m | }.

  be the multiset of all intended honest votes in t that are not v special . Let k def = |V wanted |, and V change def = k • v special . By FF , there exists a multiset V c such that

Definition 38 .

 38 A voting scheme consists in seven probabilistic polynomial-time algorithms V = (Setup, Register, Pub, Vote, Tally, Valid, ValidTally) where • Setup(1 λ ), given a security parameter λ, computes a pair of election keys (pk, sk).

Figure 5 . 1 :

 51 Figure 5.1: Registration and corruption oracles

Figure 5

 5 Figure 5.2: Verifiability

Figure 5 . 3 :

 53 Figure 5.3: Privacy

Figure 5 . 4 :

 54 Figure 5.4: ValidTally game

  = 1 is negligible where the game Exp ValidTally V,A (λ) is defined in Figure 5.4.

  by definition, b k has been added to BB b by the kth call to O p vote made by B after it had finished running A. Therefore, b k = Vote(pk, id k , c k , v β ) for some v β . Thus, provided C correctly guesses β = β and k, C returns (BB a [b 1 , . . . , b k-1 ], id k , v β ). The conditions on BB in Exp ValidTally V,C holds, and thus Exp ValidTally V,C = 1. Therefore, ValidTally(BB a , sk, U 1 ) holds and ValidTally(BB a BB b , sk, U 1 ∪ U 2 ) does not with probability at most 2l P Exp ValidTally V,C = 1 , which is smaller than 2q(λ) P Exp ValidTally V,C

V

  and Exp verif V are modified to prevent revote, by allowing only one call to O p vote /O v vote and/or to O cast /O cast for each id.

Figure 6 .

 6 Figure 6.1: The hb-BPRIV game.

  For any id ∈ I, and any vote v, if (pk, sk) are generated by Setup, U by Register, and (p, b) by Vote(pk, id, U[id], v), then extract(sk, U, p, b) = (id, v) with overwhelming probability. • For any pk produced by Setup, and any BB, id, (p, b) produced by an adversary, Valid(id, (p, b), BB, pk) = ⇒ ValidInd(p, b) = .

  For any id ∈ I, and any vote v, if (pk, sk) are generated by Setup, U by Register, and (p, b) by Vote(pk, id, U[id], v), then extract id (U, p) = id and extract v (sk, b) = v with overwhelming probability. We then write extract(sk, U, p, b) = (extract id (U, p), extract v (sk, b)) the extraction function that extracts (id, v) from (p, b).

then return 1 else return 0

 0 Notation: for any board BB = [(p 1 , b 1 ), . . . , (p n , b n )], any sk, U and extract, we denote extract(sk, U, BB) the list of extractions of the ballots in BB, i.e. [extract(sk, U, p 1 , b 1 ), . . . , extract(sk, U, p n , b n )].

Figure 6 . 2 :

 62 Figure 6.2: The mb-BPRIV game.

Figure 6 . 3 :

 63 Figure 6.3: The Recover del,reorder algorithm.

Figure 6 . 4 :

 64 Figure 6.4: The Recover del,reorder,change algorithm.

Figure 6 . 5 :

 65 Figure 6.5: The Recover ∅ algorithm.

  1 , v 1 ) . . . vote(id n , v n ) r pk, id for id ∈ I c id pk, sk BB r, Π pk c id , for id ∈ D id 1 , (p 1 , b 1 ), . . . , id n , (p n , b n ) BB verif. order r, Π res-ok

Figure 6 . 6 :

 66 Figure 6.6: The real execution with id1, . . . , idn ∈ H

Figure 6 . 8 :

 68 Figure 6.8: The ideal functionality F del,reorder v

Figure 6 . 9 :

 69 Figure 6.9: Predicates associated with the three functionalities F ∅ v , F del,reorder v

(

  as in the real execution), and (p , b , state id ) = Vote(pk, id, c id , v * ). It records the voter's internal state, and stores (id, (p, b)) and (id, (p , b )) respectively in lists BB 0 and BB 1 . H then returns (id, (p , b )) to A (instead of (id, (p, b)) in Game 0).

Figure 6 . 10 :

 610 Figure 6.10: Predicate P del , associated with functionality F del v (ρ).

Figure 6 . 13 :

 613 Figure 6.13: Comparison of several privacy definitions (: the protocol is private, : there exists an attack on privacy, ?: unknown, -:definition does not apply)

Definition 67 (

 67 Conditional entropy). For an entropy function H, the conditional entropy of Xgiven Y is the expected entropy of X given the value of Y, over all possible values of Y:H(X|Y) = E y∈Y (H(X|Y = y)).Definition 68 (Minimal entropy). For an entropy function H, the minimal entropy of X given Y is the minimal entropy of X given the value of Y, over all possible values of Y:H ⊥ (X|Y) = min y∈Y (H(X|Y = y)).Definition 69 (Average min-entropy). In the case of the min-entropy H ∞ , we consider the average min-entropy of X given Y, definedH ∞ (X|Y) = -log Ey∈Y 2 -H∞(X|Y=y) , i.e. H ∞ (X|Y) = -log E y∈Y max x∈X (P(X = x|Y = y)) .

  Hence,∀S ∈ S γ . ∃S ∈ S γ . H(T(V)|View(S , E D , F P v (ρ))) ≥ H(T(V)|View(S, E D , F P v (ρ))), which implies min S ∈Sγ H(T(V)|View(S , E D , F P v (ρ))) ≥ min S∈Sγ H(T(V)|View(S, E D , F P v (ρ))),i.e. H P ,ρ D,γ (T(V)) ≥ H P,ρ D,γ (T(V)).

Theorem 17 (

 17 F del,reorder v and F del,reorder,change v have the same entropy). For any target function, any γ, any distribution D, V being the list of votes, we have H P del,reorder ,ρ D,γ (T(V)) = H P del,reorder,change ,ρ D,γ (T(V)).

6. 8 .

 8 Entropy δ = 0.8α: δ = 0.85α: δ = 0.9α:

29 .

 29 ∀T. T <: LL =⇒ T is a pair type ∨ (∃T , T . T = (T ) T ) ∨ (∃T , T . T = {T } T ) ∨ (∃T . T <: key LL (T )) ∨ (∃l, T . T = pkey(T )) ∨ (∃l, T . T = vkey(T )) ∨ T = LL. 30. ∀T. T <: HH =⇒ T is a pair type ∨ (∃T . T <: key HH (T )) ∨ T = HH.

  and Γ M ∼ N : LL → c. Hence by Lemma A.5, Γ M ∼ N : LL → c, and by the induction hypothesis applied to P , Q , Γ P ∼ Q → C for some C such that C ⊆ C . Therefore by rule POut, Γ P ∼ Q → C ∪ ∀ c, and since C ∪ ∀ c ⊆ C ∪ ∀ c(= C), this proves the claim.

  and the claim holds.

. 8 .

 8 6. If Γvk(M ) ∼ N : LL → c, then c = ∅, ∃N .N = vk(N ), and either ∃l, T .T <:eqkey l (T ) ∧ Γ M ∼ N : T → ∅, or ∃k ∈ keys(Γ) ∪ F K.M = N = k. 7. If Γ n ∼ N : HH → c, then n ∈ BN , c = ∅ and either Γ(n) = τ HH,1 n or τ HH,∞ n If Γ n ∼ N : LL → c, then N = n, c = ∅,and either there exists a ∈ {1, ∞} such that Γ(n) = τ LL,a n , or n ∈ FN ∪ C.

9 .

 9 The symmetric properties to points 4 to 8 ( i.e. with k (resp. pk(M ), vk(M ), n) on the right) also hold.Proof. Point 1 is easily proved by induction on the derivation of Γ M ∼ N : T → c. Indeed, by the form of the type, using Lemma A.1, the last rule can only be TKey, TVar, or TSub. In the TKey and TVar cases the claim clearly holds. In the TSub case, we have T <: T such that Γ M ∼ N : T → c with a shorter derivation. By transitivity, T <: key l (T ). Thus by applying by the induction hypothesis, either M , N are variables, or they are keys and Γ(M, N ) <: T <: T , and in both cases the claim holds.

  (a) If Kφ↓= ⊥ then Kφ ↓= ⊥, hence Rφ↓= Rφ ↓= ⊥. (b) If Kφ↓ = ⊥ and is not a key then Kφ ↓ = ⊥ (by IH), and by IH we have Γ Kφ↓∼ Kφ ↓: LL → c for some c ⊆ c. Then, by Lemma A.

7 .

 7 R = aenc(S, K) We apply the induction hypothesis to K and distinguish three cases. (a) If Kφ↓= ⊥ then Kφ ↓= ⊥, hence Rφ↓= Rφ ↓= ⊥. (b) If Kφ↓ = ⊥ and is not pk(k) for some k ∈ K then Kφ ↓ = ⊥ (by IH), and by IH there exists c ⊆ c such that Γ Kφ↓∼ Kφ ↓: LL → c . Then, by Lemma A.18, Kφ ↓ is not a public key either. Hence Rφ↓= Rφ ↓= ⊥. (c) If Kφ↓= pk(k) for some k ∈ K, then by IH there exists c ⊆ c such that Γ pk(k) ∼ Kφ ↓: LL → c . Thus, by Lemma A.18, Kφ ↓= pk(N ) for some N such that either N = k ∈ keys(Γ) ∪ F K; or Γ k ∼ N : eqkey l (T ) → c for some l, T , c . In the second case, the same lemma and the well-formedness of Γ also imply that N = k and k ∈ keys(Γ). Thus, by rule TPubKeyL, Γ pk(k) ∼ pk(k) : LL → ∅. We then apply the IH to S, and either Sφ↓= Sφ ↓= ⊥, in which case Rφ↓= Rφ ↓= ⊥; or there exists c ⊆ c such that Γ Sφ↓∼ Sφ ↓: LL → c . Therefore, by rule TAenc, Γ Rφ↓∼ Rφ ↓: {LL} LL → c , and by rule TAencL we have Γ Rφ↓∼ Rφ ↓: LL → c . 8. R = sign(S, K) We apply the induction hypothesis to K and distinguish three cases. (a) If Kφ↓= ⊥ then Kφ ↓= ⊥, hence Rφ↓= Rφ ↓= ⊥. (b) If Kφ↓ = ⊥ and is not a key k ∈ K then Kφ ↓ = ⊥ (by IH), and by IH we have Γ Kφ↓∼ Kφ ↓: LL → c for some c ⊆ c. Then, by Lemma A.18, Kφ ↓ is not a key either. Hence Rφ↓= Rφ ↓= ⊥. (c) If Kφ↓= k for some k ∈ K, then by IH there exists c ⊆ c such that Γ Kφ↓∼ Kφ ↓: LL → c . Hence by Lemma A.18, (and since Γ is well-formed) Kφ ↓= k ∈ K and either Γ(k, k) <: key LL (T ) for some T , or k ∈ FK. Thus, in either case, by rules TKey, TSub, and TCstFN, Γ Kφ↓∼ Kφ ↓: LL → ∅. We then apply the IH to S, and either Sφ↓= Sφ ↓= ⊥, in which case Rφ↓= Rφ ↓= ⊥; or there exists c ⊆ c such that Γ Sφ↓∼ Sφ ↓: LL → c . Therefore by rule TSignL, Γ Rφ↓∼ Rφ ↓: LL → c . In the THigh case, we have names(σ) ∪ names(σ ) ∪ vars(σ) ∪ vars(σ ) ∪ keys(σ) ∪ keys(σ ) ⊆ dom(Γ) ∪ keys(Γ) ∪ FN ∪ FK, and names(M ) ∪ names(N ) ∪ vars(M ) ∪ vars(N ) ∪ keys(M ) ∪ keys

  and by applying Lemma A.10 to Γ, Γ σ(x) ∼ σ (x) : Γ (x) → c x and the claim holds.Finally, in the TLRVar case, there exist two variables x, y, and typesτ l,1 m , τ l ,1 n , τ l ,1 m , τ l ,1 n , such that M = x, N = y, c = ∅, Γ ∪ Γ x ∼ x : τ l,1 m ; τ l ,1 n → ∅, Γ ∪ Γ y ∼ y : τ l ,1 m ; τ l ,1 n → ∅,and T = τ l,1 m ; τ l ,1 n . By Lemma A.14, this implies that (Γ∪Γ )(x) = τ l,1 m ; τ l ,1 n and (Γ∪Γ )(y) = l ; 1 m l 1n . Hence, since by hypothesis Γ does not contain such types, x ∈ dom(Γ ) and y ∈ dom(Γ ). Moreover, by the induction hypothesis, there exist c , c ⊆ c σ such that Γ xσ ∼ xσ : τ l,1 m ; τ l ,1 n → c , and Γ yσ ∼ yσ : τ l ,1 m ; τ l ,1 n → c . That is to say, since x, y ∈ dom(Γ ) = dom(σ) = dom(σ ), that Γ σ(x) ∼ σ (x) : τ l,1 m ; τ l ,1 n → c , and Γ σ(y) ∼ σ (y) : τ l ,1 m ; τ l ,1 n → c . Hence, by Lemma A.14, and since σ, σ are ground, we have σ(x) = m, σ (x) = n, σ(y) = m , and σ (y) = n , and Γ(m) = τ l,1 m and Γ(n ) = τ l ,1 n . Thus, by rule TLR 1 , Γ σ(x) ∼ σ (y) : τ l,1 m ; τ l ,1 n → ∅, which proves the claim. Lemma A.23 (Types LL and HH are disjoint). For all well-formed Γ, for all ground terms M , M , N , N , for all sets of constraints c, c , if Γ M ∼ N : LL → c and Γ M ∼ N : HH → c then M = M and N = N .

•

  TNonce: then M = m and N = p for some m, p ∈ N , T = l for some l ∈ {HH, HL}, andΠ = Γ(m) = τ l,a m Γ(p) = τ l,a p Γ m ∼ p : l → ∅ . It is clear from the definition of [ Γ ] n i that [ Γ ] n i ([ m ] Γ i ) = τ l,1 [ m ] Γ i , and that [ Γ ] n i ([ p ] Γ i ) = τ l,1 [ p ] Γ i . Hence, Γ ([ m ] Γ i ) = τ l,1 [ m ] Γ i and Γ ([ p ] Γ i ) = τ l,1 [ p ] Γ i. Then, by rule TNonce, we haveΓ [ M ] Γ i ∼ [ N ] Γ i : l → ∅and the claim holds.• TNonceL, TCstFN, TKey, TPubKeyL, TVKeyL, THigh, TLR 1 : Similarly to the TNonce case, the claim follows directly from the definition of[ Γ ] n i , [ M ] Γ i , [ N ] Γ i , [ T ] n and [ c ] Γi in these cases.• TEncH: then T = LL and there exist T , k, c such thatΠ = Π Γ M ∼ N : (T ) T → c T <: key HH (T ) Γ M ∼ N : LL → c = c ∪ {M ∼ N } .By applying the induction hypothesis to Π , since [ (T) T ] n = ([ T ] n ) [ T ] n , there exists a proof Π of Γ [ M ] Γ i ∼ [ N ] Γ i : ([ T ] n ) [ T ] n → [ c ] Γ iIn addition it is clear by definition of [ • ] n and Lemma A.1 that since T <: key HH (T ) we have [ T ] n <: key HH ([ T ] n ).

  have [ M ] Γ i = [ N ] Γ i = x i . Since Γ ∈ branches([ Γ ] n i ), we have Γ (x i ) ∈ branches([ T ] n ).Hence by rule TVar, Γ x i ∼ x i : Γ (x i ) → ∅. Therefore, by rule TOr, we haveΓ x i ∼ x i : [ T ] n → ∅which proves the claim.• TLR' (the TLRL' case is similar): then there exist m, p, l such that T = l, andΠ = Π Γ M ∼ N : τ l,a m ; τ l,a p → c Γ M ∼ N : l → c .

•

  TSub: then there exists T <: T such thatΠ = Π Γ M ∼ N : T → c T <: T Γ M ∼ N : T → c .

=

  TLR ∞ : then M = m, N = p, c = ∅, and T = τ l,∞ m ; τ l ,∞ p for some m, p ∈ N , c = ∅, andΠ = Γ(m) = τ l,∞ m Γ(p) = τ l ,∞ p Γ m ∼ p : τ l,∞ m ; τ l ,∞ p → ∅ .We have by definition[ M ] Γ i = m i and [ N ] Γ i = p i , and [ Γ ] n i (m i ) = τ l,1 m i , and [ Γ ] n i (p i ) = τ l ,1 p i . Thus Γ (m i ) = τ l,1 m i , and Γ (p i ) = τ l ,1 p i . Hence by rule TLR 1 , we have Γ [ M ] Γ i ∼ [ N ] Γ i : τ l,1 m i ; τ l ,1 p i → ∅.In addition, τ l,∞ m ; τ l ,∞ p n 1≤j≤n τ l,1 m j ; τ l ,1 p j . Therefore, by applying rule TOr, we haveΓ [ M ] Γ i ∼ [ N ] Γ i : τ l,∞ m ; τ l ,

Lemma A. 29 (Lemma A. 30 (

 2930 Branches and expansion).• For all T ,T ∈branches(T ) branches( T n ) = branches([ T ] n ) • For all Γ for all i, n ∈ N, Γ ∈branches(Γ) branches( Γ n i ) = branches([ Γ ] n i )Typing processes in all branches). For allP , Q, Γ, {C Γ } Γ ∈branches(Γ) , if ∀Γ ∈ branches(Γ). Γ P ∼ Q → C Γ then Γ P ∼ Q → Γ ∈branches(Γ) C Γ .

Theorem A. 3 (

 3 Γ )|∃Γ . (c , Γ ) ∈ C ∧ Γ ∈ branches([ Γ ] n i )} (since Γ, Γ give the same types to names and keys)= {([ c ] Γ i , Γ )|∃Γ . (c , Γ ) ∈ C ∧ Γ ∈ branches([ Γ ] n i )}∪ ∀ [ c ] Γ i = [ C ] n i ∪ ∀ [ c ] Γi Typing processes with expanded types). For all Γ, P , Q and C, if

•

  PZero: then P = Q = [ P ] Γ i = [ Q ] Γ i = 0, and C = {(∅, Γ)}. Hence [ C ] n i = {(∅, Γ ) | Γ ∈ branches([ Γ ] n i )}

  by Lemma A.31, whose conditions are satisfied, by Lemma A.12). HenceC ∪ ∀ [ c ] Γ i ⊆ [ C ] n i, which proves the claim.• PIn: then P = in(x).P , Q = in(x).Q for some variable x and some processes P , Q , andΠ = Π Γ, x : LL P ∼ Q → C Γ P ∼ Q → C . Since [ Γ, x : LL ] n i = [ Γ ] n i , x i : [ LL ] n = [ Γ ] n i , x i : LL, by applying the induction hypothesis to Π , there exists C ⊆ [ C ] n i and a proof Π of [ Γ ] n i , x : LL [ P ] Γ,x:LL i ∼ [ Q ] Γ,x:LL i → C . In addition, [ P ] Γ i = [ in(x).P ] Γ i = in(x i ).[ P ] Γ i = in(x i ).[ P ] Γ,x:LL i . Similarly, we have [ Q ] Γ i = in(x i ).[ Q ] Γ,x:LL i .Therefore, using Π and rule PIn, we have [ Γ ] n i

-

  m : τ l,a m P ∼ Q → C Γ P ∼ Q → C . If a = 1: Since Γ, m : τ l,1 m n i = [ Γ ] n i , m : τ l,1 m ,by applying the induction hypothesis to Π , there existsC ⊆ [ C ] n i and a proof Π of [ Γ ] n i , m : τ l,1 m [ P ] Γ,m:τ l,1 m i ∼ [ Q ] Γ,m:τ l,1 m i → C . In addition [ P ] Γ i = [ new m.P ] Γ i , which is to say that [ P ] Γ i = new m : τ l,1 m .[ P ] Γ i = new m : τ l,1 m .[ P ] Γ,m:τ l,1 m i; and similarly for Q. Therefore, using Π and rule PNew, we have[ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C ⊆ [ C ] n i . -If a = ∞: Since Γ, m : τ l,∞ m n i = [ Γ ] n i , m i : τ l,1 m i , by applying the induction hypothesis to Π , there exists C ⊆ [ C ] n i and a proof Π of [ Γ ] n i , m i : τ l,1 m i [ P ] Γ,m:τ l,∞ m i ∼ [ Q ] Γ,m:τ l,∞ m i → C . In addition [ P ] Γ i = [ new m.P ] Γ i = new m i : τ l,1 m i .[ P [m i /m] ] Γ i , which is to say that [ P ] Γ i = new m i : τ l,1 m i .[ P ] Γ,m:τ l,∞ m i; and similarly for Q. Therefore, using Π and rule PNew, we have [ Γ ] n i

  By applying the induction hypothesis to Π , there existsC ⊆ [ C ] n i and a proof Π of [ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C .Similarly, by applying the induction hypothesis to Π , there existsC ⊆ [ C ] n i and a proof Π of [ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C . In addition, [ P ] Γ i = [ P | P ] Γ i = [ P ] Γ i | [ P ] Γ i . Similarly, [ Q ]

→ C 2 .

 2 By applying the induction hypothesis to Π T , there existC 1 ⊆ [ C ] n i and a proof Π 1 of [ Γ ] n i , x i : [ T ] n [ P ] Γ ,x:T i ∼ [ Q ] Γ ,x:T i → C 1 . Similarly with Π T , there exist C 2 ⊆ [ C ] n i and a proof Π 2 of [ Γ ] n i , x i : [ T ] n [ P ] Γ ,x:T i ∼ [ Q ] Γ ,x:T i In addition [ P ] Γ i = [ P ] Γ ,x:T i = [ P ] Γ ,x:T i, and similarly for Q.

  LL Γ(k 1 , k 2 ) <: key HH (T ) Π Γ, x : T P ∼ Q → C Π Γ P ∼ Q → C (∀T .∀k 3 = k 2 . Γ(k 1 , k 3 ) <: key HH (T ) ⇒ Π 1,k3 Γ, x : T P ∼ Q → C k3 ) (∀T .∀k 3 = k 2 . Γ(k 3 , k 2 ) <: key HH (T ) ⇒ Π 2,k3 Γ, x : T P ∼ Q → C k3 )Γ let x = dec(y, k 1 ) in P else P ∼ let x = dec(y, k 2

1 Γ→ c Π 2 Γ M 2 ∼

 122 by Lemma A.31). Hence (C ∪C ) ⊆ [ C ] n i , which proves the claim.• PIfLR:then P = if M 1 = M 2 then P else P ⊥ , Q = if N 1 = N 2 then Q else Q ⊥ for some messages M 1 , N 1 , M 2 , N 2, and some processes P , Q , P ⊥ , Q ⊥ , and there exist m, p, m , p such thatΠ = Π M 1 ∼ N 1 : τ l,1 m ; τ l ,1 p N 2 : τ l ,1 m ; τ l ,1 p → c b = (τ l,1 m ? = τ l ,1 m ) b = (τ l ,1 p ? = τ l ,1 p ) Π Γ P b ∼ Q b → C Γ P ∼ Q → C .By applying the induction hypothesis to Π , there existC ⊆ [ C ] n i and a proof Π of the judgement [ Γ ] n i [ P b ] Γ i ∼ [ Q b ] Γ i → C . Hence, by Lemma A.7, for all Γ ∈ branches([ Γ ] n i ), there exist C Γ ⊆ C , and a proof Π Γ of Γ [ P b ] Γ i ∼ [ Q b ] Γ i → C Γ . Moreover, by Lemma A.27 applied to Π 1 , for all Γ ∈ branches([ Γ ] n i ), there exists a proof Π 1,Γ of the judgement Γ [ M 1 ] Γ i ∼ [ N 1 ] Γ i : τ l,1 m ; τ l ,1 p → [ c ] Γ i . Similarly, there exists a proof Π 2,Γ of Γ [ M 2 ] Γ i ∼ [ N 2 ] Γ i : τ l ,1 m ; τ l ,1 p → [ c ] Γ i .In addition,[ P ]

.

  Let Γ ∈ branches([ Γ ] n i ). By Lemma A.5, using Π 2,Γ , there exists j ∈ 1, n such that there exists a proof Π2,Γ of Γ [ M 2 ] Γ i ∼ [ N 2 ] Γ i : τ l ,

  14, since σ, σ are ground, we have σ(x) = m and σ (x) = n. Therefore, σ| D∩F = σ F | D and σ | D∩F = σ F | D . Let c be the set c σ| D∩F ,σ | D∩F . By Lemma A.11, we have c σ,σ = c σ| D\F ,σ | D\F . We also have c= c σ F | D ,σ F | D , which is equal to c σ F ,σ F since vars(c ) ⊆ D. Hence c ⊆ c. Let Γ = Γ | dom(Γ )\F . We have Γ ⊆ Γ. Moreover, since Γ N ,K σ ∼ σ : Γ X → c σ ,it is clear from the definition of well-typedness for substitutions that we also have ΓN ,K σ| D\F ∼ σ | D\F : Γ X → c σ for some c σ ⊆ c σ . Note that c σ ⊆ c σ ⊆ c σ,σ = c σ|D\F ,σ | D\F . Finally, vars(c ) ⊆ vars(c )\F by definition of instantiation, thus vars(c ) ⊆ dom(Γ ). We have established that c ⊆ c, Γ ⊆ Γ, vars(c ) ⊆ dom(Γ ), Γ N ,K σ| D\F ∼ σ | D\F : Γ X → c σ , and c σ ⊆ c σ| D\F ,σ | D\F . Therefore, by definition of the consistency of c in Γ, theframes φ Γ LL ∪ φ l ( c σ| D\F ,σ | D\F ) and φ Γ LL ∪ φ r ( c σ| D\F ,σ | D\F ) are statically equivalent. Since φ Γ LL ⊆ φ Γ LL , that is to say that φ Γ LL ∪ φ l ( c σ,σ ) and φ Γ LL ∪ φ r ( c σ,σ) are statically equivalent. This proves the consistency of c in Γ.Lemma A.33. For all ground σ, σ such that ∃Γ ⊆ Γ. ∃c σ . Γ N ,K σ ∼ σ : Γ X → c σ , we have step2 Γ ( c σ,σ ) = true.

F

  = {x ∈ dom(Γ) | ∃m, n, l, l . Γ(x) = τ l,1 m ; τ l ,1 n },and we write (c, Γ)def = step1 Γ (c). For all i ∈ 1, n , let (c i , Γ i ) def = step1 Γ i (c i ). Let also (c , Γ ) def = step1 Γ (c ). We have c = (∪ 1≤i≤n c i ) ∪ c , and Γ = (∪ 1≤i≤n Γ i ) ∪ Γ .

If

  M ∼ N ∈ c, either M ∼ N ∈ c , or there exists i ∈ 1, n such that M ∼ N ∈ c i . • In the first case, M ∼ N ∈ c . By assumption, [ C ] n 1 and [ C ] n 2 are not empty. Hence there exist (c , Γ ) ∈ [ C ] n 1 and (c , Γ ) ∈ [ C ] n 2 . Thus, (c ∪ c ∪ c , Γ ∪ Γ ∪ Γ ) ∈ [ C ] n 1 ∪ × [ C ] n 2 ∪ × [ C ] n1 (as noted previously, Γ , Γ , and Γ are compatible). Hence, by assumption, check_const({(c∪ c ∪ c , Γ ∪ Γ ∪ Γ )}) succeeds. If c = f st(step1 Γ (c )), and c = f st(step1 Γ (c )), then we have c ∪ c ∪ c = f st(step1 Γ ∪Γ ∪Γ (c ∪ c ∪ c )).Therefore, step2 Γ (c ∪ c ∪ c ) = true.

3 .

 3 Finally, we check that step3 Γ (c) holds. Let M 1 ∼ N 1 ∈ c and M 2 ∼ N 2 ∈ c. Let us prove the property in the case where M 1 and M 2 are unifiable with a most general unifier µ. The case where N 1 and N 2 are unifiable is similar. Let then α be the restriction of µ to {x ∈ vars(M 1 ) ∪ vars(M 2 ) | Γ(x) = LL ∧ µ(x) ∈ N }.

Finally, only the

  case where M 1 ∼ N 1 ∈ c and M 2 ∼ N 2 ∈ c remains. By assumption,[ C ] n1 and [ C ] n 2 are not empty, hence there exist (c , Γ )∈ [ C ] n 1 and (c , Γ ) ∈ [ C ] n 2 . Thus, (c ∪ c ∪ c , Γ ∪ Γ ∪ Γ ) ∈ [ C ] n 1 ∪ × [ C ] n 2 ∪ × [ C ] n 1 . Hence, by assumption, check_const({(c ∪ c ∪ c , Γ ∪ Γ ∪ Γ )}) succeeds. If c = f st(step1 Γ (c )) and c = f st(step1 Γ (c )), then c ∪ c ∪ c = f st(step1 Γ ∪Γ ∪Γ (c ∪ c ∪ c )). Thus, step3 Γ ∪Γ ∪Γ (c ∪ c ∪ c ) holds, and since {M 1 ∼ N 1 , M 2 ∼ N 2 } ⊆ c ∪ c ∪ c , we know that N 1 α = N 2 α.Therefore the claim holds in this case, which concludes the proof that step3 Γ (c) holds.Therefore, for every (c, Γ)∈ (∪ × 1≤i≤n [ C ] n i )∪ × [ C ] n 1 , check_const({(c, Γ)}) succeeds, which proves the claim.Lemma A.42. For all (c, Γ) such that vars(c) ⊆ dom(Γ) which only contains variables indexed by 1 or 2, and all names and keys in c have finite types, if check_const({(c, Γ)}) succeeds, then for all Γ ∈ branches(Γ ), whereΓ = Γ[ 1≤i≤n τ l,1 m i ; τ l ,1 p i / τ l,∞ m ; τ l ,∞ p ] m,p∈N [seskey l,1 (T ) / seskey l,∞ (T )], check_const({(c, Γ )}) succeeds. Proof. Let n ∈ N.Let (c, Γ) be as defined in the statement of the lemma. Let us assume that check_const({(c, Γ)}) succeeds. p∈N [seskey l,1 (T ) / seskey l,∞ (T )],

(

  xµ )θ = xτ = xσ l µ = (xσ l )µ = m i µ = m i .Thus, xµ can only be either a variable y such that yθ = m i , or the nonce m i .Therefore, µ satisfies the conditions on the most general unifier expressed in step3 Γ (c ).Let x ∈ vars(M 1 ) ∪ vars(M 2 ) such that Γ (x) = LL and µ(x) ∈ N . We have (xµ )θ = xτ = xσ l µ = (xσ l )µ = xµ = µ(x) ∈ N .Thus, xµ can only be either a variable y (such that yθ = µ(x)), or the nonce µ(x).Conversely, let x ∈ vars(M 1 ) ∪ vars(M 2 ) such that Γ(x) = LL and µ (x) ∈ N . We have xµ = (xσ l )µ = xτ = (xµ )θ = µ (x).Let then θ be the substitution with domain {x ∈ vars(M 1 )∪ vars(M 2 ) | ∃m, p, l, l .∃i ∈ 1, n . Γ(x) = τ l,∞ m ; τ l ,∞ p ∧ µ (x) = m i } such that ∀x ∈ dom(θ ). θ (x) = p i if µ (x) = m i and Γ(x) = τ l,∞ m ; τ l ,∞ p .Let also α be the restriction ofµ to {x ∈ vars(M 1 ) ∪ vars(M 2 ) | Γ(x) = LL ∧ µ (x) ∈ N }.Since check_const({(c, Γ)}) = true, we know that step3 Γ (c ) holds. Since M 1 ∼ N 1 ∈ c , and M 2 ∼ N 2 ∈ c , this implies that N 1 α θ = N 2 α θ .

  {x ∈ vars(M 1 ) ∪ vars(M 2 ) | Γ(x) = LL} = {x ∈ vars(M 1 ) ∪ vars(M 2 ) | Γ (x) = LL}. Hence dom(α) = {x ∈ vars(M 1 ) ∪ vars(M 2 ) | Γ (x) = LL ∧ µ(x) ∈ N } = {x ∈ vars(M 1 ) ∪ vars(M 2 ) | Γ(x) = LL ∧ µ(x) ∈ N } ⊇ {x ∈ vars(M 1 ) ∪ vars(M 2 ) | Γ(x) = LL ∧ µ(x) ∈ N ∧ µ (x) ∈ N } = {x ∈ vars(M 1 ) ∪ vars(M 2 ) | Γ(x) = LL ∧ µ (x) ∈ N } = dom(α ).• either the test ∀id ∈ H check . I[id] = the last element of LL id succeeds: in that case, LL is by definition obtained by adding all elements of LL id except the last one before the only occurrence of this last element, I[id], in LL. In addition, by definition, all p in BB revote are distinct, and since BB is valid, they are associated with different id's. Thus, by construction of LL, two distinct indices corresponding to ballots of the same id in BB 1 cannot occur in LL. Therefore, no element from LL id is already present in LL, except for the last one I[id]. Hence, the list [LL [j]|∃(p, b). BB 1 [LL[j]] = (id, (p, b))] contains exactly the elements of LL id , in the same order, which proves the claim in this case. • or this test fails, and LL = [1 . . . |BB 1 |] LL cast . In that case it is clear that [LL [j]|∃(p, b).BB 1 [LL [j]] = (id, (p, b))] = [j|∃(p, b). BB 1 [j] = (id, (p, b))].

  ({P 1 | P 2 } ∪ P; φ; σ)

	({0} ∪ P; φ; σ)	τ -→ τ -→	({P 1 , P 2 } ∪ P; φ; σ) (P; φ; σ)	Par Zero
	({new n.P } ∪ P; φ; σ)	τ -→	({P } ∪ P; φ; σ)	New
	({new k.P } ∪ P; φ; σ)	τ -→	({P } ∪ P; φ; σ)	NewKey
	({out(t).P } ∪ P; φ; σ)

new axn.out

(axn)

  .4.

	Protocols	ProVerif TypeEq
	Helios	x	0.006s
	Needham-Schroeder (sym)	0.17s	0.017s
	Needham-Schroeder-Lowe	0.055s	0.010s
	Yahalom-Lowe	0.43s	0.020s
	Private Authentication	0.025s	0.009s
	BAC	0.026s	0.006s

  draws at random a bit β , and then simulates B 2 up to the point where B 2 has finished simulating A 2 . C 2 keeps a list BB, initially empty. It simulates each call to O p vote (id, v 0 , v 1 ) B makes by calling O vt vote (id, v β ), and appending the obtained ballot to BB. It simulates each call to O cast (id, b) by appending b to BB, provided id is corrupted and Valid(id, b, BB, pk). • Once C 2 has finished simulating B 2 , it draws at random a number k ∈ 1, l Recall that l is the number of different ids O p vote (and thus O vt vote ) has been called on, and is also the number of additional calls to O p

vote B has yet to make. Note that, at this point, BB in Exp ValidTally V,C is the same as BB a in Exp priv,β V,B . C then simulates the next k -1 calls to O p vote (id, v 0 , v 1 ), again by calling O vt vote (id, v β ). If the kth call is O p vote

•

  The entity H is a dummy interface between the environment and the voting functionality (i.e. it only forwards the messages between E and F v ).

			E
			setup	setup voting voting done tally	vote(id 1 , v 1 ) . . . vote(id n , v n )	r
			voting
		voting done
		ack(id)	modif?		H
	S	modif(f )		setup voting tally voting done	vote(id 1 , v 1 ) vote(id n , v n ) . . .	r
			result(r) res-ok		F v

Figure 6.7: The ideal execution with id1, . . . , idn ∈ H

  6. If σ 1 and σ 1 are ground and have disjoint domains, as well as σ 2 and σ 2 , then for all c,c σ 1 ,σ 2 σ 1 ,σ 2 = c σ 1 ∪σ 1 ,σ 2 ∪σ 27. if σ, σ are ground and Γ N ,K σ ∼ σ : Γ X → c for some c, if C∪ ∀ c is consistent, and if for all (c , Γ ) ∈ C, Γ ⊆ Γ , then C σ,σ is consistent.

	Proof. Points 1 and 2 follow immediately from the definition of consistency and of static
	equivalence.
	Point 3 follows from point 1: for every (c, Γ) ∈ C, (c ∪ c , Γ) is in C∪ ∀ c , and is therefore
	consistent. Hence (c, Γ) also is by point 1.
	Point 4 follows from the definition of ∪

  18, Kφ ↓ is not a key either. Hence Rφ↓= Rφ ↓= ⊥. (c) If Kφ↓ is a key, then by IH there exists c ⊆ c such that Γ Kφ↓∼ Kφ ↓: LL → c .

Hence, by Lemma A.18 (and since Γ is well-formed), Kφ ↓= Kφ↓∈ K, and either Γ(Kφ↓, Kφ ↓) <: key LL (T ) for some T , or Kφ↓∈ FK. Thus, in each case, by rules TKey and TSub or TCstFN, Γ Kφ↓∼ Kφ ↓: LL → ∅. We then apply the IH to S, and either Sφ↓= Sφ ↓= ⊥, in which case Rφ↓= Rφ ↓= ⊥; or there exists c ⊆ c such that Γ Sφ↓∼ Sφ ↓: LL → c . Since Rφ↓= enc(Sφ↓, Kφ↓), and similarly for φ , by rule TEnc, we have Γ Rφ↓∼ Rφ ↓: (LL) LL → c , and then by rule TEncL, Γ Rφ↓∼ Rφ ↓: LL → c .

  applying the induction hypothesis to Π , there existsC ⊆ [ C ] n i and a proof Π of [ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C . Hence, by Lemma A.7, for all Γ ∈ branches([ Γ ] n i ), there exist C Γ ⊆ C and a proof Π Γ of Γ [ P ] Γ i ∼ [ Q ] Γ i → C Γ . Moreover, by Lemma A.27, for all Γ ∈ branches([ Γ ] n i ), there exists a proof Π Γ of Γ [ M ] Γ i ∼ [ N ] Γ i : LL → [ c ] Γ i . In addition, [ P ] Γ i = [ out(M ).P ] Γ i = out([ M ] Γ i ).[ P ] Γ i . Similarly, we have [ Q ] Γ i = out([ N ] Γ i ).[ Q ] Γ i .Therefore, using Π Γ , Π Γ and rule POut, we have for all Γ ∈ branches([ Γ ] n i ) that Γ [ P ]

  by applying the induction hypothesis to Π , there existC ⊆ [ C ] n i and a proof Π of [ Γ ] n i , x i : [ T ] n [ P ] Γ,x:T

	proof Π of [ Γ ] n i	i [ P ] Γ i ∼ [ Q ] Γ ∼ [ Q ] Γ,x:T i i → C . → C . Similarly, there exist C ⊆ [ C ] n i and a
	By Lemma A.28 applied to Π d , we also have
		[ Γ ] n i	[ t ] Γ i ∼ t

Γ i : [ T ] n In addition, [ P ] Γ i = [ let x = t in P else P ]

  and for any k 3 satisfying the assumptions of either of the last two premises, [k 3 ] Γ i = k 3 . Since [ Γ, x : T ] n i = [ Γ ] n i , x i : [ T ] n ,by applying the induction hypothesis to Π , there exist C 1 ⊆ [ C ] n Similarly, there exist C 1 ⊆ [ C ] n i and a proof Π 1 of [ Γ ] n i

i and a proof Π 1 of [ Γ ] n i , x i : [ T ] n P Γ,x:T i ∼ Q Γ,x:T i → C 1 .

  applying the induction hypothesis to Π , there exists C ⊆ [ C ] n i and a proof Π of [ Γ ] n Hence, by Lemma A.7, for all Γ ∈ branches([ Γ ] n i ), there exist C Γ ⊆ C and a proof Π 1,Γ of Γ [ P ] Γ i ∼ [ Q ] Γ i → C Γ ; as well as C Γ ⊆ C and a proof Π 2,Γ of Γ [ P ] Γ i ∼ [ Q ] Γ i → C Γ . Moreover, by Lemma A.27, for all Γ ∈ branches([ Γ ] n i ), there exists a proof Π 1,Γ of Γ [ M ] Γ i ∼ [ N ] Γ i : LL → [ c ] Γ i .Similarly, there exists a proof Π 2,Γ of Γ [ M ]

i [ P ] Γ i ∼ [ Q ] Γ i → C . Similarly, there exists C ⊆ [ C ] n i and a proof Π of [ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C .

  by Lemma A.31, whose conditions are satisfied, by Lemma A.12). Hence (C ∪C )∪ ∀ ([ c ] Γ i ∪[ c ] Γ i ) ⊆ [ C ] n i , which proves the claim.

  applying the induction hypothesis to Π , there existC ⊆ [ C ] n i and a proof Π of the judgement [ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C . Similarly, there exist C ⊆ [ C ] n i and a proof Π of [ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C . Hence, by Lemma A.7, for all Γ ∈ branches([ Γ ] n i ), there exist C Γ ⊆ C and a proof Π 1,Γ of the judgement Γ [ P ] Γ i ∼ [ Q ] Γ i → C Γ ; as well as C Γ ⊆ C and a proof Π 2,Γ of Γ [ P ] Γ i ∼ [ Q ] Γ i → C Γ . Moreover, by Lemma A.27, for all Γ ∈ branches([ Γ ] n i ), there exists a proof Π 1,Γ of the judgement Γ [ M ] Γ i ∼ [ N ] Γ i : LL → [ c ] Γ i . Similarly, there exists a proof Π 2,Γ of Γ [ t ] Γ i ∼ [ t ] Γ i : LL → [ c ] Γ i . Since t ∈ K ∪ N ∪ C, we also have [ t ] Γ i ∈ K ∪ N ∪ C.

	In addition,
	[ P ] Γ

i = if M = M then P else P Γ i = if [ M ] Γ i = M Γ i then P Γ i else P Γ i .

Similarly,

[ Q ]

  C ⊆ [ C ] n i and a proof Π of the judgement [ Γ ] n Hence, by Lemma A.7, for all Γ ∈ branches([ Γ ]n i ), there exist C Γ ⊆ C and a proof Π Γ of the judgement Γ [ P ] Γ i ∼ [ Q ] Γ i → C Γ . Moreover, by Lemma A.27, for all Γ ∈ branches([ Γ ] n i ), there exists a proof Π 1,Γ of the judgement Γ [ M ] Γ i ∼ [ N ] Γ i : LL → [ c ] Γ i .Similarly, there exists a proof Π 2,Γ of Γ

i [ P ] Γ i ∼ [ Q ] Γ i → C .

  By applying the induction hypothesis to Π , there existC ⊆ [ C ] n i and a proof Π of the judgement [ Γ ] n i [ P ] Γ i ∼ [ Q ] Γ i → C . Let Γ ∈ branches([ Γ ] n i ). By applying Lemma A.7 to Π , there exists C Γ ⊆ C , such that there exists a proof Π Γ of the judgement Γ[ P ] Γ i ∼ [ Q ] Γ i → C Γ . Moreover, by Lemma A.27 applied to the proof Π 1 , there exists a proof Π 1,Γ of the type judgement Γ [ M ] Γ i ∼ [ N ] Γ i : [ T ] n * [ T ] n → [ c ] Γ i . Similarly, there exists a proof Π 2,Γ of the judgement Γ [ M ] Γ i ∼ [ N ] Γ

	Γ P ∼ Q → C		a m ; τ l ,a p	→ c	.
	i : τ l,a m ; τ l ,a p	n	) → [ c ] Γ i .
	In addition,
	[ P ] Γ

i = if M = M then P else P

  Similarly with Π ⊥ , there existC ⊆ [ C 2 ] n i ⊆ [ C ] n i and a proof Π of [ Γ ] n i [ P ⊥ ] Γ i ∼ [ Q ⊥ ] Γ i → C . Hence, by Lemma A.7, for all Γ ∈ branches([ Γ ] n i ), there exist constraint sets C 1,Γ ⊆ C (⊆ [ C ] n i ), and C 2,Γ ⊆ C (⊆ [ C ] n i ), and proofs Π ,Γ and Π ⊥,Γ of Γ [ P ] Γ i ∼ [ Q ] Γ i → C 1,Γ and Γ [ P ⊥ ] Γ i ∼ [ Q ⊥ ] Γ i → C 2,Γ . Moreover, by Lemma A.27 applied to Π 1 , for all Γ ∈ branches([ Γ ] n i ), there exists a proof Π 1,Γ of Γ [ M 1 ] Γ i ∼ [ N 1 ] Γ i : 1≤j≤n τ l,1 m

j ; τ l ,1 p j → [ c ] Γ i .

Similarly, there exists a proof Π

  Hence, by Lemma A.7, for all Γ ∈ branches([ Γ ] n i ), there exist C Γ ⊆ C (⊆ [ C ] n i ), and a proof Π Γ of Γ [ P ⊥ ] Γ i ∼ [ Q ⊥ ] Γ i → C Γ . Moreover, by Lemma A.27 applied to Π 1 , for all Γ ∈ branches([ Γ ] n i ), there exists a proof Π 1,Γ of Γ [ M 1 ] Γ i ∼ [ N 1 ] Γ Γ i . Similarly, there exists a proof Π 2,Γ of Γ [ M 2 ] Γ i ∼ [ N 2 ] Γ Γ i .We distinguish several cases, depending on a and a .

i : τ l,a m ; τ l ,a p n → [ c ] i : τ l ,a m ; τ l ,a p n → [ c ]

We omit the low confidentiality and high integrity type, which could be added but was not necessary to typecheck any of the protocols we considered.

In the actual types later on, we will actually only specify the type of the key, rather than the key itself, in the encryption type. We write the key itself in this overview for clarity.

Γ(k, k ) = T Γ k ∼ k : T → ∅ (TKey) Γ(x) = T Γ x ∼ x : T → ∅ (TVar) Γ M ∼ N : T → c Γ M ∼ N : T → c Γ M, M ∼ N, N : T * T → c ∪ c (TPair) Γ M ∼ N : T → c Γ M ∼ N : T → c T = LL ∨ (∃T , l.T <: key l (T )) Γ enc(M, M ) ∼ enc(N, N ) : (T ) T → c ∪ c (TEnc) Γ M ∼ N : (T ) T → c T <: key HH (T ) Γ M ∼ N : LL → c ∪ {M ∼ N } (TEncH) Γ M ∼ N : (LL) T → c T <: key LL (T ) or T = LL Γ M ∼ N : LL → c (TEncL) Γ M ∼ N : T → c Γ M ∼ N : T → c T = LL ∨ (∃T , T , l.T = pkey(T ) ∧ T <: key l (T )) Γ aenc(M, M ) ∼ aenc(N, N ) : {T } T → c ∪ c (TAenc) Γ M ∼ N : {T } pkey(T ) → c T <: key HH (T ) Γ M ∼ N : LL → c ∪ {M ∼ N } (TAencH) Γ M ∼ N : {LL} T → c (T = pkey(T ) ∧ T <: eqkey l (T )) or T = LL Γ M ∼ N : LL → c (TAencL) Γ M ∼ N : T → c Γ M ∼ N : LL → c Γ M ∼ N : eqkey HH (T ) → ∅ Γ sign(M, M ) ∼ sign(N, N ) : LL → c ∪ c ∪ {sign(M, M ) ∼ sign(N, N )}(TSignH) Γ M ∼ N : LL → c Γ M ∼ N : LL → c Γ sign(M, M ) ∼ sign(N, N ) : LL → c ∪ c (TSignL)

? = τ l ,1 n ) Γ P b ∼ Q b → C Γ if M 1 = M 2 then P else P ⊥ ∼ if N 1 = N 2 then Q else Q ⊥ → C (PIfLR) Γ P ∼ Q → C Γ M ∼ N : LL → c Γ M ∼ N : HH → c Γ if M = M then P else P ∼ if N = N then Q else Q → C (PIfS) Γ M 1 ∼ N 1 : τ l,∞ m ; τ l ,∞ n → ∅ Γ M 2 ∼ N 2 : τ l,∞ m ; τ l ,∞ n → ∅ Γ P ∼ Q → C Γ P ∼ Q → C Γ if M 1 = M 2 then P else P ∼ if N 1 = N 2 then Q else Q → C ∪ C (PIfLR*) Γ P ∼ Q → C Γ P ∼ Q → C Γ M ∼ N : LL → c Γ t ∼ t : LL → c t ∈ K ∪ N ∪ C Γ if M = t then P else P ∼ if N = t then Q else Q → C ∪ C (PIfP) Γ P ∼ Q → C Γ M ∼ N : T * T → c Γ M ∼ N : τ l,a m ; τ l ,a

m , τ l ,a n = τ l ,a n Γ P ∼ Q → C Γ if M 1 = M 2 then P else P ∼ if N 1 = N 2 then Q else Q → C (PIfLR'*)

In the full proof we actually prove a more general lemma, that does not require this condition, but we only present this particular case here, as it makes for a more legible statement.

Applying the induction hypothesis requires us to show that the type derivation for Γ M ∼ N : LL → c is shorter that the one for Γ M ∼ N : LL → c. This is done in the complete proof by actually proving a stronger version of Lemma 4, that does not only guarantee the existence of this derivation, but also that it is shorter than the one for Γ M ∼ N : (LL) T → c.

This is again using some of the technical lemmas established when proving the first soundness theorem

0 and 1 are represented as public constants in our model

They actually generate constraint sets containing only the empty set of constraints. We omit these from the presentation, for clarity, as they do not matter for consistency.

In Bob's process, variables have to be renamed to avoid collisions with the variables in Alice's. We omit this detail here.

Since the key k is used only for this purpose, it is never matched with other keys in Γ, and thus in that case rule PLetDec does not create many proof obligations.

As stated earlier, we renamed the variables xr and x k in Bob's ballots.

If C were dishonest, the attacker would know his private key and could simply try to send a request with it to see who B is willing to talk to.

Note that this is possible even though the decoy message and the true response have different length since, as mentioned in Chapter 2, we model length-hiding encryption.

The actual constraint set also contains empty sets of constraints generated when typechecking the else-branch corresponding to the case where decryption or projection fails on both sides. We omit them here for clarity, as they do not matter for consistency.

In the games, we leave implicit that when the adversary proceeds in several steps, it may transmit a state containing some knowledge to be used in further steps.

In this description we overloaded the semantics of the recovery algorithm. Strictly speaking this algorithm returns a selection function, which in turn defines a tampering function.

On register(id) from H, R lets c id = Register(id), and sends c id to H, who records it.

Ignoring the "reordering" part, which allows the adversary to change the order of Alice's votes in case Alice submitted several. For simplicity we consider in this section the case where voters do not revote.

We first establish several technical lemmas regarding the type system. These are used throughout the rest of the proofs for technical points. These technical details will not really appear in this rather high-level presentation of the proof, and hence we do not present here all these lemmas. To give an idea of the kind of properties they express, we give three examples of such lemmas. We do not however detail their proof: they are quite simple, and can be found in appendix A.1.

Lemma 1 (Typing is preserved by extending the environment). Consider processes P , Q that typecheck in Γ: Γ P ∼ Q → C. Assume Γ contains only bindings for variables, that do not occur in dom(Γ) and are not bound in P or Q. Also assume Γ does not contain union types, Overify BB (id) for id ∈ H check if Verify(id, V[id], BB) = then Happy ← Happy ∪ {id} verifications. If the verification is successful, id is added to the set Happy (initially empty). Once the adversary gives control back, provided all voters in H check are satisfied with BB (i.e. were added to Happy), BB is tallied. We finally check whether the result r contains at least all votes in Voted in that order (i.e. all votes from voters who verified). That is, we check whether there exists a list V c of pairs (id, v) (with id / ∈ H check ) such that r = ρ(Voted V c ). If not, the game returns 1, and the adversary wins.

Note that in this definition, when writing ρ(Voted V c ), we grouped all votes from voters in H check in the beginning of the list (without changing their order), and all additional votes in the end. For this to make sense, we will assume that the counting function ρ is stable, in the sense defined in the previous section (i.e., changing the order of votes does not change the result, as long as for any id, id's votes remain in the same order).

As in the previous chapter, we will assume that given a result r and a sequence V of identities and votes, it is possible to efficiently decide whether r contains all votes in V . That is, we assume a polynomial-time algorithm D such that

Definition 63 (Individual verifiability). A voting system V for a stable counting function ρ is individually verifiable against a malicious ballot box if for any adversary A,

As we explained above, for the ideal functionality F P v to entail verifiability, we need P to enforce it. We formalise this condition as follows.

Conclusion Appendix

Appendix A

Proofs of the type system (Chapter 2)

In this appendix, we provide the detailed proofs to all of the theorems in Chapter 2.

Only some of the lemmas from the proof were presented in Chapter 2. The following table gives the correspondence between the numbers used for Lemmas and Theorems in Chapter 2 and the numbers used in this appendix. Unless specified otherwise, the environments Γ considered in the lemmas are implicitly assumed to be well-formed.

A.1 General results and soundness

In this section, we prove the soundness of the type system for non replicated processes, as well as several results regarding the type system that this proof uses. i.e. T 3 is LL, HL, HH or a pair type.

∀T, T 1 , T 2 . T <: T

Lemma A.2 (Terms of type T ∨ T ). For all Γ, T , T , for all ground terms t, t , for all c, if

Proof. We prove this property by induction on the derivation of Γ t ∼ t : T ∨ T → c. The last rule of the derivation cannot be TNonce, TNonceL, TCstFN, TPubKey, TPubKeyL, TVKey, TVKeyL, TPair, TKey, TPair, TEnc, TEncH, TEncL, TAenc, TAencH, TAencL, TSignH, TSignL, THash, THashL, THigh, TLR 1 , TLR ∞ , TLRVar, TLR', or TLRL' since the type in their conclusion cannot be T ∨ T . It cannot be TVar since t, t are ground.

In the TSub case we know that Γ t ∼ t : T → c (with a shorter derivation) for some T <: T ∨ T ; thus, by Lemma A.1, T = T ∨ T , and the claim holds by the induction hypothesis.

Finally in the TOr case, the premise of the rule directly proves the claim.

Lemma A. [START_REF]Ordonnance de la ChF sur le vote électronique (OVotE) du 13 décembre 2013[END_REF] (Terms and branch types). For all Γ, T , c, for all ground terms t, t , if

then there exists T ∈ branches(T ) such that

Proof. This property is a corollary of Lemma A.2. We indeed prove it by successively applying this lemma to Γ t ∼ t : T → c until T is not a union type.

Lemma A. [START_REF]Délibération n o 2019-053 du 25 avril 2019 portant adoption d'une recommandation relative à la sécurité des systèmes de vote par correspondance électronique[END_REF] (Substitutions type in a branch). For all Γ, c, for all ground substitutions σ, σ , if

then there exists Γ ∈ branches(Γ) such that

Proof. This property follows from Lemma A.3. Indeed, by definition, c = x∈dom(Γ X ) c x for some c x such that for all x ∈ dom(Γ X )(= dom(σ) = dom(σ )),

Hence by applying Lemma A.3 we obtain a type T x ∈ branches(Γ(x)) such that Γ σ(x) ∼ σ (x) :

Thus if we denote Γ by ∀x ∈ dom(Γ X ).Γ (x) = T x , and Γ = Γ N ,K ∪Γ , we have Γ ∈ branches(Γ) and Γ N ,K σ ∼ σ : Γ X → c.

Lemma A. [START_REF]Machine readable travel document[END_REF] (Typing terms in branches). For all Γ, T , c, for all terms t, t , for all Γ ∈ branches(Γ), if Γ t ∼ t : T → c then Γ t ∼ t : T → c. Corollary: in that case, there exists T ∈ branches(T ) such that Γ t ∼ t : T → c.

Proof. We prove this property by induction on the derivation of Γ t ∼ t : T → c. In most cases for the last rule applied, Γ(x) is not directly involved in the premises, for any variable x.

Rather, Γ appears only in other typing judgements, or is used in Γ(k, k ) or Γ(n) for some keys k, k or nonce n, and keys or nonces cannot have union types. Hence, since the typing rules for terms do not change Γ, the claim directly follows from the induction hypothesis. For instance in the TPair case, we have t = t 1 , t 2 , t = t 1 , t 2 , T = T 1 * T 2 , c = c 1 ∪ c 2 , Γ t 1 ∼ t 1 : T 1 → c 1 , and Γ t 2 ∼ t 2 : T 2 → c 2 . Thus by the induction hypothesis, Γ t 1 ∼ t 1 : T 1 → c 1 , and Γ t 2 ∼ t 2 : T 2 → c 2 ; and therefore by rule TPair, Γ t ∼ t : T → c. The cases of rules TPubKey, TVKey, TKey, TEnc, TEncH, TEncL, TAenc, TAencH, TAencL, THashL, TSignH, TSignL, TLR', TLRL', TLRVar, TSub, TOr are similar.

The cases of rules TNonce, TNonceL, TCstFN, TPubKeyL, TVKeyL, THash, THigh, TLR 1 , and TLR ∞ are immediate since these rules use neither Γ nor another typing judgement in their premise.

Finally, in the TVar case, t = t = x for some variable x such that Γ(x) = T , and c = ∅. Rule TVar also proves that Γ x ∼ x : Γ (x) → ∅. Since Γ (x) ∈ branches(Γ(x)), by applying rule TOr as many times as necessary, we have Γ x ∼ x : Γ(x) → ∅, i.e. Γ x ∼ x : T → ∅, which proves the claim.

The corollary then follows, again by induction on the typing derivation. If T is not a union type, branches(T ) = {T } and the claim is directly the previous property. Otherwise, the last rule applied in the typing derivation can only be TVar, TSub, or TOr. The TSub case follows trivially from the induction hypothesis; since T is a union type, it is its own only subtype. In the TVar case, t = t = x for some variable x such that Γ(x) = T . Hence, by definition, Γ (x) ∈ branches(T ), and by rule TVar we have Γ t ∼ t : Γ (x) → c. Finally, in the TOr case, we have T = T 1 ∨ T 2 for some T 1 , T 2 such that Γ t ∼ t : T 1 → c. By the induction hypothesis, there exists T 1 ∈ branches(T 1 ) such that Γ t ∼ t : T 1 → c. Since, by definition, branches(T 1 ) ⊆ branches(T 1 ∨ T 2 ), this proves the claim.

Lemma A. [START_REF] Abadi | Mobile values, new names, and secure communication[END_REF] (Typing destructors in branches). For all Γ, T , t, t , x, for all Γ ∈ branches(Γ), if Γ t ∼ t : T then Γ t ∼ t : T .

Proof. This property is immediate by examining the typing rules for destructors. Indeed, Γ and Γ only differ on variables, and the rules for destructors only involve Γ(x) for x ∈ X in conditions of the form Γ(x) = T for some type T which is not a union type.

Hence in these cases Γ (x) is also T , and the same rule can be applied to Γ to prove the claim.

Lemma A. [START_REF] Abadi | Private authentication[END_REF] (Typing processes in branches). For all Γ, C, for all processes P , Q, for all

Proof. We prove this lemma by induction on the derivation of Γ P ∼ Q → C. In all the cases for the last rule applied in this derivation, we can show that the conditions of this rule still hold in Γ (instead of Γ) using • Lemma A.5 for the conditions of the form Γ M ∼ N : T → c;

• Lemma A.6 for the conditions of the form Γ d(y) ∼ d (y) : T ;

• the fact that if Γ(x) is not a union type, then Γ (x) = Γ(x), for conditions such as "Γ(x) = LL", "Γ(x) = τ l,a m ; τ l ,a n " or "Γ(x) <: key l (T )" (in the PLetLR case);

In the PIn, PLet, PLetDec, PLetAdecSame, and PLetAdecDiff cases, the typing judgement appearing in the condition of the rule uses Γ extended with an additional variable, which is bound in P and Q. We detail the PIn case, the other cases are similar. We have P = in(x).P , Q = in(x).Q for some x, P , Q such that x / ∈ dom(Γ) and Γ, x : LL P ∼ Q → C. Hence by the induction hypothesis, if (c, Γ ) ∈ C, then dom(Γ ) ⊆ dom(Γ, x : LL) ∪ bvars(P ) ∪ bvars(Q ) ∪ nnames(P ) ∪ nnames(Q ) ∪ (nkeys(P ) ∪ nkeys(Q )) 2 .

Since bvars(P ) = {x} ∪ bvars(P ) and bvars(Q) = {x} ∪ bvars(Q ), this proves the claim.

The cases of rules PNew and PNewKey are similar, extending Γ with a nonce or key instead of a variable.

In the POut case, there exist P , Q , M , N , C , c such that P = out(M ).P , and since bvars(P ) = bvars(P ), nnames(P ) = nnames(P ), and similarly for Q, this proves the claim.

In the PIfL case, there exist P , P , Q , Q , M , N , M , N , C , C , c, c such that We write the proof for the case where (c , Γ ) ∈ C , the other case is analogous. By the induction hypothesis, we thus have dom(Γ ) ⊆ dom(Γ) ∪ bvars(P ) ∪ bvars(Q ) ∪ nnames(P ) ∪ nnames(Q ) ∪ (nkeys(P ) ∪ nkeys(Q )) 2 and since bvars(P ) ⊆ bvars(P ), nnames(P ) ⊆ nnames(P ), and similarly for Q, this proves the claim.

The cases of rules POr, PLetLR, PIfLR, PIfS, PIfLR*, PIfP, PIfI, PIfLR'*, and PIfAll remain. All these cases are similar, we write the proof for the PIfLR* case. In this case, there exist P , P , Q , Q , M , N , M , N , C , C , l, l , m, n such that

• and Γ P ∼ Q → C .

If (c, Γ ) ∈ C, we thus know that (c, Γ ) ∈ C or (c, Γ ) ∈ C . We write the proof for the case where (c, Γ ) ∈ C , the other case is analogous. By the induction hypothesis, we thus have dom(Γ ) ⊆ dom(Γ) ∪ bvars(P ) ∪ bvars(Q ) ∪ nnames(P ) ∪ nnames(Q ) ∪ (nkeys(P ) ∪ nkeys(Q )) 2 and since bvars(P ) ⊆ bvars(P ), nnames(P ) ⊆ nnames(P ), and similarly for Q, this proves the claim.

Lemma A.9 (Environments in the constraints do not contain union types). For all Γ, C, for all processes P , Q, if

then for all (c, Γ ) ∈ C, branches(Γ ) = {Γ } i.e. for all x ∈ dom(Γ ), Γ (x) is not a union type.

Proof. This property is immediate by induction on the typing derivation.

Lemma A.10 (Typing is preserved by extending the environment). For all Γ, Γ , P , Q, C, c, t, t , T , c, if Γ and Γ ∪ Γ (we do not require that Γ is well-formed):

• if dom(Γ) ∩ dom(Γ ) = ∅, and if Γ t ∼ t : T → c, then Γ ∪ Γ t ∼ t : T → c.

• if dom(Γ) ∩ dom(Γ ) = ∅, and if Γ d(y) : T , then Γ ∪ Γ d(y) : T .

• if (dom(Γ) ∪ bvars(P ) ∪ bvars(Q) ∪ nnames(P ) ∪ nnames(Q)) ∩ dom(Γ ) = ∅, and keys(Γ ) ∩ (keys(Γ) ∪ nkeys(P ) ∪ nkeys(Q)) = ∅, and Γ P ∼ Q → C, then Γ ∪ Γ P ∼ Q → C . where C = {(c, Γ c ∪ Γ )|(c, Γ c ) ∈ C ∧ Γ ∈ branches(Γ )} (note that the union is well defined, i.e. Γ c and Γ are compatible, thanks to Lemma A. [START_REF] Abadi | A calculus for cryptographic protocols: The spi calculus[END_REF] Proof.

• The first point is immediate by induction on the type derivation.

• The second point is immediate by examining the typing rules for destructors.

• The third point is immediate by induction on the type derivation of the processes. In the PZero case, to satisfy the condition that the environment is its own only branch, rule POr needs to be applied first, in order to split all the union types in Γ , which yields the environments branches(Γ ∪ Γ ) in the constraints.

Lemma A.11 (Consistency for Subsets).

The following statements about constraints hold:

1. If (c, Γ) is consistent, and c ⊆ c then (c , Γ) is consistent.

2. Let C be a consistent constraint set. Then every subset C ⊆ C is also consistent.

3. If C∪ ∀ c is consistent then C also is.

5. • σ,σ commutes with ∪, ∪ × , ∪ ∀ , i.e. for all C, C , σ, σ , C∪ × C σ,σ = C σ,σ ∪ × C σ,σ and similarly for ∪, ∪ ∀ .

In the PPar case, we have

Thus any element of C is of the form (c 1 ∪ c 2 , Γ 1 ∪ Γ 2 ) where (c 1 , Γ 1 ) ∈ C 1 , (c 2 , Γ 2 ) ∈ C 2 , and Γ 1 , Γ 2 are compatible. By the induction hypothesis, both C 1 and C 2 contain a branch of Γ. The claim holds, as these are necessarily the same branch, since Γ 1 and Γ 2 are compatible.

In the POr case, we have Γ = Γ , x : T 1 ∨ T 2 for some x, Γ , T 1 , T 2 such that Γ , x : T 1 P ∼ Q → C 1 and Γ , x : T 2 P ∼ Q → C 2 , and C = C 1 ∪ C 2 . Thus by the induction hypothesis, if (c, Γ ) ∈ C i (for i ∈ {1, 2}), then Γ contains some Γ ∈ branches(Γ , x : T i ) ⊆ branches(Γ), and the claim holds.

In the POut case, there exist P , Q , M , N , C , c such that P = out(M ).P ,

by definition of ∪ ∀ there exists c such that (c , Γ ) ∈ C and c = c ∪ c . Hence by applying the induction hypothesis to Γ P ∼ Q → C , there exists Γ ∈ branches(Γ) such that Γ ⊆ Γ .

In the PIfL case, there exist P , P , Q , Q , M , N , M , N , C , C , c, c such that We write the proof for the case where (c , Γ ) ∈ C , the other case is analogous. By applying the induction hypothesis to Γ P ∼ Q → C , there exists Γ ∈ branches(Γ) such that Γ ⊆ Γ , which proves the claim.

All remaining cases are similar. We write the proof for the PIfLR* case. In this case, there exist

→ ∅, Γ P ∼ Q → C , and Γ P ∼ Q → C . If (c, Γ ) ∈ C, we thus know that (c, Γ ) ∈ C or (c, Γ ) ∈ C . We write the proof for the case where (c, Γ ) ∈ C , the other case is analogous. By applying the induction hypothesis to Γ P ∼ Q → C , there exists Γ ∈ branches(Γ) such that Γ ⊆ Γ , which proves the claim. Lemma A. [START_REF] Arapinis | Untraceability in the applied pi calculus[END_REF] (All branches are represented in the constraints). For all Γ, C, for all processes P , Q, if Γ P ∼ Q → C then for all Γ ∈ branches(Γ), there exists (c, Γ ) ∈ C, such that Γ ⊆ Γ .

Proof. We prove this property by induction on the type derivation of Γ P ∼ Q → C. In the PZero case, C = {(∅, Γ)}, and by assumption branches(Γ) = {Γ}, hence the claim trivially holds.

In the PPar case, we have

By the induction hypothesis, there exists (c 1 , Γ 1 ) ∈ C 1 and (c 2 , Γ 2 ) ∈ C 2 such that Γ ⊆ Γ 1 and Γ ⊆ Γ 2 . By Lemma A.8, dom(Γ 1 ) and dom(Γ 2 ) only contain dom(Γ)(= dom(Γ )) and variables and names in bvars(P 1 ) ∪ bvars(Q 1 ) ∪ nnames(P 1 ) ∪ nnames(Q 1 ) ∪ (nkeys(P 1 ) ∪ nkeys(Q 1 )) 2 and bvars(P 2 ) ∪ bvars(Q 2 ) ∪ nnames(P 2 ) ∪ nnames(Q 2 ) ∪ (nkeys(P 2 ) ∪ nkeys(Q 2 )) 2 respectively. We have Γ 1 (x) = Γ 2 (x) = Γ (x) for all x ∈ dom(Γ ), and the sets bvars(P 1 ) ∪ bvars(Q 1 ) ∪ nnames(P 1 ) ∪ nnames(Q 1 ) ∪ (nkeys(P 1 ) ∪ nkeys(Q 1 )) 2 and bvars(P 2 ) ∪ bvars(Q 2 ) ∪ nnames(P 2 ) ∪ nnames(Q 2 ) ∪ (nkeys(P 2 ) ∪ nkeys(Q 2 )) 2 are disjoint by well formedness of the processes P 1 | P 2 and Q 1 | Q 2 . Thus Γ 1 and Γ 2 are compatible. Therefore (c 1 ∪ c 2 , Γ 1 ∪ Γ 2 ) ∈ C 1 ∪ × C 2 (= C), and the claim holds since Γ ⊆ Γ 1 ∪ Γ 2 .

In the POr case, we have Γ = Γ , x : T 1 ∨ T 2 for some x, Γ , T 1 , T 2 such that Γ , x : T 1 P ∼ Q → C 1 and Γ , x : T 2 P ∼ Q → C 2 , and C = C 1 ∪ C 2 . Since branches(Γ) = branches(Γ , x : T 1 ) ∪ branches(Γ , x : T 2 ), we know that Γ ∈ branches(Γ , x : T i ) for some i. We conclude this case directly by applying the induction hypothesis to Γ , x :

In the POut case, there exist P , Q , M , N , C , c such that P = out(M ).P , Q = out(N ).Q , C = C ∪ ∀ c, Γ M ∼ N : LL → c and Γ P ∼ Q → C . By applying the induction hypothesis to Γ P ∼ Q → C , there exists (c , Γ ) ∈ C such that Γ ⊆ Γ . By definition of ∪ ∀ , (c ∪ c, Γ ) ∈ C, which proves the claim.

In the PIfL case, there exist P , P , Q , Q , M , N , M , N , C , C , c, c such that All remaining cases are similar. We write the proof for the PIfLR* case. In this case, there exist

If (c, Γ ) ∈ C, we thus know that (c, Γ ) ∈ C or (c, Γ ) ∈ C . We write the proof for the case where (c, Γ ) ∈ C , the other case is analogous. By applying the induction hypothesis to Γ P ∼ Q → C , there exists Γ ∈ branches(Γ) such that Γ ⊆ Γ , which proves the claim.

Lemma A.14 (Refinement types). For all Γ, for all terms t, t , for all m, n, a, l, l , c, if

• or t and t are variables x, y ∈ X and there exist labels l , l , and names m , n such that

In particular if t, t are ground then the last case cannot occur.

Proof. The proof of this property is immediate by induction on the typing derivation for the terms. Indeed, because of the form of the type, and by well-formedness of Γ, the only rules which can lead to Γ t ∼ t : τ l,a m ; τ l ,a n → c are TVar, TLR 1 , TLR ∞ , TLRVar, and TSub. In the TVar, TLR 1 , TLR ∞ cases the claim directly follows from the premises of the rule. In the TLRVar case, t and t are necessarily variables, and their types in Γ are obtained directly by applying the induction hypothesis to the premises of the rule.

Finally in the TSub case, Γ t ∼ t : T → c and T <: τ l,a m ; τ l ,a n . By Lemma A.1, T = τ l,a m ; τ l ,a n and we conclude by the induction hypothesis.

Lemma A.15 (Encryption types). For all environment Γ, types T , T , messages M , N , M 1 , M 2 and set of constraints c:

both with shorter derivations (than the one for Γ M ∼ N : (T ) T → c);

• or M and N are variables.

If

with shorter derivations (than the one for Γ M ∼ N : {T } T → c);

• or M and N are variables.

If T <:

7. The symmetric properties to the previous four points, i.e. when the term on the right is an encryption, also hold.

Proof. We prove point 1 by induction on the derivation of Γ M ∼ N : (T ) T → c. Because of the form of the type, and by well-formedness of Γ, the only possibilities for the last rule applied are TVar, TEnc, and TSub. The claim clearly holds in the TVar and TEnc cases. In the TSub case, we have Γ M ∼ N : T → c for some T <: (T ) T . Hence by Lemma A.1, there exists T <: T such that T = (T ) T . Therefore, by applying the induction hypothesis to Γ M ∼ N : T → c

• either M and N are two variables, and the claim holds; Point 2 has a similar proof to point 1.

We now prove point 3 by induction on the proof of Γ enc(M 1 , M 2 ) ∼ N : T → c. Because of the form of the terms, the last rule applied can only be THigh, TOr, TEnc, TEncH, TEncL, TAencH, TAencL, TLR', TLRL' or TSub.

The THigh, TLR', TOr, TEnc cases are actually impossible by Lemma A.1, since T <: LL. In the TSub case, we have Γ enc(M 1 , M 2 ) ∼ N : T → c for some T such that T <: T . By transitivity of <:, T <: LL, and the induction hypothesis proves the claim. In all other cases, T = LL and the claim holds.

Point 4 has a similar proof to point 3.

We prove point 5 by induction on the proof of Γ enc(M 1 , M 2 ) ∼ N : LL → c. Because of the form of the terms and of the type (i.e. LL) the last rule applied can only be TEncH, TEncL, TAencH, TAencL, TLRL' or TSub.

The TLRL' case is impossible, since by Lemma A.14 it would imply that enc(M 1 , M 2 ) is either a variable or a nonce.

In the TSub case, we have Γ enc(M 1 , M 2 ) ∼ N : T → c for some T such that T <: LL. By point 3, T = LL, and the premise of the rule thus gives a shorter derivation of Γ enc(M 1 , M 2 ) ∼ N : LL → c. The induction hypothesis applied to this shorter derivation proves the claim.

The TAencH and TAencL cases are impossible, since the condition of the rule would then imply Γ enc(M 1 , M 2 ) ∼ N : {T } T → c for some T , T , c , which is not possible by point 2.

In the TEncH case, there exist

Finally in the TEncL case, there similarly exist T , T such that T <: key LL (T ) or T = LL, and Γ enc(M 1 , M 2 ) ∼ N : (LL) T → c. Hence by point 1, there exist

Hence in any case (potentially using subtyping), Γ M 2 ∼ N 2 : LL → c 2 , which proves the claim.

Point 6 has a similar proof to point 5.

The symmetric properties, as described in point 7, have analogous proofs. Lemma A.16 (Signature types). For all environment Γ, type T , messages M 1 , M 2 , N , and set of constraints c:

3. The symmetric properties to the previous points, i.e. when the term on the right is a signature, also hold.

We now prove point 2 by induction on the proof of Γ M 1 , M 2 ∼ N : T → c. Because of the form of the terms, the last rule applied can only be THigh, TOr, TPair, TEncH, TEncL, TAencH, TAencL, TLR', TLRL' or TSub.

The THigh, TLR', and TOr cases are actually impossible by Lemma A.1, since T <: LL.

The TLRL' and case is also impossible, since by Lemma A.14 it would imply that M 1 , M 2 is either a variable or a nonce.

The TEncH, TEncL, TAencH, TAencL cases are impossible, since the condition of the rule would then imply Γ M 1 , M 2 ∼ N : (T ) T → c (or {T } T ) for some T , T , c , which is not possible by Lemma A. [START_REF] Arapinis | When are three voters enough for privacy properties? In 21st[END_REF].

In the TPair case, the claim clearly holds. Finally, in the TSub case, we have Γ M 1 , M 2 ∼ N : T → c for some T such that T <: T . By transitivity of <:, T <: LL, and we may apply the induction hypothesis to Γ M 1 , M 2 ∼ N : T → c. Hence either T = LL or T = T 1 * T 2 for some T 1 , T 2 . By Lemma A.1, this implies in the first case that T = LL and in the second case that T = LL or T is also a pair type (T = HL and T = HH in both cases, since we already know that T <: LL).

We prove point 3 as a consequence of the first two points, by induction on the derivation of Γ M 1 , M 2 ∼ N : LL → c. The last rule in this derivation can only be TEncH, TEncL, TAencH, TAencL, TLR', TLRL' or TSub by the form of the types and terms, but similarly to the previous point TEncH, TEncL, TAencH, TAencL, TLR' and TLRL' are actually not possible.

Hence the last rule of the derivation is TSub.

and we conclude by the induction hypothesis. Otherwise, since T <: LL, by Lemma A.1, T 1 <: LL and T 2 <: LL. Moreover by the first property, there exist

Thus by subtyping, Γ M 1 ∼ N 1 : LL → c 1 and Γ M 2 ∼ N 2 : LL → c 2 , which proves the claim.

The symmetric properties, as described in point 4, have analogous proofs.

Lemma A.18 (Type for keys, nonces and constants). For all well-formed environment Γ, for all messages M , N , for all key k ∈ K, for all nonce or constant n ∈ N ∪ C, for all c, l, the following properties hold:

The TLRL' case is also impossible. Indeed in this case, we have Γ pk(M ) ∼ N : τ l,a m ; τ l ,a n → ∅ for some m, n. Lemma A.14 then implies that m = pk(M ) (and n = N ), which is contradictory.

In the TSub case, we have Γ pk(M ) ∼ N : T → c for some T such that T <: LL. By Lemma A.1, this implies that T is either a pair type, an encryption type, a public or verification key type, a key type, or LL. Just as in the previous point, the pair, encryption, verification key, and key cases are impossible. If T = LL, the claim trivially holds by the induction hypothesis. The case where T = pkey(T ) (for some T ) remains. Since Γ pk(M ) ∼ N : T → c, by point 2 we have N = pk(N ) for some N , c = ∅ and Γ M ∼ N : T → ∅. In addition, by Lemma A.1, since T <: LL, there exist l, T such that T <: eqkey l (T ), and the claim holds.

Finally in the TPubKeyL case, the claim clearly holds.

Point 6 has a similar proof to point 5.

The remaining properties have similar proofs to point 4. For point 7, i.e. if Γ n ∼ t : HH → c, only the TNonce, TSub, and TLR' cases are possible. The claim clearly holds in the TNonce case.

In the TLR' case, we have Γ n ∼ t : τ HH,a m ; τ HH,a p → ∅ for some m, p. Lemma A.14 then implies that m = n, and p = t, and Γ(n) = τ HH,a m , and Γ(p) = τ HH,a p , which proves the claim. In the TSub case, Γ n ∼ t : T → c for some T <: HH, thus by Lemma A.1, T is either a pair type (impossible by Lemma A.17), an encryption type (impossible by Lemma A.15), a public key, verification key, or key type (impossible by points 1 to 3), or HH (and we conclude by the induction hypothesis).

For point 8, similarly, only the TNonceL, TCstFN, TSub, TLRL' cases are possible. The TSub case is proved in the same way as for the third property. The TLRL' case is proved similarly to the previous point. Finally the claim clearly holds in the TNonceL and TCstFN cases.

The symmetric properties, as described in point 9, have analogous proofs.

Lemma A. [START_REF] Bana | Towards unconditional soundness: Computationally complete symbolic attacker[END_REF] (Typable messages either reduce on both sides, or fail on both sides). For all (well-formed) Γ, for all messages M , M , for all T , c, if

Proof. Note that since messages do not contain destructors, it is clear that for any message M , either M↓= M or M↓= ⊥.

We prove the lemma by induction on the type derivation for Γ M ∼ N : T → c.

In the TNonce, TNonceL, TCstFN, TPubKeyL, TVKeyL, TKey, TVar, TLR 1 , TLR ∞ , TLRVar, it is clear that M↓= M = ⊥ and N↓= N = ⊥.

In the THigh case, the premise of the rule implies that M↓ = ⊥ and N↓ = ⊥.

In the TLR' and TLRL' cases, there exist l, l , a, m, n, c such that Γ M ∼ N : τ l,a m ; τ l ,a n → c. Hence by Lemma A.14, either M , N are variables, or M = m and N = n. Either way, M↓= M = ⊥ and N↓= N = ⊥.

The TEnc case is more involved. In that case, there exist M , M , N , N , T , T such that M = enc(M , M ), N = enc(N , N ), and T = (T ) T . Let us show that M ↓ = ⊥ ⇒ N ↓ = ⊥ (the other direction has a similar proof). Since M↓ = ⊥, we have M ↓ = ⊥. Hence, as Γ M ∼ N : T → c for some c , by the induction hypothesis, N ↓ = ⊥. Since M ↓ = ⊥, we also have M ↓∈ K, i.e. by the previous remark, M ∈ K. In addition, Γ M ∼ N : T → c for some c , and either T = LL or ∃l, T .T <: key l (T ). Hence, by Lemma A.18, either M , N ∈ K, or M , N ∈ X . The second case is impossible since M ∈ K. We thus have N ↓ = ⊥ and N ↓∈ K. Therefore, N↓ = ⊥ and the claim holds.

The TAenc, TPubKey, TVKey, TSignH, TSignL cases are similar to the TEnc case.

In the remaining cases, i.e. TPair, TEncH, TEncL, TAencH, TAencL, THash, THashL, TSub, and TOr, the claim directly follows from the induction hypothesis. We write the proof for the TPair case. In that case there exist Lemma A.20 (Application of destructors). For all Γ, for all t, t , T , c, for all ground substitutions σ, σ such that dom(σ

Proof. Since Γ t ∼ t : T , by examining the typing rules for destructors, we can distinguish four cases for t, t .

• t = dec(x, M ) and t = dec(x, M ), for some variable x ∈ X , and some M ∈ X ∪ K. We know that Γ t ∼ t : T , which can be proved using the rule DDecL, DDecT, DDecT', DDecH', or DDecL'. In the DDecL, DDecH', DDecL' cases, Γ(x) = LL, and in the DDecT and DDecT' cases Γ(x) = (T ) T for some T . By assumption we have

-Let us prove 1) by contraposition. Assume tσ↓ = ⊥. Hence, σ(x) = enc(M , M σ) for some M , and M σ is a key k ∈ K. We will now show that Let us now show that there exists a ground message N such that σ (x) = enc(N , k). * In the DDecL, DDecH' and DDecL' cases, Γ(x) = LL. Since σ, σ are welltyped, we have Γ N ,K σ(x) ∼ σ (x) : LL → c for some c , i.e. Γ N ,K enc(M , k) ∼ σ (x) : LL → c . Thus by Lemma A.15, there exist N , N such that σ (x) = enc(N , N ). In addition:

• either Γ N ,K k ∼ N : key HH (T ) → c for some T , c : in that case, by Lemma A.18, N ∈ K and Γ(k, N ) <: key HH (T ). We have already shown that Γ(k, k) is either a subtype of LL, or seskey l,a (T ) for some l, T . By well-formedness of Γ, only the second case is possible, and it implies that N = k.

• or Γ N ,K k ∼ N : LL → c for some c : in that case, by Lemma A.18, N = k. In any case we have σ (x) = enc(N , k). * In the DDecT and DDecT' cases, Γ(x) = (T ) seskey l,a (T ) and Γ M ∼ M : seskey l,a (T ) → ∅ for some l, T . Hence we have Γ N ,K σ(x) ∼ σ (x) : (T ) seskey l,a (T ) → c for some c , i.e. Γ N ,K enc(M , k) ∼ σ (x) : (T ) seskey l,a (T ) → c . Therefore, by Lemma A.15, there exist N , N such that σ (x) = enc(N , N ), and Γ N ,K k ∼ N : seskey l,a (T ) → ∅. Thus, by Lemma A.18, N ∈ K and Γ(k, N ) = seskey l,a (T ). By well-formedness of Γ, this implies that In all cases, point 2) holds, which concludes this case.

• t = adec(x, M ) and t = adec(x, M ), for some variable x ∈ X , and some M ∈ X ∪ K. We know that Γ t ∼ t : T , which can be proved using the rule DAdecL, DAdecT, DAdecT', DAdecH', or DAdecL'. In the DAdecL, DAdecH', DAdecL' cases, Γ(x) = LL, and in the DAdecT and DAdecT' cases Γ(x) = {T } T for some T . By assumption we have

-Let us prove 1) by contraposition. Assume tσ↓ = ⊥. Hence, σ(x) = aenc(M , pk(M σ)) for some M , and M σ is a key k ∈ K. We will now show that Let us now show that σ (x) = aenc(N , pk(k)) for some ground N . * In the DAdecL, DAdecH' and DAdecL' cases, Γ(x) = LL. Since σ, σ are well-typed, we have Γ N ,K σ(x) ∼ σ (x) : LL → c for some c , i.e. Γ N ,K aenc(M , pk(k)) ∼ σ (x) : LL → c . Thus by Lemma A.15, there exist N , N such that σ (x) = aenc(N , N ). In addition:

• either Γ N ,K pk(k) ∼ N : pkey(T ) → c and T <: key HH (T ) for some T , T , c : in that case, by Lemma A.18, N = pk(k ) for some key k ∈ K such that Γ(k, k ) <: key HH (T ). We have already shown that Γ(k, k) is either a subtype of LL, or seskey l,a (T ) for some l, T . By well-formedness of Γ, only the second case is possible, and it implies that k = k. • or Γ N ,K pk(k) ∼ N : LL → c for some c : in that case, by Lemma A.18, N = pk(k).

In any case we have σ (x) = aenc(N , pk(k)). * In the DAdecT and DAdecT' cases, we have Γ(x) = {T } pkey(seskey l,a (T )) as well as Γ M ∼ M : seskey l,a (T ) → ∅ for some l, T . Hence we have

for some c , i.e. Γ N ,K aenc(M , pk(k)) ∼ σ (x) : {T } pkey(seskey l,a (T )) → c . Therefore, by Lemma A.15, there exist N , N , c such that σ (x) = aenc(N , N ), and Γ N ,K pk(k) ∼ N : pkey(seskey l,a (T )) → c . Thus, by Lemma A.18, N = pk(k ) for some key k ∈ K and Γ(k, k ) = seskey l,a (T ). By well-formedness of Γ, this implies that k = k. Therefore σ (x) = aenc(N , pk(k)).

Hence, in any case, t σ = adec(aenc(N , pk(k)), k), By assumption, σ, σ are welltyped, and σ(x)↓ = ⊥. Thus by Lemma A.19 σ (x)↓ = ⊥. Then N ↓ = ⊥. Therefore we have t σ ↓= N ↓ = ⊥, which proves the first direction of 1). The other direction is analogous.

-Moreover, still assuming tσ↓ = ⊥, and keeping the notations from the previous point, we have tσ ↓= M and t σ ↓= N . The destructor typing rule applied to prove Γ t ∼ t : T can be DAdecT, DAdecT', DAdecL, DAdecH', or DAdecL'. * In the DAdecT and DAdecT' cases, we have

for some c ⊆ c, i.e. • t = t = checksign(x, M ). We know that Γ t ∼ t : T , which can be proved using either DCheckH, DCheckH', DCheckL, or DCheckL'. In both cases, Γ(x) = LL. M is either a verification key or a variable. By assumption we have Γ N ,K σ(x) ∼ σ (x) : LL → c x for some c x ⊆ c.

-Let us prove 1) by contraposition. Assume tσ↓ = ⊥. Hence, σ(x) = sign(M , M σ) for some M , M , and M σ is a key k ∈ K such that M σ = vk(k).

We will now show that M σ = M σ = vk(k).

In both cases we have Γ vk(k) ∼ vk(k) : vkey(T ) → c for some c and some T <: key HH (T ). Hence by Lemma A.18, Γ(k, k) <: key HH (T ). By Lemma A.16, we know that there exist c ⊆ c x such that Γ M ∼ N : T → c (the case where Γ k ∼ k : LL → c is impossible by Lemma A.18 since Γ(k, k) <: key HH (T ) and Γ is well-formed). This proves point 2). * In the DCheckL and DCheckL' cases we have T = LL, and Γ N ,K σ(x) ∼ σ (x) : LL → c x for c x ⊆ c, i.e. Γ N ,K sign(M , k) ∼ sign(N , k) : LL → c x . By Lemma A. [START_REF] Arapinis | New privacy issues in mobile telephony: fix and verification[END_REF], we know that there exist c ⊆ c x such that Γ M ∼ N : LL → c . This proves point 2). In all cases, point 2) holds, which concludes this case.

• t = t = π 1 (x). We know that Γ t : t T , which can be proved using either rule DFst or DFstL. In the first case, Γ(x) = T 1 * T 2 is a pair type, and in the second case Γ(x) = LL.

-We prove 1) by contraposition. Assume tσ↓ = ⊥. Hence, σ(x) = M 1 , M 2 for some M 1 , M 2 . By assumption σ, σ are well-typed. Thus Γ σ(x) ∼ σ (x) : Γ(x) → c x , for some c x ⊆ c. Thus, by applying Lemma A.17, in any case we know that there exist N 1 , N 2 such that N = N 1 , N 2 . Since, σ, σ are well-typed, and σ(x)↓ = ⊥, by Lemma A.19, σ (x)↓ = ⊥. Then N 1 ↓ = ⊥. Therefore we have t σ ↓= N 1 ↓ = ⊥, which proves the first direction of 1). The other direction is analogous.

-Moreover, still assuming tσ↓ = ⊥, and keeping the notations from the previous point, we have tσ↓= M 1 and t σ ↓= N 1 . In addition, we know that Γ t : t T , which can be proved using either rule DFst or DFstL. Lemma A.17, which we applied in the previous point, also implies that there exist c 1 , c 2 , such that c = c 1 ∪ c 2 and for i ∈ {1, 2}, Γ M i ∼ N i :

We distinguish two cases for the rule applied to prove Γ t : t T . * DFst: Then Γ(x) = T * T 2 for some T 2 , and Γ

In both cases, point 2) holds, which concludes this case.

• t = t = π 2 (x). This case is similar to the previous one.

Lemma A.21 (LL type is preserved by attacker terms). For all (well-formed) Γ, for all frames φ and φ with Γ φ ∼ φ : LL → c, for all attacker term R such that vars(R) ⊆ dom(φ), either there exists c ⊆ c such that

Proof. We show this property by induction over the attacker term R. Induction Hypothesis: the statement holds for all subterms of R.

There are several cases for R. The base cases are the cases where R is a variable, a name in FN or a constant in C.

By assumption, there exists c ⊆ c such that Γ φ(x) ∼ φ (x) : LL → c . Thus, by Lemma A.19, either φ(x) = φ (x) = ⊥, or φ(x)↓= φ(x) and φ (x)↓= φ (x). In the first case the claim clearly holds. In the second case, Rφ↓= φ(x) and Rφ ↓= φ (x). Since Γ φ(x) ∼ φ (x) : LL → c ⊆ c, the claim also holds.

2. R = a with a ∈ C ∪ FN ∪ F K. Then Rφ↓= Rφ ↓= a and by rule TCstFN, we have Γ a ∼ a : LL → ∅. Hence the claim holds.

3. R = pk(K) We apply the induction hypothesis to K and distinguish three cases. 4. R = vk(K) This case is analogous to the pk case.

5. R = R 1 , R 2 where R 1 and R 2 are also attacker terms. We then apply the induction hypothesis to the same frames and R 1 , R 2 . We distinguish two cases:

(a) R 1 φ↓= ⊥ ∨ R 2 φ↓= ⊥ In this case we also have R 1 φ ↓= ⊥ ∨ R 2 φ ↓= ⊥ and therefore Rφ↓= Rφ ↓= ⊥.

R = h(S)

We apply the induction hypothesis to S. We distinguish two cases:

(a) Sφ↓= ⊥ In this case we also have Sφ ↓= ⊥ and therefore Rφ↓= Rφ ↓= ⊥.

(b) Sφ↓ = ⊥ In this case, by the induction hypothesis, we also have Sφ ↓ = ⊥, and we also know that there exists c ⊆ c such that Γ Sφ↓∼ Sφ ↓: LL → c Thus, by rule THashL, Γ Rφ↓∼ Rφ ↓: LL → c , which proves this case.

10. R = π 1 (S) We apply the induction hypothesis to S and distinguish three cases.

(a) Sφ↓= ⊥ Then Sφ ↓= ⊥ (by IH), hence Rφ↓= Rφ ↓= ⊥.

(b) Sφ↓ = ⊥ and is not a pair Then by IH there exists c ⊆ c such that Γ Sφ↓∼ Sφ ↓: LL → c , which implies that Rφ ↓ and is not a pair either by Lemma A.17. Hence Rφ↓= Rφ ↓= ⊥.

(c) Sφ↓= M 1 , M 2 is a pair Then by IH there exists c ⊆ c such that Γ Sφ↓∼ Sφ ↓: LL → c . This implies, by Lemma A.17, that Sφ ↓= M 1 , M 2 is also a pair, and that Γ M 1 ∼ M 1 : LL → c for some c ⊆ c . Since Rφ↓= M 1 and Rφ ↓= M 1 , this proves the case.

11. R = π 2 (S) This case is analogous to the case 10.

12. R = dec(S, K) We apply the induction hypothesis to K and, similarly to the case 6, we distinguish several cases.

(a) If Kφ↓= ⊥ or is not a key then, as in case 6, Rφ↓= Rφ ↓= ⊥.

(b) If Kφ↓ is a key, then similarly to case 6 we can show that Kφ↓= Kφ ↓, and either Γ(Kφ ↓, Kφ ↓) <: key LL (T ) for some T , or Kφ ↓∈ FK. We then apply the IH to S, which creates two cases. Either Sφ ↓= Sφ ↓= ⊥, or there exists c ⊆ c such that Γ Sφ ↓∼ Sφ ↓: LL → c . In the first case, the claim holds, since Rφ↓= Rφ ↓= ⊥. In the second case, by Lemmas A.15 and A.18, and since Γ is well-formed, we know that Sφ ↓ is a message encrypted with Kφ ↓ if and only if Sφ ↓ also is an encryption by this key. Consequently, if Sφ↓ is not an encryption by Kφ↓ (= Kφ ↓), then it is the same for Sφ ↓; and Rφ↓= Rφ ↓= ⊥. Otherwise, Sφ↓= enc(M, Kφ↓) and Sφ ↓= enc(N, Kφ ↓) for some M , N . In that case, by IH, we have Γ enc(M, Kφ↓) ∼ enc(N, Kφ ↓) : LL → c . Therefore, by Lemma A.15, Γ M ∼ N : LL → c , which is to say Γ Rφ↓∼ Rφ ↓: LL → c . Hence the claim holds in this case.

13. R = adec(S, K) We apply the induction hypothesis to K and, similarly to the case 6, we distinguish several cases.

(a) If Kφ↓= ⊥ or is not a key then, as in case 6, Rφ↓= Rφ ↓= ⊥.

(b) If Kφ↓ is a key, then similarly to case 6 we can show that Kφ↓= Kφ ↓, and either Γ(Kφ↓, Kφ ↓) <: key LL (T ) for some T , or Kφ↓∈ F K. We then apply the IH to S, which creates two cases. Either Sφ↓= Sφ ↓= ⊥, or there exists c ⊆ c such that Γ Sφ↓∼ Sφ ↓: LL → c . In the first case, the claim holds, since Rφ↓= Rφ ↓= ⊥. In the second case, by Lemmas A. [START_REF] Arapinis | When are three voters enough for privacy properties? In 21st[END_REF] • for all x ∈ dom(Γ), Γ(x) is not of the form τ l,1 m ; τ l ,1 n ,

• for all x ∈ dom(σ), σ(x)↓= σ(x), and similarly for σ ,

In particular, if we have Γ = Γ X and Γ = Γ N ,K for some Γ , then the first three conditions trivially hold.

Proof. Note that Γ N ,K = ∅, and Γ X = Γ . This proof is done by induction on the typing derivation for the terms. The claim clearly holds in the TNonce, TNonceL, TCstFN, TPubKeyL, TVKeyL, TKey, TLR 1 , TLR ∞ since their conditions do not use Γ(x) (for any variable x) or another type judgement, and they still apply to the messages M σ and N σ . Indeed, (as Γ is well-formed) the only possible cases are TNonce, TSub, and TLR'. In the TNonce case the claim clearly holds. In the TSub case we use Lemma A.1 followed by Lemma A.18. In the TLR' case we apply Lemma A.14 and the claim directly follows.

Let us now show that for all M , N , N ground, for all c, c , Γ M ∼ N : LL → c and Γ M ∼ N : HH → c cannot both hold. (This corresponds, with the notations of the statement of the lemma, to proving by contradiction that M = M . The proof that N = N is analogous.)

We show this property by induction on the size of M . Since Γ M ∼ N : HH → c , by the property stated in the beginning of this proof, we can distinguish four cases.

• If M is a nonce and Γ(M ) = τ HH,a M : then this contradicts Lemma A.18. Indeed, this lemma (point 5) implies that M ∈ BN , but also (by point 6), since Γ M ∼ N : LL → c, that either Γ(M ) = τ LL,a M for some a ∈ {1, ∞}, or M ∈ FN ∪ C.

• If M is a key and Γ(M, k) <: key HH (T ) for some T , k: then by Lemma A.18, since Γ M ∼ N : LL → c, there exists T , k such that Γ(M, k ) <: key LL (T ) or k, k ∈ FK. Since Γ is well-formed, and by Lemma A.1, this contradicts Γ(M ) <: key HH (T ).

• If Γ M ∼ N : HH * T → c for some T , c : then by Lemma A.17, since M , N are ground, there exist

• If Γ M ∼ N : T * HH → c for some T , c : this case is similar to the previous one.

Lemma A. [START_REF] Benaloh | Verifiable secret-ballot elections[END_REF] (Low terms are recipes on their constraints). For all ground messages M , N , for all T <: LL, for all Γ, c, if Γ M ∼ N : T → c then there exists an attacker recipe R without destructors such that

Proof. We prove this lemma by induction on the typing derivation of Γ M ∼ N : T → c. We distinguish several cases for the last rule in this derivation.

• TNonce, THigh, TOr, TLR 1 , TLR ∞ , TLR', TLRVar: these cases are not possible, since the type they give to terms is never a subtype of LL by Lemma A.1.

• TVar: this case is not possible since M , N are ground.

• TSub: this case is directly proved by applying the induction hypothesis to the judgement Γ M ∼ N : T → c where T <: T <: LL, which appears in the conditions of this rule, and has a shorter derivation.

• TLRL': in this case, Γ M ∼ N : τ LL,a n ; τ LL,a n → c for some nonce n, some a ∈ {∞, 1}, some c , and c = ∅. By Lemma A.14, this implies that M = N = n, and Γ(n) = τ LL,a n . Thus, by definition, there exists x such that φ Γ LL (x) = n and the claim holds with R = x.

• TNonceL: in this case M = N = n for some n ∈ N such that Γ(n) = τ LL,a n for some a ∈ {1, ∞}. Hence, by definition, there exists x such that φ Γ LL (x) = n and the claim holds with R = x.

• TCstFN: then M = N = a ∈ C ∪ FN ∪ FK, and the claim holds with R = a.

• TKey: then by well-formedness of Γ, M = N = k ∈ K and there exists T such that Γ(k, k) <: key LL (T ). By definition, there exists x such that φ Γ LL (x) = k and the claim holds with R = x.

• TPubKeyL, TVKeyL: then M = N = pk(k) (resp. vk(k)) for some k ∈ keys(Γ) ∪ FK.

If k ∈ keys(Γ), by definition, there exists x such that φ Γ LL (x) = pk(k) (resp. vk(k)) and the claim holds with R = x. If k ∈ FK, the claim holds with R = pk(k).

• TPubKey, TVKey: these two cases are similar, we write the proof for the TPubKey case. The form of this rule application is:

for some T such that pkey(T ) <: LL. By Lemma A.1, this implies that there exist T , l such that T <: eqkey l (T ). Thus, Γ M ∼ N : eqkey l (T ) → ∅. By Lemma A.18, this implies M = N = k ∈ keys(Γ). By definition, there exists x such that φ Γ LL (x) = pk(k), and the claim holds with R = x.

• TPair, THashL: these cases are similar. We detail the TPair case. In that case, T = T 1 * T 2 for some T 1 , T 2 . By Lemma A.1, T 1 , T 2 are subtypes of LL. In addition, there exist

. By applying the induction hypothesis to these two judgements (which have shorter proofs), we obtain R 1 , R 2 such that for all i,

• TEncH, TAencH, THash, TSignH: these four cases are similar. In each case, by the form of the typing rule, we have c = {M ∼ N } ∪ c for some c . Therefore by definition of φ l (c), φ r (c), there exists x such that φ l (c)(x) = M and φ r (c)(N ) = N . The claim holds with R = x.

• TEncL, TAencL: these two cases are similar, we write the proof for the TEncL case. The form of this rule application is:

for some T such that T = LL or T <: key LL (T ) for some T . In both cases T <: LL.

both with a proof shorter that Π. Thus by applying the induction hypothesis to these judgements, there exist R, R such that

. Therefore, the claim holds with the recipe enc(R, R ).

Lemma A.26 (Invariant). For all Γ, φ

for all multisets of processes P, P , Q, where the processes in P, P , Q are noted {P i }, {P i }, {Q i }; for all constraint sets {C i }, if:

• for all i = j, the sets of bound variables in P i and P j (resp. Q i and Q j ) are disjoint, and similarly for the names

Q are ground, and there exist ground

for all x ∈ dom(σ P ), σ P (x)↓= σ P (x), and similarly for σ Q ,

then there exist a word w, a multiset Q = {Q i }, constraint sets {C i }, a frame φ Q , a substitution σ Q , an environment Γ , constraints c φ , and c σ such that:

• for all i = j, the sets of bound variables in P i and P j (resp. Q i and Q j ) are disjoint, and similarly for the bound names;

• σ 2 P , σ 2 Q are ground and there exist σ P ⊇ σ 2 P , and

for all x ∈ dom(σ P ), σ P (x)↓= σ P (x), and similarly for σ Q ,

Proof. Note that the assumption that σ P (resp. σ Q ) extends σ 1 P (resp. σ 1 Q ) only with variables not appearing in P or φ P (resp.

First, we show that it is sufficient to prove this lemma in the case where Γ does not contain any union types. Indeed, assume we know the property holds in that case. Let us show that the lemma then also holds in the other case, i.e. if Γ contains union types. By hypothesis, σ P , σ Q are ground, and Γ N ,K σ P ∼ σ Q : Γ X → c σ . Hence we know by Lemma A.4 that there exists a branch Γ ∈ branches(Γ) (thus Γ does not contain union types), such that (Γ )

Moreover, by Lemma A.7, ∀i, Γ

and is therefore consistent. Thus, if the lemma holds when the environment does not contain union types, it can be applied to the same processes, frames, substitutions and to Γ , which directly concludes the proof.

Therefore, we may assume that Γ does not contain any union types. Note that, since by assumption c σ ⊆ c φ σ P ,σ Q , we have

Hence, by Lemma A.11, (

Thus the assumption on the disjointness of the sets of bound variables (and names) in the processes implies, using Lemma A.8, that each of the C i σ P ,σ Q ∪ ∀ c σ is also consistent. Moreover, this disjointness property for P and Q follows from the other points, as it is easily proved by examining the reduction rules that it is preserved by reduction.

By hypothesis, (P, φ P , σ 1 P ) reduces to (P , φ P , σ 2 P ) We know from the form of the reduction rules that exactly one process P i ∈ P is reduced, while the others are unchanged. By the assumptions, there is a corresponding process

We continue the proof by a case disjunction on the last rule of Π i . Let us first consider the cases of the rules PZero, PPar, PNew, and POr.

• PZero: then P i = Q i = 0. Hence, the reduction rule applied to P is Zero, and P = P\{P i }, φ P = φ P , and σ 2 P = σ 1 P . The same reduction can be performed in Q:

Since the other processes, the frames, environments and substitutions do not change in this reduction, all the claims clearly hold in this case (with

using Π i in the case of P i and Q i ;

using Π j , for j = i, as well as Lemma A.10, for the other processes, since n does not appear in these processes by assumption.

In addition, all the frames, substitutions, and constraints are unchanged; and σ, σ are well-typed in Γ if and only if they are well-typed in Γ.

• PNewKey: This case is analogous to the PNew case.

• POr: this case is not possible, since we have already eliminated the case where Γ contains union types.

In all the other cases for the last rule in Π i , we know that the head symbol of P i is not | , 0 or new.

Hence, the form of the reduction rules implies that P i ∈ P is reduced to exactly one process P i ∈ P , while the other processes in P do not change (i.e. P j = P j for j = i). If we show in each case that the same reduction rule that is applied to P i can be applied to reduce Q to a multiset Q by reducing process Q i into Q i , we will also have Q j = Q j for j = i. Therefore the claim on the cardinality of the processes multisets will hold.

Since P i , Q i can be typed and the head symbol of P i is not new, it is clear by examining the typing rules that the head symbol of Q i is not new either. Hence, we will choose a Γ containing the same nonces and keys as Γ.

The proofs for theses cases follow the same structure:

• The typing rule gives us information on the form of P i and Q i .

• The form of P i gives us information on which reduction rule was applied to P.

• The form of Q i is the same as P i . Hence (additional conditions may need to be checked depending on the rule) Q i can be reduced to some process Q i by applying the same reduction rule that was applied to P i (or at least, a reduction rule with the same action).

• thus Q can be reduced too, with the same actions as P. We then check the additional conditions on the typing of the processes, frames and substitutions, and the consistency condition.

First, let us consider the POut case.

• POut: then P i = out(M ).P i and reduces to P i via the Out rule, and

We have

Hence, the same reduction rule Out can be applied to reduce the process Q i into Q i , and the claim on the reduction of Q holds. We choose Γ = Γ. We have

Q are not extended by the reduction, and the typing environment does not change, which trivially proves the claim regarding the substitutions.

In addition, since by assumption c σ ⊆ c φ σ 1

Moreover, since only M and N are added to the frames in the reduction, Π suffices to prove the claim that Γ φ P ∼ φ Q : LL → c φ . Since all processes other that P i and Q i are unchanged by the reduction (and since the typing environment is also unchanged), Π suffices to proves the claim that ∀j.

Thus, in this case, it only remains to be proved that (

This constraint set is equal to

which is consistent by hypothesis. Hence the claim holds in this case.

In the remaining cases, from the form of the typing rules for processes, the head symbol of neither P i nor Q i is out. Thus, the reduction applied to P i (from the assumption), as well as the one applied to Q i (which, as we will show, has the same action as the rule for P i ), cannot be Out. Therefore no new term is output on either side, and φ P = φ P and φ Q = φ Q . Hence the claim on the domains of the frames holds by assumption. Moreover, as we will see, in all cases Γ is either Γ, or Γ, x : T where x is a variable bound in (the head of) P i and Q i , and T is not a union type.

We choose

Besides, in the cases where we choose Γ = Γ then it is true (by hypothesis) that for j = i, Γ P j ∼ Q j → C j . In the cases where we choose Γ = Γ, x : T , where x is bound in P i and Q i , then, since the processes are assumed to use different variable names, x does not appear in P j or Q j (for j = i). Hence, if j = i, using the assumption that Γ P j ∼ Q j → C j , by Lemma A.10, we have Γ

Hence, for each remaining possible last rule of Π i , we only have to show that:

a) The same reduction rule can be applied to Q i as to P i , with the same action. (Except in the case of the rule PIfLR, as we will see, where rule If-Then may be applied on one side while rule If-Else is applied on the other side, but this has no influence on the argument, as these two rules both represent a silent action, and have a very similar form.) b) there exist σ P and σ Q ground, and containing σ 2 P and σ 2 Q respectively, that satisfy the conditions on the domains, contain only messages that do not reduce to ⊥, and such that Γ N ,K σ P ∼ σ Q : Γ X → c σ for some set of constraints c σ . Since at most one variable x is added to the substitutions in the reduction, we will show in each case that we can choose It is thus sufficient to ensure the consistency of S∪ ∀ c φ σ P ,σ Q . Since σ P = σ P ∪ {σ P (x)/x} (and similarly for Q), it then suffices to show the consistency of

The substitutions σ P (x) and σ Q (x) are ground, and Γ N ,K σ P (x) ∼ σ Q (x) : T → c x (which we will show for each case as point b)). Hence by Lemma A.11, if

Therefore, by the previous implication, it is sufficient to prove that

is consistent. This is the condition stated at the beginning of this point, since

We can now prove the remaining cases for the last rule of Π i , that is to say the cases of the rules PIn, PLet, PLetDec, PLetAdecSame, PLetAdecDiff, PLetLR, PIfL, PIfLR, PIfS, PIfLR*, PIfP, PIfI, PIfLR'*, and PIfAll.

• PIn: then P i = in(x).P i and reduces to P i via the In rule, and

We have α = in(R) for some attacker recipe R such that vars(R) ⊆ dom(φ P ), and Rφ P σ 1 P ↓= Rφ P σ P ↓ = ⊥. We also have σ 2 P = σ 1 P ∪ {Rφ P σ 1 P ↓ /x}, φ P = φ P . The same reduction rule In can be applied to reduce the process

This follows from Lemma A.21, using the fact that by Lemma

Therefore point a) holds.

We choose Γ = Γ, x : LL. We have

Moreover, Π and the fact that

which is consistent by hypothesis, prove point c) and conclude this case.

• PLet: then P i = let x = t in P i else P i and

. P i reduces to either P i via the Let-In rule, or P i via the Let-Else rule. In addition

We have α = τ .

Let

Hence, by Lemma A.20, using Π, we have:

Therefore, if rule Let-In is applied to P i then it can also be applied to reduce

and if the rule applied to P i is Let-Else then it can also be applied to reduce

This proves point a). We prove here the Let-In case. The Let-Else case is similar (although slightly easier, since no new variable is added to the substitutions).

In this case we have

In addition, by hypothesis, tσ P = tσ 1 P = tσ and t σ Q = t σ 1 Q = t σ . By Lemma A.20, we know in this case that there exists c ⊆ c such that Γ N ,K tσ P ↓∼ t σ Q ↓: T → c. Thus, by Lemma A.2, there exists T ∈ branches(T ) such that Γ N ,K tσ P ↓∼ t σ Q ↓: T → c.

We now prove that point c) holds. Using Π , we have Γ, x :

This last constraint set is consistent by hypothesis.

Hence, by Lemma

) and concludes this case.

• PLetDec: then there exist y, P i , P i , Q i , Q i such that P i = let x = dec(y, k 1 ) in P i else P i , and

and Γ(y) = LL. P i reduces to either P i via the Let-In rule, or P i via the Let-Else rule. In addition

We have α = τ . In addition, by hypothesis, σ P (y) = σ 1 P (y) and σ Q (y) = σ 1 Q (y). We consider two cases.

-If dec(yσ P , k 1 )↓ = ⊥ then the reduction applied to P i is Let-In, and P i is reduced to P i .

This also implies that there exists M such that yσ P = enc(M, k 1 ). Since Γ(y) = LL, we know by assumption that Γ

↓= N , and rule Let-In can be applied to reduce Q i into Q i , which proves point a). In this case we have

We now prove that point c) holds. Using Π i , we have Γ, x :

This last constraint set is consistent by hypothesis. Hence, by Lemma A.11, (∪

and rule Let-Else can be applied to reduce

Q i into Q i , which proves point a). In this case we have

We now prove that point c) holds. Using Π 1,k i , we have Γ, x :

This last constraint set is consistent by hypothesis. Hence, by Lemma A.11, (∪

proves point c) and concludes this case.

-If dec(yσ P , k 1 )↓= ⊥ then the reduction applied to P i is Let-Else, and P i is reduced to P i . Again we distinguish two cases.

In this case we have

by well-formedness of the processes, x does not appear in P i ). Since Γ does not contain union types, Γ ∈ branches(Γ, x :

We now prove that point c) holds. Using Π 2,k i , we have Γ, x :

This last constraint set is consistent by hypothesis. Hence, by Lemma A.11, (∪

proves point c) and concludes this case. * If dec(yσ Q , k 2 )↓= ⊥ then rule Let-Else can be applied to reduce Q i into Q i . In this case we have σ 2 P = σ 1 P and σ 2 Q = σ 1 Q . We choose Γ = Γ, σ P = σ P and σ Q = σ Q . Since the substitutions and environments do not change, point b) clearly holds. We now prove that point c) holds. Using Π i , we have Γ

This last constraint set is consistent by hypothesis. Hence, by Lemma A.11, (∪

proves point c) and concludes this case.

• PLetAdecSame and PLetAdecDiff: these two cases are similar to the PLetDec case.

• PLetLR: then

P i reduces to either P i via the Let-In rule, or P i via the Let-Else rule.

In addition

.

We have α = τ . By assumption we also have σ P (y) = σ 1 P (y) and σ Q (y) = σ 1 Q (y). By hypothesis, σ P , σ Q are ground and Γ N ,K σ P ∼ σ Q : Γ X → c σ . Hence, by definition of the well-typedness of substitutions, there exists Therefore the reduction rule applied to P i can only be Let-Else, and P i is reduced to P i . Since we also have d(σ Q (y))↓= ⊥, this rule can also be applied to reduce Q i into Q i . This proves point a).

We therefore have σ 2 P = σ 1 P and σ 2 Q = σ 1 Q . We choose Γ = Γ. Since the substitutions and typing environments are unchanged by the reduction, point b) clearly holds.

Moreover, Π , and the fact that

which is consistent by hypothesis, prove point c) and conclude this case.

• PIfL: then

for some Q i , Q ⊥ i . P i reduces to P i which is either P i via the If-Then rule, or P ⊥ i via the If-Else rule. In addition

We have α = τ . In addition, by hypothesis,

Let us first consider the case where

We have α = τ in any case. In addition, by assumption, tσ P = tσ 1

There are four cases for b and b , which are all similar. We write the proof for the case where b = and b = ⊥, i.e. τ l,1 m = τ l ,1 m and τ l ,1 n = τ l ,1 n .

Thus the reduction rule applied to P i is If-Then and P i = P i . On the other hand, rule If-Else can be applied to reduce

This proves point a) (these rules both correspond to silent actions).

We choose Γ = Γ. We have σ P = σ P and σ Q = σ Q .

Since the substitutions and environments do not change in this reduction, point b) trivially holds.

Moreover, Π and the fact that

) and conclude this case.

• PIfS:

for some Q i , Q ⊥ i . P i reduces to P i which is either P i via the If-Then rule, or P ⊥ i via the If-Else rule. In addition

We have α = τ in any case. In addition, by hypothesis, tσ P = tσ 1 P for t ∈ {M, M } and

Let us first consider the case where

Therefore by Lemma A.23, M σ P = M σ P and N σ Q = N σ Q . Hence the reduction for P i is necessarily If-Else, which is also applicable to reduce Q i to Q ⊥ i . This proves point a). We choose Γ = Γ. We have σ 2 P = σ 1 P and σ 2 Q = σ 1 Q . Since the substitutions and typing environments do not change in this reduction, point b) trivially holds.

Moreover, Π and the fact that

) and conclude this case.

The case where M σ P ↓= N σ Q ↓= ⊥ or M σ P ↓= N σ Q ↓= ⊥ remains. In that case, the rule applied to P i is necessarily If -Else, and this rule can also be applied to Q i . We conclude the proof similarly to the previous case.

• PIfI: then

This case is similar to the PIfS case: the incompatibility of the types of M , N and M , N ensures that the processes can only follow the else branch. P i reduces to P i which is either P i via the If-Then rule, or P ⊥ i via the If-Else rule. In addition

We have α = τ in any case. In addition, by hypothesis, tσ P = tσ 1 P for t ∈ {M, M } and

Let us first consider the case where M σ P ↓ = ⊥, and

By Lemma A.17, M σ P and N σ Q both are pairs. Similarly we can show that Γ N ,K M σ P ∼ N σ Q : τ l,a m ; τ l ,a n → c for some c . By Lemma A.14, this implies that M σ P = m and N σ Q = n. Thus neither of these two terms are pairs. Therefore M σ P = M σ P and N σ Q = N σ Q . The end of the proof for this case is then the same as for the PIfS case.

The case where M σ P ↓= N σ Q ↓= ⊥ or M σ P ↓= N σ Q ↓= ⊥ remains. In that case, the rule applied to P i is necessarily If -Else, and this rule can also be applied to Q i . We conclude the proof similarly to the previous case.

, some messages M , N , and some t ∈ C ∪ K ∪ N . P i reduces to P i which is either P i via the If-Then rule, or P ⊥ i via the If-Else rule. In addition

We have in any case α = τ . In addition, by assumption, t σ P = t σ 1 P for t ∈ {M, M } and

Let us first consider the case where M σ P ↓ = ⊥, M σ P ↓ = ⊥, and t↓ = ⊥.

We then show that M σ P = t if and only if N σ Q = t (note that since t is ground,

. In all possible cases for t, i.e. t ∈ K, t ∈ N , and t ∈ C, Lemma A.18 implies that N σ Q = t. This proves the first direction of the equivalence, the other direction is similar.

Therefore, if rule If-Then is applied to P i then it can also be applied to reduce Q i into Q i , and if the rule applied to P i is If-Else then it can also be applied to reduce

This proves point a). We prove here the If-Then case. The If-Else case is similar.

We choose Γ = Γ. We have σ 2 P = σ 1 P and σ 2 Q = σ 1 Q . Since the substitutions and typing environments do not change in this reduction, point b) trivially holds. Moreover, by hypothesis,

This fact proves point c) and concludes this case.

The case where M σ P ↓= N σ Q ↓= ⊥ or t↓= ⊥ remains. In that case, the rule applied to P i is necessarily If -Else, and this rule can also be applied to Q i . We conclude the proof similarly to the previous case.

• PIfLR*: then

for some Q i , Q ⊥ i . P i reduces to P i which is either P i via the If-Then rule, or P ⊥ i via the If-Else rule. In addition

We have α = τ in any case. In addition, by assumption,

To prove the claim, it is then sufficient to show that φ P σ P and φ Q σ Q are statically equivalent. Note that since σ P ⊆ σ P and (dom(σ P )\dom(σ P )) ∩ (vars(P) ∪ vars(φ P )) = ∅, we have

We will now show that (c, Γ N ,K ) is consistent. Let Γ ∈ branches(Γ ). By Lemma A.12, for all i, since Γ

The disjointness condition on the bound variables implies by Lemma A.8 that for all i, j, Γ i and Γ j are compatible. Thus 11,(c,Γ ) is consistent. Since c is ground, it follows from the definition of consistency that (c, Γ N ,K ) is also consistent. Moreover, we know that Γ ⊆ Γ , and Γ is a branch of Γ . It is then clear that Γ N ,K ⊆ Γ . Hence, by Lemma A.10, since Γ N ,K φ

Hence, we have Γ

) consistent. Moreover, φ P σ P and φ Q σ Q are ground (by well-formedness of the processes). Therefore, by Lemma A.25, the frames φ P σ P and φ Q σ Q are statically equivalent.

Theorem A.2 (Typing implies trace equivalence). For all Γ containing only keys, for all P and Q, if

and C is consistent, then P ≈ t Q.

Proof. Theorem A.1 proves that under these assumptions, P t Q. This is sufficient to prove the theorem. Indeed, it is clear from the typing rules for processes and terms that

where C is the constraint obtained from C by swapping the left and right hand sides of all of its elements, and Γ is the environment obtained from Γ by swapping the left and right types in all refinement types, as well as swapping all pairs of keys in its domain. Clearly from the definition of consistency, C is consistent if and only if C is. Therefore, by symmetry, proving that the assumptions imply P t Q also proves that they imply Q t P , and thus P ≈ t Q.

A.2 Typing replicated processes

In this section, we prove the soundness result for replicated processes. We recall that a table displaying the correspondence between the numbering of the Lemmas and Theorems in Chapter 2 and here is provided at the beginning of Appendix A. In this section, as well as the following ones, without loss of generality we assume, for each infinite nonce type τ l,∞ m appearing in the processes we consider, that N contains an infinite number of fresh names which we will denote by {m i | i ∈ N}; such that the m i do not appear in Proof. The first point is proved by induction on T .

If

by the induction hypothesis. Since branches(T ) = branches(T ) ∪ branches(T ), this proves the claim.

Otherwise, branches(T ) = {T } and the claim trivially holds.

The second point directly follows from the first point, using the definition of [ Γ ] n i .

• PIfAll: this case is similar to the PIfL case.

Theorem A.4 (Typing n sessions). For all Γ, P , Q and C, such that

Proof. Let us assume Γ, P , Q and C are such that

The claim clearly holds (using Theorem A.3

⊆ K∪N , and the types associated to keys and nonces are the same in each [ Γ ] n i . The property follows from Theorem A.3. Indeed, this theorem guarantees that for all i ∈ 1, n , there exists

By construction, all variables in dom([ Γ ] n i ) are indexed with i, and all keys and nonces are either unindexed or indexed with i, and as we mentioned earlier, for all i, j, [ Γ ] n i and [ Γ ] n j have the same values on their common domain.

Hence we have

. Therefore, by Lemma A.10, we have for all i ∈ 1, n

). Thus, by applying rule PPar n -1 times, we have

It only remains to be proved that

and for all i = j, Γ i and Γ j are compatible.

For all i, (c i , Γ i ) ∈ C i . Thus by definition of C i there exist Γ i and Γ i such that (c i ,

), and Γ i = Γ i ∪ Γ i . Since for all i = j, Γ i and Γ j are compatible, we know that Γ i and Γ j also are, as well as Γ i and Γ j .

since n ≥ 2, and are compatible since for all i = j, Γ i and Γ j are compatible. Thus Γ = ( 1≤i≤n Γ i ), and since the Γ i are all pairwise compatible, and for all i,

This proves that ∪ × 1≤i≤n C i ⊆ ∪ × 1≤i≤n C i , which concludes the proof.

Theorem A.5. Consider P , Q, P ,Q , C, C , such that P , Q and P , Q do not share any variable. Consider Γ, containing only keys and nonces with types of the form τ l,1 n . Assume that P and Q only bind nonces and keys with infinite nonce types, i.e. using new m : τ l,∞ m and new k : seskey l,∞ (T ) for some label l and type T ; while P and Q only bind nonces and keys with finite types, i.e. using new m : τ l,1 m and new k : seskey l,1 (T ). Let us abbreviate by new n the sequence of declarations of each nonce m ∈ dom(Γ) and session key k such that Γ(k, k) = seskey l,1 (T ) for some l, T . If

Proof. Note that since Γ only contains keys and nonces with finite types, for all i,

is just P where all variables and some names have been α-renamed, and similarly for Q. Since P , Q only contain nonces with finite types, [ P ] Γ 1 and [ Q ] Γ 1 are P , Q where all variables have been α-renamed.

By Theorem A.4, we know that for all i, n,

Therefore, by Lemma A.10, we have

where C is C where all the environments have been extended with 1≤i≤n ([ Γ ] n i ) N ,K (note that this environment still only contains nonces and keys).

Therefore, by rules PPar and PNew,

where Γ is the restriction of [ Γ ] n to keys.

Then, by Theorem A.2,

which implies (since [ P ] Γ 1 is just a renaming of the variables in P ) that

A.3 Checking consistency

In this section, we prove the soundness of the procedure check_const in the non-replicated case.

We recall that a table displaying the correspondence between the numbering of the Lemmas and Theorems in Chapter 2 and here is provided at the beginning of Appendix A.

Note that we only consider constraints obtained by typing, and therefore such that Γ is well-formed, and such that there exists c φ ⊆ c such that Γ φ l (c) ∼ φ r (c) : LL → c φ .

Indeed, it is clear by induction on the typing rules for terms that:

From this result, and using Lemmas A.3 and A.12, it follows clearly by induction on the typing rules for processes that

Let us now prove that the procedure is correct for constraints without infinite nonce types, i.e. constraint sets C such that

We fix such a constraint set C (obtained by typing). Let (c, Γ) ∈ C. Let (c, Γ) = step1 Γ (c). Let us assume that step2 Γ (c) = true and step3 Γ (c) = true.

• public keys pk(k), pk(k ) where ∃T.Γ(k, k ) <: key HH (T );

• or public keys pk(x), pk(x) where ∃T.Γ(x) <: key HH (T );

• or a variable x such that ∃T, T .Γ(x) = pkey(T ) and T <: key HH (T );

In the first case M 2 σ = M 2 and N 2 σ = N 2 are still the same public keys. In the two other cases, similarly to the proof for M 1 and N 1 , either x / ∈ dom(σ), and we also have M 2 σ = M 2 and N 2 σ = N 2 ; or x ∈ dom(σ), and by well-typedness of σ, σ and Lemma A.18, M 2 σ and N 2 σ are keys of the right type. Therefore, in all cases, M 2 σ and N 2 σ satisfy the required conditions.

Thus, M σ ∼ N σ satisfies the conditions for step2 Γ ( c σ,σ ).

Lemma A.34. There exists

Proof. As explained previously, there exists

Moreover, we have by definition Γ = Γ F Γ , where F is defined as in step1 and Γ F is the restriction of Γ to F , and for some Γ ⊆ Γ. In addition (Γ F ) N ,K σ F ∼ σ F : (Γ F ) X → ∅ using rule TLR 1 . By definition of F , and since the refinement types in Γ only contain ground terms by assumption, we also know that Γ does not contain refinement types. Hence, by Lemma A.22, and Lemma A.10, there exists

Besides, it is clear from the definition of φ Γ LL and rules TCstFN, TNonceL, TKey, TPubKeyL, TVKeyL that Γ φ Γ LL ∼ φ Γ LL : LL → ∅. These two results prove the lemma. Lemma A. [START_REF] Blanchet | Automated verification of selected equivalences for security protocols[END_REF]. For all ground σ, σ such that ∃Γ ⊆ Γ.

Proof. By Lemma A.34, there exists

which concludes the proof.

Lemma A.36. For all ground σ, σ , for all recipe R such that

• φ l ( c σ,σ ) and φ r ( c σ,σ ) restricted to vars(R) are ground, there exists a recipe R without destructors, i.e. in which dec, adec, checksign, π 1 , π 2 , do not appear, such that

Proof. We prove the property by induction on R.

, we may apply the induction hypothesis to R 1 (and R 2 when it is present). All these case are similar, we write the proof generically for

. By the induction hypothesis, there exist

. The first point imply that R satisfies the conditions on variables. Since

)), and the claim holds.

for some k ∈ K, and S(φ

It is then clear that either S = x for some variable x ∈ AX , or S = enc(S , K ) for some S , K . We have already shown that Γ(k, k) <: key LL (T ). In addition, by Lemma A.33, step2 Γ ( c σ,σ ) = true. Hence c σ,σ only contains messages encrypted with keys k such that Γ(k , k ) <: key HH (T ) or Γ(k , k ) <: key HH (T ) for some T , k . Therefore the first case is not possible.

Hence there exist S , K such that S = enc(S , K ). Since S (φ

)), and similarly for φ r ( c σ,σ ). Moreover, S , being a subterm of S , also satisfies the conditions on the domains, and thus the property holds with R = S .

• If R = adec(S, K) for some recipes S, K: this case is similar to the symmetric case.

• If R = checksign(S, K) for some recipes S, K:

Similarly, there exists

, by the induction hypothesis, there exists S such that vars(S ) ⊆ vars(S), S (φ -In the second case, there exist S , K such that S = sign(S , K ). Since S (φ

)), and similarly for φ r ( c σ,σ ). Moreover, S being a subterm of S it also satisfies the conditions on the domains, and thus the property holds with R = S .

, by the induction hypothesis, there exists S such that vars(S ) ⊆ vars(S), S (φ

, it is clear from the definition of ↓ that either S = x for some x ∈ AX , or S = S 1 , S 2 for some S 1 , S 2 .

The first case is impossible, since by Lemma A.33, step2 Γ ( c σ,σ ) = true, and thus c σ,σ does not contain pairs. In the second case, there exist S 1 , S 2 such that S = S 1 , S 2 . Since S (φ

)), and similarly for φ r ( c σ,σ ). Moreover, S 1 , being a subterm of S , also satisfies the conditions on the domains, and thus the property holds with R = S 1 .

• If R = π 2 (S) for some S: this case is similar to the π 1 case.

Lemma A.37. For all term t and substitution σ containing only messages, if t↓ = ⊥, then (tσ)↓= (t↓)σ.

Proof. This property is easily proved by induction on t. In the base case where t is a variable x, by definition of ↓, since σ(x) is a messages, σ(x)↓= σ(x) and the claim holds. In the other base cases where t is a name, key or constant the claim trivially holds. We prove the case where t starts with a constructor other than enc, aenc, sign generically for t = f (t 1 , t 2 ). We then have t 1 σ↓ = ⊥ and t 2 σ↓ = ⊥, and tσ↓= f (t 1 σ↓, t 2 σ↓), which, by the induction hypothesis, is equal to

The case where f is enc, aenc or sign is similar, but we in addition know that t 2 ↓ is a key.

Finally if t starts with a destructor, t = d(t 1 , t 2 ), we know that t 1 ↓ starts with the corresponding constructor f : t 1 ↓= f (t 3 , t 4 ). In the case of encryptions and signatures we know in addition that t 4 ↓ and t 2 ↓ are the same key (resp. public key/verification key). We then have t↓= t 3 ↓, and tσ↓= t 3 σ↓ (or t 4 in the case of the second projection π 2 ). Hence by the induction hypothesis, tσ↓= t 3 ↓ σ = t↓ σ and the claim holds.

Lemma A.38. For all ground σ, σ , for all recipe R such that

• φ l ( c σ,σ ) and φ r ( c σ,σ ) restricted to vars(R) are ground,

Proof. We only detail the proof for φ l ( c σ,σ ), as the proof for φ r ( c σ,σ ) is similar.

We distinguish several cases for R.

• If R = a ∈ C ∪ F N : the claim clearly holds.

• If R = x ∈ AX then the claim trivially holds.

• If R = enc(S, K) or sign(S, K) for some recipes S, K: these two cases are similar, we only detail the encryption case. (φ Γ LL ∪ φ l ( c σ,σ ))(x) is then an encrypted message. By Lemma A.33, step2 Γ ( c σ,σ ) = true. Hence there exist k, k ∈ K and T such that

. This is only possible if there exists a variable z such that K = z and (φ Γ LL ∪ φ l ( c σ,σ ))(z) = k. Since step2 Γ (c) = true, z can only be in dom(φ Γ LL ). By definition of φ Γ LL , this implies that Γ(k, k) <: key LL (T ) for some T . Since Γ is well-formed, this contradicts Γ(k, k ) <: key HH (T ): this case is impossible.

• If R = aenc(S, K) or h(S) for some recipes S, K: these two cases are similar, we only detail the encryption case. (φ Γ LL ∪ φ l ( c σ,σ ))(x) is then an asymmetrically encrypted message. By Lemma A.33, we know that step2 Γ ( c σ,σ ) = true. Hence S(φ Γ LL ∪φ l ( c σ,σ )) contains directly under pairs a nonce n such that Γ(n) = τ HH,a n , or a key k ∈ K such that Γ(k, k ) = key HH (T ) for some T , k . This is only possible if there exists a recipe S such that S (φ Γ LL ∪ φ l ( c σ,σ )) = n (resp. k). Since S can only contain names from FN (and no keys), this implies that there exists a variable z such that (φ

for some a (resp. Γ(k, k) <: key LL (T ) for some T ), which is contradictory (as Γ is well-formed).

• Finally, the head symbol of R cannot be •, • , dec, adec, checksign, π 1 , π 2 since step2 Γ ( c σ,σ ) = true by Lemma A.33.

Lemma A.39. For all ground σ, σ , for all recipes R, S such that

• φ l ( c σ,σ ) and φ r ( c σ,σ ) restricted to vars(R) ∪ vars(S) are ground, we have

Proof. We only detail the proof for the (⇒) direction, as the other direction is similar. We then assume that (R(φ

This follows from Lemmas A.35 and A.21.

Similarly, we have

By assumption, in that case we also have S(φ Γ LL ∪ φ l ( c σ,σ ))↓= ⊥, and thus S(φ Γ LL ∪ φ r ( c σ,σ ))↓= ⊥, and the claim holds.

Let us now assume that R(φ Γ LL ∪ φ l ( c σ,σ )) ↓ = ⊥, i.e., by assumption, that S(φ [START_REF] Blum | How to generate cryptographically strong sequences of pseudo random bits[END_REF], there exist recipes R , S without destructors such that

By the assumption, we have

)), we can distinguish four cases for R and S .

• If they have the same head symbol, either this symbol is a nonce or constant and the claim is trivial, or it is a variable, and we handle this case later, or it is a constructor. We write the proof for this last case generically for R = f (R ) and S = f (S ). We have necessarily

It then follows by applying the induction hypothesis to R and S that R (φ

The claim follows by applying f on both sides of this equality.

• If R is a variable and not S : then by Lemma A.38, S ∈ C ∪ F N . Let us denote R = x.

By Lemma A.35, there exists c x such that Γ (φ

• If S is a variable and not R : this case is similar to the previous one.

• If R , S are two variables x and y, we have (φ

is a nonce, key, public key, or verification key. Hence φ l ( c σ,σ )(y) is also a nonce, key, public key or verification key. This is not possible, as by Lemma A.33, step2 Γ ( c σ,σ ) = true. Finally, since R (φ

This proves the property.

Lemma A.40. For all ground σ, σ , for all Γ ⊆ Γ, and for all c ⊆ c, such that

Proof. This is a direct consequence of Lemma A.39, by unfolding the definition of static equivalence.

Lemma A.41. c is consistent in Γ.

Proof. By Lemma A.32, it suffices to show that c is consistent in Γ. This is a direct consequence of Lemma A.40, by unfolding the definition of consistency.

Theorem A.6 (Soundness of the procedure). Let C be a constraint set without infinite nonce types, i.e.

Proof. The previous lemmas directly imply that for all (c, Γ) ∈ C, c is consistent in Γ. This proves the theorem.

A.4 Consistency for replicated processes

In this section, we prove the results regarding the procedure when checking consistency in the replicated case. We recall that a table displaying the correspondence between the numbering of the Lemmas and Theorems in Chapter 2 and here is provided at the beginning of Appendix A.

In this section, we only consider constraints obtained by typing processes (with the same key types). Notably, by the well-formedness assumptions on the processes, this means that a nonce n is always associated with the same nonce type.

Theorem A.7. Let C and C be two constraint sets that

• do not share any common variable, i.e.

• only share nonces which have the same finite nonce type, i.e.

• only share keys which are paired in the same way and have the same types, i.e.

and

Proof. Let n ∈ N. Let C, C be as defined in the statement of the theorem.

Note that this implies dom(Γ iX ) only contains variables indexed by i, and, from the assumption that vars(c i ) ⊆ dom(Γ iX ), that vars(c i ) ⊆ dom(Γ iX ).

For all i ∈ 1, n , let δ 1 i denote the function on terms which consists in exchanging all occurrences of the indices i and 1, i.e. replacing any occurrence of m i (for all nonce m with an infinite nonce type) with m 1 , any occurrence of m 1 with m i , any occurrence of k 1 with k i (for all key k), any occurrence of k i with k 1 , any occurrence of x i with x 1 (for all variable x), and any occurrence of x 1 with x i (also for all variable x).

We extend this function to constraints, types, typing environments and constraint sets. In the case of types we use it to denote the replacement of nonces appearing in the refinements. In the case of typing environments it denotes the replacement of nonces appearing in the types, and of nonces, keys and variables in the domain of the environment, i.e. (δ 1 i (Γ))(x 1 ) = δ 1 i (Γ(x i )). In the case of constraint sets it denotes the application of the function to each constraint and environment in the constraint set.

Similarly, we denote δ 2 i the function exchanging indices i and 2.

1. We compute (c, Γ ) = step1 Γ (c). Following the notations in the procedure, we denote

Let also

It is easily seen from the definition of Γ that F = F F .

By definition of step1

It is clear from the definitions of Γ and Γ that for all x ∈ F , there exists i ∈ 1, n and m, p, l, l such that Γ(x) = τ l,∞ m ; τ l ,∞ p and Γ (x) = τ l,1 m i ; τ l ,1 p i . Let σ l and σ r be the substitutions defined by dom(σ l ) = dom(σ r ) = F and

It is clear from the definition of c and c that c = c σ l ,σr .

2. We check that step2 Γ (c) holds.

Since check_const({(c, Γ)}) = true, we know that u and v have the required form. Note that by definition of Γ , the keys which are secret in Γ , i.e. the keys k ∈ K such that there exist k , T such that Γ (k, k ) <: key HH (T ) or Γ (k , k) <: key HH (T ), are exactly the keys which are secret in Γ. Similarly, for all variable x, there exists T such that Γ(x) <: key HH (T ) if and only if there exists T such that Γ (x) <: key HH (T ); and there exist m, n, a such that Γ(x) = τ HH,a m ; τ HH,a n if and only if there exist m, n, a such that Γ (x) = τ HH,a m ; τ HH,a n .

It clearly follows, by examining all cases for u and v , that u σ l and v σ r , i.e. u and v, also have the required form.

Therefore, step2 Γ (c) holds.

Finally, we check the condition step3 Γ (c).

Let

Let us prove the first direction of the equivalence, i.e. the case where M 1 , M 2 are unifiable. The proof for the case where N 1 , N 2 are unifiable is similar.

If M 1 , M 2 are unifiable, let µ be their most general unifier. We have

Let τ denote the substitution σ l µ. Since M 1 τ = M 2 τ , M 1 and M 2 are unifiable. Let µ be their most general unifier. There exists θ such that τ = µ θ.

Let also α be the restriction of

Therefore, ∀x ∈ dom(α ). x ∈ dom(α) ∧ α (x) = α(x). Thus there exists α such that α = α α .

Since we already have N 1 α = N 2 α , this implies that N 1 α = N 2 α, which concludes the proof that step3 Γ (c) holds. Hence, check_const({(c, Γ )}) = true.

Theorem A.8. Let C, and C be two constraint sets without any common variable

Thus, by Lemma A.42, for all (c

= true, which concludes the proof.

Theorem A.9. Let C, and C be two constraint sets without any common variable. Then

Therefore, by Theorem A.6, (∪

Appendix B

Proofs of the case study (Chapter 6)

In this appendix, we provide the detailed proofs for the case study in Chapter 6, detailing all assumptions we made and defining the relevant Recover algorithms.

B.1 Perfect ideal functionality

We show here the result mentioned in Section 6.6.2, i.e. that, assuming all voters verify their vote, and that the counting function ρ is stable, the perfect ideal functionality F ∅ v (ρ) is implied by the functionality F del v (ρ). Recall that a result function ρ is stable if changing the order of votes does not change the result, as long as for each voter, her votes remain in the same order, i.e.

∀L, L . (∀id. [(id , v) ∈ L|id

We prove the following theorem.

Theorem B.10. Assume that H = H check , and that ρ is a stable counting function. For any simulator S, there exists a simulator S such that for any well-behaved environment E, the outputs of idealexec(E||S||F del v (ρ)) and idealexec(E||S ||F ∅ v (ρ)) are indistinguishable.

Proof. Let S be a simulator, intended to be executed with F del v (ρ). We construct a simulator S , intended to be executed with F ∅ v (ρ). S will run S internally, and answers queries from F ∅ v (ρ) as follows.

• On setup from F ∅ v (ρ), starting the setup phase: S sends setup to S (in the name of F del v (ρ)).

• On voting from F ∅ v (ρ), starting the voting phase: S sends voting to S.

• On ack(id) from F ∅ v (ρ) during the voting phase: S forwards this message to S, and appends id to a list LL (initially empty). Let us call L the list of (identities,votes) kept by the functionality F ∅ v (ρ) in the execution idealexec(E||S ||F ∅ v (ρ)). It is clear that LL is the list of identities in L, i.e. LL = [id|(id, v) ∈ L]. In addition, by definition of F del v (ρ) and F ∅ v (ρ), L is also equal to the list kept by F del v (ρ) in the (simulated) execution idealexec(E||S||F del v (ρ)).

• On voting done from F ∅ v (ρ): S forwards this message to S.

• On modif? from F ∅ v (ρ):

-S forwards modif? to S, and waits for S to try to send a modification function to F del v (ρ). When S sends modif(f ), S retrieves the function f , and has to produce a function to send to F ∅ v (ρ). -S starts by checking whether P del (L, f ) = . S does not have access to the list L, but it appears by carefully examining the definition of P del that L itself is not needed to compute P del (L, f ): only the list of the identities in L is used. S knows this list of identities: as previously noted, it is equal to LL.

-

, where f ∅ : ∅ → ∅ is the empty function. -Otherwise, S computes the list LL cast of the votes cast in f :

S then computes the list

• On result(r) from F ∅ v (ρ), for some r (potentially no tally), in the tallying phase:

-If P del (L, f ) was ⊥ in the previous step: S sends result(no tally) to S, and regardless of its answer, sends res-block to F ∅ v (ρ). -Otherwise, S sends result(r) to S, and waits for S's answer. S either answers res-ok or res-block. S forwards this message to F P v (ρ).

• In addition, during the whole execution, S forwards between E and S any message they wish to exchange.

Let us now prove that the outputs of idealexec(E||S||F del v (ρ)) and idealexec(E||S ||F ∅ v (ρ)) are indistinguishable. We do this by showing that both E and the simulated S in idealexec(E||S ||F ∅ v (ρ)) have the same view they would have in idealexec(E||S||F del v (ρ)). It is clear that up to right before S sends the result command to S, these views are indeed the same. The subtle points is that remain to be proved are then that • S simulated by S receives exactly the same result it would receive in idealexec(E||S||F del v (ρ));

• and E in idealexec(E||S ||F ∅ v (ρ)) receives the same result (or no tally) from F ∅ v (ρ) as it would receive from F del v (ρ) in the execution with S idealexec(E||S||F del v (ρ)).

Let us first deal with the easy case where the test P del (L, f ) performed by S fails. In that case, in idealexec(E||S||F del v (ρ)), F del v (ρ) would reject f , meaning that S would receive result(no tally), and E would receive no tally. These are indeed the results they see in idealexec(E||S ||F ∅ v (ρ)). The interesting case is when P del (L, f ) = . Then in idealexec(E||S||F del v (ρ)), F del v (ρ) would accept f , and compute r = ρ(f (L)). S would receive result(r), and E would receive r or

B.1. Perfect ideal functionality

no tally depending on S's decision. In idealexec(E||S ||F ∅ v (ρ)), S computes f = λi. L [i], where L = [1, . . . , |LL|] LL cast and LL cast are the votes cast in f . This f is clearly accepted by F ∅ v (ρ), i.e. P ∅ (L, f ) = . Indeed

• f keeps the votes of all honest voters in the same order:

• and no honest votes are modified by

Thus F ∅ v (ρ) accepts f , and returns to S r = ρ(f (L)) = ρ(L LL cast ). In addition, since P del (L, f ) = , f keeps the votes of each separate voter id ∈ H (as H = H check ) in the same order. Thus it is clear that L LL cast and f (L) feature the votes of each voter in the same order. By assumption ρ is stable, and therefore r = r . Thus, S and E indeed receive the same result as in idealexec(E||S||F del v (ρ)), which concludes the proof.

We can similarly show the following theorem, when there is no revote.

Theorem B.11. Assume that H = H check , and that ρ is a stable counting function. For any simulator S, there exists a simulator S such that for any well-behaved environment E that does not make voters revote, the outputs of idealexec(E||S||F del,reorder,change v (ρ)) and idealexec(E||S

Proof. The construction of the simulator S is exactly the same as in the proof of the previous theorem, except that it checks whether P del,reorder,change (L, f ) = instead of P del (L, f ) = . As before, we show that both E and the simulated S in idealexec(E||S ||F ∅ v (ρ)) have the same view they would have in idealexec(E||S||F del,reorder,change v (ρ)). For the same reason as in the previous proof, it is clear that these views are the same, up to right before S sends the result command to S. The subtle point, as before, is to prove that E and the simulated S in idealexec(E||S ||F ∅ v (ρ)) both receive the same result they would obtain in idealexec(E||S||F del,reorder,change v (ρ)). Here, too, the case where P del,reorder,change (L, f ) = ⊥ is trivial, as both receive no tally.

The interesting case is when P del,reorder,change (L, f ) = . Then in the ideal execution idealexec(E||S||F del,reorder,change v (ρ)), F del,reorder,change v (ρ) would accept f , and compute r = ρ(f (L)). S would receive result(r), and E would receive r or no tally depending on S's decision. In

where L = [1, . . . , |LL|] LL cast and LL cast are the votes cast in f . This f is clearly accepted by F ∅ v (ρ), i.e. P ∅ (L, f ) = . Indeed

• f keeps the votes of all honest voters in the same order:

• and no honest votes are modified by f : ∀i, id, v, if f (i) = (id, v) then (id, v) ∈ Im(f ), which implies, since P del,reorder,change (L, f ) = , that id ∈ D ∪ H check = D.

Thus F ∅ v (ρ) accepts f , and returns to S r = ρ(f (L)) = ρ(L LL cast ). In addition, since P del,reorder,change (L, f ) = , f keeps the (unique, as E does not make voters revote) vote of all voters id ∈ H (as H = H check ). Thus it is clear that L LL cast and f (L) contain the same votes, and only differ by the order of the honest votes. Thus they feature the votes of each voter in the same order. By assumption ρ is stable, and therefore r = r . Thus, as in the previous proof, S and E indeed receive the same result as in idealexec(E||S||F del v (ρ)), which concludes the proof.

From the previous two theorems, we get that:

Theorem B.12. Let V be a voting scheme. Assume that H = H check , and that ρ is a stable counting function.

• If we only consider environments where voters do not revote, if V securely implements F del,reorder,change v (ρ), then V securely implements F ∅ v (ρ). Proof. The first point directly follows from Theorem B.10. Indeed, if V securely implements F del v (ρ), then for any adversary A, there exists a simulator S such that for any well-behaved E the outputs of realexec(E||A||V) and idealexec(E||S||F del v (ρ)) are indistinguishable. By Theorem B.10 there exists S such that for any well-behaved E the outputs of idealexec(E||S ||F ∅ v (ρ)) and idealexec(E||S||F del v (ρ)) are indistinguishable. This S proves that V securely implements F ∅ v (ρ). The second point similarly follows from Theorem B.11.

B.2 Case study: Civitas and Belenios without revote

We show here that, under reasonable assumptions, Civitas and Belenios without revote are mb-BPRIV w.r.t. Recover del,reorder (defined below), and that this implies they realise F del,reorder v . Equivalently, as there is no revote, they realise F del v . Consequently they also realise the weaker F del,reorder,change v . We write the assumptions and proofs in a generic way, so that they apply to both Civitas and Belenios.

B.2.1 Notations: Civitas

enc(•, pk) denotes ElGamal encryption under key pk.

• Register(id) generates a private credential c id • Pub(c) = enc(c, pk) encrypts the credential c

• Vote(id, pk, c, v) = (s, enc(c, pk), (enc(v, pk), π 1 , π 2 )). The state s records the ballot. The public credential/pseudonym is enc(c, pk). π 1 is a zero-knowledge proof that v is a valid vote, and π 2 is a zero-knowledge proof that the agent generating the ballot knows both c and v.

• ValidBoard(BB, pk) checks for each (p, b) in BB the zero-knowledge proofs in b, and ensures that p is a valid public credential, using Pub(U) and a PET. It finally checks, also with a PET, that BB does not already contain several ballots (p, b), (p , b ) where p and p encrypt the same credential.

• Tally only keeps the parts of the ballots containing the encrypted votes. These are then run through a mixnet, decrypted, and published.

• Verify(id, s, BB) checks whether the ballot recorded in s appears on BB.

B.2.2 Notations: Belenios

signElGamal(•, pk, k) denotes the combination of ElGamal encryption and signature, under the public encryption key pk and the private signing key k.

• Register(id) generates a pair (k id , pk id ) of a secret signing key k id and the associated verification key pk id .

• Pub(k id , pk id ) = pk id is simply the public verification key.

• Vote(id, pk, (k id , pk id ), v) = (s, pk id , (signElGamal(v, pk, k id ), Π)). The state s records the ballot. The public credential/pseudonym is the public key pk id . π is a zero-knowledge proof that v is a valid vote.

• ValidBoard(BB, pk) checks for each (p, b) in BB the zero-knowledge proof in b, and ensures that p is a valid verification key, using Pub(U), and that b is indeed signed with the associated signing key. It finally checks that BB does not contain several ballots (p, b), (p, b ) that use the same public key, i.e. such that p = p .

• Tally can either run the ballots through a mixnet, decrypt them, and publish the decrypted votes; or homomorphically compute the sum of all ballots, before decrypting and publishing the result.

• Verify(id, s, BB) checks whether the ballot recorded in s appears on BB, signed by id's signing key.

B.2.3 Recovery

We consider the following recovery algorithm:

(in case several such j exist, pick the first one)

B.2.4 Assumptions

We assume that the ballots (including the public credential) are non malleable, i.e. that for all adversary A, |P(Exp NM,0 A,V (λ) = 1) -P(Exp NM,1 A,V (λ) = 1)| is negligible in λ, where Exp NM,β A,V is the following game.

for all id ∈ I do

A is allowed any number of calls to O c , followed by one single call to O d .

We also assume that the credentials within the ballots are non malleable, i.e. that for all adversary A, |P(Exp CNM A,V (λ) = 1)| is negligible in λ, where Exp CNM A,V is the following game.

We assume that the voting scheme is strongly consistent. We also assume a zero-knowledge property from the proof of correct tallying, expressed by the following game:

Finally we assume that the proof of correct tallying and the rest of the protocol use different random oracles.

B.2.5 Belenios and Civitas without revote are mb-BPRIV

Theorem B.13. Assume Belenios, with no revote allowed, is strongly consistent, has nonmalleable ballots and credentials, that the proofs of correct tallying are zero-knowledge, and that different random oracles are used for these proofs and the rest of the protocol. Then Belenios, without revote, is mb-BPRIV w.r.t. Recover del,reorder .

Under the same assumptions, Civitas without revote also is mb-BPRIV w.r.t. Recover del,reorder .

Proof. Consider the game Exp mb-BPRIV1,β A,V

, which is identical to Exp mb-BPRIV,Recover del,reorder ,β

, except that the adversary is not shown the tally of the board, but instead the result computed using ρ and the extract function, without any proof of correct tallying. That is, the Otally oracle is replaced with Otally , defined by:

Otally BB,BB 0 ,BB 1 () for β = 1

We will also consider the game Exp mb-BPRIV2,β

, where the adversary is given the result of the election as computed by the Tally algorithm, but still no proof of correct tallying, i.e. this game is identical to Exp mb-BPRIV , except the oracle Otally is replaced with Otally :

Finally we consider a third variant, Exp mb-BPRIV3,β

, where the adversary is shown the result of the election, and the proof of correct tallying for the board provided by A is simulated on both sides, i.e. where the Otally oracle is replaced with the following Otally :

The structure of the proof is as follows. We first show that if no adversary has a non-negligible advantage in Exp NM or Exp CNM , then no adversary has a non-negligible advantage in Exp mb-BPRIV1 . Using the strong consistency assumption, we then show that this implies no adversary has a non-negligible advantage in Exp mb-BPRIV2 . We then show, using the assumption that the random oracles used for the proof of correct tallying and the remainder of the protocol are different, that this implies no adversary has a non-negligible advantage in Exp mb-BPRIV3 . From there, using the zero-knowledge assumption on the proof of correct tallying, we show that no adversary has a non-negligible advantage in Exp mb-BPRIV .

Exp NM ∧ Exp CNM ⇒ Exp mb-BPRIV1 . Let A be an attacker that wins the Exp mb-BPRIV1, V game. We construct an attacker B against Exp NM,β V . B is given access to pk and U. It runs A internally, simulating the oracle calls as follows. When A calls OvoteLR(id, v 0 , v 1 ), for some • It is also clear by examining the game Exp mb-BPRIV1,β A that, up to this point, A has been accurately simulated, and has the same view it would have in game Exp mb-BPRIV1,β A .

• By construction of the OvoteLR oracle, the list BB init is also equal to the list BB β in (the corresponding execution of) the game Exp mb-BPRIV1,β A for A.

• We can also note that BB init contains no duplicate ballots (except with a negligible probability p β 1 (λ)). Indeed, BB init containing duplicate ballots would imply that two oracle calls Vote(pk, id, U[id], v) and Vote(pk, id , U[id ], v ) produced the same ballot. If this happened with non-negligible probability, by submitting

to the encryption oracle, and checking whether the two resulting ballots are equal, an adversary would win the non-malleability game. The two ballots obtained on the right would indeed be different, except with negligible probability, by strong consistency (as they contain different votes).

Once A has returned BB, B checks (in V) that all voters in H check have voted, and halts if not. B also checks whether ValidBoard(BB, pk) = . If not, B directly asks A to guess the bit β , and returns A's guess.

Following the structure of game Exp mb-BPRIV1 , B then lets A perform the verifications for the honest voters. That is, when A calls Overify BB (id), B retrieves the entry (id, v 0 , v 1 , p, b) for id in V, and checks that (p, b) ∈ BB. Once A is done with the verification phase, B checks that each id ∈ H check has verified (and halts otherwise). If any of the verifications have failed, B directly asks A to guess the bit β , and returns A's guess.

If all verifications are successful, B will simulate the tallying phase to A. To do this, B first computes π = Recover del,reorder U (BB init , BB). Note, at this point, that since all checks succeeded, π is simpler than in the general case. Indeed, this means that the algorithm Recover del,reorder U (BB init , BB) did not need to add back any ballots from a honest voter who checked and whose ballot would be missing from BB. Hence, π is only defined on 1, |BB| , and, except with negligible probability p β 2 (λ), is such that for all i:

• π(i) = j if j is the index of the first (and only) occurrence of BB[i] in BB init ,

• or π(i) = BB[i] if no such index exists. Indeed, in that case, we have extract id (U, p) / ∈ H (where p is the public credential in BB[i]), except with negligible probability: otherwise an adversary could win game Exp CNM by simulating A and returning BB.

To continue the simulation of A, B must then provide A with the result of the election, to answer A's calls to Otally . B asks for the decryption of the list of all (p, b) such that ∃j.

). This call to the decryption oracle is allowed: indeed, by definition of Recover del,reorder , a ballot such that π(j) = (p, b) cannot occur in an element of BB init , and hence is not in L.

B then constructs a list BB containing the votes in πBB 0 in clear, BB 0 being the board of the left ballots, maintained by OvoteLR in Exp mb-BPRIV1,β A,V . This is done by retrieving the vote from the list V for ballots coming from the encryption oracle, and using the decryption oracle for the others. Formally this list is obtained by, for all i:

At this point, we have BB = extract(sk, U, π(BB 0 )), except with negligible probability. Indeed, for any i:

• Either BB[i] does not appear in BB init , and, by definition,

) holds by construction of BB.

• Or BB init [j] = (id, BB[i]) for some j, id, and, by definition, which is negligible by strong consistency.

Since BB has as many elements as BB, it is of polynomial size (bounded by the running time of A). Hence, P(BB = extract(sk, U, π(BB 0 ))) = P(∃i. BB[i] = extract(sk, U, π(BB 0 )[i])) is also negligible. We write

B then computes ρ(BB), and shows this result to A. A finally outputs a bit β , that B returns.

We now argue that ρ(BB) is indeed the result A would have been shown in Exp mb-BPRIV1,β A,V .

• If β = 1, BB init = BB 1 , and thus π = Recover del,reorder U (BB 1 , BB). As previously explained, we then have BB = extract(sk, U, Recover del,reorder

that is, BB = extract(sk, U, BB ), where BB is the board computed using Recover del,reorder in Exp mb-BPRIV1,1

. By definition of Otally , ρ(BB) is thus the election result A sees in this game.

• If β = 0, BB init = BB 0 , and thus π = Recover del,reorder U (BB 0 , BB). Recall that, since all the verifications have succeeded, all the ballots in BB 0 produced by honest voters who check correctly occur in BB. Therefore, it is clear from the definition of Recover del,reorder that π(BB 0 ) = BB. As previously explained, we then have BB = extract(sk, U, BB), and, by definition of Otally , ρ(BB) is thus the election result A sees in this Exp mb-BPRIV1,0 A,V .

As we argued, except if BB init contains duplicate ballots, or π does not have the expected form, or BB = extract(sk, U, πBB 0 ), A is run until the end of its execution by B if and only if it would also reach the end of the game Exp mb-BPRIV1,β

Therefore

which implies that, assuming strong consistency holds, and that no adversary has a non-negligible advantage in Exp NM , no adversary has a non-negligible advantage in Exp mb-BPRIV1 .

Exp mb-BPRIV1 ∧ Exp SC ⇒ Exp mb-BPRIV2 . We now show that no adversary has a non-negligible advantage in Exp mb-BPRIV2 . Let A be an adversary against Exp mb-BPRIV2 . Consider the same A playing Exp mb-BPRIV1 instead. A has the same view in Exp mb-BPRIV1,β

, except if the result r returned by the Tally algorithm differs from ρ applied to the extractions of the board, which happens only with negligible probability by the second point of the strong consistency assumption.

More precisely, consider an adversary B playing Exp SC , that runs A internally, simulating its execution in game Exp mb-BPRIV2,0 A,V . B answers any call to OvoteLR(id, v 0 , v 1 ) made by A by running Vote(pk, id, U[id], v 0 ), and returning the generated ballot to A. When A produces a board BB, B returns this board.

When β = 0, Exp mb-BPRIV1,0

and Exp mb-BPRIV2,0

give A the same view, and hence return the same result, except if ρ(extract(sk, U, BB)) = r, where (r, Π) = Tally(BB, sk). That is, except if Exp SC B,V returns 1. Therefore

Similarly, consider an adversary C playing Exp SC , that runs A internally, simulating its execution in game Exp mb-BPRIV2,1 A,V . C answers any call to OvoteLR(id, v 0 , v 1 ) made by A by running Vote(pk, id, U[id], v 0 ) and Vote(pk, id, U[id], v 1 ), storing the generated ballots in boards BB 0 and BB 1 , and returning the ballot for v 1 to A. When A produces a board BB, C computes BB = Recover del,reorder U (BB 1 , BB)(BB 0 ), and returns this board.

give A the same view, and hence return the same result, except if ρ(extract(sk, U, BB )) = r, where (r, Π) = Tally(BB , sk). That is, except if Exp SC C,V returns 1. Therefore

Therefore:

which implies, by the strong consistency assumption, that no adversary has a non-negligible advantage in Exp mb-BPRIV2 .

Exp mb-BPRIV2 ∧ different random oracles ⇒ Exp mb-BPRIV3 . We now show that no adversary has a non-negligible advantage in Exp mb-BPRIV3 . Let A be an adversary against Exp mb-BPRIV3 . Consider an adversary B against Exp mb-BPRIV2 , that runs A internally. During the voting and verification phases, B answers A's oracle queries by making the same calls to its oracles, once A returns a board BB, B returns this same board. B also runs its own random oracle, that is made available to A, to simulate the random oracle used for the proof of correct tallying that A expects to receive. This is made possible by the assumption that this random oracle is not used in any other part of the protocol. Once A calls Otally , B calls Otally and receives a result r. Manipulating the random oracle it runs, B then produces a proof Π = SimProof(r, BB), and returns (r, Π) to A. When A makes its guess regarding β, B returns the same guess.

It is clear that A as run by B has the same view it would have in game Exp mb-BPRIV3,β A,V

. Hence

is negligible, which proves no adversary has a non-negligible advantage in Exp mb-BPRIV3 .

Exp mb-BPRIV3 ∧ Exp ZK ⇒ Exp mb-BPRIV . Finally we show that no adversary has a non-negligible advantage in Exp mb-BPRIV . Let A be an adversary against Exp mb-BPRIV . Consider A playing Exp mb-BPRIV3 instead.

It is clear that, when β = 1, Exp mb-BPRIV3,1

and Exp mb-BPRIV,1

A,V are identical. Hence

P(Exp mb-BPRIV,1

A,V

= 1) = P(Exp mb-BPRIV3,1

A,V = 1).

When β = 0, the outputs of Exp mb-BPRIV,1

and Exp mb-BPRIV3,1

A,V can only differ if A is able to distinguish the real proof of correct tallying Π returned by Tally(BB, sk) from the simulated proof SimProof(r, BB).

More precisely, let B be an adversary against Exp ZK,β V . B runs Exp mb-BPRIV,0 A,V internally. That is, B generates its own sets of credentials U, using the Register algorithm, and runs A, answering calls to OvoteLR(id, v 0 , v 1 ) by computing Vote(pk, id, U[id], v 0 ). B obtains a board BB from A, on which it performs the validity check using ValidBoard. If this check fails, B answers 0. Otherwise, it lets A call its verification oracle, using Verify to answer A's queries. Again, if A does not make all voters in H check verify, B answers 0. If some verifications fail, B asks A for its guess regarding the bit β , and returns it. Otherwise, B returns the board BB, and obtains (r, Π β ), where r is the result of the tally, and Π β , depending on β , is either the real proof Π 0 computed by Tally(BB, sk), or the simulated proof Π 1 = SimProof(r, BB). B continues to run A, answering (r, Π β ) when A calls Otally. Finally A makes a guess regarding β , that B returns as its output.

It is clear that, if β = 0, A as simulated by B in Exp ZK,0 B,V has the same view it would have in Exp mb-BPRIV,0 A,V . Hence, P(Exp ZK,0 B,V = 1) = P(Exp mb-BPRIV,0

A,V = 1).

Similarly if β = 1, A simulated by B in Exp ZK,1 B,V has the same view it would have in Exp mb-BPRIV3,0 A,V . Hence, P(Exp ZK,1 B,V = 1) = P(Exp mb-BPRIV3,0

Thus, |P(Exp mb-BPRIV,0

which implies that, assuming that the zero-knowledge property holds, no adversary has a non-negligible advantage in Exp mb-BPRIV .

B.2.6 Ideal functionality corresponding to Recover del,reorder

Recall the predicate P del,reorder that is checked by the functionality F del,reorder v (ρ):

• f keeps the votes of all voters who check:

• and no honest votes are modified by f :

Theorem B.14. The Recover del,reorder algorithm defined above is compatible with the predicate P del,reorder . Proof. Indeed, consider an adversary A, that plays the game Exp comp,P del,reorder ,Recover del,reorder , v) for some v. Let BB be the board returned by A in the game. Note that, by the non-malleability assumption, following the same reasoning as in the previous proof, BB 1 contains no duplicate ballots, except with negligible probability. If BB is not valid, or BB 1 does not contain at least one entry for each id ∈ H check , A loses the game.

Otherwise, let π = Recover del,reorder U (BB 1 , BB). Let us show that π is compatible P del,reorder w.r.t. sk, U, L id , except with negligible probability. Assume BB 1 contains no duplicate ballots, which, as explained, holds with overwhelming probability.

Let L be a list of elements (id, v), such that [id|(id, v) ∈ L] = L id . We show that P del,reorder (L, mod sk,U (π)) = .

∈ BB], the list of the positions in BB 1 of ballots belonging to voters in H check that do not occur in BB. Let also LL be the list constructed by the following process:

where LL is the list obtained obtained by removing all ⊥ elements from LL = LL L .

We have to show that P del,reorder (L, mod sk,U (π)) = . That is, that 1. No honest votes are modified by mod sk,U (π):

Let i, id, v be such that mod sk,U (π)[i] = (id, v). Hence LL[j] = (id, v) for some j. Thus, by construction of LL, BB[k] = (p, b) for some k, p, b such that (p, b) does not occur in BB 1 , extract id (U, p) / ∈ H, and extract(sk, U, BB[j]) = (id, v). Therefore id ∈ D.

2. mod sk,U (π) keeps the votes of all voters who check:

Then by definition of L id , there exist p, b such that BB 1 [i] = (id, (p, b)). Hence, by definition of L , either (p, b) ∈ BB, or i ∈ L . In the first case, by construction of LL, i ∈ LL, and thus ∃j. mod sk,U (π)(j) = i. In the second case, since, by construction of LL , L is a sublist of LL , we have i ∈ LL and hence ∃j. mod sk,U (π)(j) = i. In any case, the claim holds, which concludes the proof.

B.2.7 Conclusion on Belenios and Civitas without revote

Theorem B.15. Assume Belenios, with no revote allowed, is strongly consistent, has nonmalleable ballots and credentials, that the proofs of correct tallying are zero-knowledge, and that different random oracles are used for these proofs and the rest of the protocol. Then Belenios, securely implements ideal functionalities F del v (ρ), F del,reorder v (ρ) and F del,reorder,change v (ρ) against environments that make each voter vote at most once.

Under the same assumptions, Civitas also implements these three functionalities.

Proof.

• It directly follows from Theorems 12, B.13, and B.14 that, under these assumptions, Belenios and Civitas implement the functionality F del,reorder v (ρ).

• It is also clear that F del,reorder v (ρ) is stronger than F del,reorder,change v (ρ), in that it gives less power to the simulator. Indeed these two functionalities are the same, except that F del,reorder,change v (ρ) allows more modification functions from S than F del,reorder v (ρ). Any simulator S running with F del,reorder v (ρ) can thus be accurately simulated by a simulator S running with F del,reorder,change v (ρ), that runs S internally, checks whether its proposed modification function f is accepted by P del,reorder , then submits f if so and blocks the result otherwise. (Note S can check this condition using only f and the sequence of the ids of voters who submitted votes, but does not need to know the votes themselves, by definition of P del,reorder .) Therefore, any voting scheme that securely implements F del,reorder v (ρ) also securely implements F del,reorder,change v (ρ), which proves the claim that Belenios and Civitas implement this functionality.

• In addition, it is clear by carefully examining the ideal execution that when only considering environment E that do not make voters revote, functionalities F del,reorder v (ρ) and F del v (ρ) are identical. Indeed, in that case, the list L that F del,reorder v (ρ) and F del v (ρ) keep respectively in idealexec(E||S||F del,reorder v (ρ)) and idealexec(E||S||F del v (ρ)) only contains at most one entry for each honest id. For such a list L, we have for any f that P del (L, f ) = P del,reorder (L, f ). Since the predicates P del and P del,reorder are the only difference between the two functionalities, they are indeed equivalent in the case of environments that do not make voters revote, which proves the claim that Civitas and Belenios securely implement F del v (ρ).

B.3 Case study: Belenios with revote

We show here that, under reasonable assumptions, Belenios with revote is mb-BPRIV w.r.t.

Recover del (defined below), and that this implies it realises F del v . Consequently it also realises the weaker F del,reorder v and F del,reorder,change v .

B.3.1 Notations

Compared to the "no revote" case, the verification algorithm differs. Verify(id, s, BB) now checks whether the last ballot recorded in s, i.e. the last ballot generated by id, is the last ballot that appears next to the public key of id in BB, or, equivalently when the board is valid, the last ballot signed with id's key in BB.

Since revote is now allowed, the validity algorithm ValidBoard also changes: it no longer rejects a board that contains several ballots associated with public credentials encrypting the same private credential. However it still checks all the proofs and signatures on all ballots.

B.3.2 Recovery

We consider the following recovery algorithm:

BB revote ← BB where only the last (p, b) is kept for each public key p

(in case several such j exist, pick the first one)

B.3.3 Assumptions

We assume, as before, that the ballots as well as the credentials are non malleable, i.e. that for all adversary A, |P(Exp NM,0 A,V (λ) = 1) -P(Exp NM,1 A,V (λ) = 1)| and |P(Exp CNM A,V (λ) = 1)| are negligible in λ. As before, we also assume that the voting scheme is strongly consistent, that the proof of correct tallying has the zero-knowledge property, and that the proof of correct tallying and the rest of the protocol use different random oracles.

In addition, we will assume that the revote policy encoded by the counting function ρ is to keep each voter's last vote. That is, for any list L of pairs (id, v), if L is the list obtained from L by removing each element except the last pair for each distinct id, then ρ(L) = ρ(L ).

B.3.4 Belenios with revote is mb-BPRIV

Theorem B.16. Assume Belenios, with revote allowed, is strongly consistent, has non-malleable ballots and credentials, that the proofs of correct tallying are zero-knowledge, that different random oracles are used for these proofs and the rest of the protocol, and that ρ encodes the "last vote counts" revote policy.

Then Belenios is mb-BPRIV w.r.t. Recover del .

Proof. As for the "no revote" case, we will consider a sequence of games that differ from Exp mb-BPRIV,Recover del by the way the result the adversary gets to see is computed. These games are the same as before, except they use Recover del instead of Recover del,reorder :

, A is not shown the tally of the board/the recovered board by Otally, Otally instead computes the result using ρ and the extract function, without any proof of correct tallying.

, A has access to Otally , who computes the result of the election using the Tally algorithm, but still no proof of correct tallying.

, A is shown by Otally the result of the election computed by the Tally algorithm, but the proof of correct tallying for the board provided by A is simulated on both sides.

The structure of the proof is similar to the "no revote" case. We first show that if no adversary has a non-negligible advantage in Exp NM or Exp CNM , then no adversary has a non-negligible advantage in Exp mb-BPRIV1 . Using the strong consistency assumption, we then show that this implies no adversary has a non-negligible advantage in Exp mb-BPRIV2 . We then show, using the assumption that the random oracles used for the proof of correct tallying and the remainder of the protocol are different, that this implies no adversary has a non-negligible advantage in Exp mb-BPRIV3 . From there, using the zero-knowledge assumption on the proof of correct tallying, we show that no adversary has a non-negligible advantage in Exp mb-BPRIV .

Let A be an attacker that wins the Exp mb-BPRIV1, V game. We construct an attacker B against Exp NM,β V . B is given access to pk and U. It runs A internally, simulating the oracle calls as follows. When A calls OvoteLR(id, v 0 , v 1 ), for some • It is also clear by examining the game Exp mb-BPRIV1,β A that, up to this point, A has been accurately simulated, and has the same view it would have in game Exp mb-BPRIV1,β A .

• By construction of the OvoteLR oracle, the list BB init is also equal to the list BB β in (the corresponding execution of) the game Exp mb-BPRIV1,β A for A.

• We can also note that BB init contains no duplicate ballots (except with a negligible probability p β 1 (λ)). Indeed, BB init containing duplicate ballots would imply that two oracle calls Vote(pk, id, U[id], v) and Vote(pk, id , U[id ], v ) produced the same ballot. If this happened with non-negligible probability, by submitting O c (id, U[id], v, v ) followed by O c (id , U[id ], v , v ) (for some v = v ) to the encryption oracle, and checking whether the two resulting ballots are equal, an adversary would win the non-malleability game. The two ballots obtained on the right would indeed be different, except with negligible probability, by strong consistency (as they contain different votes).

Once A has returned BB, B checks (in V) that all voters in H check have voted, and halts if not. B also checks whether ValidBoard(BB, pk) = . If not, B directly asks A to guess the bit β , and returns A's guess.

Following the structure of game Exp mb-BPRIV1 , B then lets A perform the verifications for the honest voters. That is, when A calls Overify BB (id), B retrieves the last entry (id, v 0 , v 1 , p, b) for id in V, and checks that the last (p , b ) ∈ BB such that extract id (U, p ) = id is indeed (p, b). Once A is done with the verification phase, B checks that each id ∈ H check has verified (and halts otherwise). If any of the verifications have failed, B directly asks A to guess the bit β , and returns A's guess.

If all verifications are successful, B will simulate the tallying phase to A. To do this, B first computes π = Recover del U (BB init , BB). Note, at this point, that since all checks succeeded, π is simpler than in the general case. Indeed, the verifications guarantee that the last ballot cast by each id ∈ H check is the last ballot to occur for id's key in BB. Therefore, the test "if ∀id ∈ H check . I[id] = the last element of LL id " performed by Recover del U (BB init , BB) succeeds. Let BB revote be the board obtained by applying the revote policy to BB, i.e. keeping only the last ballot for each public key. From the definition of Recover del , it appears clearly that π is in fact equal to Recover del U (BB init , BB revote ). Then, consider L the list of length |BB revote | such that for all i:

such index exists. Note that, in that case, we have extract id (U, p) / ∈ H (where p is the public key in BB revote [i]), except with negligible probability p β 2 (λ): otherwise an adversary could win game Exp CNM by simulating A and returning BB revote .

By definition of Recover del , π is the function λi. L [i], where L is obtained from L by inserting, for each id ∈ H check , the list LL id of all indices of id's ballots in BB init before the index of id's last ballot. We will also denote π revote the function λi. L [i].

To continue the simulation of A, B must then provide A with the result of the election, to answer A's calls to Otally . B asks for the decryption of the list of all (p, b) such that ∃j.

). This call to the decryption oracle is allowed: indeed, by the description of π above, a ballot such that π(j) = (p, b) cannot occur in an element of BB init , and hence is not in L.

B then constructs a list BB containing the votes in πBB 0 in clear, BB 0 being the board of the left ballots, maintained by OvoteLR in Exp mb-BPRIV1,β A,V . This is done by retrieving the vote from the list V for ballots coming from the encryption oracle, and using the decryption oracle for the others. Formally this list is obtained by, for all i:

At this point, we have BB = extract(sk, U, π(BB 0 )), except with negligible probability. Indeed, for any i:

holds by construction of BB.

• Or π(i) = j for some j.

which is negligible by strong consistency.

Since BB has as many elements as BB, it is of polynomial size (bounded by the running time of A). Hence, P(BB = extract(sk, U, π(BB 0 ))) = P(∃i.

)) is also negligible. We write

B then computes ρ(BB), and shows this result to A. A finally outputs a bit β , that B returns.

We now argue that ρ(BB) is indeed the result A would have been shown in Exp mb-BPRIV1,β A,V .

• If β = 1, BB init = BB 1 , and thus π = Recover del U (BB 1 , BB). As previously explained, we then have

that is, BB = extract(sk, U, BB ), where BB is the board computed using Recover del in Exp mb-BPRIV1,1

. By definition of Otally , ρ(BB) is thus the election result A sees in this game.

• If β = 0, BB init = BB 0 , and thus π = Recover del U (BB 0 , BB). By definition of Otally , A receives the result ρ(extract(sk, U, BB)) in Exp mb-BPRIV1,1 A,V

. By assumption, ρ follows the "last vote counts" revote policy. Thus ρ(extract(sk, U, BB)) = ρ(extract(sk, U, BB revote )). In addition, for the same reason, it is clear that

Recall that, since all the verifications have succeeded, for each honest voter who checks id ∈ H check , all the last ballot in BB 0 produced by id occurs in BB revote . Therefore, it is clear from the definition of π revote that π(BB 0 ) = BB revote . Hence,

As we argued, except if

• or π does not have the expected form (p β 2 (λ)),

A is run until the end of its execution by B if and only if it would also reach the end of the game Exp mb-BPRIV1,β A ; and A run by B has the same view it would have in the corresponding execution of Exp mb-BPRIV1,β A,V . Hence, except in those three cases, B returns 1 in Exp NM,β B if and only if A returns 1 in the corresponding execution of Exp mb-BPRIV1,β A . Thus, for any β, if p β (λ) denotes

Therefore

which implies that, assuming strong consistency holds, and that no adversary has a non-negligible advantage in Exp NM , no adversary has a non-negligible advantage in Exp mb-BPRIV1 .

The remaining steps of the proof are identical to the "no revote" case.

Exp mb-BPRIV1 ∧ Exp SC ⇒ Exp mb-BPRIV2 . We now show that no adversary has a non-negligible advantage in Exp mb-BPRIV2 . Let A be an adversary against Exp mb-BPRIV2 . Consider the same A playing Exp mb-BPRIV1 instead. A has the same view in Exp mb-BPRIV1,β

, except if the result r returned by the Tally algorithm differs from ρ applied to the extractions of the board, which happens only with negligible probability by the second point of the strong consistency assumption.

More precisely, consider an adversary B playing Exp SC , that runs A internally, simulating its execution in game Exp mb-BPRIV2,0 A,V . B answers any call to OvoteLR(id, v 0 , v 1 ) made by A by running Vote(pk, id, U[id], v 0 ), and returning the generated ballot to A. When A produces a board BB, B returns this board.

When β = 0, Exp mb-BPRIV1,0

and Exp mb-BPRIV2,0

give A the same view, and hence return the same result, except if ρ(extract(sk, U, BB)) = r, where (r, Π) = Tally(BB, sk). That is, except if Exp SC B,V returns 1. Therefore

Similarly, consider an adversary C playing Exp SC , that runs A internally, simulating its execution in game Exp mb-BPRIV2,1 A,V

. C answers any call to OvoteLR(id, v 0 , v 1 ) made by A by running Vote(pk, id, U[id], v 0 ) and Vote(pk, id, U[id], v 1 ), storing the generated ballots in boards BB 0 and BB 1 , and returning the ballot for v 1 to A. When A produces a board BB, C computes BB = Recover del U (BB 1 , BB)(BB 0 ), and returns this board.

give A the same view, and hence return the same result, except if ρ(extract(sk, U, BB )) = r, where (r, Π) = Tally(BB , sk). That is, except if Exp SC C,V returns 1. Therefore

Therefore:

which implies, by the strong consistency assumption, that no adversary has a non-negligible advantage in Exp mb-BPRIV2 .

Exp mb-BPRIV2 ∧ different random oracles ⇒ Exp mb-BPRIV3 . We now show that no adversary has a non-negligible advantage in Exp mb-BPRIV3 . Let A be an adversary against Exp mb-BPRIV3 . Consider an adversary B against Exp mb-BPRIV2 , that runs A internally. During the voting and verification phases, B answers A's oracle queries by making the same calls to its oracles, once A returns a board BB, B returns this same board. B also runs its own random oracle, that is made available to A, to simulate the random oracle used for the proof of correct tallying that A expects to receive. This is made possible by the assumption that this random oracle is not used in any other part of the protocol. Once A calls Otally , B calls Otally and receives a result r. Manipulating the random oracle it runs, B then produces a proof Π = SimProof(r, BB), and returns (r, Π) to A. When A makes its guess regarding β, B returns the same guess. Exp mb-BPRIV3 ∧ Exp ZK ⇒ Exp mb-BPRIV . Finally we show that no adversary has a non-negligible advantage in Exp mb-BPRIV . Let A be an adversary against Exp mb-BPRIV . Consider A playing Exp mb-BPRIV3 instead.

It is clear that

It is clear that, when β = 1, Exp mb-BPRIV3,1

and Exp mb-BPRIV,1

A,V are identical. Hence P(Exp mb-BPRIV,1

A,V

= 1) = P(Exp mb-BPRIV3,1

A,V = 1).

When β = 0, the outputs of Exp mb-BPRIV,1

and Exp mb-BPRIV3,1

A,V can only differ if A is able to distinguish the real proof of correct tallying Π returned by Tally(BB, sk) from the simulated proof SimProof(r, BB).

More precisely, let B be an adversary against Exp ZK,β V . B runs Exp mb-BPRIV,0

A,V internally. That is, B generates its own sets of credentials U, using the Register algorithm, and runs A, answering calls to OvoteLR(id, v 0 , v 1 ) by computing Vote(pk, id, U[id], v 0 ). B obtains a board BB from A, on which it performs the validity check using ValidBoard. If this check fails, B answers 0. Otherwise, it lets A call its verification oracle, using Verify to answer A's queries. Again, if A does not make all voters in H check verify, B answers 0. If some verifications fail, B asks A for its guess regarding the bit β , and returns it. Otherwise, B returns the board BB, and obtains (r, Π β ), where r is the result of the tally, and Π β , depending on β , is either the real proof Π 0 computed by Tally(BB, sk), or the simulated proof Π 1 = SimProof(r, BB). B continues to run A, answering (r, Π β ) when A calls Otally. Finally A makes a guess regarding β , that B returns as its output.

It is clear that, if β = 0, A as simulated by B in Exp ZK,0 B,V has the same view it would have in Exp mb-BPRIV,0 A,V . Hence, P(Exp ZK,0 B,V = 1) = P(Exp mb-BPRIV,0

A,V = 1).

Similarly if β = 1, A simulated by B in Exp ZK,1 B,V has the same view it would have in Exp mb-BPRIV3,0 A,V . Hence, P(Exp ZK,1 B,V = 1) = P(Exp mb-BPRIV3,0

A,V = 1).

Thus, |P(Exp mb-BPRIV,0

which implies that, assuming that the zero-knowledge property holds, no adversary has a non-negligible advantage in Exp mb-BPRIV .

B.3.5 Ideal functionality corresponding to Recover del

Recall the predicate P del that is checked by the functionality F del v (ρ):

• f keeps the votes of all voters who check, in the same order for each voter:

• and no honest votes are modified by f :

Theorem B.17. The Recover del algorithm defined above is compatible with the predicate P del .

Proof. Indeed, consider an adversary A, that plays the game Exp comp,P del ,Recover del A,V

. Following this game, let (pk, sk)

A has access to the Ovote oracle, to generate honest ballots, that get stored in a board BB 1 . For each (id, (p, b)) ∈ BB 1 , by construction, (p, b) was constructed by calling Vote(pk, id, U[id], v) for some v. Let BB be the board returned by A in the game. Note that, by the non-malleability assumption, following the same reasoning as in the previous proof, BB 1 contains no duplicate ballots, except with negligible probability. If BB is not valid, or BB 1 does not contain at least one entry for each id ∈ H check , A loses the game.

Otherwise let π = Recover del U (BB 1 , BB). Let us show that π is compatible with P del w.r.t. sk, U, L id , except with negligible probability. Assume BB 1 contains no duplicate ballots, which, as explained, holds with overwhelming probability.

Let L be a list of elements (id, v), such that [id|(id, v) ∈ L] = L id . We show that P del (L, mod sk,U (π)) = . 2. mod sk,U (π) keeps the votes of all voters who check, in the same order:

that is, since the non-⊥ elements in LL and LL are in the same order,

Let id ∈ H check . We distinguish two cases:

B.4.1 Notations

Compared to the "no revote" case, the verification algorithm differs. Verify(id, s, BB) now checks whether the last ballot recorded in s, i.e. the last ballot generated by id, appears on BB.

Since revote is now allowed, the validity algorithm ValidBoard also changes: it no longer rejects a board that contains several ballots associated with public credentials encrypting the same private credential. However it still checks all the proofs and performs the PETs on all ballots.

B.4.2 Recovery

We consider the following recovery algorithm:

(in case several such j exist, pick the first one)

B.4.3 Assumptions

We assume, as before, that the ballots as well as the credentials are non malleable, i.e. that for all adversary A, |P(Exp NM,0 A,V (λ) = 1) -P(Exp NM,1 A,V (λ) = 1)| and |P(Exp CNM A,V (λ) = 1)| are negligible in λ. As before, we also assume that the voting scheme is strongly consistent, that the proof of correct tallying has the zero-knowledge property, and that the proof of correct tallying and the rest of the protocol use different random oracles.

In addition, as explained in Section 6.6.1, when a voter revotes in Civitas, her new ballot must indicate which ballot it replaces, and to provide proofs of knowledge of the contents of this previous ballot. The ValidBoard algorithm is in charge of checking all these proofs, and that the old ballot that is claimed to be replaced is indeed present on the bulletin board before the new ballot, and is not already supposed to be replaced. This chains the ballots belonging to the same voter together, and provided that this verification is correctly performed, if one of the ballot created by a voter is present in a valid board, it must mean that all of her previous ballots are also present exactly once, in the correct order. We formalise the assumption that the ValidBoard algorithm correctly performs all these checks by the following game.

B.4.4 Civitas with revote is mb-BPRIV

Theorem B.19. Assume Civitas, with revote allowed, is strongly consistent, has non-malleable ballots and credentials, that the proofs of correct tallying are zero-knowledge, that different random oracles are used for these proofs and the rest of the protocol, and that ValidBoard correctly checks the chain of ballots belonging to the same voters.

Then Civitas is mb-BPRIV w.r.t. Recover del .

Proof. As for the "no revote" case, we will consider a sequence of games that differ from Exp mb-BPRIV,Recover del by the way the result the adversary gets to see is computed. These games are the same as before, except they use Recover del instead of Recover del,reorder :

, A is not shown the tally of the board/the recovered board by Otally, Otally instead computes the result using ρ and the extract function, without any proof of correct tallying.

• In Exp mb-BPRIV2,β A,V , A has access to Otally , who computes the result of the election using the Tally algorithm, but still no proof of correct tallying.

, A is shown by Otally the result of the election computed by the Tally algorithm, but the proof of correct tallying for the board provided by A is simulated on both sides.

The structure of the proof is similar to the "no revote" case. We first show that if no adversary has a non-negligible advantage in Exp NM , Exp CNM or Exp valid , then no adversary has a non-negligible advantage in Exp mb-BPRIV1 . Using the strong consistency assumption, we then show that this implies no adversary has a non-negligible advantage in Exp mb-BPRIV2 . We then show, using the assumption that the random oracles used for the proof of correct tallying and the remainder of the protocol are different, that this implies no adversary has a non-negligible advantage in Exp mb-BPRIV3 . From there, using the zero-knowledge assumption on the proof of correct tallying, we show that no adversary has a non-negligible advantage in Exp mb-BPRIV .

Exp NM ∧ Exp CNM ∧ Exp valid ⇒ Exp mb-BPRIV1 . Let A be an attacker that wins the Exp mb-BPRIV1, V game. We construct an attacker B against Exp NM,β V . B is given access to pk and U. It runs A internally, simulating the oracle calls as follows. When A calls OvoteLR(id, v 0 , v 1 ), for some • It is also clear by examining the game Exp mb-BPRIV1,β A that, up to this point, A has been accurately simulated, and has the same view it would have in game Exp mb-BPRIV1,β A .

• By construction of the OvoteLR oracle, the list BB init is also equal to the list BB β in (the corresponding execution of) the game Exp mb-BPRIV1,β A for A.

• We can also note that BB init contains no duplicate ballots (except with a negligible probability p β 1 (λ)). Indeed, BB init containing duplicate ballots would imply that two oracle calls Vote(pk, id, U[id], v) and Vote(pk, id , U[id ], v ) produced the same ballot. If this happened with non-negligible probability, by submitting O c (id, U[id], v, v ) followed by O c (id , U[id ], v , v ) (for some v = v ) to the encryption oracle, and checking whether the two resulting ballots are equal, an adversary would win the non-malleability game. The two ballots obtained on the right would indeed be different, except with negligible probability, by strong consistency (as they contain different votes).

Once A has returned BB, B checks (in V) that all voters in H check have voted, and halts if not. B also checks whether ValidBoard(BB, pk) = . If not, B directly asks A to guess the bit β , and returns A's guess.

Following the structure of game Exp mb-BPRIV1 , B then lets A perform the verifications for the honest voters. That is, when A calls Overify BB (id), B retrieves the last entry (id, v 0 , v 1 , p, b) for id in V, and checks that (p, b) ∈ BB. Once A is done with the verification phase, B checks that each id ∈ H check has verified (and halts otherwise). If any of the verifications have failed, B directly asks A to guess the bit β , and returns A's guess.

If all verifications are successful, B will simulate the tallying phase to A. To do this, B first computes π = Recover del U (BB init , BB). Note, at this point, that since all checks succeeded, π is simpler than in the general case. Indeed, the Exp valid assumption implies that, except with negligible probability p β 2 (λ), for each voter id ∈ H check , all the ballots generated for id are present in BB in the same order. Otherwise, an adversary could win the Exp valid game by running A and returning the same board BB. Therefore, the test

Hence, π is only defined on 1, |BB| , and, except with negligible probability p β 3 (λ), is such that for all i:

• π(i) = j if j is the index of the first (and only) occurrence of BB[i] in BB init ,

• or π(i) = BB[i] if no such index exists. Indeed, in that case, we have extract id (U, p) / ∈ H (where p is the public credential in BB[i]), except with negligible probability: otherwise an adversary could win game Exp CNM by simulating A and returning BB. . This is done by retrieving the vote from the list V for ballots coming from the encryption oracle, and using the decryption oracle for the others. Formally this list is obtained by, for all i:

the corresponding element in V (in that case, π(i) is the index of this element in V).

•

) holds by construction of BB.

• Or BB init [j] = (id, BB[i]) for some j, id, and, by definition, which is negligible by strong consistency.

Since BB has as many elements as BB, it is of polynomial size (bounded by the running time of A). Hence, P(BB = extract(sk, U, π(BB 0 ))) = P(∃i. BB[i] = extract(sk, U, π(BB 0 )[i])) is also negligible. We write

B then computes ρ(BB), and shows this result to A. A finally outputs a bit β , that B returns.

We now argue that ρ(BB) is indeed the result A would have been shown in Exp mb-BPRIV1,β A,V .

• If β = 1, BB init = BB 1 , and thus π = Recover del U (BB 1 , BB). As previously explained, we then have BB = extract(sk, U, Recover del U (BB 1 , BB)(BB 0 )), that is, BB = extract(sk, U, BB ), where BB is the board computed using Recover del in Exp mb-BPRIV1,1

. By definition of Otally , ρ(BB) is thus the election result A sees in this game.

• If β = 0, BB init = BB 0 , and thus π = Recover del U (BB 0 , BB). Recall that, since all the verifications have succeeded, for each honest voter who checks id ∈ H check , all the ballots in BB 0 produced by id occur in BB in the same order (except with negligible probability p β 2 (λ)). Therefore, it is clear from the definition of Recover del that π(BB 0 ) = BB. As previously explained, we then have BB = extract(sk, U, BB), and, by definition of Otally , ρ(BB) is thus the election result A sees in this Exp mb-BPRIV1,0 A,V .

As we argued, except if

• or the validity check fails to ensure all previous ballots of each voter who check are there (p β 2 (λ)),

• or π does not have the expected form (p β 3 (λ)),

• or BB = extract(sk, U, πBB 0 ) (p β 4 (λ)),

• or applying π to BB 0 does not return BB when β = 0 (p β 2 (λ)),

A is run until the end of its execution by B if and only if it would also reach the end of the game Exp mb-BPRIV1,β

which implies that, assuming strong consistency holds, and that no adversary has a non-negligible advantage in Exp NM , no adversary has a non-negligible advantage in Exp mb-BPRIV1 .

The remaining steps of the proof are identical to the "no revote" case.

Exp mb-BPRIV1 ∧ Exp SC ⇒ Exp mb-BPRIV2 . We now show that no adversary has a non-negligible advantage in Exp mb-BPRIV2 . Let A be an adversary against Exp mb-BPRIV2 . Consider the same A playing Exp mb-BPRIV1 instead. A has the same view in Exp mb-BPRIV1,β

, except if the result r returned by the Tally algorithm differs from ρ applied to the extractions of the board, which happens only with negligible probability by the second point of the strong consistency assumption.

More precisely, consider an adversary B playing Exp SC , that runs A internally, simulating its execution in game Exp mb-BPRIV2,0 A,V . B answers any call to OvoteLR(id, v 0 , v 1 ) made by A by running Vote(pk, id, U[id], v 0 ), and returning the generated ballot to A. When A produces a board BB, B returns this board.

When β = 0, Exp mb-BPRIV1,0

A,V and Exp mb-BPRIV2,0 A,V

give A the same view, and hence return the same result, except if ρ(extract(sk, U, BB)) = r, where (r, Π) = Tally(BB, sk). That is, except if Exp SC B,V returns 1. Therefore

Similarly, consider an adversary C playing Exp SC , that runs A internally, simulating its execution in game Exp mb-BPRIV2,1 A,V

. C answers any call to OvoteLR(id, v 0 , v 1 ) made by A by running Vote(pk, id, U[id], v 0 ) and Vote(pk, id, U[id], v 1 ), storing the generated ballots in boards BB 0 and BB 1 , and returning the ballot for v 1 to A. When A produces a board BB, C computes BB = Recover del U (BB 1 , BB)(BB 0 ), and returns this board.

give A the same view, and hence return the same result, except if ρ(extract(sk, U, BB )) = r, where (r, Π) = Tally(BB , sk). That is, except if Exp SC C,V returns 1. Therefore

Therefore:

which implies, by the strong consistency assumption, that no adversary has a non-negligible advantage in Exp mb-BPRIV2 .

Exp mb-BPRIV2 ∧ different random oracles ⇒ Exp mb-BPRIV3 . We now show that no adversary has a non-negligible advantage in Exp mb-BPRIV3 . Let A be an adversary against Exp mb-BPRIV3 . Consider an adversary B against Exp mb-BPRIV2 , that runs A internally. During the voting and verification phases, B answers A's oracle queries by making the same calls to its oracles, once A returns a board BB, B returns this same board. B also runs its own random oracle, that is made available to A, to simulate the random oracle used for the proof of correct tallying that A expects to receive. This is made possible by the assumption that this random oracle is not used in any other part of the protocol. Once A calls Otally , B calls Otally and receives a result r. Manipulating the random oracle it runs, B then produces a proof Π = SimProof(r, BB), and returns (r, Π) to A. When A makes its guess regarding β, B returns the same guess.

It is clear that A as run by B has the same view it would have in game Exp mb-BPRIV3,β A,V

. Hence

is negligible, which proves no adversary has a non-negligible advantage in Exp mb-BPRIV3 .

Exp mb-BPRIV3 ∧ Exp ZK ⇒ Exp mb-BPRIV . Finally we show that no adversary has a non-negligible advantage in Exp mb-BPRIV . Let A be an adversary against Exp mb-BPRIV . Consider A playing Exp mb-BPRIV3 instead.

It is clear that, when β = 1, Exp mb-BPRIV3,1

A,V

and Exp mb-BPRIV,1

A,V are identical. Hence P(Exp mb-BPRIV,1

A,V

= 1) = P(Exp mb-BPRIV3,1

A,V = 1).

When β = 0, the outputs of Exp mb-BPRIV,1

A,V

and Exp mb-BPRIV3,1

A,V can only differ if A is able to distinguish the real proof of correct tallying Π returned by Tally(BB, sk) from the simulated proof SimProof(r, BB).

More precisely, let B be an adversary against Exp ZK,β V . B runs Exp mb-BPRIV,0

A,V internally. That is, B generates its own sets of credentials U, using the Register algorithm, and runs A, answering calls to OvoteLR(id, v 0 , v 1 ) by computing Vote(pk, id, U[id], v 0 ). B obtains a board BB from A, on which it performs the validity check using ValidBoard. If this check fails, B answers 0. Otherwise, it lets A call its verification oracle, using Verify to answer A's queries. Again, if A does not make all voters in H check verify, B answers 0. If some verifications fail, B asks A for its guess regarding the bit β , and returns it. Otherwise, B returns the board BB, and obtains (r, Π β ), where r is the result of the tally, and Π β , depending on β , is either the real proof Π 0 computed by Tally(BB, sk), or the simulated proof Π 1 = SimProof(r, BB). B continues to run A, answering (r, Π β ) when A calls Otally. Finally A makes a guess regarding β , that B returns as its output.

It is clear that, if β = 0, A as simulated by B in Exp ZK,0 B,V has the same view it would have in Exp mb-BPRIV,0 A,V . Hence, P(Exp ZK,0 B,V = 1) = P(Exp mb-BPRIV,0

Similarly if β = 1, A simulated by B in Exp ZK,1 B,V has the same view it would have in Exp mb-BPRIV3,0 A,V . Hence, P(Exp ZK,1 B,V = 1) = P(Exp mb-BPRIV3,0

A,V = 1).

Thus, |P(Exp mb-BPRIV,0

which implies that, assuming that the zero-knowledge property holds, no adversary has a non-negligible advantage in Exp mb-BPRIV .

B.4.5 Ideal functionality corresponding to Recover del

Recall the predicate P del from the functionality F del v (ρ):

• f keeps the votes of all voters who check, in the same order for each voter:

• and no honest votes are modified by f :

Theorem B.20. The Recover del algorithm defined above is compatible with the predicate P del .

Proof. Indeed, consider an adversary A, that plays the game Exp comp,P del ,Recover del A,V

. Following this game, let (pk, sk)

A has access to the Ovote oracle, to generate honest ballots, that get stored in a board BB 1 . For each (id, (p, b)) ∈ BB 1 , by construction, (p, b) was constructed by calling Vote(pk, id, U[id], v) for some v. Let BB be the board returned by A in the game. Note that, by the non-malleability assumption, following the same reasoning as in the previous proof, BB 1 contains no duplicate ballots, except with negligible probability. If BB is not valid, or BB 1 does not contain at least one entry for each id ∈ H check , A loses the game.

Otherwise let π = Recover del U (BB 1 , BB). Let us show that π is compatible with P del w.r.t. sk, U, L id , except with negligible probability. Assume BB 1 contains no duplicate ballots, which, as explained, holds with overwhelming probability.

Let L be a list of elements (id, v), such that [id|(id, v) ∈ L] = L id . We show that P del (L, mod sk,U (π)) = .

Consider the lists LL, LL , LL cast , LL id for id ∈ H, constructed by the following process:

where LL is the list obtained obtained by removing all ⊥ elements from LL .

We have to show that P del (L, mod sk,U (π)) = . That is, that 1. No honest votes are modified by mod sk,U (π): 2. mod sk,U (π) keeps the votes of all voters who check, in the same order:

that is, since the non-⊥ elements in LL and LL are in the same order,

Let id ∈ H check . We distinguish two cases: In any case, the claim holds, which concludes the proof.

B.4.6 Conclusion on Civitas with revote

Theorem B.21. Assume Civitas, with revote allowed, is strongly consistent, has non-malleable ballots and credentials, that the proofs of correct tallying are zero-knowledge, that different random oracles are used for these proofs and the rest of the protocol, and that ValidBoard correctly checks the chain of ballots belonging to the same voters.

Then Civitas securely implements the three ideal functionalities F del v (ρ), F del,reorder v (ρ) and F del,reorder,change v (ρ).

Proof.

• It directly follows from Theorems 11, B.19, and B.20 that, under these assumptions, Civitas securely implements the functionality F del v (ρ).

• As argued for Belenios in Section B.3.6, F del v (ρ) is stronger than both F del,reorder v (ρ) and F del,reorder,change v (ρ), meaning that any scheme that securely implements F del v (ρ) also implements these two functionalities, which proves the claim.

B.5 Case study: Helios without revote

We show here that, under reasonable assumptions, Helios without revote is mb-BPRIV w.r.t. Recover del,reorder,change (allowing only one call to the OvoteLR oracle for each id, where Recover del,reorder,change is defined below), and that this implies it realises F del,reorder,change v (when the environment E does not make voters revote).

B.5.1 Notations: Helios

• Helios does not use credentials, hence the Register and Pub algorithms are unused (they return empty strings).

• Vote(id, pk, c, v) = (s, id, (enc(v, pk), Π)). We will call (enc(v, pk), Π) the ciphertext of the ballot. The state s records this ciphertext. The pseudonym is id. π is a zero-knowledge proof that v is a valid vote. Since Vote does not use a credential c, we will omit it in the following.

• ValidBoard(BB, pk) checks the zero-knowledge proofs in the ballots in BB, that BB does not contain several ballots for the same id, and that BB does not contain duplicate ciphertexts.

• Tally only keeps the parts of the ballots containing the encrypted votes. These are then run through a mixnet, decrypted, and published.

• Verify(id, s, BB) checks whether the ciphertext recorded in s appears on BB.

B.5.2 Recovery

We consider the following recovery algorithm:

Intuitively, given BB 1 and BB, when applied to BB 0 , this recovery algorithm will construct a board BB where • all the ciphertexts in BB that come from BB 1 are replaced with the corresponding ciphertext from BB 0 ;

• the other ciphertexts in BB are considered to be cast, and added to BB as is;

• all the ciphertexts registered for voters who check in BB 0 are added to BB , regardless of whether these voters' ballots actually occur in BB.

The subtle point is that the ciphertexts that are cast should be cast for identities that do not conflict with those appearing in BB 1 : only the identities of dishonest voters, or of voters whose ballot was removed should be used. That is the purpose of the set S used by Recover del,reorder,change .

B.5.3 Assumptions

We assume that the ciphertexts of the ballots (i.e. excluding the identity p) are non malleable, i.e. that for all adversary A,

is the following game.

A is allowed any number of calls to O c , followed by one single call to O d .

As for Belenios and Civitas, we assume that the voting scheme is strongly consistent, and that the proof of correct tallying and the rest of the protocol use different random oracles. We also assume a zero-knowledge property from the proof of correct tallying, expressed, as before, by the game Exp ZK .

In addition, we will assume that the counting function ρ only uses the identities it is given to apply a revote policy, that is, that it only looks for repetitions between the ids, but does not depend on the ids themselves. Formally we assume that for any list L of pairs (id, v), if σ is a permutation of identities, then ρ(L) = ρ(Lσ). We call this property id-blindness.

B.5.4 Helios without revote is mb-BPRIV

Theorem B.22. Assume Helios, with no revote allowed, is strongly consistent, has non-malleable ciphertexts, that the proofs of correct tallying are zero-knowledge, that different random oracles are used for these proofs and the rest of the protocol, and that the counting function ρ is id-blind.

Then Helios, without revote, is mb-BPRIV w.r.t. Recover del,reorder,change .

Proof. As for Belenios and Civitas, we will consider a sequence of games that differ from Exp mb-BPRIV,Recover del,reorder,change by the way the result the adversary gets to see is computed. These games are the same as before, except they use the algorithm Recover del,reorder,change instead of Recover del,reorder :

, A is not shown the tally of the board/the recovered board by Otally, Otally instead computes the result using ρ and the extract function, without any proof of correct tallying.

• In Exp mb-BPRIV2,β A,V , A has access to Otally , who computes the result of the election using the Tally algorithm, but still no proof of correct tallying.

, A is shown by Otally the result of the election computed by the Tally algorithm, but the proof of correct tallying for the board provided by A is simulated on both sides.

The structure of the proof is similar to the case of Belenios and Civitas. We first show that if no adversary has a non-negligible advantage in Exp NM , then no adversary has a non-negligible advantage in Exp mb-BPRIV1 . Using the strong consistency assumption, we then show that this implies no adversary has a non-negligible advantage in Exp mb-BPRIV2 . We then show, using the assumption that the random oracles used for the proof of correct tallying and the remainder of the protocol are different, that this implies no adversary has a non-negligible advantage in Exp mb-BPRIV3 . From there, using the zero-knowledge assumption on the proof of correct tallying, we show that no adversary has a non-negligible advantage in Exp mb-BPRIV .

Exp NM ⇒ Exp mb-BPRIV1 . Let A be an attacker that wins the Exp mb-BPRIV1, V game.

We construct an attacker B against Exp NM,β V . B is given access to pk and U. It runs A internally, simulating the oracle calls as follows. When A calls OvoteLR(id, v 0 , v 1 ), for some id ∈ H, B calls O c (id, v 0 , v 1 ) and obtains some b. B records (id, (id, b)) in a list BB init , and stores (id, v 0 , v 1 , b) in a list V. B then returns (id, b) to A. At some point, A returns to B some board BB.

Note that

• By construction, during the execution, the list [b|(id, (p, b)) ∈ BB init ] of the ciphertexts in BB init (kept by B) is always equal to the list L in the game Exp NM,β V played by B.

• It is also clear by examining the game Exp mb-BPRIV1,β A that, up to this point, A has been accurately simulated, and has the same view it would have in game Exp mb-BPRIV1,β A .

• By construction of the OvoteLR oracle, the list BB init is also equal to the list BB β in (the corresponding execution of) the game Exp mb-BPRIV1,β A for A.

• We can also note that BB init contains no duplicate ciphertexts (except with a negligible probability p β 1 (λ)). Indeed, BB init containing duplicate ciphertexts would imply that two oracle calls Vote(pk, id, v) and Vote(pk, id , v ) produced ballots with the same ciphertext. If this happened with non-negligible probability, by submitting O c (id, v, v ) followed by O c (id , v , v ) (for some v = v ) to the encryption oracle, and checking whether the ciphertexts of the two resulting ballots are equal, an adversary would win the nonmalleability game Exp NM . The two ciphertexts obtained on the right would indeed be different, except with negligible probability, by strong consistency (as they contain different votes).

• Finally, by assumption A is only allowed at most one call to OvoteLR for each id. Thus BB init , as well as V, contain at most one entry for each distinct id.

Once A has returned BB, B checks (in V) that all voters in H check have voted, and halts if not. B also checks whether ValidBoard(BB, pk) = . If not, B directly asks A to guess the bit β , and returns A's guess.

Following the structure of game Exp mb-BPRIV1 , B then lets A perform the verifications for the honest voters. That is, when A calls Overify BB (id), B retrieves the entry (id, v 0 , v 1 , b) for id in V, and checks that b occurs in BB, i.e. that ∃p. (p, b) ∈ BB. Once A is done with the verification phase, B checks that each id ∈ H check has verified (and halts otherwise). If any of the verifications have failed, B directly asks A to guess the bit β , and returns A's guess.

If all verifications are successful, B will simulate the tallying phase to A. First, B computes π = Recover del,reorder,change U (BB init , BB). Note, at this point, that since all checks succeeded, π is simpler than in the general case. Indeed, this means that the algorithm Recover del,reorder,change U (BB init , BB) did not need to add back any ballots from a honest voter who checked and whose ciphertext would be missing from BB. That is, the list L = [i|BB init ∈ BB)} be the initial value of S. Let then S be the set of identities occurring in BB that are also in S, and S the set of identities in BB but not in S. Since ValidBoard(BB, pk) = , by definition, all identities in BB are distinct, and all ciphertexts also are.

For all id ∈ S , id appears in BB, and either id ∈ H check , or id ∈ H check has a ciphertext in BB init that appears in BB. Actually, since all verifications succeed and since all voters in H check have ballots in BB init , in any case, id's ciphertext appears in BB. Hence each identity in S appears in BB, has a ciphertext in BB init , and this ciphertext appears in BB. . This is done by retrieving the vote from the list V for ballots coming from the encryption oracle, and using the decryption oracle for the others. Formally this list is obtained by, for all i:

• BB[i] = (id, v 0 ) if BB[i] = (p, b) for some p, b such that BB init [j] = (id, (id, b)) for some j, and V[j] = (id, v 0 , v 1 , b) (again, such a j is then unique, and π(i) = j).

• Since BB has as many elements as BB, it is of polynomial size (bounded by the running time of A). Hence, P(BB = extract(sk, U, π(BB 0 ))) = P(∃i. BB[i] = extract(sk, U, π(BB 0 )[i])) is also negligible. We write p β 3 (λ) = P(BB = extract(sk, U, π(BB 0 )) in Exp NM,β B,V ).

B then computes ρ(BB), and shows this result to A. A finally outputs a bit β , that B returns.

We now argue that ρ(BB) is indeed the result A would have been shown in Exp mb-BPRIV1,β A,V .

• If β = 1, BB init = BB 1 , and thus π = Recover del,reorder,change U (BB 1 , BB). As previously explained, we then have BB = extract(sk, U, Recover del,reorder,change U (BB 1 , BB)(BB 0 )), that is, BB = extract(sk, U, BB ), where BB is the board computed using algorithm Recover del,reorder,change in Exp mb-BPRIV1,1

. By definition of Otally , ρ(BB) is thus the election result A sees in this game.

• If β = 0, BB init = BB 0 , and thus π = Recover del,reorder,change U (BB 0 , BB). By definition of Otally , A receives the result ρ(extract(sk, U, BB)) in Exp mb-BPRIV1,1 A,V . Recall that, as explained before, for all i, if BB[i] = (id, b), then.

either b occurs in some element BB 0 [j] (j is then unique), and then π(i) = j; -or π(i) = (id , b), where all of the id are chosen distinct in the set S of identities that are either dishonest, or are in H check and do not have a ciphertext in BB 0 that appears in BB. Since ValidBoard(BB, pk) = , all the id i are pairwise distinct. In addition, by construction of π, the id i are comprised of, on one hand, pairwise distinct identities picked in S, and on the other hand, identities from BB 0 , whose associated ciphertext (in BB 0 ) is present in BB. By construction of S, these two sets are disjoint, and since, as noted before, there is no revote, the ids in BB 0 are also pairwise distinct. Thus, all the id i are pairwise distinct.

Hence, there exists a permutation of identities that maps each id i on id i . By assumption on ρ, we therefore have By definition of Otally , ρ(BB) is thus the election result A sees in Exp mb-BPRIV1,0 A,V .

As we argued, except if

• BB init contains duplicate ciphertexts (p β 1 (λ)),

• or π does not have the expected form (p β 2 (λ)),

• or BB = extract(sk, U, πBB 0 ) (p β 3 (λ)),

A is run until the end of its execution by B if and only if it would also reach the end of the game Exp mb-BPRIV1,β B,V (λ) = 1) -P(Exp NM,1 B,V (λ) = 1)| + p 0 (λ) + p 1 (λ), which implies that, assuming that strong consistency holds, and that no adversary has a nonnegligible advantage in Exp NM , no adversary has a non-negligible advantage in Exp mb-BPRIV1 .

The remaining steps of the proof are identical to the case of Belenios and Civitas.

Exp mb-BPRIV1 ∧ Exp SC ⇒ Exp mb-BPRIV2 . We now show that no adversary has a non-negligible advantage in Exp mb-BPRIV2 . Let A be an adversary against Exp mb-BPRIV2 . Consider the same A playing Exp mb-BPRIV1 instead. A has the same view in Exp mb-BPRIV1,β A,V as in Exp mb-BPRIV2,β A,V

, except if the result r returned by the Tally algorithm differs from ρ applied to the extractions of the board, which happens only with negligible probability by the second point of the strong consistency assumption.

More precisely, consider an adversary B playing Exp SC , that runs A internally, simulating its execution in game Exp mb-BPRIV2,0 A,V . B answers to any call to OvoteLR(id, v 0 , v 1 ) made by A by running Vote(pk, id, v 0 ), and returning the generated ballot to A. When A produces a board BB, B returns this board.

When β = 0, Exp mb-BPRIV1,0 A,V and Exp mb-BPRIV2,0 A,V give A the same view, and hence return the same result, except if ρ(extract(sk, U, BB)) = r, where (r, Π) = Tally(BB, sk). That is, except if Exp SC B,V returns 1. Therefore |P(Exp mb-BPRIV1,0

A,V (λ) = 1) -P(Exp mb-BPRIV2,0

A,V (λ) = 1)| ≤ P(Exp SC B,V (λ) = 1).

Similarly, consider an adversary C playing Exp SC , that runs A internally, simulating its execution in game Exp mb-BPRIV2,1 A,V . C answers to any call to OvoteLR(id, v 0 , v 1 ) made by A by running Vote(pk, id, v 0 ) and Vote(pk, id, v 1 ), storing the generated ballots in boards BB 0 and BB 1 , and returning the ballot for v 1 to A. When A produces a board BB, C computes BB = Recover U (BB, BB 1 )(BB 0 ), and returns this board.

When β = 1, Exp mb-BPRIV1,1

A,V

and Exp mb-BPRIV2,1

A,V

give A the same view, and hence return the same result, except if ρ(extract(sk, U, BB )) = r, where (r, Π) = Tally(BB , sk). That is, except if Exp SC C,V returns 1. Therefore |P(Exp mb-BPRIV1,1

A,V

(λ) = 1) -P(Exp mb-BPRIV2,1

A,V

(λ) = 1)| ≤ P(Exp SC C,V (λ) = 1).

Therefore: Exp mb-BPRIV2 ∧ different random oracles ⇒ Exp mb-BPRIV3 . We now show that no adversary has a non-negligible advantage in Exp mb-BPRIV3 . Let A be an adversary against Exp mb-BPRIV3 . Consider an adversary B against Exp mb-BPRIV2 , that runs A internally. During the voting phase, B answers A's oracle queries by making the same calls to its oracles, and once A returns a board BB, B returns this same board. B also runs its own random oracle, that is made available to A, to simulate the random oracle used for the proof of correct tallying that A expects to receive. This is made possible by the assumption that this random oracle is not used in any other part of the protocol. Once A calls Otally , B calls Otally and receives a result r. Manipulating the random oracle it runs, B then produces a proof Π = SimProof(r, BB), and returns (r, Π) to A. When A makes its guess regarding β, B returns the same guess. Exp mb-BPRIV3 ∧ Exp ZK ⇒ Exp mb-BPRIV . Finally we show that no adversary has a non-negligible advantage in Exp mb-BPRIV . Let A be an adversary against Exp mb-BPRIV . Consider A playing Exp mb-BPRIV3 instead.

It is clear that, when β = 1, Exp mb-BPRIV3,1

A,V

and Exp mb-BPRIV,1

A,V are identical. Hence P(Exp mb-BPRIV,1

A,V

= 1) = P(Exp mb-BPRIV3,1

A,V = 1).

When β = 0, the outputs of Exp mb-BPRIV,1

A,V

and Exp mb-BPRIV3,1

A,V can only differ if A is able to distinguish the real proof of correct tallying Π returned by Tally(BB, sk) from the simulated proof SimProof(r, BB).

More precisely, let B be an adversary against Exp ZK,β V . B runs Exp mb-BPRIV,0

A,V internally. That is, B generates its own sets of credentials U, using the Register algorithm, and runs A, answering calls to OvoteLR(id, v 0 , v 1 ) by computing Vote(pk, id, v 0 ). B obtains a board BB from A, on which it performs the validity checks, and the voter verifications, using ValidBoard. If this check fails, B answers 0. Otherwise, it lets A call its verification oracle, using Verify to answer A's queries. Again, if A does not make all voters in H check verify, B answers 0. If some verifications fail, B asks A for its guess regarding the bit β , and returns it. Otherwise, B returns the board BB, and obtains (r, Π β ), where r is the result of the tally, and Π β , depending on β , is either the real proof Π 0 computed by Tally(BB, sk), or the simulated proof Π 1 = SimProof(r, BB). B continues to run A, answering (r, Π β ) when A calls Otally. Finally A makes a guess regarding β , that B returns as its output.

It is clear that, if β = 0, A as simulated by B in Exp ZK,0 B,V has the same view it would have in Exp mb-BPRIV,0 A,V . Hence, P(Exp ZK,0 B,V = 1) = P(Exp mb-BPRIV,0 , v) for some v. Let BB be the board returned by A in the game. Note that, by the non-malleability assumption on ciphertexts, following the same reasoning as in the previous proof, BB 1 contains no duplicate ciphertexts, except with negligible probability. If BB is not valid, or BB 1 does not contain at least one entry for each id ∈ H check , A loses the game.

Otherwise let π = Recover del,reorder,change U (BB 1 , BB). Let us show that π is compatible with P del,reorder,change w.r.t. sk, U, L id , except with negligible probability. Assume BB 1 contains no duplicate ballots, which, as explained, holds with overwhelming probability.

Let L be a list of elements (id, v), such that [id|(id, v) ∈ L] = L id . We show that P del,reorder,change (L, mod sk,U (π)) = .

Consider the lists LL, LL , LL constructed by the following process: By definition, mod sk,U (π) is λi.LL [i], where LL is the list obtained obtained by removing all ⊥ elements from LL .

We have to show that P del,reorder,change (L, mod sk,U (π)) = . That is, that 1. No votes from voters in H check are modified by mod sk,U (π):

∀i. ∀(id, v). mod sk,U (π

Let i, id, v be such that mod sk,U (π)[i] = (id, v). Hence LL[j] = (id, v) for some j. Thus, by construction of LL, id ∈ S. Since S ⊆ D ∪ H check by definition, we have id ∈ D ∪ H check .

2. mod sk,U (π) keeps the votes of all voters who check: Let id ∈ H check , i, b such that BB 1 [i] = (id, (id, b)). We distinguish two cases:

• either ∀p . (p , b) / ∈ BB: in that case, by definition of LL , i ∈ LL . Hence, since LL is a sublist of LL , i ∈ LL and the claim holds.

• or there exists j such that BB[j] = (p , b) for some p . In that case, by construction of LL, we have LL[j] = i, and thus LL [j] = i.

In any case, the claim holds, which concludes the proof.

B.5.6 Conclusion on Helios without revote

Theorem B.24. Assume Helios, with no revote allowed, is strongly consistent, has non-malleable ciphertexts, that the proofs of correct tallying are zero-knowledge, that different random oracles are used for these proofs and the rest of the protocol, and that the counting function ρ is id-blind. Then Helios securely implements the ideal functionality F del,reorder,change v (ρ), when considering only environments that do not make voters revote.