ouverture 950316 497031 + poison 950316 497031 + fermeture xiv Le livreur retourne ensuite voir Bob et lui donne la livraison piégée, et ce dernier la croit sûre à cause de la présence de son mot de passe et mange le gâteau empoisonné. Donc : Propriété ((in)securité du protocole de livraison de gâteaux V3) Si le livreur a un complice parmi les clients d'Isabelle, il peut empoisonner Bob même si Bob et Isabelle utilisent V3 et que Bob ne veut accepter que des gâteaux d'Isabelle. Une contre-mesure naturelle est que le client mette la note avec son nom à l'intérieur du coffre, à côté du mot de passe, pour empêcher le livreur de le modifier. En appelant V4 cette version finale pour protocole, DeepSec est parvenu à démontrer en quelques secondes (sur un ordinateur personnel) qu'il n'existait aucune attaque impliquant jusqu'à 9 rôles (un rôle étant soit un client commandant un gâteau, soit Isabelle répondant à une commande). Bien que cela n'exclue pas des potentielles attaques impliquant plus de rôles, on peut observer que les attaques sur les protocoles réels ne requièrent habituellement pas plus de 3 ou 4 rôles, donnant Nous vous offrons un gâteau en remerciement de votre fidélité. Vous pouvez l'obtenir en initiant une session de V4 avec nous. -La pâtisserie d'Isabelle de la valeur à cette guarantie de sécurité. Isabelle peut donc à présent offrir un gâteau à Bob en lui demandant d'initier une session du protocole avec sa pâtisserie. Naturellement, le livreur pourrait alors effectuer une attaque par hameçonnage (phising attack ), la technique préférée des spammeurs d'emails, en envoyant une fausse offre "Obtenez un gâteau gratuit en initiant une session de V4 avec nous ! (utilisez notre cadenas joint à ce message). La pâtisserie d'Isabelle" en joignant son propre cadenas à la lettre. Notre garantie de sécurité n'est donc effective que si Bob suit toujours strictement le protocole, en particulier s'il utilise uniquement des cadenas fournis par l'organisation comme demandé (et pas des cadenas fournis par des tierces parties).

2 Vérification des protocoles de sécurité

Lien avec l'énigme

Bien que cette thèse n'ait pas été motivée en premier lieu par la livraison de gâteaux, son cadre a des points communs avec l'histoire d'Isabelle et Bob. Elle étudie les protocoles de sécurité, des séquences d'instructions exécutées en parallèle par différentes entités s'envoyant et recevant des données. Ces protocoles apparaissent dans nos connexions quotidiennes au réseau 3/4/5G mais aussi dans le paiement en ligne, le vote électronique, ou même les puces RFID des passeports électroniques. Tous ces exemples partagent deux caractéristiques importantes :

Gmpsjbo

Cpsjt

Njhvfm

Fmfob Qfqf

t = n ∑ i = 1 t i f = f n 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 + ℙ [ | 1 N N ∑ i = 1 t * ( m i ) IM D E A U◢ft!ubs "
Ns/!Dpdipo-! u◢ft!ubs "

Kpboof Tpsz Mpvjtf c c c c

Introduction générale

Note for English readers. An English version of this introduction can be found in p.7. The body of the dissertation is written in English as well.

Question. En se servant de ces cadenas, comment transférer le gâteau depuis la pâtisserie d'Isabelle à la maison de Bob sans risque ?

Du gâteau avant toute chose

La difficulté de l'énigme est que, bien qu'Isabelle et Bob aient tous deux un cadenas, ils ne peuvent pas ouvrir celui de l'autre. Isabelle pourrait mettre le gâteau dans un coffret, le verrouiller, et envoyer la clé à Bob plus tard; cependant le livreur pourrait alors obtenir à la fois le coffre verrouillé et sa clé, ce qui lui permettrait de l'ouvrir. Il faut donc trouver une solution où Isabelle et Bob gardent toujours leur clé sur eux. ix x Une première solution Un moyen de s'en sortir est de combiner les deux cadenas comme suit. Dans un premier temps, Isabelle met le gâteau dans un coffre, le verrouille avec son cadenas, et demande au livreur d'apporter le tout à Bob : Pour l'instant le livreur ne peut pas manger le gâteau, mais Bob ne peut pas non plus ouvrir le coffre. Ce dernier ajoute alors son propre cadenas au coffre de manière à ce qu'il soit verrouillé par les deux, puis retourne le colis à Isabelle : À la réception du coffret, Isabelle y retire son propre cadenas et le renvoie :

Bob reçoit alors le gâteau dans un coffre scellé uniquement par son propre cadenas et peut donc le récupérer. Aucune clé n'a été envoyée durant le procédé et il y avait toujours au moins un cadenas sur les différents colis donnés au livreur. Nous obtenons donc : Propriété (sécurité du protocole de livraison de gâteaux) Le livreur ne peut pas manger un gâteau qu'Isabelle veut envoyer à Bob en utilisant ce protocole.

... mais est-ce réellement le cas ? Il y a en fait de nombreuses façons pour le livreur de récupérer le gâteau, la plus directe étant de forcer les cadenas avec les outils appropriés. La propriété ci-dessus repose donc sur des hypothèses implicites sur le livreur :

1 cadenas parfaits: le livreur ne peut pas forcer les cadenas ou obtenir des morceaux de gâteau à travers de potentielles fissures dans le coffret (ce qui permettrait de manger une partie du gâteau sans avoir à forcer quoi que ce soit). 2 sûreté des clés: il ne peut pas s'introduire chez Isabelle ou Bob pour voler leurs clés.

3 Passivité: malgré sa gourmandise, il ne ment jamais au destinataire d'un colis à propos de son contenu, c'est-à-dire, il suit le flot du protocole sans essayer activement de le perturber.

Sans ces trois hypothèses, le protocole n'offre a priori pas la sécurité attendue. Mais sont-elles réalistes ? Est-il possible de protéger le gâteau sans (certaines d'entre) elles ? xi Contre un livreur actif À partir de maintenant, disons que les cadenas et le coffre sont de très bonne qualité et que les clés sont bien gardées chez Isabelle et Bob. Concrètement, cela signifie que nous conservons les deux premières hypothèses ; en d'autres termes nous nous concentrons sur la structure logique du protocole plutôt que sur la solidité du matériel de sécurité. Mais même dans ce contexte, le protocole offre relativement peu de garanties car il repose fortement sur la passivité du livreur -qui peut être irréaliste si, par exemple, les gâteaux d'Isabelle valent particulièrement cher. Un livreur pourrait par exemple activement perturber la sécurité du protocole en achetant son propre cadenas et en procédant comme suit. Tout d'abord, Isabelle encoffre le gâteau avec son cadenas comme d'habitude. Mais ensuite le livreur dévie de ses instructions : au lieu de livrer le colis à Bob, il ajoute son propre cadenas dessus et le retourne à Isabelle.

N'ayant pas conscience qu'il ne s'agit pas du cadenas de Bob, Isabelle pense que le protocole suit son cours sans problème particulier. Elle retire donc son cadenas et demande au livreur de l'apporter à Bob : La situation finale est alors la suivante : Isabelle n'a rien remarqué de particulier et le livreur peut déverrouiller le coffre avec sa propre clé. Cette attaque contre la sécurité du gâteau n'a nécessité de forcer aucun cadenas, elle exploite simplement une brèche dans la structure du protocole.

Corriger le protocole Il est en fait presque impossible de concevoir un protocole résistant au vol dans le contexte d'un livreur actif avec ce système de cadenas. Isabelle et ses clients décident donc de souscrire à une organisation à grande échelle de cadenas publics : 1 tout membre de l'organisation se voit remettre une clé personnelle; 2 toute personne peut obtenir auprès de l'organiation un cadenas ne pouvant être ouvert que par la clé d'un membre spécifique.

Un protocole simple de livraison de gâteaux (V2) est alors le suivant : Isabelle met le gâteau dans un coffre verrouillé avec un cadenas que seul Bob peut ouvrir (obtenu auprès de l'organisation), et Bob le déverrouille avec sa clé personnelle. En supposant que les cadenas de l'organisation ont les propriétés prétendues, nous avons cette fois :

Propriété (sécurité du protocole de livraison de gâteaux V2)

Un livreur ne peut pas manger un gâteau qu'Isabelle veut envoyer à Bob en utilisant V2. -La pâtisserie d'Isabelle Usurpation d'identité L'histoire ne s'arrête cependant pas là. Étant au fait du goût de Bob pour les gâteaux d'Isabelle, un ennemi à lui se procure un cadenas ne pouvant être ouvert que par Bob, et l'utilise pour lui envoyer un gâteau empoisonné avec le message "Nous vous offrons ce gâteau en remerciement de votre fidélité. La pâtisserie d'Isabelle". Bob le mange, ce qui révèle une faiblesse du protocole : nous ne pouvons jamais être sûr que l'expéditeur d'une livraison est celui qu'il prétend être. Au retour de Bob de l'hôpital, Isabelle et lui decident de mettre à jour le protocole de livraison de gâteaux pour qu'il garantisse une forme d'authentification.

Nous supposons qu'Isabelle et son client (ici Bob) se sont procuré chacun de leur côté, auprès de l'organisation, des cadenas ne pouvant être ouverts que par l'autre (que l'on appellera le cadenas du client et le cadenas d'Isabelle, respectivement). Cette fois, le client est celui qui initie le protocole. Pour ce faire il écrit sur un bout de papier un (long) mot de passe de son choix qui servira à identifier sa commande. Il l'envoie ensuite à Isabelle dans un coffre scellé avec le cadenas de cette dernière, et joint une note au colis indiquant son nom pour qu'Isabelle sache à qui retourner la livraison : 950316 497031

B o b

À la reception du coffre, Isabelle lit le nom du client sur la note, ouvre le coffre avec sa clé, met le gâteau à l'intérieur à côté du papier où est écrit le mot de passe, puis scelle le tout avec le cadenas du client. Elle lui fait ensuite livrer le colis :

+ 950316 497031
Quand le client reçoit la commande, il vérifie que le gâteau est bien accompagné du même mot de passe qu'il a choisi initialement. Si ce n'est pas le cas il reste prudent, et détruit le gâteau au cas où il serait empoisonné. Si nous appelons V3 cette nouvelle version du protocole, nous voudrions qu'il ait la propriété suivante :

Propriété attendue (sécurité du protocole de livraison de gâteaux V3)

Un livreur actif ne peut ni manger un gâteau qu'Isabelle veut envoyer à Bob avec V3, ni empoisonner Bob s'il n'accepte de manger que des gâteaux qu'il pense être d'Isabelle.

Intuitivement, la sécurité repose sur le fait que, pourvu que le mot de passe choisi par Bob soit assez long et imprévisible, si quelqu'un tentait d'envoyer à Bob un gâteau empoisonné en xiii prétendant être Isabelle, il n'aurait qu'une probabilité négligeable de deviner le mot de passe par chance (et donc de faire manger le gâteau piégé à Bob). Cependant, la situation devient petit à petit hors de contrôle : le protocole utilise de plus en plus de mécanismes de sécurité et, puisqu'il est difficile de prédire le comportement d'un livreur actif, il n'est pas évident de se convaincre que le protocole est réellement sécurisé -autrement dit, que nous n'avons pas négligé un potentiel déroulé des événements parmi l'infinité de ceux possibles.

Analyse assistée par ordinateur Au vu de la situation actuelle, argumenter informellement en faveur de la sécurité du protocole ne peut pas être satisfaisant -nous serions sûr d'oublier un potentiel scénario d'attaque. Nous suivons donc plutôt les deux principes suivants : 1 Un raisonnement rigoureux, explicitant les hypothèses de la situation et démontrant que la sécurité est bien effective, comme un théorème mathématique. 2 Une démonstration assistée par ordinateur : traiter un scénario d'attaque est faisable à la main mais, s'il faut en traiter des centaines, des erreurs de raisonnement ou des oublis de scénarios sont à prévoir à cause de la fatigue. Automatiser une partie du processus de démonstration permet de limiter ce problème d'endurance et ses conséquences.

La recherche a produit beaucoup d'outils automatisés permettant d'analyser la sécurité du protocole de livraison de gâteaux. Nous en développons dans cette thèse : DeepSec. Nous détaillerons plus tard ses fonctionnalités techniques, nouveautés et limitations, et comment il se compare à d'autres outils ; pour le moment donnons simplement les conclusions obtenues en l'utilisant pour analyser V3 : 1 Le protocole V3 est sûr pourvu que le livreur ne soit pas lui-même client de la pâtisserie (et n'ait pas de complices parmi eux). 2 Si le livreur est client ou a un complice, il peut empoisonner les autres clients.

Pour le second point, l'attaque trouvée par DeepSec peut être décrite comme suit. Le protocole commence comme d'habitude : Bob choisit un mot de passe, le place dans un coffre verrouillé, et écrit son nom sur une note jointe à la commande. En parallèle le livreur achète aussi un gâteau qui sera à récupérer plus tard à la pâtisserie. Il transmet alors la commande de Bob à Isabelle mais remplace le nom de Bob par le sien :

Ok, je le mets dans le coffre et le verrouille Bonjour, je viens pour la livraison de MON gâteau (commande de Bob)

Isabelle suit les instructions du protocole et met le gâteau dans le coffre (pensant que le mot de passe qui s'y trouve est celui du livreur), puis le referme avec le cadenas du livreur. Ce dernier peut donc l'ouvrir, empoisonner le gâteau, et le refermer avec le cadenas de Bob.

En particulier, tout comme dans l'énigme, les protocoles de sécurité sont conçus avec l'idée en tête qu'un message envoyé d'une entité A à une entité B peut être intercepté ou modifié pendant sa transmission à travers le réseau ; cela est souvent représenté théoriquement par xv une notion d'attaquant ou adversaire, c'est-à-dire, une entité abstraite contrôlant le réseau. Dans l'énigme, l'attaquant est le livreur puisqu'il est celui qui décide comment les colis sont distribués, et peut les modifier pour perturber activement le flot du protocole à son avantage. Les éléments sensibles à protéger de lui sont alors le gâteau et son intégrité (c'est-à-dire, le fait que les clients n'acceptent pas des gâteaux ayant été empoisonnés pendant la livraison).

Les coffres et cadenas qu'Isabelle et Bob utilisent pour entraver les actions de l'adversaire sont alors l'analogue des primitives cryptographiques, qui sont des outils mathématiques utilisés pour sécuriser les communications. Par exemple, les cadenas publics d'Isabelle et Bob correspondent au chiffrement à clé publique qui, intuitivement, permet de rendre un message inintelligible à toute personne exceptée une. Les cadenas utilisés dans la première variante de l'énigme (où les cadenas n'étaient pas disponibles publiquement) rappellent plutôt le chiffrement symétrique, où le chiffrement, i.e., le mécanisme rendant un message inintelligible, nécessite aussi de posséder la clé.

Morale(s) de l'histoire

Bien que les protocoles de sécurité offrent des avantages notables à de nombreux utilisateurspar exemple le vote électronique peut faciliter l'accès à la démocratie aux personnes à mobilité réduite, aux expatriés ou aux militaires en opération extérieure -les communications par ordinateur ont aussi tendance à augmenter l'ampleur des conséquences des failles de sécurité, donnant lieu à des cyberattaques spectaculaires. Au vu de la nature sensible de l'information (économique, politique, médicale...) et le nombre important d'utilisateurs, il devient critique d'assurer que les protocoles de sécurité ne présentent pas de failles notoires. En particulier, nous pouvons tirer de l'expérience de l'énigme les principes de sécurité clés suivants :

Principe 1: le choix des capacités attribuées à l'attaquant est crucial.

Comme nous l'avons vu, considérer un attaquant réaliste est important : est-il actif ou passif ? Est-il capable de casser les primitives cryptographiques ? Peut-il compromettre les clés (en s'introduisant chez Bob) ? A-t-il des complices parmi les autres participants ? Tous ces choix ont des conséquences directes sur le fait qu'un protocole sera déclaré ou non comme sûr et, par conséquence, ont un impact sur la signification du fait qu'il soit déclaré comme tel.

Principe 2: analyser les protocoles de sécurité est complexe.

Du fait que de nombreux participants agissent en parallèle, nous obtenons différentes exécutions du protocole en fonction de l'ordre dans lequel ils réalisent leurs actions (par exemple dans l'énigme, livrer ou traiter plusieurs commandes dans un ordre différent induira un flot de messages différent). Il y a un nombre exponentiel de tels entrelacements des actions des participants. Ajoutant à cela les interférences arbitraires de l'adversaire actif, réaliser une analyse de sécurité devient un problème non trivial même pour des exemples simples comme le protocole de livraison de gâteaux (où chaque participant n'a qu'une ou deux instructions à exécuter) avec un nombre fixé de participants (comme nous l'avons fait lors de l'analyse de V4 avec DeepSec). Passer à des études de cas réelles nécessite de considérer bien plus de scénarios et est donc particulièrement hardu.

De plus, il y a une asymétrie inhérente au problème entre le but de l'adversaire (trouver au moins une faille du protocole à exploiter) et celui des concepteurs de protocoles (éviter toutes les failles du protocole), rendant la tâche de ces derniers d'autant plus difficile.

Principe 3: les analyses assistées par ordinateur peuvent aider.

Comme mis en valeur par l'attaque sur V3 trouvée par DeepSec, les points faibles subtils des protocoles sont plus facilement mis au jour par des analyses automatisées puisqu'elles considèrent de manière systématisée tous les scénarios possibles. Naturellement, lorsqu'un outil produit avec succès une preuve de sécurité, il est cependant toujours nécessaire de garder à l'esprit les hypothèses de l'analyse lors de l'interprétation du résultat (par exemple dans l'énigme, nous nous sommes uniquement concentrés sur les failles dans la structure logique du protocole en supposant que les coffres et cadenas étaient incassables).

Principe 4: une attention particulière est nécessaire lors de la modélisation du protocole.

La façon dont le protocole et la notion de sécurité à vérifier sont décrits peut aussi induire des hypothèses implicites. Dans l'énigme par exemple, il est facile de ne pas penser à modéliser la possibilité qu'un client puisse être un complice de l'attaquant, ce qui nous aurait fait passer à côté d'une faille de sécurité dans le cas de V3. Plus généralement, négliger certaines capacités de l'adversaire, restreindre le scénario d'attaque, ou inconsciemment supposer que certains participants du protocole sont honnêtes sont des travers relativement courants lors de l'étude des protocoles de sécurité.

Dans cette thèse : vérification symbolique d'équivalences

Modèles symboliques Dans cette thèse nous nous intéressons à l'analyse des protocoles de sécurité à l'aide de modèles symboliques, dont l'approche est de représenter les protocoles en idéalisant les propriétés de certains mécanismes cryptographiques en jeu. Par exemple dans l'énigme, nous supposions que les coffres et cadenas étaient incassables, et que le mot de passe du client ne pouvait pas être deviné ; mais il n'est bien sûr pas stricement impossible que le livreur ait des outils assez puissants pour casser les cadenas ou qu'il parvienne à deviner un mot de passe de 100 caractères par chance. Notre approche cible donc les vulnérabilités dans la structure logique du protocole et laisse de côté celles causées par les imperfections de la cryptographie ou les détails techniques à un trop bas niveau d'abstraction. Typiquement, le système coffre-cadenas-clé va simplement être défini par sa fonction, c'est-à-dire, par le fait qu'un cadenas peut être ouvert par la clé correspondante. Nous exprimons cela par une règle de réécriture notée ouvrir(fermer(x, cadenas(k)), k) → x où 1 cadenas(k) représente un cadenas, obtenu de l'organisation, ne pouvant être ouvert que par la clé k ; 2 fermer(x, c) représente un objet x scellé dans un coffre verrouillé par le cadenas c ; 3 ouvrir(y, k) représente une tentative de déverrouiller un coffre y avec la clé k. Le comportement des cadenas et des coffres est idéalisé par l'absence d'autres règles, ce qui modélise une hypothèse que on ne peut rien faire d'autre à un cadenas que le déverrouiller avec la bonne clé (en particulier on ne peut pas le forcer).

Ce type de modèle trouve ses origines en 1981 avec les travaux fondateurs de Dolev et Yao [START_REF] Dolev | On the security of public key protocols[END_REF]. Une grande quantité de travaux théoriques leur a emboîté le pas, se concentrant sur la compréhension des limites exactes en terme de décidabilité et complexité du protocole pour des classes de protocoles particulières [DEK82, DLMS99, RT03, DLM04, CC05, KKNS14]. xvii Vraisemblablement en s'appuyant sur cette meilleure compréhension théorique du problème, de premiers prototypes automatisés d'analyse de sécurité dans ce context ont vu le jour, menant après plus de 30 ans de recherche active dans le domaine à des outils efficaces et matures tels que ProVerif [START_REF] Blanchet | Modeling and verifying security protocols with the applied pi calculus and proverif[END_REF] et Tamarin [START_REF] Schmidt | The TAMARIN prover for the symbolic analysis of security protocols[END_REF] -pour ne citer que les plus importants. Ces outils sont capable de vérifier de manière automatisée des modèles complets de protocoles et standards déployés à grande échelle, tels que le protocole TLS pour des connexions http sécurisées [BBK17, CHH + 17], le protocole de messagerie Signal [KBB17, CGCG + 18], des protocoles d'authentification du standard 5G [BDH + 18b], ou des protocoles déployés d'authentification à multi-facteurs [START_REF] Jacomme | An extensive formal analysis of multi-factor authentication protocols[END_REF].

Atteignabilité et indistinguabilité Les résultats mentionnés ci-dessus couvrent la vérification pour les notions de sécurité formalisées par des propriétés d'atteignabilité, c'est-à-dire, par des énoncés de la forme "il n'existe aucune exécution du protocole, impliquant potentiellement l'attaquant, menant à une situation où la sécurité est violée". Les deux exigences de sécurité de l'énigme peuvent être formalisées comme telles : En pratique, les propriétés d'atteignabilité sont suffisantes pour modéliser l'authentification et de multiples formes de la confidentialité, même dans des scénarios complexes avec différentes possibilité de compromission [START_REF] Basin | Know your enemy: Compromising adversaries in protocol analysis[END_REF]. Une autre manière classique de formaliser la sécurité est d'utiliser des propriétés d'indistinguabilité, qui expriment que l'adversaire ne peut pas faire la différence entre deux situations hypothétiques. Considérons par exemple : Manger un gâteau empoisonné rend un client normal malade ; si le gâteau n'est pas empoisonné rien ne se passe. Un client immunisé, lui, ne tombe jamais malade quoi qu'il mange. Si le protocole permet d'observer une différence entre ces deux types de clients, cela signifie qu'il existe une séquence d'actions du livreur permettant de faire manger un gâteau empoisonné à l'un d'entre eux. Pour paraphraser : le fait qu'il n'existe aucune action de l'adversaire permettant de distinguer ces deux situations est une autre manière de formaliser la résistance à l'usurpation d'identité du protocole de livraison de gâteaux. Il s'agit en réalité d'un fait général : les propriétés d'atteignabilité peuvent être simulées par des propriétés d'indistinguabilité comme ci-dessus. Cependant, l'utilisation de l'indistinguabilité permet également de formaliser des notions plus fortes de sécurité ; considérons par exemple les deux situations hypothétiques suivantes : Le fait que l'attaquant ne puisse pas faire de différence entre ces deux situations exprime une notion de sécurité plus forte que la résistance au vol : si le livreur a un moyen de manger le gâteau alors il saura naturellement s'il s'agit d'un gâteau au chocolat ou d'une tarte au pomme3 , mais la capacité à différencier ces deux situations englobe également des brèches plus subtiles (par exemple, la capacité de sentir ou voir un morceau du gâteau). Plus généralement, les notions de sécurité fondée sur l'indistinguabilité permettent d'exclure toute forme de fuite d'information, même partielle, de données sensibles.

Remarque: vérification de V4 Pour anlayser V4 avec DeepSec, nous avons utilisé une unique propriété d'indistinguabilité englobant les deux ci-dessus. Le fichier la décrivant dans la syntaxe de DeepSec peut être trouvée à [START_REF]DeepSec files used throughout this thesis[END_REF]. Nous nous réferrons au Chapitre 1 dans le corps de cette thèse pour plus de détails sur le cadre de l'outil, et au Chapitre 2 pour notre approche générale pour modéliser les protocoles et la sécurité. Pour des tutoriaux et le téléchargement de l'outil, voir https://deepsec-prover.github.io/.

Notons qu'avec une approche similaire, nous pourrions également formaliser l'anonymat du client en utilisant les deux situations suivantes : L'incapacité de l'adversaire à distinguer ces deux situations exprime qu'il ne peut pas inférer qui le commanditaire du gâteau livré est. Cela ne fait pas nécessairement grand sens dans le contexte de l'énigme où le livreur donne le gâteau en main propre au client, mais cela donne malgré tout un aperçu de comment formaliser l'anonymat dans d'autres protocoles.

Équivalences de processus Il est commode de formaliser l'indistinguabilité par des équivalences observationnelles dans des calculs de processus cryptographiques comme le pi calcul appliqué [ABF17] -un modèle symbolique classique de protocoles que nous utiliserons tout xix le long de cette thèse. Comme vu ci-dessus elles peuvent être utilisées pour modéliser différentes forme de secret en terme de non-interférence ou comme une expérience de pensée "real-or-random". Les équivalences sont aussi l'outil de choix pour formaliser le respect de la vie privée de manière générale. Cela inclut, pour ne citer que quelques exemples : 1 l'anonymat [START_REF] Abadi | Private authentication[END_REF] : l'adversaire peut-il obtenir des informations sur les identités des participants du protocole ? 2 la non-traçabilité [ACRR10, FHMS19]: l'adversaire peut-il tracer différentes sessions d'un même utilisateur ? (par exemple pour tracer l'utilisateur d'un passeport électronique) 3 confidentialité du vote [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF]: lors d'une élection électronique, l'avdersaire peut-il apprendre plus d'information sur le vote d'un participant que ce qui est déjà révélé par le résultat de l'élection ? Les propriétés à base équivalence, instances de ce qu'on appelle des hyperpropriétés, sont inhéremment plus complexes que celles fondés sur l'atteignabilité. Leur compréhension théorique et l'automatisation de leur analyse sont en particulier plus récentes et plus fragiles. Cet état de fait a motivé un grand nombre de travaux récents -dont cette thèse -afin d'en améliorer la prise en charge.

Restrictions La plupart des notions de sécurité sont cependant indécidables en général et des restrictions sont donc nécessaires pour obtenir des résultats de décidabilité (ou en terme d'implémentation : pour obtenir des outils entièrement automatisées dont l'analyse finit toujours par terminer). La plupart des résultats de cette thèse sont énoncés dans le contexte suivant : 1 processus bornés : le nombre de participants du protocole (ou, alternativement, le nombre de sessions du protocole exécutées en parallèle) est fixé, comme cela était le cas dans notre analyse de V4 au cours de l'énigme ; 2 nous considérons uniquement des primitives cryptographiques pouvant être représentées par un système de réécriture constructeur-destructeur et sous-terme convergent (ce que nous définirons plus tard, dans le corps de cette thèse). La restriction à des processus bornés a été introduite dans [START_REF] Rusinowitch | Protocol insecurity with a finite number of sessions, composed keys is NP-complete[END_REF] pour étudier la décidabilité des propriété d'atteignabilité, démontrant qu'elle était NP complète si le nombre de sessions du protocole était un paramètre du problème. Cela donne un aperçu intéressant de la complexité du problème malgré son indécidabilité dans le cas non-borné, tout en restant non trivial à cause de la présence de l'attaquant actif. Cette restriction à des processus bornés permet typiquement d'obtenir des résultats de décidabilité et de complexité pour les propriétés d'équivalence dans cette thèse.

Modèles calculatoires Bien que nous ne fournissions pas de nouveaux résultats pour eux, nous pouvons mentionner les modèles calculatoires pour comparaison. Aussi introduits dans les années 80 (voir par exemple Goldwasser et Micali [START_REF] Goldwasser | Probabilistic encryption[END_REF]), ces modèles proposent une approche plus précise de la cryptographie, prenant en compte les probabilités. Par exemple, plutôt qu'un résultat booléen "sûr/pas sûr" comme ceux que nous fournissons dans l'analyse symbolique du protocole de livraison de gâteaux, une analyse calculatoire va tenter de borner la probabilité que l'attaquant casse la sécurité du protocole (ce qui va prendre en compte la probabilité de deviner le mot de passe du client, de casser les cadenas...). xx L'analyse obtenue est donc plus complète au sens où elle prend plus de détails en compte, mais est également significativement plus difficile à automatiser. Notons cependant que nous avons dans certains contextes des résultats de validité calculatoire (computational soundness), autrement dit des preuves symboliques impliquant des preuves calculatoires [START_REF] Cortier | A survey of symbolic methods in computational analysis of cryptographic systems[END_REF]. La plupart des formalisations de la sécurité que nous proposons dans cette thèse sont en fait inspirées de définitions calculatoires, adaptée dans le monde symbolique en abstrayant les probabilités et en idéalisant la cryptographie.

3 Résumé des contributions 3.1 Partie I : Modèles symboliques de la protection de la vie privée dans les protocoles cryptographiques

Dans la Partie I de cette thèse, nous introduisons le modèle des protocoles de sécurité que nous utiliserons (Chapitre 1) et montrons à travers quelques exemples comment l'utiliser en pratique (Chapitre 2). Nous y donnons également quelques rappels de théorie de la complexité.

Comme expliqué précédemment, notre approche peut être résumée par deux caractéristiques ; nous étudions : 1 les modèles symboliques, se concentrant sur la structure logique des protocoles ; 2 les propriétés d'équivalence qui sont l'outil de choix pour modéliser la préservation de la vie privée dans ce modèle. Plus précisément, nous modélisons les processus dans un dialecte du pi calcul appliqué [START_REF] Abadi | The applied pi calculus: Mobile values, new names, and secure communication[END_REF], un modèle symbolique de processus concurrents inspiré du pi calcul [START_REF] Milner | A calculus of mobile processes[END_REF] avec un attaquant actif et des primitives cryptographiques. Nous étudions plusieurs notions d'équivalence pour modéliser la sécurité : l'équivalence de trace et la bisimilarité labellée.

Dans le Chapitre 2, nous proposons quelques modèles de protocoles cryptographiques classiques, ainsi que des formalisations de différentes de leur guaranties de sécurité à l'aide de propriétés d'équivalence. Ce chapitre a plusieurs buts : 1 Fournir plusieurs exemples illustrant comment le pi calcul appliqué peut être utilisé en pratique, et qui serviront de référence pour les contributions des chapitres suivants. 2 Illustrer le fait que construire des modèles pour un nombre borné de sessions est parfois plus subtil que le faire dans le cas de l'atteignabilité. 3 Débattre des définitions de sécurité utilisées dans la littérature pour l'anonymat, la nontraçabilité et la confidentialité du vote, et en proposer dans le pi calcul appliqué.

Partie II : DEciding Equivalence Properties in SECurity protocols

Dans la Partie II, nous nous concentrons plus sur l'outil DeepSec, l'analyseur de protocoles que nous présentons dans cette thèse. Plus précisément, nous présentons : 1 dans les Chapitres 3 et 4, une procédure de décision théorique pour l'équivalence de trace et la bisimilarité labellée de processus bornés (pourvu qu'ils n'utilisent que des primitives cryptographiques pouvant être représentées par un système de réécriture constructeurdestructeur et sous-terme convergent) ; xxi 2 une implémentation de cette procédure de décision dans le cas de l'équivalence de trace et une évaluation de ses performances 4 (dans le Chapitre 3 également) ; 3 dans le Chapitre 5, une nouvelle technique de preuve pour l'équivalence de trace que nous appelons l'équivalence par session. Son but est d'exploiter les symétries des processus qui sont monnaie courrante en pratique, ce qui nous a permis de réduire le temps de vérification de DeepSec de plusieurs ordre de magnitude sur plusieurs exemples.

Partie III : Un guide pour la complexité des équivalences

Pour conclure en Partie III, nous contribuons à une meilleure compréhension théorique du problème en démontrant des résultats de décidabilité et de complexité pour les propriétés d'équivalence, et en les intégrant dans une revue exhaustive des résultats similaires de la littérature. Plus précisément :

1 dans le Chapitre 6, nous démontrons la terminaison de l'algorithme de DeepSec et montrons que le problème qu'il résout est coNEXP complet ; 2 dans le Chapitre 7 nous dépeignons l'état de l'art à travers une revue des résultats de décidabilité et complexité pour les propriétés d'équivalences (pour des processus bornés comme non-bornés). Cela inclut de nouveaux résults que nous démontrons ou améliorons, et un effort de présenter tous les résultats dans un modèle unifié -ce qui nous a permit d'identifier des variations subtiles dans la façon de définir les problèmes à travers la littérature.

1 [START_REF] Cheval | DEEPSEC: Deciding equivalence properties in security protocols theory and practice[END_REF] présente nos résultats de décidabilité et de complexité au coeur de DeepSec, ce qui correspond donc au contenu des Chapitres 3,4,6. Notons cependant que les performances de DeepSec et la présentation de la théorie ont été significativement améliorées depuis cette publication. 2 [CKR18b] présente les aspects pratiques de DeepSec avec un accent sur l'effort d'ingénierie déployé. Comme ci-dessus, les performances et l'interface utilisateur a significativement évolué depuis lors. 3 [CKR19] décrit l'optimisation présentées dans le Chapitre 5, bien que la version présentée dans ce manuscrit soit faite dans un cadre un peu plus général. [START_REF]Vincent Cheval est le contributeur majoritaire de cette implémentation[END_REF] Enfin, [CKR20] contient les résultats de décidabilité et complexité du Chapitre 7 sans changement significatif.

Les deux contributions supplémentaires [RK19, DLFP + 21] correspondent à des travaux annexes sur d'autres sujets avec d'autres contributeurs, se concentrant plus sur les conséquences de la façon dont les primitives cryptographiques et les protocoles sont implémentés. Elles ne correspondent pas à des chapitres de cette thèse.

General introduction

We motivate and introduce the research problem studied in this thesis, namely the automated verification of security protocols. But before anything, let us solve a little riddle which, surprisingly, nails down many key questions of this research field despite its playful tone; we will explicit the link with our contributions after that.

1 The greedy delivery guy riddle Isabelle Bob would like to buy a cake from a renowned backery run by Isabelle. The shop is too far away for him to go in person and he thus asks for a delivery. Unfortunately the delivery guy is notorious for being greedy: he tends to compulsively eat the cakes he should deliver during his errands. This is a tricky situation: Isabelle and Bob need the delivery guy but are also aware of the fact that he cannot be trusted.

After discussing the issue by phone, they realise that they both have locks at home, meaning that whenever they would need to rely on this untrusted postal service, they could put deliveries in locked chests to mitigate the risk of theft.

Question. How can we transfer the cake from Isabelle's bakery to Bob's house safely?

For the sake of a cake

The difficulty of the riddle is that, although Isabelle and Bob each have a lock, neither of them can open the other's. Isabelle could try to lock the chest and later send the key to Bob; however the delivery guy may then end up with both the locked chest and the key and could therefore open the former. A solution has to be found where both Isabelle and Bob keep their keys close to them.

A first solution A possible workaround is to combine the two locks as follows. First, Isabelle puts the cake in a chest, locks it, and asks the delivery guy to bring it to Bob: So far the delivery guy cannot eat the cake but Bob cannot open the chest either. Then Bob adds his own lock to the chest, so that it is locked with both, and sends it back to Isabelle:

Upon receiving the chest, Isabelle removes her own lock from it and sends it back:

Bob hence receives the cake only sealed by his own lock and can therefore recover it. No keys were sent during the process and there was always at least one layer of lock on the different chests given to the delivery guy. Therefore we have: Property (security of the cake-delivery protocol)

The delivery guy cannot eat a cake Isabelle is willing to send to Bob using this protocol.

... but is it really true? There are actually many ways for the delivery guy to obtain the cake, the most straightforward one being to force the locks with the appropriate tools. The above property therefore relies on implicit assumptions about the delivery guy: Without these these three assumptions, the security goal is a priori not achieved. But are they realistic? Is it possible to protect the cake even without (some of) them?

Against an active delivery guy We suppose that the locks and the chest are of very high quality and that the keys are well guarded, which means we keep the first two assumptions.

In other terms we focus on the logical structure of the protocol rather than the solidity of security equipment. But even then its security is quite weak: it heavily relies on the passivity assumption which may be unrealistic if, for instance, Isabelle's cakes are worth a very high price. A delivery guy could actively try to disrupt the protocol's security by, for example, buying his own lock and stealing the cake as follows. First, Isabelle locks her cake in the chest as usual. But then the delivery guy deviates from his instructions, not delivering the chest to Bob and putting his own lock on it instead, and bringing it back to Isabelle: Unable to tell that this is not Bob's lock, Isabelle thinks the protocol is proceeding fine. She therefore removes her lock from the chest and asks the delivery guy to bring it to Bob:

The final situation is then the following: Isabelle did not notice any problem and the delivery guy is able to unlock the chest with his own key. This attack on the cake's security did not require to force any lock, it simply exploits a breach in the structure of the protocol.

Patching the protocol Designing a theft-resistant protocol in the context of an active delivery guy is actually close to impossible with this system of locks. Isabelle and her clients therefore decide to subscribe to a large-scale organisation of public locks: 1 anyone in the organisation is given a personal key; 2 anyone can request a lock that can only be opened by the key of one specific member.

A simple cake-delivery protocol (V2) thus consists of Isabelle putting her cake in a chest and using a lock that can only be opened by Bob (obtained through the organisation). Assuming the locks of the organisation have the claimed properties, we have this time:

Property (security of the cake-delivery protocol V2) An active delivery guy cannot eat a cake Isabelle is willing to send to Bob using V2.

A darker riddle

We offer you this as a token of gratitude for your fidelity.

-Isabelle's Bakery

Impersonation This is however not the end of the story. Knowing that Bob likes Isabelle's cakes, an ennemy of him requests a lock that can only be opened by Bob, and uses it to send him a poisoned cake with the message "We offer you this as a token of gratitude for your fidelity. Isabelle's backery". Bob eats it which reveals one weakness of the protocol: we can never be sure that the sender of a delivery is the one they pretend to be. After Bob returns from the hospital, he and Isabelle decide to update the cake-delivery protocol as follows to provide a form of authentication.

We assume that both Isabelle and her client (Bob here) have obtained, from the organisation, locks than can only be opened by the other (referred to as the client's lock and Isabelle's lock, respectively). This time the client initiates the protocol. He writes on a piece of paper a (long) password of his choice that will serve to identify his command. Then he sends this paper to Isabelle inside a chest sealed with her lock, and joins a note to the locked chest indicating his name so that Isabelle can know who sending the delivery back to:

950316 497031

B o b

Upon receiving the chest, Isabelle reads the name of the client, opens the chest with her key, puts the cake inside next to the password paper, and eventually seals everything again with the client's lock. Then she sends everything back to the client:

+ 950316 497031
When the client receives the delivery, he checks that the cake is accompanied by the password that he put initially. If it is not the case he remains careful and destroys the cake in case it is poisoned. If we call V3 this new version of the protocol, we would like to have:

Expected property (security of the cake-delivery protocol V3)

An active delivery guy cannot eat a cake Isabelle is willing to send to Bob using V3, nor can he poison Bob if Bob is only willing to accept cakes he thinks are from Isabelle.

Intuitively the security relies on the fact that, provided the password chosen by Bob is long and unpredictable enough, if someone wants to send him a poisoned cake by pretending to be Isabelle, there is only a negligible probability that he will manage to guess the password by luck (and therefore to make Bob eat the poisoned cake). However, the situation is steadily getting out of control: the protocol is starting to involve many security mechanisms and since it is difficult to predict an active delivery guy's behaviour, it is becoming increasingly hard to convince ourselves that security holds-that is, that we have not overlooked one among the infinitely-many potential courses of action.

Automated analysis Regarding the current situation, informally arguing for the security of the protocol cannot be satisfying-we would be likely to forget a potential attack scenario. Instead, we rely on two principles: 1 A rigorous reasoning, expliciting the hypotheses of the situation and carefully proving that security holds like a mathematical theorem. 2 A mechanised proof : treating one attack scenario is feasible by hand but reasoning mistakes and missing scenarios are to be expected due to fatigue when treating hundreds of them. Automating part of the proof process mitigates this stamina issue and its consequences.

There exist many automated tools that would permit to study the security of the cake delivery protocol. We develop one in this thesis: the DeepSec prover. We will detail later the technical features, novelties and limitations of the tool and how it compares to other similar analysers; for now let us simply give the conclusions we obtained by using it to analyse V3: 1 The protocol V3 is secure provided the delivery guy is not one of the clients of the backery (and has no accomplices among them). 2 If the delivery guy is a client or has an accomplice, he can poison other clients.

For the second point, the attack found by DeepSec can be described as follows. The protocol starts as usual with Bob choosing a password for his command to Isabelle, putting it in a locked chest, and writing his name on a note attached to the order. In parallel the delivery guy also purchases a cake to be picked later at the backery. He then forwards Bob's command to Isabelle but replaces Bob's name by his own:

Ok, I put your cake inside and lock it Hello, I come for the delivery of MY cake (Bob's order)

Isabelle follows the instruction of the protocol and removes her lock, puts the cake in the chest (thinking that the password comes from the delivery guy), and locks the chest with the delivery guy's lock. He can therefore open it, poison the cake, and relock it with Bob's lock. Eventually he comes back to Bob and gives him the poisoned delivery, who believes it to be safe due to the presence of his password and eats the poisoned cake. Therefore: Property ((in)security of the cake delivery protocol V3)

If the delivery guy has an accomplice among Isabelle's clients, he can poison Bob even if Bob and Isabelle use V3 and Bob is only willing to accept cakes from Isabelle.

A natural patch is to make the client put his name inside the chest, next to the password, to prevent the delivery guy from modifying it. If we call V4 this final version of the protocol, DeepSec managed to prove in a few seconds (on a personal computer) that there existed no

We offer you a cake as a token of gratitude for your fidelity. You can get it by initiating a session of V4 with us.

-Isabelle's Bakery attack scenarios involving up to 9 parallel roles (one role being either a client ordering a cake or Isabelle answering to a command). Although this does not exclude potential attacks involving more roles, we observe that attacks in real protocols usually require no more than 3 or 4 roles, giving worth to this security guarantee. Isabelle can now send a gift cake to Bob by requesting him to initiate a session of the protocol with her backery. Naturally the delivery guy could do a phishing attack, the favourite one of email spammers, by sending a fake gift message "You can get your free cake by initiating a session of V4 with us! (use our lock attached to this message). Isabelle's backery" and joining his own lock to the letter. Our security statements hence assume that Bob always sticks to the protocol, that is, that he only uses locks provided by the organisation as required.

2 Verification of security protocols

Link with the riddle

Although this thesis has not been primarily motivated by sending cakes, it has some common ground with the story of Isabelle and Bob. We study security protocols that are sequences of instructions concurrently executed by different entities sending and receiving data to each others. These protocols include our everday connections to the 3/4/5G network but also online payment, electronic voting, or even the RFID chips on electronic passports. All these examples share two important characteristics:

1 the data sent during communications is sensitive, a lack of confidentiality or integrity has economical or political consequences (think about online payments or electronic elections); 2 the protocols are operated over untrusted networks such as the Internet: anyone could use an antenna to spy on communications, or even interfere with them.

In particular, just as in the riddle, security protocols are designed with the idea in mind that a message sent from an entity A to an entity B may be intercepted or modified during its transmission through the network; this is often modelled by a notion of attacker or adversary, that is, an abstract entity controlling the network. In the riddle, the attacker is the delivery guy as he is the one to decide how messages are distributed and may modify them to actively disrupt the protocol's flow to his advantage. The sensitive assets to be protected from him are then the cake and its integrity (i.e., the fact that clients do not accept cakes that have been poisoned during the delivery).

The chests and locks that Isabelle and Bob use to impede the actions of the adversary are then the analogue of cryptographic primitives, that are mathematical tools used to secure communications. For example the public locks of Isabelle and Bob correspond to publickey encryption which intuitively makes a message unintelligible to anyone except one chosen person. The locks used in the first variant of the riddle (where the locks are not publicly available) rather recall symmetric encryption, where encryption, i.e., the mechanism rendering a message unintelligible, also requires to possess the key.

Takeaway message(s)

Although security protocols provide significant benefits to many users-for instance electronic voting can ease the access to democracy to disabled people, foreign nationals or militaries in field operations-computer communications also tend to increase the scalability of vulnerabilities, giving rise to spectacular cyberattacks. Due to the sensitive nature of the information (economical, political, medical...) and the huge number of users, this makes it critical to ensure that security protocols are not breached. In particular, looking back at the riddle, we can exhibit the following core security principles:

Takeaway 1: identifying the threat model is crucial.

As we have seen, considering realistic capabilities for the adversary is important: is he passive or active? Is he able to break the cryptographic primitives? Can he compromise keys (by breaking into Bob's house for example)? Does he have accomplices among the other participants? This has direct consequences on whether the protocol will be deemed secure or not and, subsequently, impacts the interpretation of a potential conclusion that it is so.

Takeaway 2: analysing security protocols is complex.

Due to the fact that many participants operate in parallel, depending on the order they act, we obtain different executions of protocol (for example in the riddle, delivering and treating several commands in a different order yields a different flow of messages). There are exponentially many such interleavings of the participant actions. Adding the arbitrary interferences of the active adversary to the equation, security analysis becomes a non-trivial problem even for simple examples such as the cake delivery protocol (where each participant only has 1 or 2 instructions to execute) with a fixed number of participants (like we did when analysing V4 with DeepSec). Scaling to real-world case studies requires to consider much more involved scenarios and is therefore particularly challenging.

Besides there is an inherent asymmetry between the goal of the adversary (finding at least one flaw of the protocol to exploit) and the goal of the protocol designers (avoiding all flaws of the protocol) which makes the task of the latter harder.

Takeaway 3: automated tools can help.

As shown by the attack on V3 found by DeepSec, the subtle weak points of protocols are more easily discovered by automated tools as they systematically consider all possible scenarios. On the contrary when a tool successfully produces a security proof, we should always keep in mind the hypotheses of the model when interpreting the result (in the riddle for example, we only focused on weaknesses of the logical structure of the protocol by assuming the chest-lock system to be unbreakable).

Takeaway 4: particular care is needed when modelling the protocol and security properties.

How we describe the protocol and the security property to be verified can also induce some implicit hypotheses. In the riddle for example, one may easily forget to model the possibility that a client could be an accomplice of the attacker, which would have made us miss a security breach in the case of V3. More generally, overlooking some capabilities of the adversary, restricting the attack scenario, or unconsciously assuming that some protocol participants are honest are rather common pitfalls when studying security protocols.

In this thesis: symbolic verification of equivalence properties

Symbolic models In this thesis we are interested in the analysis of security protocols relying on symbolic models, that are representations of the protocols idealising the properties of some cryptographic mechanisms in play. For example in the riddle, we assumed the chests and locks to be unbreakable and the client passwords to be unguessable; but of course it is not strictly impossible that the delivery guy has tools powerful enough to break the locks, or manages to guess a 100-character password by luck. Our approach therefore searches for vulnerabilities in the logical structure of the protocol and overlooks those caused by the imperfection of cryptography or implementation details. Typically, the chest-lock-key system is simply defined by its functional properties, that is, by the fact that a lock can be opened by the corresponding key. We express this by a rewrite rule written unlock(lock(x, publicLock(k)), k) → x where 1 publicLock(k) models the lock obtained from the organisation and unlocked by the key k; 2 lock(x, l) models an object x sealed in a chest locked with l; 3 unlock(y, k) models an attempt to unlock a chest y with a key k. The absence of other rules to define the behaviour of locks and chests models an idealising assumption than nothing else can be done to a lock except opening it with the right key (in particular it cannot be forced open).

These kinds of models can be traced back to 1981 with the seminal work of Dolev and Yao [START_REF] Dolev | On the security of public key protocols[END_REF]. A large amount of theoretical follow-up work focused on understanding the precise limits of decidability and the computational complexity of particular protocol classes [DEK82, DLMS99, RT03, DLM04, CC05, KKNS14]. Arguably by building on this better theoretical understanding of the problem, some first automated prototypes for security analysis in this context arose, leading after more than 30 years of active research in the field to efficient and mature tools such as ProVerif [START_REF] Blanchet | Modeling and verifying security protocols with the applied pi calculus and proverif[END_REF] and Tamarin [START_REF] Schmidt | The TAMARIN prover for the symbolic analysis of security protocols[END_REF] to only cite the most prominent ones. These tools are able to automatically verify full fledged models of widely deployed protocols and standards, such as the TLS protocol for secure http [BBK17, CHH + 17], the Signal messaging protocol [KBB17, CGCG + 18], authentication protocols of the upcoming 5G standard [BDH + 18b], or deployed multi-factor authentication protocols [START_REF] Jacomme | An extensive formal analysis of multi-factor authentication protocols[END_REF].

Reachability and indistinguishability

The abovementioned results extensively cover verification for the class of reachability properties. Such properties formalise properties of the form "there exist no executions of the protocol potentially involving the attacker leading to a situation where security is broken". The two properties of the riddle can be formalised as such:

1 Theft resistance (or confidentiality of the chest's content): there exist no executions of the protocol permitting the delivery guy to eat the cake. 2 Resilience to impersonation (or authentication): there exist no executions of the protocol where Bob accepts a delivery that is not from Isabelle.

Reachability properties are indeed sufficient to model authentication properties and various flavors of confidentiality, even in complex scenarios with different kinds of compromise [START_REF] Basin | Know your enemy: Compromising adversaries in protocol analysis[END_REF]. Another classical class of properties are indistinguishability properties and express that the adversary cannot distinguish between two hypothetical situations. Consider for example: Upon eating a poisoned cake a normal client gets sick; if the cake is not poisoned nothing happens. On the contrary an immune client never gets sick whatever he eats. If the protocol can allow to observe a difference between these two types of clients, this means that there exists a sequence of actions of the delivery guy that can make one of them eat a poisoned cake. Rephrasing, the fact that no actions of the adversary can distinguish between these two situations is another way of formalising the resilience to impersonation of the cake delivery protocol. It is actually a general fact: reachability properties can be encoded as indistinguishability statements as above. However, indistinguishability can also be used to formalise stronger security notions; consider for example the two hypothetical situations:

Situation 2: apple pie Situation 1: chocolate cake A client orders a cake from Isabelle.

The indistinguishability of these two situations expresses a property that subsumes theft resistance: if the delivery guy has a way to eat the cake then he can of course tell whether it is a chocolate cake or an apple pie5 , but the ability to distinguish them also captures more subtle breaches (for example, the delivery guy being able to smell or see a portion of the cake). More generally, indistinguishability statements allow to express stronger security notions that aim at excluding any form of partial information leakage on sensitive data.

Remark: verification of V4

When we used DeepSec to analyse the security of V4, we verified a single indistinguishability property embedding the above two. The file describing it in DeepSec's syntax can be found at [START_REF]DeepSec files used throughout this thesis[END_REF]. We refer to Chapter 1 in the body of the thesis for more details about DeepSec's framework and to Chapter 2 for more insight on our modelling approach. For tutorials and downloading the tool, see https://deepsec-prover.github.io/.

With the same approach, we could also formalise anonymity using the two situations: The inability to distinguish between the two situations models that the adversary cannot infer what the identity of the client is. This arguably does not make much sense in the context of the riddle where the delivery guy gives the cake to the client in person, but still gives some insight on how to model anonymity in other protocols.

Process equivalences Indistinguishability properties are conveniently modelled as observational equivalences in a cryptographic process calculus, such as the applied pi calculus [ABF17]-a classical symbolic model of protocols that we will use in this thesis. Similarly as above they can be used to model strong flavors of secrecy in terms of non-interference or as a "real-or-random" experiment. Equivalences are also the tool of choice to model many other privacy-preserving properties. To cite a few, such properties include: 1 anonymity [AF04]: is the adversary able to obtain some information about the identities of the participants of the protocol? 2 unlinkability [ACRR10, FHMS19]: is the adversary able to track multiple sessions of a user? (typically to track users of e-passport) 3 vote privacy [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF]: in an electronic election, is the adversary able to learn more information on a participant vote than what is already revealed by the result of the election? Equivalence properties, instances of so-called hyperproperties, are inherently more complex than reachability properties. Both the theoretical understanding and tool support are thus more recent and more brittle. This state of affairs triggered a large amount of recent worksincluding this thesis-to improve them.

Modelling restrictions Most security properties are however undecidable in general and some restrictions are therefore needed when aiming at decidability results (or in terms of implementation: at fully automated tools with guaranteed termination). Most of the results of this thesis are provided in the following context: 1 bounded processes: the number of protocol participants (or alternatively, the number of parallel protocol sessions) is fixed, similarly to our security analysis of V4 in the riddle; 2 we only consider cryptographic primitives that can be represented by constructor-destructor subterm convergent rewriting systems (to be defined in the body of the thesis).

The restriction to bounded processes has been introduced in [START_REF] Rusinowitch | Protocol insecurity with a finite number of sessions, composed keys is NP-complete[END_REF] when proving reachability properties to be decidable and NP complete if the number of protocol sessions is a parameter of the problem. This gives an interesting insight on the complexity of the problem despite its undecidability in the unbounded case, while remaining non-trivial due to the presence of the active attacker. This restriction to bounded processes typically allows us to obtain decidability and complexity results for equivalence properties in this thesis.

Computational models Although we do not provide new results for them, we can also mention computational models for comparison. Also first considered in the 80's (see for example Goldwasser and Micali [START_REF] Goldwasser | Probabilistic encryption[END_REF]) these models propose a more precise approach of cryptography, taking probabilities into account. For example instead of a boolean "secure/not secure" result as we provide in the symbolic analysis of the cake delivery protocol, a computational analysis attempts to bound the probability of the attacker breaching security (which takes into account the probability to guess the client password, to break the locks...).

The resulting analysis is therefore more complete in that it takes more details into account, but is also much harder to automate. Note however that in some contexts we have computational soundness, namely symbolic proofs imply computational proofs [START_REF] Cortier | A survey of symbolic methods in computational analysis of cryptographic systems[END_REF]. Most of the formalisations of security we propose in this thesis are actually inspired by computational definitions, cast in the symbolic model by abstracting probabilities and idealising cryptography.

Outline of the contributions

Part I: Symbolic models of privacy in cryptographic protocols

In the Part I of this thesis we introduce the model of security protocols we use (Chapter 1) and demonstrate through some examples how to use it in practice (Chapter 2). We also provide some reminders of complexity theory. As previously explained our approach can be summed up by two main characteristics: 1 we study symbolic models focusing on the logical structure of protocols; 2 we study equivalence properties that are the tool of choice to model privacy in this model.

More technically we model processes in a variant of the applied pi calculus [ABF17], a symbolic model of concurrent processes inspired by the pi calculus with an active attacker and support for cryptographic primitives. We study several notions of process equivalences for modelling security, namely trace equivalence and labelled bisimilarity.

In Chapter 2 we then propose some models of classical cryptographic protocols within our model, as well as formalisations of various privacy-type properties using equivalence properties. This chapter has several goals: 1 Providing some examples that illustrate how the applied pi calculus can be used in practice and will serve as benchmarks for our verification techniques in the next chapters. 2 Illustrating the fact that writing models for a bounded number of sessions is sometimes more subtle than doing it for reachability properties. 3 Debating the security definitions used in the literature in the context of anonymity, unlinkability and vote privacy, and proposing some models of them in the applied pi calculus.

Part II: DEciding Equivalence Properties in SECurity protocols

In Part II we then focus on the DeepSec prover, the protocol verifier we present in this thesis. More precisely, we present: 1 in Chapters 3 and 4, a theoretical decision procedure for trace equivalence and labelled bisimilarity of bounded processes (provided they only use cryptographic primitives that can be represented by a constructor-destructor subterm convergent rewriting system); 2 an implementation of this decision procedure in the case of trace equivalence and an evaluation of its performances6 (in Chapter 3 as well); 3 in Chapter 5, a new proof technique for trace equivalence that we call equivalence by session.

Its goal is to exploit the process symmetries that often arise during practical verification, allowing us to increase the efficiency of DeepSec by orders of magnitude.

Part III: A guide to the complexity of equivalences

Finally in Part III we also contribute to the theoretical understanding of the problem by proving decidability and complexity results for equivalence properties and by integrating them in an exhaustive survey similar results of the literature. More precisely:

1 in Chapter 6 we prove the termination of the algorithm of DeepSec and show that the problem it solves is coNEXP complete;

The additional two contributions [RK19, DLFP + 21] correspond to side work on other topics with different contributors, focusing more on the security implications of how cryptographic primitives and protocols are implemented. They do not correspond to chapters of this thesis. on information leakage due to the execution time of programs. We provide in this paper an attacker model more suited for explaining and understanding practical timing attacks, studying more particularly attack strategies by divide-and-conquer. We formalise sufficient condition for them to be correct under the form of independence statements and study their complexity. 6 I also intermittently participated to a long-time effort for a security analysis of the QUIC protocol in [DLFP + 21], carried among others by Microsoft Research. QUIC is a protocol initially proposed by Google in 2012 and that is currently under standardisation by the IETF. Although the initial motivation of the IETF was to design the protocol so that it inherits security properties from TLS 1.3 (which required years of work to prove), many TLS abstractions were broken in the process, resulting in a new protocol with new cryptographic constructions but few security insights on them. I contributed to prove in the F proof assistant some functional properties of the QUIC transport and study privacy issues due to the weak authentication of some transport parameters.

Part I

Symbolic models of privacy in cryptographic protocols

Introduction

An analysis of the protocol's logic

In this first part of the thesis (Chapters 1 and 2) we introduce the model we use all along this thesis and present detailed examples that will serve as illustrations of the formalism as well as opportunities to discuss practical security modelling questions.

Concurrent processes

As security protocols are distributed by essence, concurrent process calculi such as the pi calculus [START_REF] Milner | A calculus of mobile processes[END_REF] are a natural fit for modelling them. However the calculus is quite minimal and the resulting models would therefore have to rely on complex, often unnatural or at least error-prone, encodings. This was the reason behind the design of more specialised extensions of the pi calculus including support for cryptography and an explicit model of an active attacker controlling the communication network. We can cite for example the spi calculus [START_REF] Abadi | A calculus for cryptographic protocols: The spi calculus[END_REF] which provides support for a fixed set of common primitives such as encryption and pairs; but we are here more interested in its later generalisation, the applied pi calculus [START_REF] Abadi | The applied pi calculus: Mobile values, new names, and secure communication[END_REF], that can handle in a more compact and uniform way arbitrary primitives using equational theories.

This kind of model is symbolic (by opposition to computational models) in that it abstracts probabilities to focus on the logical structure of protocols. Such models find their origin in the seminal work of Dolev and Yao in the 80's [START_REF] Dolev | On the security of public key protocols[END_REF]. A nonce, randomness or encryption key will be modelled by a so-called name that is assumed uncomputable by the adversary at the beginning of the protocol execution (which may change at some point during the execution since the adversary spies on the communication network and, therefore, may learn the value of this data from the flow of messages). The equational theories also abstract the behaviour of cryptographic primitives by a set of equations modelling their functional properties-and nothing more, which is an idealising assumption. This simplifying abstraction typically facilitates the automation of security analyses as we will see in Part II.

Equivalence properties Regarding the modelling of security properties, we are here interested in equivalence properties, typically used to model indistinguishability statements between two hypothetical situations. This kind of approach is well-suited for modelling various flavours of privacy-type properties such as (strong notions of) secrecy, anonymity, unlinkability, or even ballot privacy in the context of electronic voting. More precisely we will study a running example throughout Chapter 1 to illustrate the various notions we introduced in a simple context, and study more precise modelling concerns in Chapter 2 (including discussions on how to Part I: Symbolic models of privacy in cryptographic protocols capture an accurate notion of privacy without unconsciously restricting the potential attack scenarios). We study:

1 the private authentication protocol [START_REF] Abadi | Private authentication[END_REF] and study what kind of violations of authentication, anonymity, and secrecy can be uncovered using our approach; 2 the Basic Access Control (BAC) protocol [START_REF]PKI for machine readable travel documents offering ICC readonly access[END_REF] implemented in European e-passports with a focus on unlinkability; 3 a mixnet variant of the Helios e-voting protocol [START_REF] Adida | Helios: Web-based open-audit voting[END_REF] with a focus on ballot privacy.

In the three cases we evaluate in particular the importance of considering compromised sessions-namely sessions of the protocol executed by dishonest participants-and discuss the resulting security implications.

Chapter 1: Model: the applied pi-calculus

Summary.

This chapter details the model of cryptographic protocols we study in this thesis as well as the class of security properties we aim at verifying. Our formalism is strongly inspired by the applied pi-calculus [START_REF] Abadi | The applied pi calculus: Mobile values, new names, and secure communication[END_REF] focusing on the protocol's logic with idealised cryptography. We consider security properties that can be expressed using behavioural equivalences, typically different flavours of privacy.

NB. This chapter also includes some reminders of complexity theory (Section 4).

Cryptographic primitives and messages

Section summary

We first describe the model of cryptographic primitives and protocol messages. This is done using a term algebra, cryptographic properties being idealised a set of rewriting rules.

Term algebra

Function symbols Models such as ours are said to be symbolic in that they rely on a abstraction of the messages sent during a protocol execution. Rather than representing them as arbitrary bitstrings, this abstraction aims at capturing their structure and their functional properties (and only these). Concretely, a cryptographic primitive is represented by a function symbol f that has an arity n (i.e., the number of arguments it takes). The symbol is sometimes referred as f/n. A finite set of such symbols

F = {f/n, g/m, h/p, . . .} with a partition F = F c F d
is called a signature. The elements of F c are called constructors and those of F d destructors:

intuitively the latter will model functions that fail when their argument are not of a certain form (for example a decryption function that can only process valid ciphertexts). Symbols of arity 0 are specifically called constants and model public values such as agent identities or protocol tags. Since our goal is to study security in presence of an adversary with unbounded computational power, they may generate arbitrarily many constants to compute messages which is why we assume an infinite set of constants F 0 and we consider that F only contains 25 the symbols of positive arity for simplicity1 . On the other hand private values such as fresh nonces or long-term keys that are assumed unknown to third parties upon generation, are modelled by an infinite set of names N . Finally we may also use variables from an infinite set X that represent bound values. A message sent during a protocol is then represented by: Definition 1.1 (term)

A term is either a name, a variable, or a symbol of arity n applied to n other terms. The set of terms built from the values and functions of

A ⊆ F ∪ F 0 ∪ X ∪ N is written T (A). Besides if t ∈ T (A), we say that t is a constructor term if A ∩ F d = ∅, a ground term if A ∩ X = ∅, and a public term if A ∩ N = ∅.
Example 1.1 A signature F modelling symmetric encryption and pairs is usually written as follows

F = F c F d F c = {senc/2, , /2} F d = {sdec/2, fst/1, snd/1}
The symbols senc and sdec respectively model encryption and decryption, u, v models a pair of terms u and v that will intuitively be retrievable using the projection functions fst and snd. We also often use the common condensed notation u 1 , . . . , u n to refer to tuples of n nested pairs u 1 , u 2 , . . . , u n . The encryption of a plaintext m with a key k would then be modelled by the term senc(m, k). The fact that sdec is in F d rather than F c intuitively models that the function fails when its argument is not of the correct form, that is, when attempting to decrypt a message that is not an encryption, or an encryption with the wrong key. Putting it in F c instead will model that the decryption always returns a result. However in both cases this only models a deterministic encryption scheme: to include a randomness r ∈ N one may use a pair, i.e., consider the term senc( m, r , k). An alternative modelling of randomness consists of using dedicated symbols rsenc/3, rsdec/2 that include it as additional argument, leading to the ciphertext c = senc(m, r, k) decrypted as rsdec(c, k).

The set of variables (resp. names, subterms, strict subterms) of a term t is written vars (t) (resp. names(t), subterms (t), subterms = (t)); all these notations are extended to sets of terms in the natural way. When we want to refer to the specific subterm of t at position p (where p is a sequence of positive integers), we write t |p . The function symbol (or the variable or the name) at the root of a term t is written root(t).

Substitutions Given a variable x, we refer by t{x → u} to the term obtained by replacing all occurrences of x in t by the term u. More generally we call a substitution a mapping σ = {x 1 → u 1 , . . . , x n → u n }, where x 1 , . . . , x n are pairwise distinct variables and form the domain of σ written dom(σ), and u 1 , . . . , u n are terms and form the image of σ written img(σ). They are homomorphically applied to terms, that is, tσ is the term obtained by replacing all occurrences of x i in t by u i = x i σ. The term tσ is called an instance of t. Going further with the notations inspired from sets, we also write σ ⊆ σ to express that σ is an extension of σ, and σ ∪ σ the substitution of domain dom(σ) ∪ dom(σ ) that extends both σ and σ (provided they coincide on dom(σ) ∩ dom(σ )). The substitution ∅, i.e., the identity, is rather referred as . Finally we write σσ the composition σ • σ, i.e., for all terms t, tσσ = (tσ)σ .

Rewriting

Function symbols are only syntactic and it remains to model their properties, e.g., encryptiondecryption cancellation (i.e., the fact that sdec(senc(m, k), k) = m in Example 1.1). In this thesis we do this using a rewriting system R which is a finite binary relation on terms, i.e., a finite set of pairs of terms ( , r) usually written → r and called rewrite rules. We always assume that and r do not contain any names. A rewriting system R induces a relation on terms → defined as its closure by subsitution and context, i.e., by the inference rules:

( → r) ∈ R → r u → v σ substitution uσ → vσ u i → u i f(u 1 , . . . , u n ) → f(u 1 , . . . , u i-1 , u i , u i+1 , . . . , u n ) Definition 1.2 (theory)
In this thesis we call a theory a pair (F, R) with F a signature and R a rewriting system. All definitions involving terms at any point are to be understood w.r.t. a theory that is sometimes left implicit for the sake of succinctness.

Example 1.2 The following rewrite rules define the theory of pairs and encryption:

fst( x, y ) → x snd( x, y ) → y sdec(senc(x, y), y) → x
Typically one can decrypt (apply sdec) a ciphertext senc(x, y) with the corresponding key y to recover the plaintext x. This behaviour is idealised by the absence of other rules for senc and sdec, modelling an assumption that no information can be extracted from a ciphertext except by knowing the decryption key. The analogue for randomised symmetric encryption would be rsdec(rsenc(x, y, z), z) → x. Let us also give a toolbox of other common theories:

1 asymmetric encryption, which is the analogue with public-key mechanisms:

non-rand. F c = {pk/1, aenc/2} F d = {adec/2} adec(aenc(m, pk(k)), k) → m rand. F c = {pk/1, raenc/3} F d = {radec/2} radec(raenc(m, r, pk(k)), k) → m
For that the sender can provide, together with the ciphertext c, a zero-knowledge proof that they know the plaintext m and the randomness r used during the encryption. This proof is modelled by the term p = zkp(c, m, r) and the recipient can check it with the test checkzkp(p, c) = ok in the theory defined by F c = {zkp/3}, F d = {checkzkp/2} and, for ok ∈ F 0 , the rewrite rule checkzkp(zkp(raenc(m, r, pk(k)), m, r), raenc(m, r, pk(k))) → ok

If t → * u where → * is the reflexive transitive closure of → and u is not reducible by →, we say that u is a normal form of t. We only consider rewriting systems R that are convergent, i.e., 1 there exist no infinite rewriting sequences and 2 whenever t → * u 1 and t → * u 2 , there needs exist a term v such that u 1 → * v and u 2 → * v. In particular all terms t have a unique normal form written t↓. This induces a notion of well-formedness of a term, stating that all destructor applications succeed yielding a valid message:

Definition 1.3 (message)
Let (F, R) be a convergent theory and t be a term. We say that t is a message, written msg(t), when for all u ∈ subterms (t), u↓ is a constructor term. This captures the previously-mentioned intuition that a destructor is a function symbol that may fail (where failing means not being reduced to a constructor term, i.e., a valid protocol message). The predicate msg is extended to sequences of terms msg(t 1 , . . . , t n ) in the natural way. This predicate is used to restrict to protocols that only send and accept wellformed messages; in particular, putting a function symbol f in F c rather than in F d models an assumption that f always returns a valid result.

Example 1.3

We refer to the theories introduced in Example 1.2. If m ∈ F 0 and k ∈ N , sdec(senc(m, k), k) is a message of normal form m; on the contrary the terms sdec(m, k) and sdec(senc(m, k), k ), k = k , are both in normal form and contain a destructor and are therefore not messages. We also mention a less intuitive example fst( m, sdec(m, k) ) which is not a message although it reduces to m which is a one.

Definition 1.4 (equality modulo theory)

Two terms u and v are equal modulo a convergent theory E, written u = E v, if msg(u, v) and u↓= v↓ w.r.t. E. Thus = E is an equivalence relation when restricted to messages and u = E u iff msg(u).

Classical classes of theories

In addition of convergence two classes of theories are particularly important in this thesis.

Definition 1.5 (subterm convergent)

A theory (F, R) is subterm convergent when R is convergent and for all rules ( → r) ∈ R, r is either a strict subterm of or a ground term in normal form (w.r.t. R). This class of theories has been studied significantly in the context of protocol analysis, see for example [START_REF] Abadi | Deciding knowledge in security protocols under equational theories[END_REF][START_REF] Baudet | Sécurité des protocoles cryptographiques: aspects logiques et calculatoires[END_REF][START_REF] Blanchet | Automated verification of selected equivalences for security protocols[END_REF][START_REF] Cheval | DEEPSEC: Deciding equivalence properties in security protocols theory and practice[END_REF][START_REF] Ciobâcă | Computing knowledge in security protocols under convergent equational theories[END_REF][START_REF] Conchinha | Fast: an efficient decision procedure for deduction and static equivalence[END_REF]. All theories discussed in Example 1.2 are subterm convergent; typical examples of non-subterm convergent theories are blind signature and trapdoor commitment (see [START_REF] Ciobâcă | Computing knowledge in security protocols under convergent equational theories[END_REF] for details). We also consider: Definition 1.6 (constructor-destructor)

A theory (F, R) is constructor-destructor if all rewrite rules ( → r) ∈ R are of the form = d(t 1 , . . . , t n ) with d ∈ F d and t 1 , . . . , t n , r constructor terms.

Such theories have been studied for example in [START_REF] Blanchet | Automated verification of selected equivalences for security protocols[END_REF][START_REF] Cheval | Trace equivalence decision: Negative tests and non-determinism[END_REF][START_REF] Cheval | DEEPSEC: Deciding equivalence properties in security protocols theory and practice[END_REF]. Intuitively a theory is constructor-destructor if the rewrite rules only describe the behaviours of destructor symbols. This gives rewriting sequences convenient properties: for example a term t may be rewritten only at positions where there is a destructor, and the number of destructors appearing in a term strictly decreases at each rewriting step. On the other hand one could also consider their complete opposite, namely theories where no functions can fail:

Definition 1.7 (equational)
In this thesis a theory (F, R) is said to be equational if

F = F c , that is, F d = ∅.
Equational theories model an assumption that all functions always return a valid message. Considering the equational variant of the theory of pairs for example (that is, with the symbols fst and snd in F c ) the term fst(u) is valid message even if u is not a pair. When refering to the theories introduced in Example 1.2, we add the explicit mention "constructor-destructor" or "equational" (e.g., "constructor-destructor pairs" or "equational pairs") to distinguish between the variant presented in Example 1.2 and the one where all symbols are put in F c .

Protocols in an adversarial environment

Section summary

We now model protocols using a calculus of concurrent processes. They come with an operational semantics modelling their executions over a network controlled by an active attacker.

Processes

In the applied pi-calculus, protocols are modelled by processes that can be seen as concurrent programs sending and receiving messages. Unlike the original pi calculus [START_REF] Milner | A calculus of mobile processes[END_REF] messages are modelled by terms and not merely names, making the modelling process often more intuitive or accurate. Assuming a theory (F, R), their syntax is defined by the following grammar:

P, Q ::= 0 (null process) if u = v then P else Q (conditional) u(x).P (input) u v .P (output) P | Q (parallel)
where u, v are terms and x a variable. Intuitively 0 models a terminated process, a conditional if u = v then P else Q executes either P or Q depending on whether u and v are equal modulo theory, and P | Q models two processes executed concurrently. The constructs u(x).P and u v .P model, respectively, inputs and outputs on a communication channel u.

When the channel u is known to the attacker, e.g., when u ∈ F 0 , executing an output on u adds it to the adversary's knowledge and inputs on u are provided by the adversary possibly forwarding a previously stored message, or computing a new message from previous outputs. Otherwise the communication is performed silently without adversarial interferences (internal communication). To model an unbounded number of protocol sessions we add the constructs

P, Q ::= new k.P (new name) ! P (replication)
The replication ! P models an unbounded number of parallel copies of P , and new k.P creates a fresh name k unknown to the attacker; in particular ! new k.P models an unbounded number of sessions, each with a different fresh key. The fragment of the calculus without replication is referred as finite or bounded. Another notable subclass is the original pi-calculus [START_REF] Milner | A calculus of mobile processes[END_REF], referred as the pure fragment, that can be retrieved with the empty theory (F and R empty).

Remark: bound and free variables The sets vars (P ) and names(P ) only refer to the free variables and names of a process, respectively; that is, variables that are not bound by an input and names that are not bound by a new operator. For example vars (c(x).0) = ∅ and names(new k.0) = ∅.

Example 1.4

We define a process modelling the protocol for private authentication described in [START_REF] Abadi | Private authentication[END_REF] as a running example through the paper. Writing sk X , pk X the secret and public keys of an agent X, its control flow can be described in informal Alice-Bob notation as follows:

X → B : raenc( N X , pk X , r 1 , pk B ) B → X : raenc( N X , N B , pk B , r 2 , pk A ) if X = A raenc(N B , r 2 , pk B ) if the decryption fails or X = A
where N X , N B , r 1 , r 2 are freshly generated nonces. Here the agent B accepts authentication requests from the agent A but not from other parties. The security goals stated in [START_REF] Abadi | Private authentication[END_REF] are 1 Authentication and secrecy: After a successful instance of the protocol between A and B, N A and N B are shared secrets (i.e., A and B know their values but not the attacker). 2 Anonymity: Upon observing and interfering with a session of the protocol, the attacker cannot tell whether it was run by A and B or by other agents. 3 Private authentication: The attacker cannot infer the set of identities accepted by B. The last two items justify the decoy message raenc(N B , pk B ) that B sends upon failure: from an outside observer there should not be an observable difference between the situations where B accepts the connection or not. The roles of X and B can be specified as follows in the applied pi calculus; each process takes as an argument its secrey key s, the public key p of the agent it aims at communicating with, its fresh session nonce n and we let t = radec(x, s):

Send(s, p, n) = new r. Rcpt(s, p, n) = d(x). new r. c raenc( n, pk(s) , r, p) . if snd(t) = p then c(x) d raenc( fst(t), n, pk(s) , r, p) else d raenc(n, r, pk(s))
where c, d ∈ F 0 . The fact that the two processes operate on different channels c, d models an assumption that the attacker can distinguish between the messages of one or the other.

Semantics in an adversarial environment

Attacker's knowledge The semantics of processes includes a model of the attacker's knowledge aggregated during the protocol's execution. We model the attacker's observations when spying on the communication network by a frame, which is a substitution of the form

Φ = {ax 1 → t 1 , . . . , ax n → t n } t i messages in normal form
where t i are the outputs performed during the protocol and AX = {ax i } i∈N is a set of special variables called axioms that serve as handles to the adversary for building new terms. The terms t i enable deductions as they aggregate; for example after observing a ciphertext and the decryption key the attacker can also obtain the plaintext by decrypting. Formally:

Definition 1.8 (recipe, deduction) A recipe is a term ξ ∈ T (F ∪ F 0 ∪ AX ).
We say that a recipe ξ deduces a message u from a frame Φ when ξΦ = E u. The set of axioms appearing in ξ is written axioms(ξ).

A recipe describes how the adversary can compute a message from the observations aggregated in Φ. The fact that a recipe cannot contain names models the fact that they are assumed unknown to the attacker. Naturally they are not anymore if they get revealed themselves; for example in Φ = {ax 1 → senc(t, k), ax 2 → k} even if deducing the term t requires to decrypt ax 1 with the key k (which is not allowed to occur directly in the recipe), this is possible by using ξ = sdec(ax 1 , ax 2 ).

Operational semantics

The behaviour of processes is formalised by an operational semantics operating on extended processes A = (P, Φ(A)), where P is a multiset of processes modelling the state of the processes executed in parallel, and Φ(A) is the frame indicating the outputs the attacker has recorded during the execution. It takes the form of a labelled transition relation α -→ whose label α is called an action, which is either: 1 a public input action ξ c (ξ t ) modelling the reception of a message forged by the adversary, where ξ c (resp. ξ t ) is a recipe indicating how the adversary has computed the input's channel (resp. the term to be input); 2 a public output action ξ c ax i modelling a message sent on the network (and therefore to the adversary), where ξ c is a recipe for the output's channel, and the underlying output term is added to the frame under axiom ax i ; 3 an unobservable action τ which represents an internal action, such as the evaluation of a conditional or a communication on a private channel.

({ {if u = v then P else Q} } ∪ P, Φ) τ -→ ({ {R} } ∪ P, Φ) R = P if u = E v (Test) R = Q otherwise ({ {u(x).P } } ∪ P, Φ) ξc(ξt) ---→ ({ {P {x → ξ t Φ↓}} } ∪ P, Φ) if msg(ξ t Φ) and ξ c Φ = E u (In) ({ {u v .P } } ∪ P, Φ) ξc ax ---→ ({ {P } } ∪ P, Φ ∪ {ax → v↓}) if msg(v) and ξ c Φ = E u (Out)
and ax ∈ AX dom(Φ) The relation is formalised in Figure 1.1. The rule (Test) compares u and v modulo theory which, we recall, requires that msg(u, v), i.e., all destructors in u and v should succeed for the test to be positive. In particular a test if u = u then P else Q will execute Q if msg(u) does not hold. The rules (In) and (Out) tackle public communications in that the channel u they are performed on should be deducible by the attacker (using recipe ξ c ). As expected this kind of communications are routed by the adversary: public outputs are sent to them, increasing the frame, and public inputs are computed by them using previous outputs, i.e., recipe ξ t . On the contrary (Comm) models a internal communication on a channel u non deducible to the adversary. However, as noted in [START_REF] Babel | On the semantics of communications when verifying equivalence properties[END_REF], there exist several variants of this rule:

({ {u v .P, w(x).Q} } ∪ P, Φ) τ -→ ({ {P, Q{x → v}} } ∪ P, Φ) if msg(v), u = E w, and (Comm)
u not deducible from Φ ({ {new k.P } } ∪ P, Φ) τ -→ ({ {P {k → k }} } ∪ P, Φ) if k ∈ N names(P, P, Φ) (New) ({ {P | Q} } ∪ P, Φ) τ -→ ({ {P, Q} } ∪ P, Φ) (Par) ({ {! P } } ∪ P, Φ) τ -→ ({ {! P, P } } ∪ P, Φ) (Repl)
These variations may seem unimportant in that they preserves reachability properties. However equivalence properties can be impacted by the choice of the semantics, as discussed in [START_REF] Babel | On the semantics of communications when verifying equivalence properties[END_REF] (for example the classical and private semantics induce incomparable notions of equivalence). All results of this thesis (decidability, complexity, case studies) are to be understood w.r.t. the private semantics but most can be adapted to the other two.

Definition 1.9 (trace)

If A 0 be an extended process, a trace of A 0 is a sequence of successive reductions steps

t : A 0 α 1 -→ A 1 α 2 -→ . . . αn --→ A n .
If tr is the word obtained by removing τ actions from the word α 1 • • • α n , this trace may be referred succinctly as t : A 0 tr = ⇒ A n . Specifically, if ε is the empty word, t : A 0 ε = ⇒ A n is used to mean that t is a sequence of τ -transitions.

Example 1.5

We now illustrate how our running example can be executed in the operational semantics. We let two agents of respective secret keys sk A , sk B ∈ N and nonces N A , N B ∈ N . An instance of the protocol between A and B is thus modelled, using the notations of Example 1.4, by the process P = Ā | B where

Ā = Send(sk A , pk(sk B ), N A ) B = Rcpt(sk B , pk(sk A ), N B )
We name the three messages sent during the protocol as follows, for two fresh names r 1 , r 2 :

m A = raenc( N A , pk(sk A ) , r 1 , pk(sk B )) m B = raenc( N A , N B , pk(sk B ) , r 2 , pk(sk A )) m B = raenc(N B , r 2 , pk(sk B ))
We assume that the public keys pk(sk A ) and pk(sk B ) are known to the attacker, which can be modelled by an initial frame Φ 0 = {ax 1 → pk(sk A ), ax 2 → pk(sk B )}. An other possibility is to prefix the process P with two outputs of pk(sk A ) and pk(sk B ) respectively, producing the frame Φ 0 after two applications of rule (Out). The normal execution of the protocol is:

({ {P } }, Φ 0 ) τ -→ ({ { Ā, B} }, Φ 0 ) c ax 3 ===⇒ ({ {c(x), B} }, Φ 1 ) with Φ 1 = Φ 0 ∪ {ax 3 → m A } d(ax 3 ) d ax 4 = ======= ⇒ ({ {c(x), 0} }, Φ 2 ) with Φ 2 = Φ 1 ∪ {ax 4 → m B } c(ax 4 ) ---→ ({ {0, 0} }, Φ 2 )
In this execution the attacker only forwards messages, that is, each input action uses the last axiom added to the frame as a recipe. However the adversary may actively engage in the protocol, for example to try to infer whether B accepts communications from a third agent C. For that they could generate a fresh nonce N ∈ F 0 , send it to B pretending it is from C and observe how it responds. With the initial frame Φ 0 = Φ 0 ∪ {ax 3 → pk(sk C )} and r ∈ F 0 , this scenario corresponds to the trace:

({ {P } }, Φ 0 ) τ -→ ({ { Ā, B} }, Φ 0 ) d(raenc( N,ax 3 ,r,ax 2 )) = ============= ⇒ ({ { Ā, d m B } }, Φ 0 ) d ax 4 ----→ ({ { Ā, 0} }, Φ 0 ∪ {ax 4 → m B })
This does not leak information assuming the attacker cannot distinguish m B from m B .

When defining security against an active attacker we quantify over all traces which means we consider all possible executions in an active adversarial environment. Thus even the bounded fragment yields an infinite transition system if the theory contains a non-constant function symbol (as this allows to build an unbounded number of messages).

Extensions of the calculus

Although it already allows to model most of the protocol mechanisms that can be encountered in practice, there exist a couple of common extensions of the applied pi-calculus. All can be encoded into the original calculus and thus do not increase its expressivity. They should rather be seen as convenient modelling tools and we will use several of them throughout this thesis, either for modelling purposes or for simplifying some complexity proofs (and in the latter case we naturally consider the impact of the encoding on the size of the process).

Non-deterministic choice A first classical operator is the non-deterministic choice: P +Q is a process that can be executed either as P or as Q. Its operational semantics can therefore be described by adding the following rule to those of Figure 1.1:

({ {P + Q} } ∪ P, Φ) τ -→ ({ {R} } ∪ P, Φ) if R ∈ {P, Q} (Choice)
This reduction can easily be encoded as an internal communication on a fresh private channel. Typically P + Q can be encoded by the process new d. (d u .P | d(x).Q) where u is an arbitrary term and x is a fresh variable. However using a native operator rather than an encoding permits to develop specific optimisations when implementing automated tools. On a theoretical aspect, we also provide in Part III a formal proof that extending the calculus with this operator does not affect the complexity of the decision problems studied in this thesis.

Let bindings and patterns A common convenient tool when defining processes is the let construct, binding a term to a variable to increase readability. For example given a message t, the process let x = t in P can be seen as a shortcut for P {x → t}. However we more generally allow patterns, for example writing let x, y = t in P else Q for a process executing P {x → fst(t), y → snd(t)} if t is a message and a pair, and executing Q otherwise. Formally we extend the syntax of the calculus with

P, Q ::= let u = v in P else Q
where v is a term and u is a constructor term called a pattern, namely a term such that: 1 It is possible to test that a term matches u using conditionals without else branches.

Referring to the example above, it is possible to test that a term t is of the form of u = x, y with the test "if t = fst(t), snd(t) then". On the contrary this excludes patterns like u = rsenc(x, y, z), rsenc(x , y, z ) that would accept any pair of ciphertexts encrypted using the same randomness. Formally we require that there exist terms t 1 , . . . , t n , t 1 , . . . , t n (possibly containing a fixed variable x) such that for all ground terms t, t is an instance of u iff for all i ∈ 1, n , msg(t i {x → t}, t i {x → t}) and t i {x → t}↓= t i {x → t}↓. 2 All free variables of u effectively appearing in the rest of the process can be extracted by applying destructors to the pattern. Referring again to the example u = x, y , this condition simply states that x and y can be used later in the process since they could simply be replaced by fst(u) and snd(u) respectively. This excludes however patterns such as u = h(x) where h is a free function symbol. Formally we require that for all variables x ∈ vars (u) ∩ vars (P ) (i.e., variables appearing in u and P that are not bound by a previous input or let), there exists a term context C without free variables such that msg(C[u]) and C[u]↓= x. The requirement that C does not contain free variables excludes, for example, the pattern senc(0, y) that accepts the constant 0 encrypted by any key. On the contrary, a pattern u = rsenc(x, y, k) is valid if k ∈ N and y / ∈ vars (P ). These technical conditions are here to ensure that the let binding can be simulated within the original calculus by using conditionals and destructors. In terms of semantics we have

({ {let u = v in P else Q} } ∪ P, Φ) τ -→ ({ {R} } ∪ P, Φ) R = P σ if v = E uσ (Let) R = Q otherwise
Similarly, some of our decidability results are also stated in a fragment of the calculus that do not contain any conditionals (if) but use patterns instead of input variables. The semantics of such inputs generalises the rule (In) of Figure 1.1 as follows:

({ {c(u).P } } ∪ P, Φ) ξc(ξt) ---→ ({ {P σ} }, Φ) if ξ c Φ = E c, msg(ξ t Φ) and ξ t Φ↓= uσ (Pat-In)
The semantics of c(u).P is therefore close to that of c(x). let u = x in P , although not strictly equivalent (the former cannot receive inputs not fitting the pattern whereas the latter can but aborts the execution after it happens).

Private function symbols

We may use private function symbols, namely function symbols assumed unknown to the adversary, as a modelling trick to express relations that are not computable by the adversary. For example, when modelling public identities id 1 , . . . , id n each possessing their own decryption key, the keys in question can be represented by the terms sk(id 1 ), . . . , sk(id n ) where sk/1 is a private function symbol. This provides a more convenient syntax to express key ownership, and keeping the symbol sk private avoids giving the adversary the unrealistic ability to derive the secret key of an agent from its identity.

Formalising this only requires to change the definition of recipes by imposing that they should not contain private function symbols. In terms of encoding they can be also be simulated by using a name p that will always remai n unknown to the adversary, used as an additional argument to all private function symbols. In the example above, sk/1 would thus be modelled by a usual function symbol sk /2 and the secret keys by sk (id 1 , p), . . . , sk (id n , p).

Security properties: equivalences

Section summary

We present the security properties we are interested in, namely equivalence properties. We define static equivalence, trace equivalence and labelled bisimilarity, three process equivalences capturing various flavours of privacy-type properties. Two other process equivalences will be introduced later in this thesis (Chapter 5).

Against a passive attacker: static equivalence

We first define the notion of static equivalence that is often used to model security against a passive attacker in that it is only an equivalence of frames, i.e., it does not involve the operational semantics. It expresses that the knowledge obtained by eavesdropping in two different situations does not permit the attacker to distinguish them. For example no differences can be observed between {ax 1 → k} and {ax 1 → k } if k, k ∈ N because, intuitively, two fresh nonces look like random bitstrings from an external observer's point of view. However the situation is different with the frames

Φ = {ax 1 → k, ax 2 → k} Ψ = {ax 1 → k , ax 2 → k} with k = k
Indeed, even if no differences can be made between k and k in isolation, the attacker observed two identical messages in the first situation Φ but two different messages in the second situation Ψ. In particular we say that the equality test "ax 1 = ax 2 " distinguishes the two frames (because it holds in Φ but not in Ψ). In addition, when the theory is constructor-destructor, we also assume that the adversary can observe destructor failures to distinguish frames, i.e., use the predicate msg. This allows for example to distinguish the following frames:

Φ = {ax 1 → k 1 , k 2 } Ψ = {ax 1 → k}
Indeed the recipe fst(ax 1 ) yields a message in the first situation but triggers a decryption failure in the second. Static equivalence has been extensively studied in the literature (see for example [START_REF] Abadi | Deciding knowledge in security protocols under equational theories[END_REF][START_REF] Ciobâcă | Computing knowledge in security protocols under convergent equational theories[END_REF][START_REF] Baudet | YAPA: A generic tool for computing intruder knowledge[END_REF][START_REF] Conchinha | Fast: an efficient decision procedure for deduction and static equivalence[END_REF]). We formalise it as follows:

Definition 1.10 (static equivalence)

Two frames Φ and Ψ of same domain are statically equivalent, written Φ ∼ Ψ, when for all recipes ξ, ζ, ξΦ = E ζΦ iff ξΨ = E ζΨ. This definition is lifted to extended processes by writing A ∼ B when Φ(A) ∼ Φ(B).

We recall that equality modulo theory = E only compares messages. In particular by taking ξ = ζ in the definition, we obtain that if Φ ∼ Ψ then msg(ξΦ) iff msg(ξΨ). This formalises that the observation of destruction failures can be used to distinguish frames.

Example 1.6

Let us give additional examples to emphasise some considerations related to our running example. The fact that the following two frames are statically equivalent

Φ = {ax 1 → raenc(m, r, pk(k))} Ψ = {ax 1 → k } with m ∈ F 0 and k, k ∈ N
intuitively model that encryption makes messages unintelligible (in that the attacker cannot distinguish a ciphertext from a fresh nonce). Naturally this cannot hold anymore once the decryption key is revealed, and indeed Φ ∪ {ax 2 → k} ∼ Ψ ∪ {ax 2 → k} as witnessed by the recipe ξ = radec(ax 1 , ax 2 ) whose computation succeeds in the first frame but triggers a decryption failure in the second. Without going to the extreme extent of revealing the key, the two situations are also distinguishable if we weaken the cryptographic assumptions on raenc.

For example if we do not suppose the encryption scheme key concealing by adding the rule getKey(raenc(x, y, pk(z))) → pk(z)

then Φ and Ψ are distinguished by the recipe getKey(ax 1 ) which yields a valid message in Φ but not in Ψ. The same holds with the weaker rule testEnc(raenc(x, y, pk(z))) → ok modelling that one can test whether a bitstring is a valid ciphertext.

Against an active attacker: behavioural equivalences

Dynamic extensions of static equivalence consider distinguishability for an attacker interacting actively with the protocol. Consider for example a protocol modelled by a process P manipulating a nonce k. A possible model of the secrecy of k can be formalised by a non-interference statement: there is no observable difference in the behaviour of the protocol when k is replaced by an other term. As we will see in more details in Chapter 2 the same approach can be used to model various flavours of privacy-type properties. such as unlinkability, or ballot privacy in the context of electronic voting. There exist however several candidate equivalences for modelling this notion of indistinguishability.

The zoo of equivalences Indistinguishability can typically be modelled by trace equivalence as introduced in [BDNP01]: intuitively two processes are trace equivalent if for all traces of either of the two processes, there exists a trace in the other process that takes the same visible actions and produces a statically equivalent frame. This equivalence has been studied intensively in the context of security protocols [CCLD11, ACK16, CCD13, CKR18a]. However behavioural equivalences have been historically defined as congruences, that is, as the indistinguishability of two processes in any adversarial context. This is for example the case of the testing equivalence introduced in [AG99], sometimes called may-testing equivalence due to its strong inspiration from a well-established equivalence of this name [START_REF] De | Testing equivalences for processes[END_REF]. Informally two processes P and Q are equivalent if for all processes R and all public channels u, P | R may input (resp. output) on u after some τ -→ steps iff Q | R may as well. In some sense trace equivalence and may-testing equivalence capture a similar notion of security, modelling the actions of the adversary either with a labelled semantics and frames in the case of trace equivalence, or with explicit processes R in the case of may-testing equivalence. Actually it has been proved in [START_REF] Cheval | Deciding equivalence-based properties using constraint solving[END_REF] that two trace equivalent processes are always may testing equivalent, and that the converse was true provided the processes were image-finite (a condition that we do not detail here but that is satisfied by bounded processes among others). This somewhat makes trace equivalence a convenient proof technique for may-testing in that it gets rid of the quantification over adversarial processes, often tedious to manage in proofs.

There also exist equivalences with bisimulation-based definitions. Several of them were introduced for example in [START_REF] Abadi | A calculus for cryptographic protocols: The spi calculus[END_REF] as proof techniques for may-testing equivalence, including one called observational equivalence in [START_REF] Abadi | The applied pi calculus: Mobile values, new names, and secure communication[END_REF] that is the targeted equivalence of the popular ProVerif tool [START_REF] Blanchet | Modeling and verifying security protocols with the applied pi calculus and proverif[END_REF][START_REF] Cheval | Proving more observational equivalences with proverif[END_REF]. Intuitively if A 0 and A 1 are observationally equivalent then they should be able to emit on the same channels (just like may-testing equivalence), and for all sequences of

τ -→ steps A i ε = ⇒ A i there should exist A 1-i ε = ⇒ A 1-i
such that A 0 and A 1 are observationally equivalent as well. Similarly to the duo may-testing/trace equivalence, there exists an alternative definition observational equivalence replacing the adversarial processes by our labelled semantics, making proofs easier to manage. This variant is called labelled bisimilarity and is proved to coincide observational equivalence in [START_REF] Abadi | The applied pi calculus: Mobile values, new names, and secure communication[END_REF].

Remark: impact of the semantics As explained in Section 2.2, variations of the semantics of internal communications (classical, private, eavesdrop) may affect the resulting notion of equivalence. If we stricly stick to the cited references, all abovementioned results are stated in the classical semantics. How these claims can be generalised to the other two semantics is studied in [START_REF] Babel | On the semantics of communications when verifying equivalence properties[END_REF].

Formalisation in our model

In this thesis we study trace equivalence and labelled bisimilarity. Since we mostly provide results for bounded processes, they therefore extend to maytesting equivalence and observational equivalence. We define the two equivalences below. In particular labelled bisimilarity is stronger than trace equivalence, i.e., two labelled bisimilar processes are always trace equivalent. Yet the converse is not true as witnessed by the following textbook example, with a, b, c, 0 ∈ F 0 and using the choice operator introduced in Section 2.3:

P = a 0 . (b 0 + c 0 ) Q = (a 0 . b 0 ) + (a 0 . c 0 )
These processes are trace equivalent because they are both able to perform an output on a followed by an output on b or c However they are not labelled bisimilar intuitively because when executing Q, one has to choose at the beginning of the trace whether b or c will be executed at the end (whereas after executing the first output of P it is still possible to output on both b and c).

Example 1.7 We refer again to the processes modelling the Private Authentication protocol as described in Example 1.4. We let for instance

Ā = Send(sk A , pk(sk B ), N A ) BY = Rcpt(sk B , pk(sk Y ), N B )
The process Ā models the role of A sending a connection to B, and BY models the role of B accepting connections from an agent Y ∈ {A, C}. The following equivalence statement models the security property that, when A attempts a connection with B, the adversary cannot infer whether B accepts connections from A or not:

({ { Ā | BA } }, Φ 0 ) ≈ t ({ { Ā | BC } }, Φ 0 )
The initial frame Φ 0 models that the attacker knows the public keys of all agents involved in the protocol, namely Φ 0 = {ax 1 → pk(sk A ), ax 2 → pk(sk B ), ax 3 → pk(sk C )}. Naturally, an extensive security modelling of private authentication would need to consider more than one session (ideally an unbounded number) of the protocol and more scenarios; typically the property should still hold if A initiates a connection with any agent besides B. We address these concerns in Chapter 2 by proposing a more complete model. Back to the simple equivalence statement above, it appears to hold; the core argument is that for all messages u 1 , u 2 , r 1 , r 2 and for all public keys pk 1 , pk 2 ∈ {pk(sk A ), pk(sk B ), pk(sk C )}, the following frames are statically equivalent:

Φ 0 ∪ {ax 4 → raenc(u 1 , r 1 , pk 1 )} Φ 0 ∪ {ax 4 → raenc(u 2 , r 2 , pk 2 )}
In particular the conclusion still holds if we weaken the cryptographic assumptions on raenc by assuming that a ciphertext is distinguishable from an arbitrary term, which is modelled by adding the rewrite rule testEnc(raenc(x, y, pk(z))) → ok. However trace equivalence is violated if we add the rule getKey(raenc(x, y, pk(z))) → pk(z), meaning that the encryption scheme is not assumed to be key-concealing. A possible attack consists of initiating a connection with B pretending to be A (i.e., using the recipe ξ = raenc( N, ax 1 , r, ax 2 ) for some N, r ∈ F 0 ) and observing which key encrypts B's response. This is formally captured by the following trace:

({ { Ā, BA } }, Φ 0 ) d(ξ) ==⇒ ({ { Ā, d u } }, Φ 0 ) with u = raenc( N, N B , pk(sk B ) , r, pk(sk A )) d ax 4 ----→ ({ { Ā, 0} }, Φ) with Φ = Φ 0 ∪ {ax 4 → u}
There is only one trace in the other process taking the same actions, which is the following for some fresh name r :

({ { Ā, BC } }, Φ 0 ) d(ξ) ==⇒ ({ { Ā, d v } }, Φ 0 ) with v = raenc(N B , r , pk(sk B )) d ax 4 ----→ ({ { Ā, 0} }, Ψ) with Ψ = Φ 0 ∪ {ax 4 → v}
and Φ ∼ Ψ because the recipe getKey(ax 4 ) is evaluated to pk(sk A ) in Φ and to pk(sk B ) in Ψ.

That is, the equality test "getKey(ax 4 ) = ax 1 " holds in Φ but not in Ψ.

As a summary the symbolic framework we use allows to detect structural flaws in security protocols, assuming a perfect cryptography up to weakening assumptions that can be added into the model as in the example above. This permits to study the soundness of the protocol's logic and the necessity of specific cryptographic assumptions but is not intended to prove that a given set of assumptions is sufficient to achieve security.

Decision problems and complexity

Section summary

Finally we recall some basic definitions and results of complexity theory that will be used across this thesis. We conclude by defining some decision problems related to security, including several variants appearing in the literature.

Computational complexity

About sizes Before anything we need to clarify the notion of size of the problem parameters since it plays a central role in complexity analyses. This is particularly important for our purpose since there exist several conventions for representing terms. The tree size of term t refers to its number of symbols and is written |t|. It corresponds to a classical representation of a term as a ranked tree. But we may also represent terms as DAGs with maximal sharing (which may be exponentially more concise): the DAG size of t refers to the cardinality |subterms (t)| and is written |t| dag . This definition is lifted to sets and sequences of terms with the sharing common to all elements of the structure. The size of a signature F is the sum of the arities of the symbols of F and the size of a rewrite system R is the sum of the sizes of the two sides of its rules. The size of a process is the sum of the number of its instructions and of the sizes of all terms appearing in the process. We emphasise that 1 A complexity upper bound stated w.r.t. the DAG size of the inputs is a stronger result than the same upper bound stated w.r.t. the tree size. 2 On the contrary a complexity lower bound stated in DAG size is a weaker result than the corresponding result in tree size. In this thesis we always adress the strongest configurations: lower bounds are stated w.r.t. the tree representation of terms, and the upper bounds w.r.t. the DAG representation.

Remark: DAG size of processes

We recall that our complexity upper bounds are to be understood w.r.t. the DAG size of processes |P | dag which is here the number of instructions of P plus the DAG size of all terms appearing in P . In particular the DAG structure only applies to terms and not to the process structure itself. For example n parallel copies of P could technically be represented by an encoding of size |P | dag + log 2 (n) whereas our notion of size grows linearly with n (which makes our complexity results weaker compared to potential results w.r.t. the logarithmic representation). In some sense we study the relation between the verificaton's hardness and the maximal number of executable instructions of the protocol, rather than its code's length.

Common classes

We now shortly remind some background on complexity, mainly introducing our notations. Given f : N → N, we write TIME(f ) (resp. SPACE(f )) the class of problems decidable by a deterministic Turing machine running in time (resp. in space) at most f (n) where n is the size of the inputs of the problem. We define the classes:

P = p∈N TIME(n p ) LOGSPACE = p∈N SPACE(log(n p )) PSPACE = p∈N SPACE(n p ) EXP = p∈N TIME(2 n p ) 2EXP = p∈N TIME(2 2 n p ) ELEM = EXP ∪ 2EXP ∪ 3EXP ∪ . . .
The class ELEM ("elementary functions") therefore contains all problems decidable in time bounded by a tower of exponentials. We also anecdotically mention the class PRIMREC ("primitive recursive functions", not formalised here), which strictly contains ELEM and is used in one of the related works we survey later in the thesis. We also define the counterparts of some of these classes for non-deterministic Turing Machine: NLOGSPACE (NL for short), NP, NPSPACE and NEXP. Given a class C, co-C is the class of problems whose negation is in C.

Theorem 1.1 (relation between the different classes [START_REF] Papadimitriou | Computational complexity[END_REF])

LOGSPACE ⊆ NL = coNL ⊆ P ⊆ NP,coNP ⊆ PSPACE = NPSPACE ⊆ EXP EXP ⊆ NEXP,coNEXP ⊆ 2EXP ⊆ 2NEXP,co2NEXP ⊆ 3EXP ⊆ • • • ⊂ ELEM ⊂ PRIMREC
Polynomial hierarchy We also mention the notion of oracle classes, deciding a problem with a constant-time black box for an other problem: the class of problems decidable in C with an oracle for a problem Q is noted C Q . When Q is complete for a class D w.r.t. a notion of reduction executable in C, we may write C D instead; in particular C D = C coD . This kind of reduction is needed to define the last complexity classes we will use in this paper: the polynomial hierarchy, which is a collection of complexity classes between P and PSPACE. Indeed the difference between NP and PSPACE lies in quantifier alternation; the usual complete problems considered for these two complexity classes are, given a boolean formula ϕ: 1 SAT (NP complete): does ∃x 1 , . . . , x n .ϕ(x 1 , . . . , x n ) hold? 2 QBF (PSPACE complete): does ∀x 1 , ∃y 1 , . . . , ∀x n , ∃y n .ϕ(x 1 , y 1 , . . . , x n , y n ) hold? One can therefore consider intermediate versions of these problems, typically a weaker variant of QBF where the number of quantifier alternations is bounded by a constant i. All these intermediate problems are called Σ n and Π n and are part of the polynomial hierarchy.

Definition 1.13 (Polynomial hierarchy)

The polynomial hierarchy PH consists of the family of complexity classes Σ n , Π n and ∆ n defined inductively by

Σ 0 = Π 0 = ∆ 0 = P Σ n+1 = NP Σn Π n+1 = coNP Σn ∆ n = P Σn

Complete problems for each complexity class

A problem is said to be complete for a complexity class C if it is in C and the decision of any problem in C is reducible to it. For that we use the standard notion many-to-one polytime reductions (for the class NP and above) and logspace reductions for P. We present below the classical complete problems for some complexity classes, taken from [START_REF] Papadimitriou | Computational complexity[END_REF]. Typically:

Definition 1.14 (SAT formula)

A literal is either a (boolean) variable or its negation and a clause is a disjunction of literals. By convention ⊥ is the empty clause and denotes tautological clauses such as x ∨ ¬x. A SAT formula is then a boolean formula of the form

ϕ = n i=1 1 i ∨ 2 i ∨ 3 i j i literals, i ∈ 1, n , j ∈ 1, 3 ,
A valuation v of ϕ is then a mapping from the variables of ϕ to B = { , ⊥}, and v(ϕ) ∈ B denotes the corresponding boolean evaluation of the formula.

Decision problem -SAT

Input: a SAT formula ϕ Question: does there exist a valuation v of ϕ such that v(ϕ) = ?

Theorem 1.2

SAT is NP complete.

It is also common to consider the following variant of satisfiability using a particular type of clauses that can be put under the form of an implication.

Definition 1.15 (Horn formula)

A Horn clause is a clause C = ∨ p i=1 i with at most one positive literal, that is, there exists at most one i ∈ 1, p such that i is not a negation. A Horn clause C = x ∨ p i=1 ¬x i , x being either a boolean variable or ⊥, is therefore often written under the more intuitive form

C = p i=1 x i ⇒ x
A Horn formula is a conjunction of Horn clauses.

Considering Horn clauses intuitively involves much simpler satisfiability mechanisms than arbitrary clauses and is known to be decidable in linear time in the size of the formula. It is even the canonical complete problem for P:

Decision problem -HornSAT

Input: a Horn formula ϕ Question: does there exist a valuation v of ϕ such that v(ϕ) = ? Theorem 1.3

HornSAT is P complete. Now we move on to high complexity classes. To obtain a complete problem for the PSPACE class we usually consider a generalisation of SAT with formula quantified by arbitrary number of operators ∀ and ∃.

Definition 1.16 (quantified satisfiability)

A quantified formula is either a boolean formula or of the form ∀x, ϕ or ∃x, ϕ for some quantified formula ϕ and variable x. We say that 1 ϕ holds if it is a boolean formula valued to , 2 ∀x,

ϕ holds if ϕ{x → 0} ∧ ϕ{x → 1} holds, 3 ∃x, ϕ holds if ϕ{x → 0} ∨ ϕ{x → 1}.
Decision problem -QBF Input: a quantified formula of the form ϕ = ∀x 1 , ∃y 1 , . . . , ∀x n , ∃y n , ψ Question: does ϕ hold?

Theorem 1.4 QBF is PSPACE complete.
As we mentioned earlier, the polynomial hierarchy can be seen as a collection of intermediary classes between NP and PSPACE. Unsurprisingly the complete problems for the hierarchy are also intermediary versions of SAT and QBF, using bounded quantifier alternation.

Decision problem -QBF n

Input: a quantified formula of the form ϕ = ∀x 1 , ∃x 2 , ∀x 3 , . . . , Q x n , φ where Q = ∀ if n is odd and Q = ∃ if n is even Question: does ϕ hold?

Theorem 1.5 For all n ∈ N, QBF n is Π n complete.
To finish we introduce a complete problem for the NEXP class, which is intuitively the counterpart of SAT with formulas of exponential size. The problem consists of considering a boolean circuit that represents an exponentially-bigger formula and to decide whether the formula in question is satisfiable.

Definition 1.17 (boolean circuit)

A logical gate is a boolean function with at most two inputs. We assume without loss of generality that the gate has at most two (identical) outputs, to be given as input to other gates. Logical gates range over ⊥, , ∧, ∨ and ¬ with the usual truth tables but we may use other common operators such as =. A boolean circuit is an acyclic graph of logical gates: each input (resp. output) of a gate is either isolated or connected to a unique output (resp. input) of an other gate, which defines the edges of this graph. A boolean circuit Γ with m isolated inputs and p isolated outputs thus models a boolean function Γ : B m → B p . We write (c 1 , c 2 , g, c 3 , c 4 ) ∈ Γ to state that g : B 2 → B is a gate of Γ whose inputs x and y are passed through edges c 1 and c 2 , respectively, and whose output g(x, y) is sent through edges c 3 and c 4 . This notation is lifted to other in-outdegrees in the natural way.

Through binary representation of integers, a boolean circuit Γ : B m+2 → B n+1 can be interpreted as a function Γ : 0, 2 m -1 × 1, 3 → B × 0, 2 n -1 . This way, Γ encodes a formula Γ ϕ with 2 n variables x = x 0 , • • • , x 2 n -1 and 2 m clauses:

Γ ϕ ( x) = 2 m -1 i=0 1 i ∨ 2 i ∨ 3 i where j i = x k if Γ (i, j) = (0, k) j i = ¬x k if Γ (i, j) = (1, k)
Rephrasing, Γ (i, j) returns a sign bit and the j th variable of the i th clause of Γ ϕ . This induces the following question decision problem:

Decision problem -SuccinctSAT

Input: A boolean circuit Γ Question: Is the SAT formula Γ ϕ satisfiable?

Theorem 1.6

SuccinctSAT is NEXP-complete.

Problems studied in this thesis and variations

Equivalence problems Our goal in this thesis is to study the decidability and complexity of static equivalence, trace equivalence and labelled bisimilarity. We thus study the following decision problems (for simplicity we make no difference between the plain process P and the extended process ({ {P } }, ∅)):

Decision problem -StatEquiv

Input: A theory E, two frames Φ and Ψ Question: Are Φ and Ψ statically equivalent for E? Decision problem -TraceEquiv (resp. Bisimilarity) Input: A theory E, two processes P and Q Question: Are P and Q trace equivalent (resp. labelled bisimilar) for E?

These problems are undecidable in general due to the calculus being Turing-complete and we therefore often need to put restrictions on the inputs. For example, when we say that "StatEquiv is decidable for subterm convergent theories" it means that the following problem is decidable: Decision problem -StatEquiv for subterm convergent theories Input: A subterm convergent theory E, two frames Φ and Ψ Question: Are Φ and Ψ statically equivalent for E?

The way we state the problem implies that a complexity analysis has to account for the sizes of all inputs, including the theory. However the treatment of this question is not uniform in the literature. For example some complexity analyses [AC06, Bau07, CCD13] consider the theory as a constant of the problem. Still considering static equivalence for example, it is proved in [START_REF] Abadi | Deciding knowledge in security protocols under equational theories[END_REF] that StatEquiv is decidable in polynomial time for all fixed subterm convergent theories; this means that for all such theories E the problem

Decision problem -E-StatEquiv

Input: Two frames Φ and Ψ Question: Are Φ and Ψ statically equivalent for E? is in P. This result provides an interesting insight on complexity but it does not imply that the earlier problem "StatEquiv for subterm convergent theories" is in P. This would indeed mean that the complexity is also polynomial in the size of the theory, which is not implied by the E-StatEquiv variant. Typically the decision procedure of [START_REF] Abadi | Deciding knowledge in security protocols under equational theories[END_REF] is polynomial in the sizes of the frames as expected but exponential in the size of E, which illustrates the difference between the two formulations. Going further we show in Chapter 7 that the first variant "StatEquiv for subterm convergent theories" is even coNP-hard.

It should also be noted that for the fixed-theory variant E-StatEquiv, P-hardness results do not make sense since the precise complexity may depend of the choice of E. We prove for example in Chapter 7 that the problem is LOGSPACE for some instances of E and P-complete for others. Therefore a complexity analysis of E-StatEquiv should rather be seen as a family of complexity results-one for each instance of E. For all of these reasons our complexity analyses always make it clear whether they consider the theory as fixed. In this case we refer to the problem as parametric equivalence and say by opposition that general equivalence is the initial variant with the theory considered as part of the input. We argue that the latter is more relevant today as the theory can now be specified by the user in many automated tools: most of our results are therefore stated in the general-equivalence setting. Still, we prove and survey in Chapter 7 several results in the parametric-equivalence setting as well to highlight the impact on complexity of choosing one setting or the other.

Single-process problems Finally, although we study it only marginally in this thesis, we also mention the following decision problem Decision problem -Deducibility Input: a theory E, a frame Φ, a term u Question: Is u deducible from Φ, i.e., does there exist a recipe ξ such that ξΦ = E u?

This problem is reducible to non static-equivalence [START_REF] Abadi | Deciding knowledge in security protocols under equational theories[END_REF]: more precisely given a theory E, a frame Φ and a term u, then u is deducible from Φ in E iff the following frames are not statically equivalent in the extension of E with (constructor-destructor or equational) symmetric encryption:

Φ 0 = Φ ∪ {ax |Φ|+1 → senc(0, u)} Φ 1 = Φ ∪ {ax |Φ|+1 → senc(1, u)} 0, 1 ∈ F 0
This transformation preserves subterm convergence and the constructor-destructor property.

In particular, even under the assumption that the theory verifies these two properties, the decidability of StatEquiv implies that of Deducibility. A dynamic extension of the deducibility problem would be for example:

Decision problem -Weak Secrecy

Input: A theory E, a process P , a term u Question: Does there exist a trace P tr = ⇒ (P, Φ) such that u is deducible from Φ?

When the answer to this question is negative, we consider that u verifies a form of secrecy in the sense that the adversary cannot entirely recover it after interacting with the protocol. This secrecy is however said to be "weak" in the sense that it does not capture partial information leaks: for example if u is of the form u = u 1 , . . . , u 100 with u 1 , . . . , u 99 public terms but u 100 is weakly secret, then u is also weakly secret although the adversary can reconstruct most of it. Stronger notions of secrecy are formalised using equivalence properties, under the form of non-interference statements as in Chapter 2. In particular Weak Secrecy can typically be reduced to non TraceEquiv, for example by observing that the following points are equivalent: 1 there exists a trace

P tr = ⇒ (P, Φ) such that u is deducible from Φ 2 Q(0) ≈ t Q(1) where Q(v) = P | c(x). if x = v
then c 0 for some fresh constants 0, 1, c ∈ F 0 Chapter 2: Formalisations of privacy using equivalences Summary.

In this chapter we describe, in the applied pi-calculus, several cryptographic protocols and privacy-type properties. When we present the property for an unbounded number of sessions we explain how to restrict the model to the bounded case. The restriction is sometimes more subtle than simply replacing replications by n parallel copies of the processes as doing so tends to fix the scenario (which participant executes which session, which one has been compromised by the adversary...) in a too restrictive way. Our models aim at being parametric in the scenario and we achieve this by involving the adversary in its construction. NB. These models are used throughout this thesis to benchmark the scalability of our verification techniques. Our benchmarks also include other protocols modelled along the same lines and all are publicly available at [START_REF]DeepSec files used throughout this thesis[END_REF].

The private authentication protocol

Section summary

We formalise common privacy goals in authentication protocols by non-interference statements, continuing the example of the Private Authentication protocol of Chapter 1. This includes all scenarios of anonymity and strong secrecy of the messages under various assumptions.

We illustrate how to model security properties in typical authentication protocols by continuing the example of the Private Authentication Protocol described in the previous chapter. Using the extensions of the calculus described in Chapter 1, Section 2.3, we let a private (constructor) function symbol sk/1, the term sk(X) modelling the key of the agent X. For convenience we also include in the theory the following rewrite rule that allows to recover the identity of an agent from its public key: getID(pk(sk(x))) → x Then using the notations of Chapter 1, Example 1.4, we consider again the processes

Send(sk A , pk C , N A ) Rcpt(sk B , pk D , N B )
that model one session of the protocol, i.e., the roles of 1 A initiating a communication with C with nonce N A ; and 2 B accepting a connection from a unique identity D with nonce N B . Several sessions of the protocol can be obtained by putting in parallel several copies of P . 47

Authentication and reachability properties

Although this is not a privacy-type property, we present briefly and informally the first security goal of the protocol to illustrate how behavioural equivalences can capture other kinds of security properties. The property in question is that, after one successful session of the protocol with C = B and D = A, the two agents effectively agree on the nonces N A and N B despite the potential adversarial interferences. If we write Q = Send(sk A , pk B , N A ) | Rcpt(sk B , pk A , N B ) then this authentication property states that for all traces of Q such that A accepts a nonce N , B has accepted the nonce N A earlier and N = N B . This is a typical example of a reachability property and they can be encoded as equivalences. However this is a rather inefficient approach for several reasons. First of all the complexity of deciding equivalence is significantly (often exponentially) higher than deciding reachability; see the results of Part III, Chapter 7 for more details on that fact. Second this makes the modelling unnatural and error-prone compared to frameworks specialised in reachability properties. For the sake of completeness we wrote a model of this property but a more scalable approach would rely on frameworks and tools natively supporting rechability properties like ProVerif [START_REF] Blanchet | Automatic Cryptographic Protocol Verifier, User Manual and Tutorial[END_REF] or Tamarin [START_REF] Schmidt | The TAMARIN prover for the symbolic analysis of security protocols[END_REF]. Our encoding of authentication consists of verifying the equivalence of Q and Qcheck , where: 1 Q is a process executing Q and then outputting publicly on a dedicated channel a summary of the communication (i.e., the public keys and the nonces of the two participants) 2 Qcheck does the same thing but outputs the summary only after a synchronisation with B, using a private channel, checking that the nonce accepted by A is the one sent by B. All in all Q and Qcheck are trace equivalent intuitively if they perform the final summary output in the same situations. That is, A can accept a nonce N only if N has indeed be sent by B (after accepting the nonce of A itself), which is the expected property.

The property can be verified for several sessions of the protocol by putting instances of P in parallel to Q and Qcheck . Note however that upon completion of a session between A and B, A only has the guarantee of an authentication with one instance of B (but this could be any of the sessions initiated by B with A). This translates as the fact that

Q | R ≈ t Qcheck | R with R = new N A . new N B . Q
These limitations are already discussed in the paper describing the protocol [START_REF] Abadi | Private authentication[END_REF] and have to be mitigated by other mechanisms in the communication following the authentication. For this reason we aim at verifying a property that does not consider this as a security issue. A simple workaround consists of only considering parallel sessions R that may involve A or B but not both in the same session. We refer to frameworks specialised in reachability properties to express more subtle formalisations of the property.

Nonce secrecy and anonymity

Non interference We now model the remaining security objectives of the protocol, namely that it should conceal the identities of the participants (including C the recipient of A and D the connection accepted by B) and the values of the exchanged nonces. A possible formalisation is that there should not be any observable difference in Send(A, C, N A ) and Rcpt(B, D, N B ) when replacing the identities by others and the nonces N A , N B by any other (public) value. For example in a simplistic scenario involving only the role of the sender this would mean that,

∀u 1 , . . . , u 6 ∈ T (F c ∪ F 0 ), ({ {Send(sk u 1 , pk u 2 , u 3 )} }, Φ 0 ) ≈ ({ {Send(sk u 4 , pk u 5 , u 6 )} }, Φ 0 )
where ≈ is either ≈ t or ≈ l and Φ 0 is a frame containing the public keys of all identities involved. The property can then naturally be extended by adding Rcpt in the scenario (and extending the universal quantification over its argument), and even considering several copies of Send and Rcpt with their own arguments to represent several parallel sessions of the protocol. This models a form of non-interference property and has been called strong secrecy in [START_REF] Blanchet | Automatic proof of strong secrecy for security protocols[END_REF] which corresponds to the query noninterf of the ProVerif tool [START_REF] Blanchet | Automatic Cryptographic Protocol Verifier, User Manual and Tutorial[END_REF]. Verifying this property for some fixed values of the u i 's can be seen as a privacy analysis in a particular scenario: this is typically what has been done in Chapter 1, Example 1.7 which models the anonymity of D assuming A wants to communicate B. In some sense, the strong secrecy based modelling captures privacy in all scenarios.

It is possible to express strong secrecy as a compact equivalence statement. This relies on the fact that the following points are equivalent for all processes Q(x), for some fixed a ∈ F 0 :

(i) for all u, v ∈ T (F c ∪ F 0 ), Q(u) ≈ Q(v) (ii) for all u ∈ T (F c ∪ F 0 ), Q(u) ≈ Q(a) (iii) c(x).Q(x) ≈ c(x).Q(a)
That is, we model strong secrecy (i) as the indistinguishability of the situations where the secret value is either replaced by a constant or an attacker-chosen term (iii). The intermediary step (ii) uses the transitivity of ≈ to simplify the definition and make a clearer link between (i) and (iii). A more classical encoding is the equivalence c(x).c(y).Q(x) ≈ c(x).c(y).Q(y)

for example mentioned in the ProVerif manual [START_REF] Blanchet | Automatic Cryptographic Protocol Verifier, User Manual and Tutorial[END_REF]. However our equivalent encoding, by requiring only one input on c for each secret parameter instead of two, is more compact and thus easier to analyse by automated tools.

Security analysis

We thus propose the following equivalence as a model of privacy in the protocol (using the patterned inputs as introduced in Chapter 1, Section 2.3):

({ {! KeyGen | ! AdvRole} }, Φ 0 ) ≈ ({ {! KeyGen | ! CstRole} }, Φ 0 ) (SS)
where KeyGen = new id . g pk(sk(id )) and

Φ 0 = {ax 1 → pk(sk(a))} AdvRole = d( role, x 1 , x 2 , x 3 ). Role(role, sk(x 1 ), pk(sk(x 2 )), x 3 ) CstRole = d( role, x 1 , x 2 , x 3 ). Role(role, sk(a), pk(sk(a)), a) Role(sk , pk , N ) = if role = send then Send(sk , pk , N ) else if role = rcpt then Rcpt(sk , pk , N )
with g, d, a, send, rcpt ∈ F 0 . Intuitively the process KeyGen generates a fresh identity id and reveals its public key to the attacker (who can retrieve id by using the function symbol getID).

When replicated, this process therefore allows the attacker to involve an arbitrary number of agents in the protocol. Then the processes AdvRole and CstRole both receive session data from the attacker on a channel d, and then either execute a role of the protocol with this data or a constant value a, respectively. We can also consider restricted models where the number of protocol participants is bounded by an integer n. This leads to the following equivalence

({ {! 2n KeyGen | ! n AdvRole} }, Φ 0 ) ≈ ({ {! 2n KeyGen | ! n CstRole} }, Φ 0 ) (SS n )
where ! n P is syntactic sugar for n identical parallel copies of P . Note that each role involves 2 identities which is why n protocol participants may involve 2n identities in total.

Proposition 2.1 (bounded model of strong secrecy)

If (SS n ) holds for all n ∈ N then (SS) holds as well.

This proposition essentially follows from the observation that for any processes P, Q, if

! n P ≈ ! n Q for all n ∈ N then ! P ≈ ! Q.
This is a proof technique that proves equivalences session by session. However the converse does not hold a priori: consider for example, for c, 0, 1 ∈ F 0 , the processes

P = c 0 + c 1 Q = c 0 | c 1 We have ! P ≈ ! Q but P ≈ Q.
Using the modelling (SS n ) we can then draw several conclusions when experimenting with this security model under different cryptographic assumptions:

1 The encryption needs to be randomised (experiment: the strong secrecy of the nonces is violated when using aenc instead of raenc). This is however not surprising and this assumption is completely standard. 2 A ciphertext does not need to be indistinguishable from an arbitrary bitstring (experiment: equivalence still holds with the additional rewriting rule testEnc(raenc(x, y, pk(z))) → ok). This somewhat strengthens the security proof by weakening the cryptographic assumptions. 3 The encryption function needs to be key concealing (experiment: trace equivalence is violated with the rewriting rule getKey(raenc(x, y, pk(z))) → pk(z)). Otherwise there is an observable difference between the responses of B upon accepting or refusing a communication. We refer to the Chapter 1, Example 1.7 for an example of an attack trace. [START_REF]Vincent Cheval est le contributeur majoritaire de cette implémentation[END_REF] The decoy message of B is necessary (experiment: trace equivalence is violated when the decoy output d raenc(n, r, pk(s)) is omitted). This also holds if B only emits a decoy message when refusing a connection but not when failing to decrypt the received ciphertext.

The attack traces show that observing whether B responds to particular messages breaks the anonymity of B itself, among others.

Privacy in presence of compromised sessions

Context and model The above equivalences (SS) and (SS n ) only formalise privacy in a context where no agents are compromised, that is, we operate under the trust assumption that the adversary controls the communication network but does not engage in a session of the protocol themselves. This weakens the security guarantees offered by the analysis: for example, although A's anonymity cannot be preserved during a session with a compromised agent C (because the attacker can decrypt all messages sent to C), one would expect that the protocol still preserves the anonymity other honest agents subsequently communicating with A. Although compromised roles are already impliticly modelled within the attacker capabilities, the current formalisation does not permit honest agents to engage a session with them. In a recent work [GHS + 20] a similar approach typically uncovered a flaw on some Noise protocols where the adversary had to engage as a protocol participant to break the anonymity of another, honest agent. As we will see, using this refined attacker model unveils a violation of strong secrecy in the Private Authentication Protocol too.

To capture this kind of scenaarios, it sufficies to allow the adversary to directly choose the public key of the recipient (instead of its identity): the key may then be a honest key pk(sk(id )) forwarded from KeyGen or a key of the form pk(sk ) where sk ∈ F 0 is generated by the adversary. To avoid trivial security violations, the identity and the nonce of a role communicating with a compromised recipient have to be discarded from the security analysis, that is, non-interference is not applied to these parameters. For that we use an additional rewrite rule, purely for modelling purposes, to test compromised keys:

isHonest(pk(sk(x))) → ok
Note that the test "isHonest(k) = ok" can be replaced by "getID(k) = getID(k)" if the theory is constructor-destructor, although the first one is arguably more readable. This eventually leads to the following model of privacy with compromised sessions:

({ {! KeyGen | ! AdvRole c } }, Φ 0 ) ≈ ({ {! KeyGen | ! CstRole c } }, Φ 0 ) (SS c )
where

AdvRole c = d( role, x 1 , x 2 , x 3 ). Role(role, sk(x 1 ), x 2 , x 3 ) CstRole c = d( role, x 1 , x 2 , x 3 ).
if isHonest(x 2 ) = ok then Role(role, sk(a), pk(sk(a)), a) else Role(role, sk(x 1 ), x 2 , x 3 )

As before a version for a bounded number of sessions can be easily derived.

Remark: case of several accepted connections In our modelling of the protocol the recipient B only accepts connections from a unique identity A. A more general model could let B accept identities from a list L of registered agents. When modelling privacy in this context, the discussion above is adapted as follows: 1 to avoid trivial violations, privacy should not apply to the identity and the nonce of B if there is at least one compromised identity in L 2 even if an identity of L is compromised, we expect that the protocol preserves the anonymity of the other honest identities of L, that is, non-interference should apply to them.

Security implications

Using this more general model uncovered a violation of anonymity not captured by (SS); more precisely, the attack showed that there were some (public) values of the nonce N B that could be used to break the anonymity of the agent that generated it.

Although not translating into a real attack if N B is effectively a "fresh unpredicable nonce" as required by the specification of the protocol [AF04], we describe the attack scenario below to highlight what kinds of issues arise from using nonces that are not purely-random bitstrings. For that we recall the definition of the recipient process proposed in Chapter 1:

Rcpt(s, p, n) = d(x). new r. let y, p = radec(x, s) in d raenc( y, n, pk(s) , r, p) else d raenc(n, r, pk(s))
The security violation relies on the fact that, for some instances of n, the decoy message raenc(n, r, pk(s)) can be forwarded to another recipient as the initial message x. Consider for example a scenario where, under some circumstances, an honest recipient B ends up using a nonce N B = u, pk C for some term u and pk C the public key of a compromised agent. Say that B outputs the decoy message m = raenc(N B , r, pk(s)) after refusing a connection from an honest agent A; then for any identity id willing to receive communications from C, the attacker can check whether B = id by sending m to id to initiate a session:

1 if B = id then id will accept and respond with a message encrypted with pk C 2 if B = id then id will refuse and respond with a decoy message encrypted with pk id In particular the attacker can check whether B = id by testing whether decrypting the response of id with sk C succeeds or not, which breaks B's anonymity. This attack can be discarded from the model by considering that the strong secrecy of the parameters should not extend to the decoy nonces, which means replacing the else branch of Rcpt(s, p, n) by . . . else new n . d raenc(n , r, pk(s))

We study this patched property in Chapters 3 and 5 using automated tools, proving it to hold for up to 5 honest participants.

The Basic Access Control protocol

Section summary

We study unlinkability, namely the impossibility to observe that two protocol sessions have been executed by the same person. This captures a form of non-traceability of the users. We illustrate it with the Basic Access Control protocol of the European e-passport (simplified here for readability).

Description of the passport and reader processes

We describe in this section a simplified control flow of the Basic Access Control protocol (BAC) implemented in the European electronic passport. The experiments conducted in later chapters use a more accurate model, closer to the original specification [START_REF]PKI for machine readable travel documents offering ICC readonly access[END_REF]. The protocol consists of a communication between a passport and a reader using the RFID tag of the passport. In a preliminary phase, a reader obtains the private key k of a passport through a trusted channel (in practice the key is printed on the passport and is obtained by the reader using an optical scanner). In the protocol's graphical description below this is represented using dotted arrows. This is then followed by a public challenge using the shared key k.

Passport Reader : k ←- : getChallenge -→ : n ←- : rsenc(n, r, k) bound as x -→ : ok if rsdec(x, k) = n error otherwise
where n, r ∈ N are fresh and getChallenge, ok, error ∈ F 0 . In particular, the passport triggers an error when it receives a communication originated from a reader that does not use the expected key k, i.e., a reader that has been paired with an other passport during the preliminary phase. A typical security concern would be whether this could help linking different sessions of the protocol or not. We model this as follows, with c, d ∈ F 0 and distr ∈ N :

Passport(k) = distr k Reader = distr (x k ) c(x 0 ). if x 0 = getChallenge then d getChallenge . new n. c n . c(x). d(x n ). if rsdec(x, k) = n then c ok new r. d rsenc(x n , r, x k ) else c error
We use two different channels c and d to model that the adversary can distinguish between the messages sent by the passport from those sent by the reader. Since these channels are public, this does not affect the executability of the protocol in the private semantics.

Modelling unlinkability

According to the ISO/IEC 15408-2 standard a protocol provides unlinkability if it "ensures that a user may make multiple uses of [the protocol] without others being able to link these uses together ". This therefore models a property of non-traceability of the users and is often modelled as the indistinguishability of two sets of protocol sessions involving several times the same user in one case and not in the other. However as discussed in [START_REF] Brusó | Linking unlinkability[END_REF][START_REF] Filimonov | Breaking unlinkability of the ICAO 9303 standard for e-passports using bisimilarity[END_REF] there exist several formalisations unlinkability. Referring to the terminology of [START_REF] Arapinis | Analysing unlinkability and anonymity using the applied pi calculus[END_REF] we can mention weak unlinkability and strong unlinkability, depending on whether trace equivalence or bisimilarity is used to model indistinguishability. Since our objective is mostly to benchmark the scalability of our verification techniques, we sticked to weak unlinkability as it fits our implementations (that target trace equivalence, see Chapters 3 and 5) and permitted to develop more succinct models. Concretely we model unlinkability by the following equivalence statement:

! Reader | ! new k. ! Passport(k) ≈ t ! Reader | ! new k. Passport(k) (UL ≈t )
The two sides of the equivalence put in parallel an arbitrary number of readers and passports, the only difference being that several identical passports are allowed to occur on the left side (whereas all passports are fresh on the right side). In particular the trace inclusion from right to left is trivially verified and the property is therefore equivalent to

! Reader | ! new k. ! Passport(k) t ! Reader | ! new k. Passport(k) (UL t )
Let us then study how this property can be adapted for a bounded number of sessions, say, for n passport and readers. For that we consider a fixed set K of n distinct names; the two inclusions of (UL ≈t ) can then be rephrased respectively as

   ∀k 1 , . . . , k n ∈ K, Dupl(k 1 , . . . , k n ) t Fresh ∃k 1 , . . . , k n ∈ K, Fresh t Dupl(k 1 , . . . , k n ) with Dupl(x 1 , . . . , x n ) = ! n Reader | Passport(x 1 ) | • • • | Passport(x n ) and Fresh = ! n Reader | ! n new k. Passport(k)
This time again the second inclusion is trivial (it sufficies to choose k 1 , . . . , k n pairwise distinct) and only the first inclusion matters. We know show how to remove the universal quantification on K by using a similar trick as in the Private Authentication protocol (Section 1), namely involving the adversary in the model to avoid an explicit enumeration of all cases. For that we let a private function symbol sk/1 that takes the identity of the passport's owner (chosen by the adversary) as an argument and returns its private key. This leads to the following model of weak unlinkability for n sessions of the protocol:

c(id 1 ) . . . c(id n ). Dupl(sk(id 1 ), . . . , sk(id n )) t c(id 1 ) . . . c(id n ). Fresh (UL t n )
Similarly to our model of strong secrecy proving this bounded model for all n is a sufficient condition to obtain security in the unbounded case but not a necessary condition a priori. It is also possible to consider another model of unlinkability for a bounded number of sessions capturing the stronger requirement that the adversary should not be able to distinguish between n different passports and any fixed set of (not necessarily identical) n passports. This kind of models are for instance investigated in [CCLD11, CKR18a, CKR19] and are obtained by replacing inclusion with equivalence in the definition of (UL t n ). Formally:

c(id 1 ) . . . c(id n ). Dupl(sk(id 1 ), . . . , sk(id n )) ≈ t c(id 1 ) . . . c(id n ). Fresh (UL ≈t n )
Proposition 2.2 (relation between the four models of unlinkability)

∀n ∈ N, (UL ≈t n ) =⇒ ∀n ∈ N, (UL t n ) =⇒ (UL t ) ⇐⇒ (UL ≈t )
The following security conclusions can then be drawn with respect our different models of unlinkability in the BAC protocol: 1 How error messages are handled may break unlinkability (experiment: (UL ≈t ) is violated when using an older version of the BAC protocol, not detailed here, using different error messages for different authentication errors). This security violation is mostly known from [START_REF] Chothia | A traceability attack against e-passports[END_REF][START_REF] Arapinis | Analysing unlinkability and anonymity using the applied pi calculus[END_REF]. The flawed protocol was implemented in the French version of the epassport and has been patched since then leading to the standard we analyse here. 2 The current BAC standard verifies (weak) unlinkability (experiment: (UL ≈t ) holds). This fact has been proved in [START_REF] Hirschi | A method for verifying privacy-type properties: the unbounded case[END_REF] using a frontend to the ProVerif tool. This conclusion can be hinted by the results in the bounded case by Proposition 2.2 as we observed during our own experiments that (UL t n ) held for n 5; see Chapters 3 and 5 for more details. 3 In some cases the adversary can non-trivially lower bound the number of distinct passports involved in the communication (experiment: (UL ≈t n ) does not hold for any n 2). This equivalence violation is for example pointed out using automated tools in Chapter 3 or in [START_REF] Cheval | DEEPSEC: Deciding equivalence properties in security protocols theory and practice[END_REF]CKR19]: for n = 2 for example, since the inclusion (UL t n ) holds, this means that after observing two sessions of the protocol, if they were executed by two different passports then the adversary may be able to know it. This is however not standardly considered as a practical security issue in the sense that it is not in contradiction with (UL ≈t ) holding.

Unlinkability in presence of compromised sessions

As in Section 1.3 we may observe that the security definition (UL ≈t ) implicitly assumes that there are no compromised protocol sessions, that is, that the adversary never initiates a session with their own passports. As before a compromised key can be modelled by an attackergenerated term and the definition of unlinkability can be refined as follows:

! Reader | ! a(x). Passport(x) | ! new k. ! Passport(k) ≈ t ! Reader | ! a(x). Passport(x) | ! new k. Passport(k) (UL ≈t c )
for some channel a ∈ F 0 . We naturally have (UL ≈t c )⇒(UL ≈t ). Variants for a bounded number of sessions can also be defined along the same lines as before. Unlike the Private Authentication protocol, we did not identify additional security violations by extending the attacker model this way, although this naturally enriched the set of considered scenarios significantly.

E-voting protocols

Section summary

We study ballot privacy for a fixed number of voters in a mixnet variant of the Helios e-voting protocol with some modifications inspired by Belenios [START_REF] Cortier | Belenios: a simple private and verifiable electronic voting system[END_REF] (stronger zero-knowledge proofs) added to thwart several security issues. We study several formalisations of privacy: one common model in symbolic approaches using vote swapping and another model inspired by the BPRIV computational definition that permits to abstract the revoting scenario from the process.

Symbolic and cryptographic definitions of ballot privacy

We study here protocols used to conduct elections remotely. Many security properties may be expected from them, a typical one being ballot privacy: it should not be possible to learn more information on a vote than what is revealed by the result of the election. This property has been formalised using several approaches, including symbolic models using trace equivalence [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF] but also computational (or cryptographic) models [BY86, Ben87, BCG + 15]. In the latter ballot privacy is formalised as the impossibility, up to negligible probability, for an attacker to guess which of two systems they are interacting with. The two systems typically differ in a parameter related to how participants have voted, which makes this approach similar in spirit to our modelling of privacy in the applied pi calculus with behavioural equivalences. Pushing the analogy further, the two symbolic models of ballot privacy we present later in the section can be seen as the symbolic analogue of two existing computational definitions.

To highlight the link between the two approaches we give below an intuition of the two cryptographic definitions in question and will later formalise our symbolic models using a similar terminology. In computational models the adversary interacts with so-called oracles in a black-box manner. They are usually of the following kinds in definitions of ballot privacy: Many formalisations of ballot privacy rely on a secret parameter β ∈ {0, 1} that affects the O voter oracle, that is, how honest voters vote. Privacy is then considered broken if, after interacting with the oracles for a random value of β, the adversary can guess the value of β with probability significantly better than 1 2 . For example an early definition of ballot privacy relies on permutations of honest voters [START_REF] Josh | Distributing the power of a government to enhance the privacy of voters[END_REF]: in this definition the voter oracle receives the identity of two honest voters id 1 , id 2 , two votes v 0 , v 1 , and casts two ballots for v 0 and v 1 in the name of id β and id 1-β , respectively. The inability for the attacker to guess β with significant probability intuitively models that a coalition of voters cannot isolate the vote of a specific honest voter. In a more recent definition called BPRIV [BCG + 15], the voter oracle receives one honest identity id , two votes v 0 , v 1 and casts a ballot for v β in the name of id . In some sense the attacker therefore constructs two elections in parallel, one for each value of β, but only has access to the public bulletin board corresponding to the value of β they are effectively interacting with. The result announced when tallying is then always the one corresponding to the case β = 0: this way, the inability for the attacker to guess β with significant probability models that one cannot distinguish the ballots effectively used during an election (case β = 0) from irrelevant ballots that did not affect the result (case β = 1).

Our two symbolic definitions of ballot privacy recall the two cryptographic ones above, replacing probabilistic indistinguishability by trace equivalence. More precisely we will study: 1 A well-established model by vote swap [DKR09, ACK16] that states that the two voting scenarios obtained by swapping the votes of two honest voters are trace equivalent. This reminds of the cryptographic model by vote permutation mentioned above. 2 A model directly inspired from BPRIV, simulating the interaction adversary-oracles with processes of the applied pi calculus. We are not aware of existing formalisations of BPRIV in a symbolic setting. We present these definitions in the case of a variant of the Helios protocol [START_REF] Adida | Helios: Web-based open-audit voting[END_REF].

The Helios protocol

Modelling voting protocols We first introduce some notations for formalising voting systems. We assume a set of votes V that contains the values the voters vote from and the set of their identities I. We also let R be the result space that contains all the possible outcomes of the election; in a majority vote for example we would have V = R but the result can also include the vote count, or even the multiset of all ballots for verifiability purpose. The voting system is then split in several components: 1 The voter process Voter that simulates the honest voters. A process DVoter is needed as well depending on the model to simulate dishonest voters explicitly. 2 The ballot box process BallotBox that receives the ballots from the voters and stores them into a state BB. Upon receiving a new ballot b, it performs a validity check Valid(b, BB) and only adds b to the ballot box if it succeeds. This test can for instance be a verification of a zero knowledge proof or that an identical ballot is not already in the box. 3 We choose not to model the public bulletin board by an explicit process; instead, all honest ballots are revealed to the adversary before being effectively cast. [START_REF]Vincent Cheval est le contributeur majoritaire de cette implémentation[END_REF] The tally process Tally that takes the ballot box BB, the secret key of the election sk , and publishes the result of the election.

The case of Helios

We now illustrate this framework by presenting a mixnet variant of the Helios protocol [START_REF] Adida | Helios: Web-based open-audit voting[END_REF]. We also discuss a security issue that leads us to strengthen the zero knowledge proofs in the model. A schematic description is provided in Figure 2.1.

Voter 1 Ballot Box Bulletin Board Tally Mixnet (id 1 ,b 1 ,zk 1 ) (id n ,b n ,zk n ) b i = raenc(v i ,r i ,p) zk i = zkp(b i ,v i ,r i ) p public key of the election with {b 1 ,…,b n } v µ(1) , … ,v µ(n) µ permutation
Voter n The voter casts their vote by connecting to a server using a password-based authentication and sending the corresponding ballot from there (which is at the same time published on the public bulletin board). Although the communication between the voters and the ballot box is not private (because its content is published on the bulletin board), this channel is often assumed authenticated due to the password authentication. That is, we assume that the ballot box effectively stores the ballot sent by the voter. Naturally making this assumption implies that the ballot box itself has not been compromised. After the voting phase is closed the ballot box sends all ballots to the tally that decrypts them, shuffles the votes using a mixnet, and eventually outputs all votes in clear.

In Helios a ballot contains the vote encrypted with the public key of the election and a zero-knowledge proof justifying that the ballot is well formed, checked by the ballot box before storing the encrypted vote. This zero-knowledge proof essentially corresponds to the theory described in Chapter 1, Example 1.2.

Trust assumptions

We now discuss which of the above components may be trusted or not and discuss, informally at first, the implications in terms of security and modelling. Mainly three entities may be compromised in the system:

The case of potential dishonest voters is already explicitly considered by our definitions. In the applied pi calculus, they can be modelled by a dedicated process or by allowing the ballot box to receive ballots directly from the adversary. Regarding the tally, it needs to be assumed honest to expect privacy. This assumption is backed up by the common practice to split the tally into several independent entities, each possessing a part of the secret key of the election. This way compromising the tally intuitively requires to take control over all of its parts, or a given threshold. Finally we discuss the case of a compromised ballot box, which is notorious for posing many modelling issues [START_REF] Cortier | Fifty shades of ballot privacy: Privacy against a malicious board[END_REF]. On the one hand assuming an honest ballot box weakens security and is not aligned with practical concerns (in particular the fact that many e-voting systems include verifiability measures precisely so that voters can check that their vote has been correctly included in the ballot box). But on the other hand a completely dishonest ballot box is incompatible with privacy: the attacker could drop all ballots except one and the result of the election would reveal the underlying vote.

Therefore attempts to model a dishonest ballot box usually parametrise their definition with the set of adversarial actions that are not tolerated [START_REF] Cortier | Fifty shades of ballot privacy: Privacy against a malicious board[END_REF]. For example dropping all ballots but one seems to be an unavoidable privacy loss and this should not be considered as a violation of ballot privacy. In vote-swapping models one usually gets around this issue by a modelling trick allowing the tally to operate only if each honest voter has a ballot in their name in the ballot box [START_REF] Arapinis | When are three voters enough for privacy properties[END_REF][START_REF] Cheval | DEEPSEC: Deciding equivalence properties in security protocols theory and practice[END_REF]. In addition our processes all assume that the channel between the voter and the ballot box is trusted, at least to the extent that an honest vote may not be modified. All in all this essentially limits our dishonest-ballot-box models to dropping a strict subset of the ballots of each voter, and possibly reordering them before they reach the ballot box. As our primary focus is benchmarking we leave open the problem of designing a more realistic symbolic model of a dishonest ballot box.

Two definitions of ballot privacy

Helios in the applied pi calculus Let us now explain how to model the protocol in the applied pi calculus. First of all the honest-voter process can be defined as follows, where c ∈ F 0 is a public channel used to publish ballots to the bulletin board, bb ∈ N is a private channel between the voter and the ballot box and pk is the public key of the election:

Voter(v, id ) = new r. let ballot = raenc(v, r, pk ) in let proof = zkp(ballot, v, r) in c id , ballot, proof . bb id , ballot, proof
If the voter is dishonest then arbitrary ballots b may be sent. The process is therefore simply DVoter(b) = bb b . Let us now model the ballot box. We represent its internal state by a tuple of n ballots, where n is the fixed number of registered participants id 1 , . . . , id n . We present here the case n = 2 for simplicity. This internal state is passed through different parallel copies of the BallotBox process below using a private channel s ∈ N :

BallotBox = s( b 1 , b 2 ). bb( id , b, proof ). if checkzkp(proof , b) = ok then if id = id 1 then s b, b 2 else if id = id 2 then s b 1 , b else s b 1 , b 2 else s b 1 , b 2
A ballot box accepting at most p votes will thus be modelled by the process ! p BallotBox. Here the channel bb between the voter and the ballot box is authenticated but nothing forces to execute communications on bb after a honest vote has been generated. That is, the ballot box may drop or reorder ballots but a priori nothing more. Another possible model of this (limited) form of non-trusted ballot box is to use a public channel instead of bb but compensating by signing messages (see the theory of signatures of Chapter 1, Example 1.2). This alternative modelling makes the theory more complex but has the advantage of rendering the process DVoter superfluous. On the contrary a model of a completely honest ballot box would have to ensure that the ballot has been cast before carrying the internal state on channel s. This can be done by merging the BallotBox process into the voter processes:

Voter h (v, id ) = DVoter h (x) = s( b 1 , b 2 ). s( b 1 , b 2 ). new r. let ballot = raenc(v, r, pk ) in let id , ballot, proof = x in let proof = zkp(ballot, v, r) in if checkzkp(proof , ballot) = ok then c id , ballot, proof . if id = id 1 then s ballot, b 2 if id = id 1 then s ballot, b 2 else if id = id 2 then s b 1 , ballot else if id = id 2 then s b 1 , ballot else s b 1 , b 2 else s b 1 , b 2 else s b 1 , b 2
In this case the ballot box process is not necessary anymore. Finally we define the tallying process that receives the internal state through the channel s and publishes the result of the election. If sk is the secret key of the election:

Tally = s( b 1 , b 2 ). let v 1 = rsdec(b 1 , sk ) in let v 2 = rsdec(b 2 , sk ) in (c v 1 | c v 2 )
The mixnet is modelled by outputting the final votes v 1 , v 2 on parallel processes: the vote shuffling is thus represented by the inherent non-determinism of parallel operators. Note also that this model of the tally assumes the ballot box honest to some extent since the final result is output only if a valid vote has been received for each voter. This assumption can be liftedalthough this will break ballot privacy in the case of the vote swap definition-by removing the let . . . in instructions and directly outputting rsdec(b 1 , sk ) and rsdec(b 2 , sk ). This way only valid votes (i.e., messages) are tallied but nothing forces all votes to be valid to output a partial result.

Definition by vote swap

We formalise ballot privacy in the applied pi calculus as the indistinguishability of two processes where the votes of two honest voters are swapped [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF][START_REF] Arapinis | When are three voters enough for privacy properties[END_REF]. Let us thus assume that V = {0, 1} and consider the identities of two honest voters id 1 , id 2 ∈ I and a dishonest voter id 3 . We then consider the process modelling the voting system for three voters:

VotingSystem(v 1 , v 2 ) = O voter (v 1 , v 2 , id 1 , id 2 ) | ! n O cast | ! p BallotBox | Tally with O voter (v 1 , v 2 , id 1 , id 2 ) = Voter(v 1 , id 1 ) | Voter(v 2 , id 2 ) and O cast = c( ballot, proof ). DVoter( id 2 , ballot, proof )
This models a system with three voters emitting n+2 ballots including n dishonest ones and a ballot box accepting p ballots maximum. Ballot privacy is then modelled by the equivalence:

VotingSystem(0, 1) ≈ t VotingSystem(1, 0)
There exists a reduction result justifying that it is sufficient to consider two honest voters and a dishonest one to prove ballot privacy for an arbitrary number of voters w.r.t. formalisations of ballot privacy by vote swap [START_REF] Arapinis | When are three voters enough for privacy properties[END_REF]. The reference [START_REF] Arapinis | When are three voters enough for privacy properties[END_REF] also provides a bound on p (7 if revote is allowed). However there are a priori no bounds on the number of times each voter may revote, which is therefore the only variable parameter of our bounded model. Yet note that, although dishonest revotes are modelled by the n copies of the cast oracle, it is not clear how to model honest revotes with this definition. A simple revoting scenario can still be captured by putting several parallel copies of O voter (v 1 , v 2 , id 1 , id 2 ), thus modelling honest voters that generate several ballots for their fixed candidate. We leave open the modelling of a more general revote scenario w.r.t. this definition.

We finally discuss briefly some of the known security issues related to Helios and how they are reflected in this model.

1 Helios is not ballot private (experiment: VotingSystem(0, 1) ≈ t VotingSystem(1, 0)). Helios is known to be vulnerable to ballot copy, a technique introducing a bias in the result of the election to break privacy [START_REF] Cortier | Attacking and fixing helios: An analysis of ballot secrecy[END_REF]. Looking at a trace violating trace equivalence we obtain the following attack scenario in our context of two honest voters id 1 , id 2 and one dishonest voter id 3 . The two honest voters vote for v 1 and v 2 , respectively. The adversary then copies, from the bulletin board, the encrypted vote of id 2 and the corresponding zeroknowledge proof and asks id 3 to cast them as its own ballot. After tallying the attacker knows that the vote that appears at leat twice in the result is the vote of id 2 . A graphical display of the attack can be found in Figure 2.2.

(id 1 ,b 1 ,zk 1 ) Voter 1 Voter 2 attacker Tally v 1 v 2 v 2 copy (id 2 ,b 2 ,zk 2 ) (id 3 ,b 2 ,zk 2 ) Figure 2.2 Ballot-copy attack
2 Ballot copy can be mitigated using weeding, but this countermeasure is inefficient if honest voters can generate more than one vote. The discovery of this issue has been pointed to us by Peter Rønne (private communication, 2016). A natural countermeasure usually considered in Helios against ballot copy is to use a weeding procedure, that is, to remove duplicated ballots from the ballot box. Trace equivalence can be proved with this new protocol. However a variant of the ballot-copy attack can be mounted if a honest voter generates several ballots (for example if the first ballot did not reach the ballot box due to adversarial interferences, forcing the voter to generate a new one). Indeed, assuming the honest voter generates two ballots for v ∈ V and, say, only the second one reaches the ballot box, it sufficies to copy and cast in one's name the first ballot to mount a ballot-copy attack despite weeding. This is reflected in the model as the equivalence violation in the simple revote scenario described earlier, i.e., VotingSystem w (0, 1) ≈ t VotingSystem w (1, 0) where

VotingSystem w (v 1 , v 2 ) = ! 2 O voter (v 1 , v 2 , id 1 , id 2 ) | O cast | ! 2 BallotBox w | Tally
where BallotBox w is the variant of BallotBox that only accepts a ballot if it passes the zero-knowledge proof and no identical encrypted vote have been received before. 3 The ballot-copy attack is thwarted by including the identity in the zero-knowledge proofs (experiment: trace equivalence holds with this new theory). Another possible countermeasure to ballot copy is to streghten the zero-knowledge proofs by including the identity of the voter inside. That is, we add an additional argument to the symbols zkp and checkzkp compared to the theory of Chapter 1, Example 1.2 and use the new rewrite rule:

checkzkp(zkp(raenc(m, r, pk(k)), m, r, id ), raenc(m, r, pk(k)), id ) → ok
This way it is not possible anymore to cast someone else's ballot in one's own name. Our experiments in Chapters 3 and 5 include the verification of trace equivalence for this variant for up to a total of 10 ballots emitted by two honest voters.

Definition inspired by BPRIV We now explain how to model the BPRIV definition outlined at the beginning of this chapter. We are not aware of existing formalisations of this definition in the applied pi calculus or symbolic models in general. To stick to the formalism of BPRIV [BCG + 15] we define 1 the voting oracle O β voter , β ∈ {0, 1}, that generates a vote for v 0 and v 1 , casts them in two different ballot boxes, and publish the ballot for v β on the bulletin board but effectively tallies v 0 . 2 the cast oracle O cast that casts a ballot b in the name of the dishonest voter id . We present here the definition of ballot privacy in the case of one honest voter id 1 and one dishonest voter id 2 . We first define the two voting oracles:

O β voter = c( v 0 , v 1 ). new r 0 . let ballot 0 = raenc(v 0 , r 0 , pk ) in new r 1 . let ballot 1 = raenc(v 1 , r 1 , pk ) in let proof 0 = zkp(ballot 0 , v 0 , r 0 ) in let proof 1 = zkp(ballot 1 , v 1 , r 1 ) in c id 1 , ballot β , proof β . bb id 1 , ballot 0 , proof 0
Then the cast oracle is essentially the same process as DVoter:

O cast = c( ballot, proof ). DVoter( id 2 , ballot, proof )
Note that in general the process BallotBox also has β as a parameter since the validity test Valid depends on the state of the bulletin board. However the situation is simpler for zeroknowledge-proof-based validity tests since they only depend on the submitted ballot. Still note that this is not the case for the weeding-based variant of the protocol which checks that no identical ballots have previously been cast. Here ballot privacy is thus simply defined as VotingSystem 0 ≈ t VotingSystem 1 where

VotingSystem β = ! m O β voter | ! n O cast | ! p BallotBox | Tally
This models a scenario with m calls to the voting oracle, n calls to the cast oracle and p ballots accepted by the ballot box. This covers arbitrary revote scenarios and all security issues witnessed using the vote-swapping model are reflected in this model as well.

Remark: reduction result for BPRIV We mentioned a reduction result for the vote-swap model proving that ballot privacy for an arbitrary number of voters was equivalent to ballot privacy for three voters and a bounded number of ballots accepted by the ballot box [START_REF] Arapinis | When are three voters enough for privacy properties[END_REF]. One may conjecture that a similar reduction result could be proved for the BPRIV definition but leave an investigation of this problem to future work.

Introduction Automated verification of equivalence properties

In Part I we introduced the applied pi calculus and two notions of behavioural equivalence in this model, trace equivalence and labelled bisimilarity, that can be used to model various forms of privacy in security protocols. In this part we will be more interested in the decidability of these equivalences. We detail the related work and our contributions below.

Decidability results

The problem of analysing security protocols is undecidable in general but several decidable subclasses have been identified. While complexity results are known for reachability properties [START_REF] Durgin | Multiset rewriting and the complexity of bounded security protocols[END_REF][START_REF] Rusinowitch | Protocol insecurity with a finite number of sessions, composed keys is NP-complete[END_REF] the case of behavioural equivalences remains mostly open. For active attackers, bounding the number of protocol sessions is often sufficient to obtain decidability results [START_REF] Rusinowitch | Protocol insecurity with a finite number of sessions, composed keys is NP-complete[END_REF] and is of practical interest: most real-life attacks indeed only require a small number of sessions. In this context Baudet [START_REF] Baudet | Sécurité des protocoles cryptographiques: aspects logiques et calculatoires[END_REF], and later Chevalier and Rusinowtich [START_REF] Chevalier | Decidability of equivalence of symbolic derivations[END_REF], showed that real-or-random secrecy was coNP for subterm convergent theories, by checking whether two constraint systems admit the same set of solutions. These procedures however require some restrictions: they do not allow for else branches, nor do they verify trace equivalence in full generality. In [START_REF] Cheval | Deciding equivalence-based properties using constraint solving[END_REF], Cheval et al. have used Baudet's procedure as a black box to verify trace equivalence of determinate processes. This class of processes (to be defined in Chapter 5) is of practical interest but insufficient for many anonymity properties. Finally, decidability results for an unbounded number of sessions were proposed in [START_REF] Chrétien | From security protocols to pushdown automata[END_REF][START_REF] Chrétien | Decidability of trace equivalence for protocols with nonces[END_REF], but with severe restrictions on the processes and on the theory (we detail these results more in a survey in Part III, Chapter 7).

Tool support (bounded) There are already mature tools for reachability properties, see ProVerif [START_REF] Blanchet | Modeling and verifying security protocols with the applied pi calculus and proverif[END_REF] and Tamarin [START_REF] Schmidt | The TAMARIN prover for the symbolic analysis of security protocols[END_REF] for example, but some prototypes also exist for verifying equivalence properties. We start discussing tools that are limited to a bounded number of sessions. The SPEC tool [TD10, TNH16] verifies a sound symbolic bisimulation, but is restricted to particular cryptographic primitives (pairing, encryption, signatures and hash functions) and does not allow for else branches. The APTE tool [CCLD11, Che14] also covers fixed primitives but allows else branches and decides trace equivalence exactly, using a constraint-solving approach similar to ours. On the contrary, the Akiss tool [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocols[END_REF] allows for user-defined cryptographic primitives. The tool is based on Horn clause resolution. Partial correctness of Akiss is shown for primitives modelled by arbitrary theories that have the finite variant property [START_REF] Comon | The finite variant property: How to get rid of some algebraic properties[END_REF]. Termination is additionally shown for subterm convergent rewrite systems. However, Akiss only decide trace equivalence of determinate processes; for other 65 Part II: DEciding Equivalence Properties in SECurity protocols processes trace equivalence can be both over-and under-approximated which still proves to be sufficient on many examples. The recent SatEquiv tool [CDD17, CDD18] uses a different approach: it relies on Graph Planning and SAT solving to verify trace equivalence, rather than a dedicated procedure. The tool is extremely efficient and several orders of magnitude faster than other tools, but can only handle a fixed set of cryptographic primitives, does not support else branches, and only considers a class of simple processes (a subclass of determinate processes) that satisfy a type-compliance condition. These restrictions severely limit its scope.

Tool support (unbounded) Other tools support verification of equivalence properties, even for an unbounded number of sessions. This is the case of ProVerif [START_REF] Blanchet | Modeling and verifying security protocols with the applied pi calculus and proverif[END_REF], Tamarin [SMCB13], Maude-NPA [START_REF] Santiago | A formal definition of protocol indistinguishability and its verification using maudenpa[END_REF] which all allow for user-defined cryptographic primitives. However, given that the underlying problem is undecidable, these tools may not terminate. Moreover, they only approximate trace equivalence by verifying the more fine-grained diffequivalence. We study this equivalence more precisely in Chapter 5 but we can mention now that it is too fine-grained on many examples. While some recent improvements of ProVerif [CB13, BS18] helps covering more protocols, general verification of trace equivalence is still out of scope. For instance, the verification by Arapinis et al. [AMR + 12] of unlinkability in the 3G mobile phone protocols required some "tricks" and approximations of the protocol to avoid false attacks. In [CGLM17, CGLM18], Cortier et al. develop a type system and automated type checker for verifying equivalences. While extremely efficient, this tool only covers a fixed set of cryptographic primitives and does not capture arbitrary proofs of trace equivalence. A different approach has been taken by Hirschi et al. [START_REF] Hirschi | A method for verifying privacy-type properties: the unbounded case[END_REF], identifying sufficient conditions provable by ProVerif for verifying unlinkability properties, implemented in the tool Ukano, a front-end to the ProVerif tool. Ukanodoes however not verify equivalence properties in general.

The DeepSec prover In Part II we contribute to the practical verification of equivalence properties when the number of sessions is bounded. We emphasise again that even in this setting, the system under study has infinite state space due to active attacker controlling the network who can forge messages and use them to interact with the protocol. Our work targets the wide class of constructor-destructor subterm convergent theories.

In Chapter 3 we show how the decision of trace equivalence and labelled bisimilarity can be reduced to a form of constraint solving, using a novel notion of partition tree. This type of approach is rather common for the decidability of equivalences [Bau07, DKR07, LL10, CCD13]. This results in an high-level procedure that takes the form of a tree generation, assuming an oracle to a constraint solver. Before going into the technical details of the solver, we present the implementation of the procedure for trace equivalence, the DeepSec prover, and compare its performances against some of the previously-mentioned tools for equivalence verification in a bounded number of sessions. Chapter 4 is then a more technical chapter that describes in details the constraint solving procedure used in an abstract way in Chapter 3 and give correctness arguments. Termination and complexity will be studied later in Part III.

Proof symmetries Finally in Chapter 5 we develop a new optimisation technique for the decision of trace equivalence that takes the form of a a sound refinement of trace equivalence that we call equivalence by session. This new equivalence exploits better the process structure and symmetries that arise during practical verification, to the cost of some occasional false attacks. This enables us to handle all examples presented in the experiments of Chapter 3 with a verification time reduced by orders of magnitude by the use of partial order reductions (por) and reductions by symmetry that we prove correct.

In terms of related work, por techniques for the verification of cryptographic protocols were first introduced by Clark et al. [START_REF] Clarke | Efficient verification of security protocols using partial-order reductions[END_REF]: while well developed in verification of reactive systems these existing techniques do not easily carry over to security protocols, mainly due to the symbolic treatment of attacker knowledge. Mödersheim et al. [START_REF] Mödersheim | Constraint differentiation: Search-space reduction for the constraint-based analysis of security protocols[END_REF] proposed por techniques that are suitable for symbolic methods based on constraint solving. However, both the techniques of [START_REF] Clarke | Efficient verification of security protocols using partial-order reductions[END_REF] and [START_REF] Mödersheim | Constraint differentiation: Search-space reduction for the constraint-based analysis of security protocols[END_REF] are only correct for reachability properties. Partial order reduction techniques for equivalence properties were only introduced more recently by Baelde et al. [START_REF] Baelde | A reduced semantics for deciding trace equivalence using constraint systems[END_REF][START_REF] Baelde | Partial order reduction for security protocols[END_REF]: implementing these techniques in the APTE tool resulted in spectacular speed-ups. Other state-of-the-art tools for a bounded number of sessions such as Akiss and even the implementation of DeepSec presented in Chapter 3, integrated these techniques as well. However, these existing techniques are limited in scope as they require protocols to be determinate. Examples of protocols that are typically not modelled as determinate processes are the BAC protocol, and the Helios e-voting protocol mentioned in Chapter 2. In recent work, Baelde et al. [START_REF] Baelde | POR for security protocol equivalences -beyond action determinism[END_REF] propose por techniques that also apply to nondeterminate processes (but do not support private channels) and implement these techniques in the DeepSec tool. Unfortunately, these techniques introduce a computational overhead, that limits the efficiency gain. As our experiments will show, our techniques, although including some approximations (potential false attacks), significantly improve efficiency. We also mention the less recent work including some symmetries (but no partial-order) reductions [START_REF] Cibrario | Exploiting symmetries for testing equivalence in the spi calculus[END_REF] to a tool, S 3 A [DSV03], that verifies testing equivalence in the spi calculus. The tool however only supports a fixed equational theory and no else branches, and we are not aware of a publicly available implementation. In the experiments of Chapter 5 we will therefore focus on the performance comparison against the procedure evaluated in Chapter 3.

Finally, our approach can also be compared to tools for an unbounded number of sessionsor more precisely to tools that verify diff equivalence which takes a similar approach as us in the sense that it is a sound refinement of trace equivalence like equivalence by session. In particular both techniques may fail to prove equivalence of processes that are trace equivalent. However equivalence by session is less fine-grained, for example capturing equivalence proofs for the BAC protocol. A detailed comparison between these two equivalences is given in Chapter 5. Moreover, the restriction to a bounded number of sessions allows us to decide equivalence by session, while termination is not guaranteed for tools in the unbounded case.

Chapter 3: Automated analysis for bounded processes Summary.

In this chapter we present an algorithm for proving equivalence of bounded processes. The approach is based on a symbolic semantics representing adversarial inputs by constraints expressing which values these inputs may take. The overall procedure then relies on a constraintsolving procedure (used in a black box manner here and detailed in Chapter 4 for constructordestructor subterm convergent theories). This generates a so-called partition tree that can be seen, intuitively, as a proof tree that the processes are equivalent. We also discuss implementation choices and evaluate the performances of the resulting automated tool, DeepSec.

1 The symbolic approach for decidability

Section summary

We introduce another process semantics replacing adversarial inputs by constraint systems and a novel notion of most general solutions. This makes the resulting transition system finitely branching (unlike the standard semantics), thus reducing protocol analysis to constraint solving.

Constraint systems

Our decision procedures for process equivalences rely on a symbolic semantics, by opposition to the usual semantics of the calculus that we will call the concrete semantics from now. Rather than requiring the attacker to provide concrete recipes, we record the constraints they should satify to reach a certain point in the protocol, thus providing a finite representation of the infinite set of actions available to the attacker. For example let c ∈ F 0 , h/1 ∈ F c and

P = new k. c k . c(x). if fst(x) = k then c h(x)
The trace executing the output h(x) will gather constraints that intuitively indicate that: 1 x is a term deducible by the attacker from the frame {ax 1 → k}; and 2 x = k, y for some term y. A constraint solving algorithm, detailed in Chapter 4, can then be used to show that these constraints have a solution: the recipe ξ = ax 1 , a , a ∈ F 0 can be used to deduce the input term x and satisfy the constraints, thus proving the output of h(x) to be reachable. Similar approaches are common to decide reachability or equivalence properties [START_REF] Baudet | Sécurité des protocoles cryptographiques: aspects logiques et calculatoires[END_REF][START_REF] Cheval | Deciding equivalence-based properties using constraint solving[END_REF]; our approach has however a larger scope.

69

Formalising symbolic constraints In order to store the order of output terms in a frame Φ, we assume that dom(Φ) is always of the form {ax 1 , ax 2 , . . . , ax n }, that is, axioms are introduced by increasing index order. In order to define constraints we also introduce a new type of variables for recipes: Definition 3.1 (second-order terms)

From now on we consider a partition of the set of variables X = X 1 X 2 . The elements of X 1 are called first-order variables and correspond to the variables we used so far in terms (appearing in processes, frames, rewrite rules). Those of X 2 are called second-order variables and are used to represent an undefined recipe. A first-order term is an element of T (F ∪ F 0 ∪ N ∪ X 1 ) and a second-order term is an element of T (F ∪ F 0 ∪ AX ∪ X 2 ).

We now distinguish vars 1 (u) = vars (u) ∩ X 1 and vars 2 (u) = vars (u) ∩ X 2 . Note that we say that a second-order term t is ground if vars 2 (t) = ∅, i.e., t may contain axioms. Recalling Definition 1.8, a recipe is therefore a ground second-order term. We also adapt the other notations of the term algebra to reflect the separation: subterms 1 , subterms 2 ... When executing an input x in the symbolic semantics, x will be associated to a fresh second-order variable X that will serve as a placeholder for the underlying recipe.

Definition 3.2 (second-order substitutions)

We suppose a partition of X 2 = n∈N X 2 i with each class X 2 i being infinite. If X is a second-order variable we may write X: i to emphasise that X ∈ X 2 i X 2

i-1 and say in this case that X is of type i. A second-order substitution is then a substitution Σ of domain dom(Σ) ⊆ X 2 that respects the types, that is,

∀X: i ∈ dom(Σ), XΣ ∈ T 2 i where T 2 i = T (F ∪ F 0 ∪ X 2 i ∪ {ax 1 , . . . , ax i })
Intuitively, if X is a second-order variable associated to an input variable x, the type of X carries the information of which axioms were available at the time x was performed. The restriction that second-order substitutions respect types thus ensures that X will be instantiated by a recipe that is consistent with the frame x is constructed from. We can then define the constraints that we use to characterise the possible values x may take:

Definition 3.3 (constraint)
We consider the following three kinds of atomic formulas: 1 deduction fact ξ ? u where u is a message in normal form and ξ is a second-order term such that root(ξ) / ∈ F c ; 2 second-order equations ξ = ? ζ where ξ and ζ are two second-order terms; 3 (first-order) equations u = ? v where u and v are two messages in normal form. A constraint is then a first-order formula over these atoms, that is, either , ⊥, one of the three atoms above, or of the form ϕ∧ψ, ϕ∨ψ, ¬ϕ, ∀x.ϕ, or ∀X: n.ϕ for ϕ, ψ constraints. Note that vars (ϕ) then refers to the free variables of the constraint ϕ. The negation ¬(α = ? β) of an equation is written α = ? β and called a disequation.

A deduction fact ξ ? u indicates that term u is deducible by the recipe ξ and second-order equations ξ = ? ζ are used to put restrictions on which recipes ξ may be used to do so. For example X : i ? x states that the variable x is to be replaced by a term deducible by the attacker using at most the i first outputs of the frame; a constraint solving procedure may then impose that ∃Y : i. X = ? f(Y ), i.e., that the underlying recipe should have a f symbol at its root. Equations reflect the syntactic equalities that the first-order terms verify. Typically when executing if fst(x) = t then P else Q, the positive branch will intutively lead to the constraint ∃y. x = ? t, y and the negative branch to ∀y. x = ? t, y .

Constraint systems Finally we define and give some properties of constraint systems that are used to collect the first-order constraints induced by a given execution of a process.

Definition 3.4 (constraint system)

A constraint system is a triple C = (Φ, D, E 1 ) whose elements are of the following form:

1 Φ = {ax 1 → t 1 , . . . , ax n → t n } is a frame (non necessarily ground) 2 D is a set of constraints of the form X ? x, with X ∈ X 2
n and x ∈ X 1 , or ∀X: i. X ? x for some i n and x ∈ X 1 . We also require the origination property:

for all i ∈ 1, n , for all x ∈ vars (t i ), there exists X ∈ X 2 i-1 such that (X ? x) ∈ D. 3 E 1 is a set of constraints of the form u = ? v or ∀z 1 . . . ∀z k . r j=1 u j = ? v j .
The components of C are also written Φ(C), D(C) and E 1 (C). The set D contains all input binders x that have been executed, each mapped to a second-order variable X that will serve as a placeholder for the corresponding recipe. The constraints ∀X: i. X ? x indicate that a channel x has been used in an internal communication and should therefore not be deducible by the adversary (which, we recall, is a requirement of the concrete semantics we use, the private semantics). Next the origination property expresses that when reference is made to an input x in an output t i , this input should be computed only from the previous outputs t 1 , . . . , t i-1 . This is a natural property preventing cyclic input-output dependencies. Finally E 1 is a set of (dis)equalities imposed on the protocol messages by conditionals, among others. We will formalise in Section 1.3 the semantics of these constraints through a notion of solution.

Remark: notational conventions

We use several convenient notations throughout the paper to lighten the presentation of constraints. First of all we do not make a difference between sets and conjunctions of constraints: for instance we may write E 1 = n i=1 ϕ i instead of E 1 = {ϕ i } n i=1 and conversely. We also interpret a substitution σ as the set of equations

E = {x = ? xσ | x ∈ dom(σ)}.

(Most general) unifiers

We now recall some basics on term unification, a key concept in symbolic models that has some specificities in our context, in particular regarding second-order terms.

Unification of first-order terms Two first-order terms u and v are unifiable if there exists a substitution σ, called a unifier, such that uσ = vσ. For example the terms u = sdec(x, y), z and v = z 1 , z 2 are unified by σ = {z 1 → sdec(x, y), z 2 → z}. The terms u and z are unifiable as well using σ = {z → u}, but the terms u and z are not. More generally a unifier σ of a set of equations E = {u i = ? v i } n i=1 is a unifier of u i and v i for all i. A classical characterisation of the set of unifiers of two terms is based on most general unifiers: Definition 3.5 (most general unifier) A substitution σ is called a most general unifier of E if for any θ unifier of E, there exists τ such that θ = στ . In this case we write σ = mgu(E). On the contrary we write mgu(E) = ⊥ when no such substitutions exist.

A straightforward inductive procedure allows to decide whether E is unifiable and, if it is, to compute mgu(E) We assume that this computation does not introduce variables, that is, if σ = mgu(E) then dom(σ) ∪ vars (img(σ)) ⊆ vars (E). We also require that dom(σ) ∩ vars (img(σ)) = ∅, that is, applying a mgu twice has not more effect than applying it once. Note as well that all unifiers are instances of the mgu but the converse is also true, that is, all instances of a mgu are unifiers. By convenience we also write mgu(E) in the case where E contains disequations (typically when writing mgu(E 1 (C))): in this case only equations are taken into account and nothing ensures that the mgu satisfies the disequations of E.

However mgu's are only syntactic: when taking the theory E into account we say that σ is a unifier modulo theory of E when for all (u = ? v) ∈ E, uσ = E vσ. A standard procedure based on narrowing (not detailed here) allows to compute most general unifiers modulo E when E is subterm convergent among others. However unlike the syntactic case they are not unique in general: Definition 3.6 (most general unifier modulo theory)

We let E be a set of equations and E be a convergent theory. A set of most general unifiers modulo E is a set of substitutions mgu E (E) that verifies the following properties: 1 for all σ ∈ mgu E (E), σ is a unifier of E modulo E 2 for all θ unifier of E modulo E, there exists σ ∈ mgu E (E) and a substitution τ such that for all x ∈ vars (E), xθ = E xστ Again we emphasise that equality modulo E only operates on valid messages, that is, if σ ∈ mgu E (u = ? v) then uσ and vσ verify the msg predicate. A typical usecase we consider in the symbolic semantics is mgu E (u = ? u), which is the most general substitution σ such that msg(uσ) holds (if any). For example if u = adec(x, y) we have

mgu E (u = ? u) = {σ}
where σ = {x → aenc(x , pk(y )), y → pk(y )}

This example also highlights that, unlike the syntactic case, computing mgu's modulo theory may require to introduce new variables. However it is still possible to enforce that dom(σ) ∩ vars (img(σ)) = ∅.

Unification of second-order terms Intuitively the unification of two second-order terms ξ and ζ modulo theory means that they deduce the same first-order term u w.r.t. a given frame Φ. This unusual kind of unification is performed as a part of our constraint solving algorithm using a dedicated kind of constraints ξ = ?

f ζ; we refer to Chapter 4 for more details. We therefore do not need to rely on an external, black-box unification algorithm. The situation is however different regarding syntactic mgu's and we give details below.

The definition is the same as usual, meaning that a syntactic unifier of ξ and ζ is a secondorder substitution Σ such that ξΣ = ζΣ. However additional care is required in our context due to the variable types. Indeed we recall that by definition a second-order substitution has to respect types, that is, a variable X: n cannot be mapped to a term containing axioms ax i or variables Y : i if i > n. Say for instance we want to unify the two second-order terms X: 1 and f(Y : 2): a syntactic computation of the mgu would give the substitution Σ = {X → f(Y )}, which does not respect the type of X. In this case one solution is to introduce a fresh variable Z: 1 and to choose the following unifier:

mgu(X = ? f(Y )) = {X → f(Z), Y → Z} = Σ{Y → Z} .
Formally given a second-order term ξ, let us write #(ξ) the maximal type appearing in ξ, that is, the integer

#(ξ) = min{i ∈ N | ξ ∈ T 2 i }.
The mgu of a conjunction of equations ϕ is then computed inductively as follows:

mgu( ) = mgu (ϕ ∧ f(ξ 1 , . . . , ξ n ) = ? g(ζ 1 , . . . , ζ n )) = ⊥ if f = g mgu (ϕ ∧ n i=1 ξ i = ? ζ i ) if f = g mgu (ϕ ∧ X: i = ? ξ) =                  ⊥ if X ∈ vars 2 (ξ) and ξ = X ⊥ else if ∃ax j ∈ axioms(ξ), j > i Σ 0 Σ else if ξ / ∈ X 2 , Y : j ∈ vars 2 (ξ), j > i, Z: i fresh and with Σ 0 = {Y → Z} and Σ = mgu (ϕΣ 0 ∧ X: i = ? ξΣ 0 ) Σ 0 Σ else if #(ξ) i, with Σ 0 = {X → ξ} and Σ = mgu (ϕΣ 0 )
As before we extend this notation to arbitrary sets E, that is, we may write mgu(E) even if E contains disequations (which are then ignored during the computation). The correctness of this function is proved below.

Proposition 3.1 (correctness of second-order mgu's)

For all sets of second-order equations E, the computation of mgu(E) terminates. Besides we have that mgu(E) = ⊥ iff there exist no unifiers of E. Otherwise: 1 mgu(E) is a second-order substitution, i.e., respects the types 2 for all unifiers Σ of E, there exists a substitution Σ 0 such that Σ = mgu(E)Σ 0 .

Proof. We only prove the termination since all other properties can be proved separately by straightforward inductions on the definition of mgu. We let the partial ordering on second order variables given by the types, i.e. X: i Y : j iff i j. Given a set of second-order equations E we then let

µ(E) = (vars 2 (E), M (E), F (E))
where M (E) is the multiset of variables of E, i.e. multiplicity included, and F (E) is the multiset of the sizes of the equations of E (where the size of ξ = ? ζ is the number of function symbols in ξ and ζ). The first two components are ordered w.r.t. the multiset extension of , and the third one w.r.t. the multiset extension of . The overall tuple is ordered w.r.t. the lexicographic composition of the three components.

If we number from 1 to 7 the axioms defining mgu, we can show that µ decreases at each recursive call: (1), (2), ( 4) and (5) make no recursive calls; (3) preserves vars 2 and M , and makes F decrease; (6) replaces all occurrences of Y with Z than has a lower type which makes vars 2 decrease. Regarding (7) two cases can arise: either ξ = X or X / ∈ vars 2 (ξ). In the first case vars 2 is nonincreasing and M is decreasing since two occurrences of X are removed and the rest of the formula E is left unchanged. In the second case vars 2 is decreasing since all occurrences of X are removed and no variables are added.

(Most general) solutions

Solutions Let us now formalise the semantics of constaints. Given a constraint ϕ, a frame Φ and second-and first-order substitutions Σ and σ we define the predicate (Φ, Σ, σ) |= ϕ by:

(Φ, Σ, σ) |= ξ ? u iff ξΣΦσ = E uσ (Φ, Σ, σ) |= ξ = ? ζ iff ξΣ = ζΣ (Φ, Σ, σ) |= u = ? v iff uσ = vσ (Φ, Σ, σ) |= ∀x. ϕ iff for all first-order terms t, (Φ, Σ, σ) |= ϕ{x → t} (Φ, Σ, σ) |= ∀X: n. ϕ iff for all ξ ∈ T 2 n , (Φ, Σ, σ) |= ϕ{X → ξ}
The definition is extended the logical constructors ¬, ∧, ∨, . . . in the natural way. By convention we may only write (Φ, Σ, σ) |= ϕ when xσ and XΣΦσ are ground for all x ∈ vars 1 (ϕ) and X ∈ vars 2 (ϕ). Intuitively the second-order substitution Σ describes which recipes are used to deduce each input term appearing in ϕ and σ gives their actual values.

Definition 3.7 (solution of a constraint system)

We say that (Σ, σ) is a solution of C if dom(Σ) = vars 2 (C), dom(σ) = vars 1 (C) and (Φ(C), Σ, σ) |= D(C) ∧ E 1 (C).
We call Σ a second-order solution of C and σ its first-order solution. The set of solutions of C is written Sol (C).

The solutions of a constraint system C indicate how the inputs of C (i.e., vars 1 (D(C))) can be computed while satisfying the constraints imposed by E 1 (C). Due to the origination property, the values the first-order solution σ takes on vars 1 (D(C)) is uniquely determined by which recipes are used to deduce terms, i.e., by the second-order solution Σ.

Example 3.1 Consider again the simple example P = new k. c k . c(x). if fst(x) = k then c h(x) . The traces performing the final output h(x) are characterised by the constraint system

Φ(C) = {ax 1 → k, ax 2 → h(x)} D(C) = {X ? x} E 1 (C) = {x = ? k, y }
where X: 1 and y are fresh second-and first-order variables, respectively. Observe in particular that the informal constraint "there exists a term y such that x = k, y " is not formalised using an explicit ∃ quantification but with a free variable y. All second-order solutions of C are instances of Σ 0 = {X → ax 1 , Y } where Y : 1 is fresh, for example, Σ = {X → ax 1 , a } with a ∈ F 0 . The corresponding first-order solution is then σ = {x → y, a , y → a}.

Most general solutions Similarly to mgu's we now give a novel characterisation of solutions as instances of so-called most general solutions (mgs). The definition is parametrised with a predicate π on second-order substitutions, writing Sol π (C) = {(Σ, σ) ∈ Sol (C) | π(C) holds}. This will permit later to consider solutions that have a certain form.

Definition 3.8 (most general solution)

A set of most general solutions of C that satisfy π is a set mgs π (C) of second-order substitutions such that: 1 for all Σ 0 ∈ mgs π (C), dom(Σ 0 ) ⊆ vars 2 (C), for all injections Σ 1 to fresh constants and of domain dom(Σ 1 ) = vars 2 (img(Σ 0 ), C) dom(Σ 0 ), (Σ 0 Σ 1 , σ) ∈ Sol π (C) for some σ. 2 for all (Σ, σ) ∈ Sol π (C), there exists Σ 0 ∈ mgs π (C) and Σ 1 such that Σ = Σ 0 Σ 1 . We omit the predicate π in the case where π = , i.e., π(Σ) holds for any substitution.

The first condition of the definition states that a mgs Σ 0 is "almost" a solution of C: it may not be one because Σ 0 may have a domain strictly included in vars 2 (C) and may not have a ground image; but we obtain a solution by replacing all pending variables by fresh names. The second condition then states that all solutions are instances of a mgs.

Example 3.2

In Example 3.1 we have mgs (C) = {Σ 0 } and Sol (C) is the set of all ground instances of Σ 0 . However in general the situation may be less ideal. For example a constraint system may have several most general solutions; a simple example being, with h/1 and k ∈ N :

Φ(C) = {ax 1 → h(k), ax 2 → k} D(C) = {X: 2 ? x} E 1 (C) = {x = ? h(k)}
The constraint system C expresses that an input x should be instantiated by h(k), potentially by using previous two outputs h(k) and k. There are therefore two ways of computing x: either using ax 1 or h(ax 2 ), which is reflected as the fact that mgs

(C) = {Σ 1 , Σ 2 } with Σ 1 = {X → h(ax 2 )} Σ 2 = {X → ax 1 }
Still, it is possible to obtain unique mgs' by performing a case analysis and restricting the solutions accordingly; typically here we have

mgs π i (C) = {Σ i } with π 1 (Σ) def = ∃X . X = ? h(X ) π 2 (Σ) def = ∀X . X = ? h(X )
Another notable point is that some ground instances of a mgs may not be solutions themselves.

The simplest example is, with a ∈ F 0 , C = (∅, X ? x, x = ? a): we have mgs (C) = {id } but the substitution {X → a} is a ground instance of the identity but not a solution (which does not contradict Item 1 of Definition 3.8 since although a is a constant, it is not fresh).

We explain in Chapter 4, Section 2 how to generate a finite set of most general solutions, at least in the context of our decision procedures.

Symbolic semantics

Symbolic execution We now present how to replace attacker inputs by constraints in practice. This takes the form of a symbolic semantics that recalls the usual semantics of the applied pi calculus (the "concrete semantics") except that a constraint system is carried over the execution to collect the trace constraints. The semantics operates on so-called symbolic processes (P, C) where P is a multiset of (non-necessarily ground) plain processes and C is a constraint system. All free variables of P are bound by deductions facts, that is, for all x ∈ vars (P) there exists (X ? x) ∈ D(C). The semantics then takes the form of a labelled transition semantics α -→ s between symbolic processes, defined in Figure 3.1, where α ranges over the following alphabet of symbolic actions:

1 symbolic input actions X(Y ) where X and Y are second-order variables, modelling public inputs as in the concrete semantics except that the attacker recipes are replaced by the two placeholders X, Y ; 2 symbolic output actions X ax i that follow the same logic; 3 the unobservable action τ which has the exact same role as in the concrete semantics.

Before we define the semantics let us explain how we handle conditionals. First of all we recall our convention to interpret substitutions as sets of equalities, that is, the positive branch of "if u = v then P else Q" will add one mgu of u and v modulo theory to E 1 . Regarding the negative branch, we want to add a constraint that is satisfied iff u and v are not equal modulo theory. We write it ¬mgu E (u = ? v) and define it as follows:

¬mgu E (u = ? v) = σ∈mgu E (u= ? v) ∀ zσ x∈vars (u,v) x = ? xσ
where zσ = vars (uσ, vσ) vars (u, v).

If C = (Φ, D, E 1 ), µ = mgu(E 1 ) = ⊥ and n = |dom(Φ)|: ({ {if u = v then P else Q} } ∪ P, C) τ -→ s ({ {P } } ∪ P, (Φ, D, E 1 ∧ σ)) (s-Then) if σ ∈ mgu E (uµ = ? vµ) ({ {if u = v then P else Q} } ∪ P, C) τ -→ s ({ {Q} } ∪ P, (Φ, D, E 1 ∧ ¬mgu E (uµ = ? vµ))) (s-Else) ({ {u(x).P } } ∪ P, C) Y (X) ---→ s ({ {P } } ∪ P, (Φ, D ∧ X ? x ∧ Y ? y, E 1 ∧ σ)) (s-In)
if Y : n, X: n and y are fresh and σ ∈ mgu E (y = ? uµ)

({ {u v .P } } ∪ P, C) Y ax n+1 ------→ s ({ {P } } ∪ P, (Φ ∪ {ax n+1 → vσ↓}, D ∧ Y ? y, E 1 ∧ σ)) (s-Out)
if Y : n and y are fresh and σ ∈ mgu E (y = ? uµ ∧ vµ = ? vµ)

({ {u v .P, w(x).Q} } ∪ P, C) τ -→ s ({ {P, Q{x → vσ}} } ∪ P, (Φ, D ∧ ϕ, E 1 ∧ σ)) (s-Comm)
if for Y : n and y fresh, ϕ = ∀Y. Y ? y and σ ∈ mgu E (uµ = ? wµ ∧ vµ = ? vµ ∧ y = ? uµ) The rule (s-In) adds two deduction facts X ? x and Y ? y to D, modelling that the input term and communication channel should be deducible by the adversary; in particular the constraint σ ∈ mgu E (y = ? uµ) indicates that the term deduced by Y is effectively the channel u. The rule (s-Out) essentially follows the same logic, adding a fresh deduction fact and a constraint indicating that the channel is deducible. We assume an implicit alpha renaming of bound variables so that each appear only once in the process: this prevents reference conflicts in D when applying the rule (s-In). Finally let us comment on the rule (s-Comm). The constraint ϕ added to D indicates that the channel u (bound to y using the equation y = ? uµ) used to perform the communication should not be deducible by the adversary. Removing the constraint leads to a symbolic semantics for the classical semantics which, we recall, is the semantics where internal communications can be performed on any channel. Then the constraint σ added to E 1 simply indicates that the two communication channels u and w should be identical.

({ {new k.P } } ∪ P, C) τ -→ s ({ {P {k → k }} } ∪ P, C) if k ∈ N names(P, P, C) (s-New) ({ {P | Q} } ∪ P, C) τ -→ s ({ {P, Q} } ∪ P, C) (s-Par) ({ {! P } } ∪ P, C) τ -→ s ({ {! P, P } } ∪ P, C) (s-Repl)
Similarly to the concrete semantics we call a symbolic trace a sequence of transitions

(P 0 , C 0 ) α 1 -→ s • • • αn --→ s (P n , C n ),
which may be referred to as (P 0 , C 0 ) tr = ⇒ s (P n , C n ) if tr is obtained by removing the τ 's from the word α 1 • • • α n . For simplicity the plain process P may be interpreted as the symbolic process ({ {P } }, (∅, , )).

Example 3.3 We consider again the example of the private authentication protocol. We recall the process of the agent B receiving the communication, writing pk X , sk X instead of pk(sk(X)), sk(X):

B = d(x). new r. let n, p = radec(x, sk B ) in if p = pk A then d raenc( n, N B , pk B , r, p) else d raenc(n, r, pk B )
and use a frame

Φ 0 = {ax 1 → pk A , ax 2 → pk B , ax 3 → raenc( N A , pk A , r , pk B )},
containing public keys and the connection request sent by A. We give in Figure 3.2 a tree of all symbolic executions of B (we only write the constraints added at each step). We execute let's using a rule (s-Let), not formalised, executing symbolically their encodings into standard conditionals. Intuitively, the branch of the constraint system C 1 abstracts the set of concrete traces where B accepts the connection, and the branch of C 2 those where B refuses it. Typically in the traces of the branch C 1 the attacker forwards the message of A or forges one pretending to be A; this is formally expressed by the fact that mgs (C 1 ) = {Σ 0 ∪ Σ fwd , Σ 0 ∪ Σ att } where:

(Φ 0 ,⊤,⊤) 1 Y(X ) X ⊢ x y = d Y ⊢ y + x = raenc(⟨x 1 ,x 2 ⟩,x 3 ,pk B ) + τ x 2 = pk A + ax 2 ↦ m B Z ⊢ z z = d + ax 2 ↦ m B Z ⊢ z z = d + 2 m B = raenc(⟨x 1 ,N B ,pk B ⟩,s,pk A ) m B = raenc(x 1 ,s,pk B ) x 2 = pk A + Z⟨ax 2 ⟩ Z⟨ax 2 ⟩ τ τ new r ↦ s fresh name
Σ 0 = {Y → d, Z → d} Σ fwd = {X → ax 3 } Σ att = {X → raenc( x 1 , ax 1 , x 3 , ax 2 )}
Soundness and completeness Similar symbolic semantics have been developed in the context of protocol analysis [START_REF] Baudet | Sécurité des protocoles cryptographiques: aspects logiques et calculatoires[END_REF][START_REF] Cheval | Deciding equivalence-based properties using constraint solving[END_REF]. The general approach is to abstract the (infinite) set of concrete traces by the finite set of symbolic traces and to study the solutions of the resulting constraint systems. A typical example is that the following statements are equivalent: 1 Weak secrecy of the term u in P : for all traces P tr = ⇒ (P, Φ), u is not deducible from Φ 2 for all symbolic traces P tr = ⇒ s (P, C), the system (Φ(C), D(C) ∧ X ? x, E 1 (C) ∧ x = ? u) has no solution, where X: n and x are fresh, n = |dom(Φ)| This reduces weak secrecy (for a bounded number of sessions) to the decidability of whether a constraint system has a solution. Similar approaches have been developed in [START_REF] Baudet | Sécurité des protocoles cryptographiques: aspects logiques et calculatoires[END_REF][START_REF] Cheval | Deciding equivalence-based properties using constraint solving[END_REF] to decide some equivalence properties for some classes of processes (we comment more on these related works in Chapter 7). This usually relies on a connection between the symbolic and the concrete semantics, under the form of two properties: 1 soundness: applying to a symbolic trace a solution of its final constraint system leads to a concrete trace; and 2 completeness: all concrete traces are obtained by applying a solution to a symbolic one. They are formalised below, the proof following from a straightforward induction on the length of the traces.

tr = ⇒ s (Q , C ) and (Σ , σ ) ∈ Sol (C ) such that Σ ⊆ Σ , Q = Q σ , tr = tr Σ and Φ = Φ(C )σ ↓.

Decision procedures for equivalences: the partition tree

Section summary

We define the novel notion of partition tree, the core notion we use to decide trace equivalence and labelled bisimilarity of bounded processes. This is intuitively a tree of symbolic executions of two processes whose structure allows to easily conclude whether the processes are equivalent.

Definition of the partition tree

To decide trace equivalence and labelled bisimilarity, we introduce the novel notion of partition tree of two bounded processes P and Q. The point is to build a (finite) tree of all symbolic executions of P and Q, grouping into the same nodes intermediary processes as follows:

1 All processes of a same node should have a common, unique mgs. Since one symbolic process alone may already have several most general solutions, the node is parametrised by a restricting predicate π on second-order solutions (recall Example 3.2). 2 When applying the mgs of a node to all of the processes it contains, the resulting frames are statically equivalent; conversely all reachable symbolic processes that would verify this property should be in the node as well.

A branch of this tree therefore represents the set of all equivalent traces of P and Q taking a given sequence of visible actions. Taking profit of this observation we will show that whenever P and Q are not trace equivalent or labelled bisimilar, a witness of non-equivalence can be exhibited using the tree. Formally its nodes are modelled by configurations that consist of sets Γ of symbolic processes sharing a unique mgs and statically equivalent solutions.

Definition 3.9 (configuration)

A configuration is a pair (Γ, π) where Γ is a set of symbolic processes and π a predicate on second-order substitutions. We also require that:

1 the predicate π is defined on vars 2 (Γ), that is, for all Σ, π(Σ) iff π(Σ |vars 2 (Γ) ); 2 for all (P, C) ∈ Γ, |mgs π (C)| = 1; 3 for all (P 1 , C 1 ), (P 2 , C 2 ) ∈ Γ, if (Σ, σ 1 ) ∈ Sol π (C 1 ) then there exists σ 2 such that (Σ, σ 2 ) ∈ Sol π (C) and Φ(C 1 )σ 1 ∼ Φ(C 2 )σ 2 .
The predicate π can typically be described using second-order (dis)equations. We then consider trees with nodes labelled by configurations and edges by visible symbolic actions (i.e., not τ ). Given a node n of such a tree, we write Γ(n) and π(n) the components of the corresponding configuration, and n α -→ n to express that n is a child node of n through an edge labelled by the symbolic action α. By definition of a mgs, the points 2 and 3 of Definition 3.9 above ensure that all symbolic processes in Γ(n) have the same set of second-order variables, written vars 2 (n), and a common and unique mgs, written mgs (n).

Definition 3.10 (partition tree)

A partition tree of two bounded processes P and Q is a tree T whose nodes are labelled by configurations and edges by visible symbolic actions, and that verifies the following properties. First of all P, Q ∈ Γ(root(T )) and π(root(T )) = , where root(T ) denotes the root node of the tree. Then for all nodes n of T , (P, C) ∈ Γ(n) and visible symbolic actions α:

1 Closure by τ -transition: if (P, C) τ = ⇒ s (P , C ) and Sol π(n) (C ) = ∅ then (P , C ) ∈ Γ(n).
2 All symbolic transitions are reflected in the tree:

if (P, C) α = ⇒ s (P , C ) and (Σ, σ) ∈ Sol π(n) (C ) then there exists an edge n α -→ n in T such that (P , C ) ∈ Γ(n ) and (Σ , σ) ∈ Sol π(n ) (C ) for some Σ that coincides with Σ on vars 2 (n).
Moreover for all edges n α -→ n c of T and (P c , C c ) ∈ Γ(n c ):

3 Predicates are refined along branches: for all Σ, if Σ verifies π(n c ) then it verifies π(n). 4 Nodes are maximal: if (Σ, σ) ∈ Sol π(n) (C), (Σ c , σ c ) ∈ Sol π(nc) (C c ) and Σ ⊆ Σ c , then Γ(n c ) contains all symbolic processes (P , C ) such that (P, C) α = ⇒ s (P , C ) and, for some substitution σ , (Σ c , σ ) ∈ Sol (C ) and Φ(C c )σ c ∼ Φ(C )σ .
The set of partition trees of P and Q is written PTree(P, Q).

The set PTree(P, Q) is infinite (at least because arbitrarily many processes can be put in the root configuration) but our decision procedures only require to construct one, arbitrary partition tree. The children n of a node n represent the sets of processes, grouped w.r.t. static equivalence, reachable by one transition from a process of n. The Item 2 ensures that all cases are covered, that is, for all symbolic transitions from n and all solutions Σ, at least one child n should contain the resulting symbolic process. Note that we do not impose that Σ verifies π(n ), but that there exists another solution Σ computing the same first-order terms that does. This more permissive approach will allow us, when generating partition-tree nodes in Chapter 4, to use families of predicates π that only consider solutions of a certain form (which therefore requires to prove that any deducible term can be computed by a recipe of this form). Item 4 then formalises that the nodes are saturated under static equivalence: if n is a child of n and a symbolic transition A α = ⇒ s B from a process A ∈ Γ(n) may result into a process statically equivalent to a process C ∈ Γ(n ) then B should be in Γ(n ) as well.

Example 3.4

Let us draw a partition tree corresponding to an anonymity analysis in the private authentication protocol, simplified for the sake of readability. We consider the following light version of the role of the process B accepting a connection from an agent X, removing the identification nonces N A , N B from the protocol and replacing the decoy message by a fresh nonce r:

B X = d(x). new r. if radec(x, sk B ) = pk X then d raenc(ok, r, pk X ) else d r
We consider a 3-agent scenario (A, B, C) where A has already emitted raenc(pk A , r A , pk B ) to initiate a communication with B and the security property we study is whether the identity of B's accepted recipient remains anonymous. That is we want to prove P ≈ Q where

P = C[B A ] Q = C[B C ] C[R] = c pk A . c pk B . c pk C . c raenc(pk A , r A , pk B ) . R X4⟨ax4⟩ B A , 0 B C , 0 π = ⊤ π1 = X = ax4 π2 = ∃Z. X = raenc(ax1,Z,ax2) π3 = ∃Z. X = raenc(ax3,Z,ax2) π4 = ¬π1 ⋀ ¬π2 ⋀ ¬π3 Y(X ) d⟨raenc(ok,r,pkA)⟩ , 1,A pos d⟨r⟩ , 1,C neg d⟨raenc(ok,r,pkA)⟩ , 1,A pos d⟨raenc(ok,r,pkC)⟩ , 1,C pos d⟨r⟩ , 1,C neg d⟨r⟩ , 1,A neg d⟨r⟩ , 1,A neg d⟨r⟩ , 1,C neg π1 0 , 2,A pos 0 , 2,C neg π2 0 , 2,A pos 0 , 2,C neg π3 0 , 2,A neg 0 , 2,C pos π4 0 , 2,A neg 0 , 2,C neg Z⟨ax5⟩ Z⟨ax5⟩ Z⟨ax5⟩ Z⟨ax5⟩ root Y(X ) Y(X ) Y(X )

X1⟨ax1⟩

Figure 3.3 A simplified partition tree of P and Q

The partition tree in Figure 3.3 is lightened for the sake of readability, that is, if a node contains two symbolic processes A s , B s such that A s τ -→ s B s then the process A s contains less constraints than B s and is omitted from the node. The configuration at the root of the tree only contains P and Q. After the four initial outputs of the context C, we reach the constraint system C 0 defined by:

Φ(C 0 ) = {ax 1 → pk A , ax 2 → pk B , ax 3 → pk C , ax 4 → raenc(pk A , r A , pk B )} D(C 0 ) = X 1 ? x 1 ∧ X 2 ? x 2 ∧ X 3 ? x 3 ∧ X 4 ? x 4 E 1 (C 0 ) = x 1 = ? c ∧ x 2 = ? c ∧ x 3 = ? c ∧ x 4 = ? c
The next step is the first one inducing a non-trivial case analysis. This node has four children, each corresponding to a way for the adversary to compute the input d(x): π 1 forwards the message of A, π 2 forges a message pretending it is from A, π 3 forges a message pretending it is from C, π 4 any other case. Depending on the case this will trigger the positive or the negative branch of the conditional in the processes B A and B C . More precisely we write

Φ(C pos 1,X ) = Φ(C neg 1,X ) = Φ(C 0 ), D(C pos 1,X ) = D(C neg 1,X ) = D(C 0 ) ∧ Y ? y and E 1 (C pos 1,X ) = E 1 (C 0 ) ∧ y = ? d ∧ x = ? raenc(pk X , x , pk B ) E 1 (C pos 1,X ) = E 1 (C 0 ) ∧ y = ? d ∧ ∀x . x = ? raenc(pk X , x , pk B )
Then the final transitions simply execute the resulting outputs, i.e. C s 2,X , s ∈ {pos, neg}, is obtained by adding Z ? z and z = ? d to C s 1,X . Since a ciphertext is indistinguishable from a nonce, the two outputs always end up in the same nodes; that is, all leaves contain at least one process originated from P and at least one from Q, which is how we prove trace equivalence. The situation would be different with a rewrite rule such as testEnc(raenc(x, y, pk(z))) → ok; a partition tree of P and Q with this extended theory can be found in Figure 3.4. We highlighted the part differing from the previous tree. Essentially some leaf nodes have been split in two due to the enhanced capabilities of the adversary to disprove static equivalence, inducing a violation of trace equivalence. For example the leftmost leaf's mgs is

X4⟨ax4⟩ B A , 0 B C , 0 π = ⊤ π1 = X = ax4 π2 = ∃Z. X = raenc(ax1,Z,ax2) π3 = ∃Z. X = raenc(ax3,Z,ax2) π4 = ¬π1 ⋀ ¬π2 ⋀ ¬π3 Y(X ) d⟨raenc(ok,r,pkA)⟩ , 1,A pos d⟨r⟩ , 1,C neg d⟨raenc(ok,r,pkA)⟩ , 1,A pos d⟨raenc(ok,r,pkC)⟩ , 1,C pos d⟨r⟩ , 1,C neg d⟨r⟩ , 1,A neg d⟨r⟩ , 1,A neg d⟨r⟩ , 1,C neg π4 0 , 2,A neg 0 , 2,C neg Z⟨ax5⟩ root Y(X ) Y(X ) Y(X ) X1⟨ax1⟩ Z⟨ax5⟩ Z⟨ax5⟩ Z⟨ax5⟩ Z⟨ax5⟩ Z⟨ax5⟩ Z⟨ax5⟩
{X → ax 4 , X 1 → d, . . . , X 4 → d, Y → d, Z → d}
which corresponds to an attack trace where the attacker forwards the message of A and observes whether the response of B is a ciphertext, which reveals whether B accepts connections from A or not.

In the remaining of the section we formalise how to decide trace equivalence and labelled bisimilarity of two processes, given a partition tree the mgs' of each of its nodes. For that we will rely on the following notion of reduction: Definition 3.11 (partition-tree trace)

Let T be a partition tree. We write (P, C), n α -→ T (P , C ), n when: 1 n and n are nodes of T such that (P, C) ∈ Γ(n) and (P , C ) ∈ Γ(n ); and

2 if α = τ then n = n , otherwise n α -→ n and (P, C) α -→ s (P , C ).
For convenience this notion is to be understood up to alpha renaming of the variables of the symbolic action α. We write A s 0 , n 0

tr = ⇒ T A s p , n p instead of A s 0 , n 0 α 1 -→ T • • • αp -→ T A s p , n p if
tr is the word obtained after removing τ symbols from α 1 • • • α p . If P is a plain process we may also write

P tr = ⇒ T A s , n instead of ({ {P } }, (∅, , )), root(T ) tr = ⇒ T A s , n.

Deciding trace equivalence

As hinted in our various examples, we now formalise how trace equivalence can be reduced to an analogue form of equivalence using the finite transition relation -→ T , given a partition tree. More precisely the goal of this section is to prove the following theorem: Theorem 3.3 (partition-tree-based characterisation of trace equivalence)

If T ∈ PTree(P 1 , P 2 ), the following points are equivalent: 1 P 1 t P 2 2 for all partition-tree traces P 1 tr = ⇒ T (P 1 , C 1 ), n, we have

P 2 tr = ⇒ T (P 2 , C 2 ), n
We rely on the soundness and completeness of the symbolic semantics, as well as two technical lemmas generalising the edge properties of the partition tree to branches. For example we can generalise as follows the fact that the nodes of the tree are labelled by maximal configurations, i.e., Definition 3.10, Item 4:

Lemma 3.4 Assume that (P 1 , C 1 ), n tr = ⇒ T (P 1 , C 1 ), n and (P 2 , C 2 ) tr = ⇒ s (P 2 , C 2 ) with (P 2 , C 2 ) ∈ Γ(n). We also consider, for all i ∈ {1, 2}, a solution (Σ , σ i ) ∈ Sol π(n ) (C i ) such that Φ(C 1 )σ 1 ∼ Φ(C 2 )σ 2 . Then we have (P 2 , C 2 ), n tr = ⇒ T (P 2 , C 2 ), n .
This lemma can be proved by induction on the length of tr; the proof in question can be found in Appendix A. Combined with the soundness and the completeness of the symbolic semantics, this permits to prove one direction of Theorem 3.3:

Proof of Theorem 3.3, 1⇒2. Let us consider a trace P 1 tr = ⇒ T (P 1 , C 1 ), n and exhibit a trace P 2 tr = ⇒ T (P 2 , C 2 ), n. We decompose the proof into the following steps:

1 By soundness of the symbolic semantics we obtain a trace P 1 trΣ = = ⇒ (P 1 σ 1 , Φ(C 1 )σ 1 ↓) for an arbitrary solution (Σ, σ 1 ) ∈ Sol (C 1 ).

2 By hypothesis 1 there exists a concrete trace P 2 trΣ = = ⇒ (P, Φ) such that Φ ∼ Φ(C 1 )σ↓.

3 By completeness of the symbolic semantics we obtain a symbolic trace P 2 tr = ⇒ s (P 2 , C 2 ) and (Σ , σ 2 ) ∈ Sol (C 2 ) such that trΣ = tr Σ , P 2 σ 2 = P and Φ(C 2 )σ 2 ↓= Φ. Due to the form of symbolic actions, we know that there exists a second-order-variable renaming such that tr = tr ; in particular P 2 tr = ⇒ s (P 2 , C 2 ) and (Σ, σ 2 ) ∈ Sol (C 2 ).

4 By Lemma 3.4 we therefore obtain that P 2 tr = ⇒ T (P 2 , C 2 ), n, which gives the expected conclusion.

The second property of the partition tree we extend is the fact that symbolic transitions are reflected in the tree, i.e., Definition 3.10, Item 2:

Lemma 3.5
Let n be a node of a partition tree T and (P, C) ∈ Γ(n). If (P, C) tr = ⇒ s (P , C ) and (Σ, σ) ∈ Sol π(n) (C ) then there exist a node n and a substitution Σ such that (P, C),

n tr = ⇒ T (P , C ), n and (Σ , σ) ∈ Sol π(n ) (C ).
Note that unlike the definition of partition tree, we do not require that Σ coincides with Σ on vars 2 (n). This additional requirement would not make the lemma false but appears to be unecessary to prove Theorem 3.3. The lemma is proved by induction on tr in Appendix A.

Proof of Theorem 3.3, 2⇒1. Let us consider a trace P 1 tr = ⇒ (P, Φ) and exhibit a trace P 2 tr = ⇒ (Q, Ψ) such that Φ ∼ Ψ. We decompose the proof into the following steps:

1 By completeness of the symbolic semantics we obtain a symbolic trace P 1 trs =⇒ s (P 1 , C 1 ) and (Σ, σ 1 ) ∈ Sol (C) such that tr s Σ = tr, P 1 σ 1 = P and Φ(C 1 )σ 1 ↓= Φ.

2 By Lemma 3.5 we then obtain a partition-tree trace P 1 trs =⇒ T (P 1 , C 1 ), n and Σ such that (Σ , σ 1 ) ∈ Sol π(n) (C 1 ).

3 By hypothesis 2 there also exists a partition-tree trace P 2 trs =⇒ T (P 2 , C 2 ), n. By definition of a configuration we also know that there exists

σ 2 such that (Σ , σ 2 ) ∈ Sol π(n) (C 2 ) and Φ(C 1 )σ 1 ∼ Φ(C 2 )σ 2 .
4 By soundness of the symbolic semantics applied to we then obtain a concrete trace

P 2 trsΣ = == ⇒ (Q, Ψ) with Q = P 2 σ 2 and Ψ = Φ(C 2 )σ 2 ↓ ∼ Φ(C 1 )σ 1 ↓ = Φ.
However we may have tr s Σ = tr and, to conclude the proof, we prove that P 2 tr = ⇒ (Q, Ψ) as well. For that it sufficies to prove that trΨ = E tr s Σ Ψ, that is, although the recipes or tr and tr s Σ are different they produce the same first-order terms. Since Φ and Ψ are statically equivalent, tr = tr s Σ and Φ = Φ(C 1 )σ 1 ↓, it sufficies to prove that tr s ΣΦ(C 1 )σ = E tr s Σ Φ(C 1 )σ. Let X ∈ vars 2 (tr s ). A quick look at the rules of the symbolic semantics shows that there exists a deduction fact (X ? x) ∈ D(C 1 ). In particular, since (Σ, σ 1 ) and (Σ , σ 1 ) are both solutions of C 1 we have XΣΦ(C 1 )σ 1 = E xσ 1 = E XΣ Φ(C 1 )σ 1 , hence the conclusion.

Deciding labelled bisimilarity

In the case of trace equivalence, a witness that A ≈ t B is simply a trace of A or B that has no equivalent trace in the other process. The case of labelled bisimilarity is more involved. Using vocabulary borrowed from game theory, the definition of bisimilarity can be seen as an prover-disprover game: at each state of the game the disprover chooses a transition from one of the two processes and the prover answers by choosing a transition of the same type from the other process (plus some potential τ -transitions). The disprover wins the game if they manage to reach a state with non-statically-equivalent processes or if the prover cannot answer to one of the moves: a witness of non-equivalence is then a winning strategy for the disprover in this game. We formalise this as follows; we recall that if α is an action, we write ᾱ = α if α = τ and ᾱ = ε if α = τ . Definition 3.12 (witness of non-bisimilarity)

A witness w is a set of pairs (A 0 , A 1 ) verifying the following two conditions: 1 A 0 and A 1 are ground extended processes such that A 0 ∼ A 1 2 there exists b ∈ {0, 1} and a transition

A b α -→ A b such that for all traces A 1-b ᾱ = ⇒ A 1-b , either A 0 ∼ A 1 or (A 0 , A 1 ) ∈ w.
We say that w is a witness for (A 0 , A 1 ) if (A 0 , A 1 ) ∈ w.

Proposition 3.6 (witness-based characterisation of labelled bisimilarity)

If A 0 ∼ A 1 then A 0 ≈ l A 1 iff
there exists a witness w for (A 0 , A 1 ).

Proof. First, we observe that A 0 ≈ l A 1 iff there exists a binary relation S on ground extended processes such that A 0 SA 1 and, for all (B 0 , B 1 ) ∈ S, either 1 B 0 ∼ B 1 , or 2 there exists b ∈ {0, 1} and a transition B b α -→ B b such that for all traces B 1-b ᾱ = ⇒ B 1-b , B 0 SB 1 . Let us call such a relation S a labelled attack on (A 0 , A 1 ). Since processes are bounded there exist no infinite sequences of transitions and A ≈ l B therefore straightforwardly rephrases to the existence of a labelled attack S such that ASB. It then sufficies to observe that 1 If S is a labelled attack on (A 0 , A 1 ) then S ∼ is a witness for (A 0 , A 1 ). 2 If w is a witness for (A 0 , A 1 ) then w ∪ ∼ is a labelled attack on (A 0 , A 1 ).

We now define a symbolic variant of the notion of witness that can be constructed within a partition tree T . In essence a symbolic witness can therefore be seen as a winning strategy for the disprover in a bisimulation game limited to the finite transition relation -→ T .

Definition 3.13 (symbolic witness of non-bisimilarity)

A symbolic witness w s w.r.t. a partition tree T is a finite tree whose nodes N are labelled by pairs (S, n) with n a node of T and S ⊆ Γ(n) is either a singleton or contains exactly two elements. We also require that if N is labelled ({A 0 , A 1 }, n), there exist b ∈ {0, 1} and a transition A b , n α -→ T A b , n (possibly α = τ ) such that:

However purely symbolic witnesses do not exhibit consistent proofs of non-equivalence in general. Indeed a concrete execution fixes the effective value of an input x at the moment it is performed, whereas in a symbolic execution the constraints on x are collected later, all along the trace. In some sense the symbolic semantics puts the prover at a disadvantage in the game, since they have to answer to the disprover's input actions without knowing the values of the input terms. Symbolic witnesses inducing invalid winning strategies for the disprover will be discarded in that they have no solutions in the following sense: Definition 3.14 (solution of a symbolic witness) Let w s be a symbolic witness. A solution of w s is a function f sol that maps nodes of w s to ground second-order substitutions such that for all nodes N labelled (S, n),

1 for all (P, C) ∈ S, (f sol (N ), σ) ∈ Sol π(n) (C) for some σ; 2 for all children nodes N 1 , N 2 of N , f sol (N ) ⊆ f sol (N 1 ) = f sol (N 2 ).
We denote Sol (w s ) the set of solutions of w s .

Theorem 3.7 (partition-tree-based characterisation of labelled bisimilarity) If T ∈ PTree(P 1 , P 2 ), the following points are equivalent: 1 P 0 ≈ l P 1 2 for all symbolic witnesses w s for (P 1 , P 2 , root(T )), we have Sol (w s ) = ∅

The proof, although technical, simply connects the symbolic witnesses to concrete ones using the soundness and completeness of the symbolic semantics as well as the properties of the partition tree, following similar ideas as the analogue proof for trace equivalence. The detailed proof can be found in Appendix A, Lemma A.1.

Assuming one has computed a partition tree T ∈ PTree(P 1 , P 2 ) and the mgs of each of its nodes, since there are finitely-many possible symbolic witnesses, Theorem 3.7 yields a decision procedure for the labelled bisimilarity of P 1 and P 2 provided one can decide whether a given symbolic witness has a solution. For that we rely on a simple, bottom-up unification of the mgs' appearing in the witness; details can be found in Chapter 6, Section 3 where we study more precisely the complexity of partition-tree-based decision procedures.

3 Generating partition trees (with oracle to a constraint solver)

Section summary

We explain how to generate the partition tree, assuming an oracle to a contraint-solving algorithm that is described in more details in Chapter 4. The nodes are generated and refined from the root to the leaves, thus permitting to distribute the generation. The tool implementation, DeepSec, is compared against similar analysers in terms of verification time on benchmarks including those presented in Chapter 2.

Overview of the top-down tree generation

In this section we detail the skeleton of the procedure for computing a partition tree of two plain processes P 1 and P 2 . The description is modular in that most of the technical details, in particular the modelling of the node predicates and how we obtain the expected properties of the tree, are abstracted by a constraint-solving oracle that we detail in the next chapter. This section should therefore be seen as the overview of the whole algorithm for deciding equivalence properties, which gives enough insight to discuss our implementation.

The algorithm generates the nodes of the tree top-down, that is, from the root to the leaves. We outline the procedure in Figure 3.5.

Initial node n

Γ

Step 1. Generate all symbolic transitions

Γ in Γ out Y(X ) Y⟨ax k ⟩ Interm. node (inputs) Interm. node (outputs) Γ in π Γ in Γ out Γ out π in π in π out π out 1 p 1 p 1 q 1 q … …
Step 2. Node partitioning (constraint solving)

Children nodes Let us now describe the algorithm to compute T ∈ PTree(P 1 , P 2 ) in more details, up to the technical developments detailed in the next chapter. 1 First, we initiate a root containing P 1 and P 2 and saturate the configuration by τ transitions. That is, we consider the set of symbolic processes

Γ(root(T )) = (P, C) | P i ε = ⇒ s (P, C), i ∈ {1, 2}, Sol (C) = ∅
Note that the constraint systems C involved in this definition do not contain deduction facts, which makes the decision of the emptiness of Sol (C) relatively straightforward. Using the terminology of Chapter 4, using simplification rules permits to put the constraints into a simple form where the existence of a solution is trivial to decide. 2 Then let us assume we already constructed a node n of the tree using this algorithm, in particular the corresponding configuration (Γ(n), π(n)). To compute the children of n we first enumerate all symbolic transitions from processes of Γ(n), separating input and output actions. That is, we compute the two sets

Γ in = B | A ∈ Γ(n), A Y (X) ===⇒ s B Γ out = B | A ∈ Γ(n), A Y (axp) = === ⇒ s B
3 Γ in and Γ out are two intermediary sets that do not satisfy yet the father-child properties of the partition tree. For that we use a constraint-solving algorithm detailed in Chapter 4 (simplification rules again, but also case distinction rules) that will partition Γ in and Γ out to gather symbolic processes with statically-equivalent solutions and remove those with no solutions. This constraint solving results into a sequence of configurations

(Γ in 1 , π in 1 ), . . . , (Γ in p , π in p ) (Γ out 1 , π out 1 ), . . . , (Γ out q , π out q )
that will label the children of n. The procedure is then carried out recursively from these child nodes until no more symbolic transitions are available.

In Chapter 4 we detail the missing parts of this procedure that take the form of constraintsolving rules, in the context of constructor-destructor subterm convergent theories. Note that the approach is modular in that the proofs we have carried so far are independent of the assumptions on the theory: generalising the results of Chapter 4 will automatically result in the decidability of trace equivalence and labelled bisimilarity of bounded processes for the extended class of theories.

Implementation and performances

The DeepSec prover Building on the procedure's structure described above and the internal solver developed in the next chapter, we have implemented a prototype in Ocaml, called DeepSec (DEciding Equivalence Properties in SECurity protocols). The user specifies a theory (that is checked to be constructor-destructor and subterm convergent by the tool), two bounded processes, and the tool verifies whether they are trace equivalent. If not, a concrete attack trace is returned in a dedicated graphical interface; we refer to the DeepSec's website for development credits, tutorials and details on practical usage [START_REF] Cheval | DeepSec v2.0.0[END_REF]:

https://deepsec-prover.github.io/ The tool's specification language implements the grammar presented in Chapter 1, Sections 2 and 2.3, including non-deterministic choice, private function symbols, a restricted form of patterned let bindings1 , as well as bounded replication ! n P defining n copies of P in parallel. As we explained in Chapter 1 these additional primitives are only here for modelling convinience; yet the native integration allowed specific optimisations compared to encodings within the initial calculus. The syntax and structure of DeepSec's input files are similar to the widely used ProVerif [BSCS20] tool to make it easier for new users to discover and use it.

Partial order reductions

The tool also implements partial order reductions (POR), an optimisation technique for protocol analysis developed by Baelde et al. [START_REF] Baelde | Partial order reduction for security protocols[END_REF]. The basic idea is to discard part of the state space that is redundant but this optimisation is only sound when processes are action-determinate, as defined in [START_REF] Baelde | Partial order reduction for security protocols[END_REF]. We will study more formally action determinacy and its implications on decidability and complexity in Chapters 5 and 7 and we omit the definition of this class of processes for now. Still, we mention that not using private channels and assigning a different channel name to each parallel process is a simple, syntactic way to ensure this property although this is not always possible-typically when looking at some anonymity or unlinkability properties. In the benchmarks presented in Chapter 2 the private authentication protocol can be modelled as a determinate process, but not the Helios and BAC protocols (due to private channels or because this introduces artifical violations of the equivalence property).

In practice, DeepSec automatically detects action-determinate processes and activates the POR, which drastically reduces the number of symbolic executions that need to be considered. Going further we study in Chapter 5 how to use similar POR techniques in general, that is, without the restriction to determinate processes. The experimental results presented in the current chapter only include the base POR of [START_REF] Baelde | Partial order reduction for security protocols[END_REF].

Distributing the computation The main task of DeepSec is to generate a partition tree and, as we explained, this is done using a top-down approach. This task can be distributed as computing a given node of the tree can be done independently of its sibling nodes. However, some engineering is needed to avoid heavy communication overhead due to task scheduling. Indeed, the partition tree is not a balanced tree and we do not know in advance which branches will be larger than others. Because of this, we do not directly compute and return the children of each node in the most straightforward manner, but proceed in two steps: 1 We start with a breadth-first generation of the partition tree. The number of pending nodes will gradually grow until eventually exceeding a threshold parameter n. 2 Each available core focuses on one of these nodes, computes the whole subtree rooted in this node in a depth-first manner and, when this the task is completed, is assigned to a new node until none remain. If some cores become idle for too long in Step 2 (because the number of non-completed nodes exceeds the number of cores), we perform a new round, that is, we interrupt the working nodes and restart this two-step procedure on incomplete nodes. Although doing so wastes some proof work, this improves performances for particularly unbalanced trees. Note that parallelisation is also supported by other automated analysers such as Akiss [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocols[END_REF], but DeepSec goes one step further as it is able to distribute the computation not only on multiple cores of a given machine but also clusters of computers.

Benchmarks We performed extensive benchmarks to compare DeepSec against other tools that verify equivalence properties for a bounded number of sessions: Akiss [CCCK16], APTE [START_REF] Cheval | APTE: an algorithm for proving trace equivalence[END_REF], SatEquiv [START_REF] Cortier | Sat-equiv: an efficient tool for equivalence properties[END_REF] and SPEC [START_REF] Tiu | SPEC: an equivalence checker for security protocols[END_REF]. Experiments are carried out on Intel Xeon 3.10GHz cores, with 40Go of memory. We distributed the computation on 20 cores for Akiss and DeepSec as they support parallelisation-unlike the others which therefore use a single core. The results are summarised in Figures 3.6 and 3.7 with the following symbol conventions: analysis terminates and equivalence holds analysis terminates and an attack is found OM analysis aborted due to memory overflow analysis aborted due to timeout (12 hours) the tool is not expressive enough to analyse the protocol

1 Scalability examples.
First of all we study a few examples of protocols and privacy-type properties with a fixed scenario, to measure the scalability of the compared tools on simple examples when increasing the number of sessions (Figure 3.6). We first analysed strong secrecy and anonymity for several classical authentication protocols. The DeepSec tool clearly outperforms Akiss, APTE, and SPEC. The SatEquiv tool becomes more efficient, when the number of sessions significantly increases.

To put more emphasis on the broad scope we also include analyses of unlinkability and anonymity properties for a number of other protocols. We experiments on the examples mentioned in Chapter 2 (still with a fixed scenario), i.e., Private authentication, BAC (property (UL ≈t n )) and Helios (vote swap model). In addition we study a simplified version of the AKA protocol deployed in 3G telephony networks without XOR [AMR + 12], the Passive Authentication protocol implemented in the European passport [START_REF]PKI for machine readable travel documents offering ICC readonly access[END_REF], as well as the Prêt-à-Voter protocol (PaV) [START_REF] Peter | Prêt-à-voter with re-encryption mixes[END_REF]. Note that, while PaV is a priori in the scope of Akiss, it failed to produce a proof: Akiss only approximates trace equivalence of non-determinate processes and finds a false attack here. Finally we note that BAC, PaV and Helios protocols are not actiondeterminate and therefore do not benefit from the POR optimisation, which explains the much higher verification times when increasing the sessions. Nevertheless, as exemplified by some examples, attacks may be found very efficiently, as it generally does not require to explore the entire state space.

2 Full fledged examples. Now that we have compared the performances of DeepSec with other tools, we focus more on its capabilities to handle complex scenarios by analysing the different models developed in Chapter 2-which, we recall, are parametric in the scenario by involving the adversary and may include adversarial sessions. The experimental results can be found in Figure 3.7. We refer to the discussions of Chapter 2 for the description of the protocols, assumptions on the adversary, and interpretations of the violations found. Let us still emphasise that DeepSec in unable to analyse 2 roles of BAC with potential adversarial sessions in a 12h timeout. To scale to this example we will need the optimisation techniques of Chapter 5. Technical Chapter. In this chapter we detail how to generate partition trees, the key tool used in Chapter 3 to prove equivalence of bounded processes. Our procedure is correct for any constructor-destructor subterm convergent theories. As sketched in the previous chapter, the generation mostly consists of constraint solving procedures that refine and partition a set of symbolic constraints to separate those that have non-statically-equivalent solutions.

Termination and complexity-related concerns are investigated in the corresponding part of the thesis (Part III, Chapter 6).

1 Extended constraint systems

Section summary

In order to carry out the constraint solving required to construct the partition tree, we extend constraint systems with components allowing to reason more finely about the attacker's knowledge.

The notion of solution of constraint system is also extended to capture their expected properties.

Knowledge base and formulas

New constraints From now on we assume an implicit theory E that is constructordestructor and subterm convergent. We introduce an extension of constraint systems with second-order constraints that serve key roles in the generation of the partition tree:

Giving a finite representation of the deductive capabilities of the attacker.

This takes the form of a knowledge base K which is a finite set of deduction facts. By relying on subterm convergence among others, our procedure will ensure that a term u is deducible iff it can be deduced by applying constructor symbols to deduction facts of K, which makes deducibility easily decidable due to the constructor-destructor property. In particular we will only consider solutions that compute terms using entries of K this way.

Giving a finite representation of the distinguishing capabilities of the attacker.

This takes the form of a set of formulas F that is, in short, a finite representation of the term equalities that hold in the current frame. In particular static equivalence will be characterisable only from the formulas of F.

Recording the constraints imposed on second-order solutions during the constraint solving.

When computing most general solutions or performing case analyses on the form of solutions, we track the resulting effect on second-order solution in a set E 2 that is the second-order analogue of E 1 . This is mostly how we model the predicates that appear in the configurations in partition trees (Chapter 3, Definition 3.9).

More formally we consider, in addition to deduction facts and second-order equations, a new atomic second-order constraint, equality facts ξ = ? f ζ, ξ and ζ second-order terms. Unlike second-order equations that model syntactic equalities, equality facts capture equalities modulo theory, that is, the fact that ξ and ζ deduce the same first-order term. Concretely we extend the relation |= (Chapter 3, Section 1.3) with

(Φ, Σ, σ) |= ξΣΦσ = E ζΣΦσ
We now define the constraints that are typically put in the set F.

Definition 4.1 (deduction formula, equality formula)

A deduction (resp. equality) formula is a constraint of the form ∀S. (C 1 ∧ . . . ∧ C n ) ⇒ H: 1 S is a set of (both first-order and second-order) variables; 2 H is a deduction fact (resp. an equality fact); 3 for all i ∈ {1, . . . , n}, C i is either a deduction fact of the form X ? t, X ∈ X 2 , or a first-order syntactic equation u = ? v. A formula ψ is called solved when it contains no hypotheses, i.e., ψ = (∀∅. ⇒ H) = H. Given a formula ψ = ∀S. ϕ ⇒ H, we denote by hyp(ψ) the set of the syntactic equations appearing in the hypotheses ϕ, and by D(ψ) the set of deduction facts in ϕ.

Intuitively, a formula captures a deduction or comparison that the attacker may perform and the premisses C 1 , . . . , C n express conditions under which this is possible. Typically if the attacker observed a ciphertext rsenc(m, r, k) (bound to an axiom ax), we may express the deducibility of m through the formula ∀X. X ? k ⇒ rsdec(ax, X) ? m Another example is the following formula that expresses the tautology that two recipes deducing the same term should be equal in the sense of an equality fact:

∀X, Y, z. (X ? z ∧ Y ? z) ⇒ X = ? f Y
This formula will serve as a generic placeholder when computing equality formulas during the constraint solving, that is, we will always add equality formulas obtained by substituting variables in the above formula. Although we consider arbitrary formulas such as the above two during the computation of the partition tree, note that only formulas of a certain shape will eventually be added in the set F recording the attacker's distinguishing capabilities. We give more details on the invariants of the procedure in Appendix B, Section 1 but we can mention for example that the formulas effectively recorded in F will be of the form ϕ ⇒ H, i.e., there are no universally-quantified variables, and ϕ only contains first-order equations.

Extended constraint systems We now formalise how we extend constraint systems to store the knowledge base, formulas, and to capture restrictions on the form of solutions. Definition 4.2 (extended constraint system) An extended constraint system C e is a tuple (Φ, D, E 1 , E 2 , K, F) where: 1 (Φ, D, E 1 ) is a constraint system, although more general in that D may contain constraints of the form X ? u or ∀X. X ? u where u may be an arbitrary constructor term; 2 E 2 is a set of second-order equations and constraints of the form ∀Y 1 , . . . , Y k . p j=1 ξ j = ? ζ j 3 K is a set of deduction facts; 4 F is a set of deduction and equality formulas.

As explained earlier, the set E 2 gathers constraints to be satisfied by the second-order solutions of the system, K is a finite representation of the attacker knowledge, and F characterises the attacker capabilities to deduce and compare terms modulo theory. In particular the set E 2 contains additional constraints to be satisfied by solutions while K and F are valid formulas that characterise potential attacker actions. For example, the (unsolved) deduction formulas in F reason about potentially deducible terms: when such formula contains premisses, the procedure will perform a case analysis to distinguish cases where the hypotheses hold or not, leading to solved or trivial formulas, respectively. When a solved deduction formula is obtained this way, we add it to the knowledge base K if u is not already deducible from it.

(Most general) solutions

We now define how the notion of solutions is lifted to extended constraint systems and how this embeds the predicates π used in the definition of partition-tree configurations. The definition of a solution (Σ, σ) of C e follows three guidelines: 1 it should be a solution in the usual sense and satisfy E 2 (C e ); 2 the set of formulas F(C e ) plays no role in the definition of solutions: we will only prove invariants that this set verifies during our specific constraintsolving procedure (see Appendix B, Section 1); and 3 all recipes used in the solution should have been constructed from the knowledge base K(C e ), uniformly (that is, a same first-order term should not be deduced by different recipes in the solution). In particular this requires a notion of consequence, indicating that a recipe can be deduced from the knowledge base.

Definition 4.3 (consequence)

We define the set of consequences of a set of deduction facts S, denoted Conseq(S), as the set of pairs (C[ξ 1 , . . . , ξ n ], C[u 1 , . . . , u n ]) where C is a context built using F c ∪ F 0 and for all i ∈ {1, . . . , n}, ξ i ? u i ∈ S. We write ξ ∈ Conseq(S) if ∃t. (ξ, t) ∈ Conseq(S).

We recall that by definition a deduction fact never has a constructor function symbol at its root (Chapter 3, Definition 3.

A pair of substitutions (Σ, σ) is a solution of (Φ, D, E 1 , E 2 , K, F) if (Φ, Σ, σ) |= D ∧ E 1 ∧ E 2
and the following two properties hold: 1 K-Basis: for all ξ ∈ subterms 2 (img(Σ) ∪ KΣ), msg(ξΦσ) and (ξ, ξΦσ↓) ∈ Conseq(KΣσ) 2 Uniformity: for all ξ, ξ ∈ subterms c (img(Σ), KΣ), ξΦσ = E ξ Φσ implies ξ = ξ . The set of solutions of C e is written Sol (C e ) and C e is satisfiable if Sol (C e ) = ∅. We will denote by ⊥ an unsatisfiable extended constraint system. The notion of most general solution of C e is adapted in a straightforward way from the analogue for regular constraint systems.

Intuitively when computing a node n of a partition tree, the extended constraint systems represent the predicate π(n): it will be defined so that given (P, C) ∈ Γ(n) attached with C e , we have Sol π(n) (C) = Sol (C e ) (up to domain restriction). We detail this in Sections 1.3 and 5.

Example 4.1

Consider the extended constraint system C e defined by

Φ = {ax 1 → k, x } D = X: 0 ? x ∧ Y : 1 ? y E 1 = y = ? x E 2 = K = ax 1 ? k, x F = K ∧ fst(ax 1 ) ? k ∧ snd(ax 1 ) ? x ∧ X = ? f snd(ax 1 )
This system involves an adversarial input x computable from an empty frame, which produces in response an output of k, x for some name k, and then the adversary inputs again y = x.

The set F, although not impacting the notion of solution, characterises here all successful operations that the attacker may perform in this situation: applying destructors to the term bound to ax 1 and observe that X and snd(ax 1 ) deduce the same term.

We have for example ( X, ax 1 , x, k, x ) ∈ Conseq(K ∪ D). However the knowledge base is not saturated in the sense that there are deducible terms u, for example u = k, such that there exist no recipes ξ such that (ξ, u) ∈ Conseq(K ∪ D). In our procedure, the saturation is done by adding to K all destructor applications that result into a non-consequence term. A saturated version of the constraint system would be

C e s = C e [K → K ∧ fst(ax 1 ) ? k]
Note that adding the deduction fact snd(ax 1 ) ? x to the knowledge base is possible but redundant since x is already deducible from X. The saturation ensures that for all (Σ, σ) satisfying D(C e s ) ∧ E 1 (C e s ) ∧ E 2 (C e s ), there exists Σ such that (Σ , σ) ∈ Sol (C e s ), meaning that the requirement that solutions verify K-basis can always be satisfied (which is key for satisfying the requirement that all symbolic transitions are reflected in the partition tree, recall Item 2 of the definition in Chapter 3). Let us then consider

Σ = {X → a, Y → snd(ax 1 )} Σ = {X → a, Y → a} σ = {x → a, y → a}
Both (Σ, σ) and (Σ , σ) are solutions of the regular constraint system (Φ(C e s ), D(C e s ), E 1 (C e s )), but only (Σ , σ) is a solution of C e . This is because Σ does not verify uniformity: two different recipes a and snd(ax 1 ) are used to deduce the same first-order term a. More generally we have mgs (C e s ) = {Y → X}. To obtain this result, the constraint-solving procedure for computing mgs', detailed in Section 2, will observe that X and Y deduce the same term and should therefore be unified to satisfy uniformity. A second-order equation X = ? Y is thus added in E 2 , whose mgu is then the expected most general solution.

Remark: uniformity and complexity

In some sense enforcing that solutions are uniform ensures their minimality in terms of DAG size, by forcing identical recipes to be reused as much as possible when constructing the solution. This will be key for the complexity of our decision procedure, see Chapter 6.

Constraint solving : the basics

Now we give details about the organisation of our constraint solver, detailed and proved correct in the next sections. As explained in Section 1.2, the goal of extended constraint system is to carry additional, structural information about solutions in a node n, thus playing the role of the predicate π(n). More formally the procedure operates on: Definition 4.5 (extended symbolic process, vector)

An extended symbolic process is a tuple (P, C, C e ) where (P, C) is a symbolic process and C e an extended constraint system. We call a vector a set of sets of extended symbolic processes

S = {Γ 1 , . . . , Γ n }. Each set Γ i is called a component of S.
An extended symbolic process (P, C, C e ) induces a predicate π on the solutions of (P, C) defined as follows: if (Σ, σ) ∈ Sol (C), then π(Σ) holds iff there exists (Σ , σ ) ∈ Sol (C e ) such that Σ ⊆ Σ and σ ⊆ σ . In particular Sol π (C) = Sol (C e ) (up to domain restriction), but this predicate may differ from one extended symbolic process to another. However, assuming a set Γ of such processes where this predicate π is uniform across all elements of Γ, this may be used to model a partition-tree node (up to the additional properties required by the definition). Given such a set Γ modelling a node n, the goal of the constraint-solving procedure is therefore to refine Γ until obtaining a vector S = {Γ 1 , . . . , Γ n } such that 1 each component Γ i can be used to model a partition-tree node, that is, a predicate π i can be defined as above uniformly across all elements of Γ i ; 2 the underlying nodes verify the properties of the partition tree w.r.t. their father node Γ.

The procedure takes the form of various reduction relations that are used to refine a set of sets of extended symbolic processes, progressively, until reaching the final vector S:

The overall procedure organising the above sets of rules into a complete algorithm to compute a partition tree is then detailed in Section 5. This is therefore the detailed version of the outline of Chapter 3, Section 3.1. The main arguments for proving the correctness of the computation are also provided in Section 5; note however that these are only partialcorrectness arguments in that the termination of the procedure is studied in Chapter 6.

Constraint solving : computing most general solutions

Section summary

We describe a constraint solving procedure permitting to compute the most general solution(s) of an extended constraint system. Due to the particular structure the solutions are required to have (K-basis and uniformity) the procedure becomes rather lightweight.

Applying solutions and unifiers

Because solutions Σ may introduce new second-order variables, their applications to a constraint system or a formula is not straightforward. Let for example C e = (Φ, D, E 1 , E 2 , K, F) where a variable X: k is used to deduce a term u, i.e. (X ? u) ∈ D. Now say we want consider the scenario where u is computed using a constructor f/3 and an entry of the knowledge base (ξ ? v) ∈ K as a first argument, that is, we want to apply to C e :

Σ = {X → f(ξ, X 1 , X 2 )} X 1 , X 2 fresh
The raw application C e Σ has a flawed structure, in particular because the variables X 1 and X 2 would not be bound in the resulting system. To solve this issue we use a custom application mechanism that replaces X ? u in D by X 1 ? x 1 , X 2 ? x 2 , x 1 , x 2 fresh, and we add the equality u = ? f(v, x 1 , x 2 ) to E 1 to express the logical link between X and XΣ = f(ξ, X 1 , X 2 ).

Definition 4.6 (application of a substitution to an extended constraint system)

Let C e = (Φ, D, E 1 , E 2 , K, F) and Σ be a substitution. We write C e :Σ the constraint system:

(Φ, D , E 1 ∧ E Σ , E 2 Σ ∧ Σ |vars 2 (C e ) ,
E Σ = {u = ? v | Y ? u ∈ D dom , (Y Σ, v) ∈ Conseq(KΣ ∪ D )}
By abuse of notation we may write S:Σ for (P, C, C e :Σ) if S = (P, C, C e ).

We will also use a similar mechanism for applying substitutions to formulas: Definition 4.7 (application of a substitution to a formula)

Let C e = (Φ, D, E 1 , E 2 , K, F), ψ = ∀S. ϕ ⇒ H be a formula,
D dom = {Y ? u ∈ D(ψ) | Y ∈ dom(Σ)} 2 D fresh = {Y ? y | Y ∈ vars 2 (img(Σ)) vars 2 (C, ψ), y fresh} 3 E Σ = {u = ? v | Y ? u ∈ D dom , (Y Σ, v) ∈ Conseq (K ∪ D ∪ D )}

Constraint-solving rules

A complete example By definition, the solutions of an extended constraint systems C e have to verify K(C e )-basis, which means that in practice we only have to compute solutions constructed by applying constructors to the entries of the knowledge base and D. Besides due to the uniformity requirement we can always unify two recipes that deduce the same first-order term. Putting everything together the most general solutions of an extended constraint system can then be computed with a simple transition system. Let us detail a complete example to illustrate the mechanisms in play, before formalising the corresponding constraint-solving rules.

Example 4.2

Given k, r ∈ N , let us consider a situation where the attacker has observed the output of a hash h(r), then inputs a term x, receives in response a ciphertext raenc(k, r, x) encrypted with x, and finally inputs a term y that should verify the equation y = ? k, h(x) . This is modelled by the frame Φ = {ax 1 → h(r), ax 2 → raenc(k, r, x)} and the constraints

D = X: 1 ? x ∧ Y : 2 ? y E 1 = y = ? k, h(x)
At this point a saturated knowledge base should contain the two entries of the frame and one recipe indicating that decrypting ax 2 results in obtaining the name k.

K = ax 1 ? h(r) ∧ ax 2 ? raenc(k, r, x) ∧ radec(ax 2 , X) ? k
We consider that E 2 = and we leave the set of formulas F unspecified since it has no influence on solutions. First of all some simplification rules will be applied to propagate the equations on x and y to the whole system; here it will apply mgu(E 1 ) to D, resulting in

D = X ? x ∧ Y ? k, h(x)
The constraint-solving rules detailed in the remaining of this section consider all ways to compute recipes for X and Y from the knowledge base. For each of these recipes two cases arise: either 1 it is picked directly from the knowledge base; or 2 it starts with a constructor symbol. This will correspond to the constraint-solving rules (MGS-Res) and (MGS-Cons), respectively. Finally, to satisfy the uniformity property, the procedure unifies any second-order terms in the system that deduce the same first-order term (Rule (MGS-Conseq)). We keep on refining the case analysis with these three rules, removing branches yielding contradictions, until no more rules are applicable. The resulting systems will either have no solutions, or be in a so-called solved form and have mgu(E 2 ) as a unique mgs. Let us do it for our example:

case 1: the recipe for Y has a constructor symbol at its root (only possible case)

The constructor in question is necessarily the pair. Therefore we let two fresh second-order variables Y 1 : 2, Y 2 : 2 and apply the substitution {Y → Y 1 , Y 2 } to the system (in the sense of Definition 4.6). After simplification this leads to the updated second-order constraints:

D = X ? x ∧ Y 1 ? k ∧ Y 2 ? h(x) E 2 = Y = ? Y 1 , Y 2
case 1.1: the recipe for Y 1 is radec(ax 2 , X) from the knowledge base (only possible case)

We thus apply the substitution {Y 1 → radec(ax 2 , X)}, resulting in the updated constraints:

D = X ? x ∧ Y 2 ? h(x) E 2 = Y = ? radec(ax 2 , X), Y 2
case 1.1.1: the recipe for Y 2 is the entry ax 1 from the knowledge base

We therefore apply the substitution {Y 1 → ax 1 }, resulting in the updated constraints:

D = X ? r E 2 = Y = ? radec(ax 2 , X), ax 1
However the constraints on X are now unsatisfiable: the corresponding recipe can neither start with a constructor nor be an entry of the knowledge base. The constraints in this branch of the case analysis therefore have no solutions.

case 1.1.2: the recipe for Y 2 has a constructor symbol at its root

The constructor in question is necessarily h. Similarly to case 1 we apply the substitution {Y 2 → h(Y 3 )} for some fresh variable Y 3 : 2 which results in the updated constraints:

D = X ? x ∧ Y 3 ? x E 2 = Y = ? radec(ax 2 , X), h(Y 3 )
Then we observe that X and Y 3 should be unified by uniformity because they deduce the same first-order term x. We have mgu(X = ? Y 3 ) = {Y 3 → X} (we recall that {X → Y 3 } is not a valid second-order substitution because Y 3 has a strictly greater type than X) which, after application to the system, results in the updated constraints:

D = X ? x E 2 = Y = ? radec(ax 2 , X), h(X)
This will be a typical example of system in solved form. Since we considered all cases and only this branch was successful we conclude that the overall system has a unique mgs which is mgu(E 2 ) = {Y → radec(ax 2 , X), h(X) }.

Formalisation We will formalise the simplification rules in the next section and focus here on the main three rules (MGS-Conseq), (MGS-Res) and (MGS-Cons) mentioned in the above example. For that we reason about a set used 2 (C e ) that represents all recipes that are already used to constraint the solutions of C e :

used 2 (C e ) = subterms c (img(mgu(E 2 (C e )), K(C e ) ∪ D(C e )) ∪ vars 2 (D(C e ))
As we saw in the example, the mgs is gradually constructed "within E 2 ", in the sense that after normalising C e with the transition system defined in this section, it will have mgu(E 2 ) as a unique mgs. In particular an invariant of our transition system is that img(mgu(E 2 (C e ))) is consequence of K(C e ) and D(C e ), hence the notation used 2 (C e ) is well defined. Formally speaking the transition system relies on three rules of the form

C e Σ -→ C e :Σ ( )
for some subtitution Σ and under various conditions capturing the possible ways to satisfy the constraints of C e . For example the uniformity property is expressed by applying ( ) with The result is the unification in C e of the two second-order terms ξ and ζ that deduce the same term u. It then remains to add rules that express how each term u, (X ? u) ∈ D(C e ), can be constructed by the adversary from the knowledge base. When Rule (MGS-Conseq) is not applicable we thus apply ( ) under one of the following two conditions. The first one expresses that u is computed by directly using an entry from the knowledge base: Σ = mgu(X = ? ξ) = ⊥ where, for some u / ∈ X , there exist deduction facts (X: k ? u) ∈ D(C e ) and (ξ ? v) ∈ K(C e ) (MGS-Res)

Σ = mgu(ξ = ? ζ) for some ξ ∈ used 2 (C e ) ∪ F 0 , ζ ∈ used 2 (C e
Then the last rule expresses that the computation of u starts by applying a constructor f:

Σ = {X → f(X 1 , . . . , X n )}
where X 1 : k, . . . , X n : k are fresh, and there exists a deduction fact (X:

k ? f(u 1 , . . . , u n )) ∈ D(C e ) (MGS-Cons)
As said above we always apply Rule (MGS-Conseq) in priority, that is, we add to the last two rules the condition that Rule (MGS-Conseq) cannot be applied. This will be crucial in particular when studying the complexity of the procedure in Chapter 6.

First set of simplification rules

Between each application of the above three rules, the constraint systems are then simplified by the following set of simplification rules. Other simplification rules serving different purposes will be introduced in the remaining of the procedure. The rules here are separated in two kinds: simplification rules for formulas that simply compute most general unifiers and simplify the hypotheses of formulas, and simplification rules for mgs' that apply the unifiers computed by above rules to the rest of the system and detect contradictions and violations of uniformity.

Simplification rules for formulas We first introduce basic simplification rules for formulas that will be used even outside of the computation of most general solutions. We define five sets rules in Figure 4.1 that apply on constraints of E 1 , E 2 and F.

Misc. ¬ ⊥ ¬⊥ ϕ ∧ ϕ ϕ ∧ ⊥ ⊥ Universal vars. ∀S ∪ {x}. (x = ? u ∧ ϕ) ⇒ H ∀S. ϕσ ⇒ Hσ if σ = mgu(x = ? u) = ⊥ ∀S ∪ {x}. ϕ ⇒ H ∀S. ϕ ⇒ H if x / ∈ vars 1 (ϕ)
1 st order eq. u = ? v mgu(u = ? v) No rules are needed for second-order equations in the context of our decision procedure, since Rules (MGS-Conseq), (MGS-Res) and (MGS-Cons) already apply mgu's to the entire system. The simplification rules are lifted to extended constraint systems C e in the natural way, by applying the simplifications to all formulas of E 1 (C e ), E 2 (C e ) and F(C e ).

1 st order diseq. ∀S. φ    ∀S. x∈dom(σ) x = ? xσ with σ = mgu(¬φ) = ⊥ if mgu(¬φ) = ⊥ 2 nd order diseq. ∀S. φ        ∀S ∪ S .
Simplification rules for MGS In addition of the rules of Figure 4.1 we define a couple of other rules specific to the computation of most general solutions. First of all the rule

(Φ, D, E 1 ∧ x = ? u, E 2 , K, F) (Φσ, Dσ, E 1 σ ∧ x = ? u, E 2 , Kσ, Fσ) (MGS-Unif)
where x ∈ vars 1 (E 1 , D, Φ, K, F) vars (u) and σ = {x → u}, propagates first-order mgu's in the whole system. We also consider the following rule discarding a system with no solutions

C e ⊥ (MGS-Unsat)
where either of the following three conditions is satisfied:

1 E 1 = ⊥ 2 there exist ξ, ζ ∈ used 2 (C e ) such that (ξ, u), (ζ, u) ∈ Conseq(K(C e ) ∪ D(C e ))
and, writing Σ = mgu(ξ = ? ζ), either Σ = ⊥ or E 2 Σ * ⊥ with the rules of Figure 4.1 3 there exist (∀X: i. X ? u) ∈ D(C e ) and ξ ∈ T 2 i such that (ξ, u) ∈ Conseq(K(C e ) ∪ D(C e )) The first condition captures trivially unsatisfiable systems, the second one systems with no uniform solutions, and the third one exhibits a public channel that has been used for an internal communication (which is forbidden by the semantics). Since the whole set of simplification rules (Figure 4.1 and the above two) is convergent modulo renaming of variables, we denote C a normal form of the extended constraint system C w.r.t. .

Overall procedure and correctness

Description of the procedure The point of the transition systems above is to transform an extended constraint system into a form where it has a unique mgs. More formally: Definition 4.8 (solved extended constraint system) An extended constraint system C e is in solved form if C e = ⊥, C e is irreducible w.r.t. and -→ , and all deduction facts in D(C e ) have variables as first-order terms.

Intuitively for such constraint systems, mgu(E 2 (C e )) is the unique mgs of C e . Note however that this method for computing mgs' is only correct under some invariants of Algorithm 1. Typically, since second-order equations are not handled by simplification rules, if E 2 contains two equations X = ? a and X = ? b for two constants a = b, our procedure would fail to detect the contradiction. If we define the reduction relations Remark: notation for extended symbolic processes For convenience we often abuse notations and, if S = (P, C, C e ) is an extended symbolic process, we write mgs (S) instead of mgs (C e ) or say that S is in solved form.

Correctness arguments As mentioned earlier this procedure is only correct under some additional properties verified all along Algorithm 1. For the sake of precision we make explicit mention to these two invariants, Inv wf (C e ) and Inv sound (C e ). They are formally defined in Appendix B, Section 1 with a proof that they are preserved during the whole computation of the partition tree, but knowing their exact definition is not necessary to understand the results of this section. The core correctness arguments can be decomposed into following propositions, proved in Appendix B. The first one states that when an extended constraint system cannot be reduced anymore then its set of most general solutions is either empty or a singleton: Proposition 4.1 (mgs of an irreducible system)

Let C e be an extended constraint system that is irreducible w.r.t. and -→ , and such that the invariants Inv wf (C e ) and Inv sound (C e ) hold. Then

1 if C e is in solved form then mgs (C e ) = {mgu(E 2 (C e ))} 2 otherwise mgs (C e ) = ∅
The second argument is that applying the mgs constraint-solving rules is correct w.r.t. the solutions of the initial system. Finally the last argument formalises than all solutions can be expressed as a sequence of mgs constraint-solving transitions.

Proposition 4.3 (completeness of one step of the mgs constraint solving)

Let C e be an extended constraint system such that C e = C e and the invariants Inv wf (C e ) and Inv sound (C e ) hold. We also assume that at least one mgs constraint-solving rule is applicable to C e . Then for all (Σ, σ) ∈ Sol (C e ), there exist a constraint-solving transition C e Σ 0 -→ C e and Σ ⊆ Σ , σ ⊆ σ such that (Σ , σ ) ∈ Sol (C e ).

Together these three results give the partial correctness of the procedure, that is, the correctness of the computation when it terminates. The termination is studied in Chapter 6: Using such an induction we can prove the two requirements of the definition, that is: 1 that all Σ ∈ S are solutions of C e after replacing their second-order variables by fresh constants (base case: Proposition 4.1; inductive case: soundness, i.e., Proposition 4.2). 2 that all solutions of C e are instances of a substitution of S (base case: Proposition 4.1 again; inductive case: completeness, i.e., Proposition 4.3).

3 Constraint solving : symbolic and simplification rules

Section summary

We now introduce: symbolic rules that apply symbolic transitions to extended symbolic processes and collect the corresponding constraints, normalisation rules that simplify the resulting constraints based on the analysis of mgs', and vector-simplification rules that separate systems with non-equivalent solutions based on the analysis of the formulas in F among other things.

Symbolic rules

The symbolic rules simply apply the transitions of the symbolic semantics to extended symbolic processes, adding the corresponding constraints to both the symbolic process and the extended constraint system. In that sense most rules are close to identical to those of the symbolic semantics (Chapter 3, Section 1.4). Typically the analogue of the rule (s-In) is:

({ {u(x).P } } ∪ P, C, C e ) Y (X) ---→ s ({ {P } } ∪ P, incr (C), incr (C e )) (E-In) where, if D ∈ {C, C e }, incr (D) = D[D → D ∧ X ? x ∧ Y ? y, E 1 → E 1 ∧ σ]
with Y : n, X: n and y fresh and σ ∈ mgu E (y = ? uµ), µ = mgu(E 1 (C)). The only rule that is not a trivial extension of the symbolic semantics is the one for outputs that puts a deduction fact in F to model the additional capability this offers to the attacker:

({ {u v .P } }∪P, C, C e ) Y ax n+1 ------→ s ({ {P } }∪P, incr (C), incr (C e )[F → F∧ax n+1 ? vσ↓]) (E-Out) where, if D ∈ {C, C e }, incr (D) = D[Φ → Φ∪{ax n+1 → vσ↓}, D → D∧Y ? y, E 1 → E 1 ∧σ]
with Y : n and y fresh and σ ∈ mgu E (y = ? uµ ∧ vµ = ? vµ), µ = mgu(E 1 (C)). We omit the definition of the remaining rules corresponding to the other symbolic transitions, all constructed being constructed similarly to (E-In) by copying the new constraints of C into C e .

Normalisation rules

We define a new set of simplification rules, called normalisation rules, that operate on extended constraint systems. Similarly to the simplification rules for most general solutions introduced in Section 2.3 they propagate first-order unifiers across the system and replace unsatisfiable systems by ⊥. They also rely on the computation of mgs' of Section 2, for example to identify and remove trivial constraints such as formulas with unsatisfiable hypotheses. They are defined in Figure 4.2 and commented below (in particular regarding the definition of h ).

C e C e if C e C e by rule (MGS-Unif) (Norm-Unif) C e ⊥ if mgs (C e ) = ∅ (Norm-no-MGS) C e [E 1 → E 1 ∧ ∀x.φ] C e if mgs (C e [E 1 → E 1 ∧ ¬φ]) = ∅ (Norm-Diseq) C e [F → F ∧ ψ] C e if mgs (C e [E 1 → E 1 ∧ hyp(ψ)]) = ∅ (Norm-Formula) C e [F → F ∧ ψ] C e if ∃ψ ∈ F, ψ h ψ and ψ solved (Norm-Dupl)
We recall that we also write C e C e if a constraint of E 1 (C e ), E 2 (C e ) or F(C e ) can be simplified using one of the simplification rules on formulas (Figure 4.1). The relation can be lifted to sets of (sets of) extended constraint systems or symbolic processes in the natural way. Let us now comment on the rules of Figure 4.2. Rule (Norm-Unif) uses the same rule as in the mgs constraint solving to propagate first-order unifiers to the whole system. The next three rules exploit the existence of a most general solution of the constraint system to simplify some constraints:

1 Rule (Norm-no-MGS) checks whether the constraint system is unsatisfiable, i.e., does not have a most general solution, and in this case transforms it into ⊥. 2 Rule (Norm-Diseq) similarly removes a disequation ∀x.φ in E 1 when it does not effectively restrict the solutions: for that we require the constraint system not to have solutions that contradict the disequation. 3 Analoguously Rule (Norm-Formula) removes a formula with unsatisfiable hypotheses.

Following the same approach as the last two rules, one could imagine a rule removing a non-deducibility constraint ∀X. X ? u from D provided mgs (C e [D → D ∧ X ? u]) = ∅. This would however not be sound in general since the knowledge base may not be saturated, that is, there may exist a solution satisfying X ? u due to an entry added to K(C e ) in the future. The treatment of non-deducibility facts will be handled by a dedicated case-distinction rule, see Section 4.4. Finally Rule (Norm-Dupl) removes an unsolved deduction or equality formula ψ from F when it is subsumed by another formula ψ . This is formalised by the following notion of equivalence: Definition 4.9 (head equivalence of formulas) Let ψ = ϕ ⇒ H and ψ = ϕ ⇒ H be two formulas. We say that ψ and ψ are head equivalent, written ψ h ψ , if for some ξ, ζ, u, u either H = H = (ξ = ? f ζ), or H = (ξ ? u) and H = (ξ ? u ).

That is, two formulas are head equivalent if their heads have the same second-order terms (but may differ on their first-order terms), which means they model the same attacker action. In particular if ψ h ψ and ψ is solved (namely has no hypotheses anymore) then the formula ψ is already implied by ψ which is why Rule (Norm-Dupl) can remove it from F.

Vector-simplification rules

We now define simplification rules that focus on vector, thus called vector-simplification rules. They are described in Figure 4.3 and focus among other things on adding formulas and entries in the knowledge base. This has to be done concurrently on an entire vector component to ensure that the same attacker actions can be performed in all of its elements, that is, that they have statically-equivalent solutions. The rules assume that the constraint systems have been normalised by the normalisation rules (see Figure 4.2), and one of them uses our custom notation for applying a substitution Σ to a formula (Section 2.1, Definition 4.7). Finally, for the sake of succinctness, if S = (P, C, C e ) is an extended symbolic process we refer as Φ(S), E 1 (S), E 2 (S), . . . to the corresponding components of C e .

S ∪ {Γ ∪ {(P, C, ⊥)}}

S ∪ {Γ} (Vect-rm-Unsat)

S ∪ {Γ} S ∪ {Γ + , Γ -} (Vect-Split)
if Γ + , Γ -is a partition of Γ and there exists a formula ψ such that 1 ∀S ∈ Γ + , ∃ψ ∈ F(S), ψ h ψ and ψ solved; and Rule (Vect-rm-Unsat) removes ⊥ elements from the vector. Rule (Vect-Split) splits a component whenever a common solution would yield statically inequivalent frames. More specifically, the rule separates the constraint systems in Γ + in which a given recipe always yields a message (resp. an equality always holds) from the constraint systems in Γ -in which the same recipe would never yield a message (resp. the same equality would never hold). This is characterised by the fact that a deduction (resp. equality) formula is solved in some constraint systems and not in the others. Rule (Vect-add-Conseq) adds a solved deduction formula from F(S) to K(S) when this formula is solved in the entire component Γ and the new knowledge-base entries are not redundant with existing ones. Finally, when an equality fact ξ = ? f ζ should hold in one constraint system, Rule (Vect-add-Formula) adds it to the entire component Γ (with appropriate hypotheses). Observe that we use in this rule the placeholder formula ψ = ∀X, Y, z. (X ? z ∧ Y ? z) ⇒ X = ? f Y , introduced in Section 1.1, stating that two recipes deducing the same term should verify an equality fact.

2 ∀S ∈ Γ -, ∀ψ ∈ F(S), ψ h ψ S ∪ {Γ} S ∪ {{S[K → K ∧ ξ ? u S ] | S ∈ Γ}} (Vect-add-Conseq) if for all S ∈ Γ, S is solved, ξ ? u S ∈ F(S)

Constraint solving : case distinction rules

Section summary

These rules are the core of the constraint solver: they generate constraints, based on case analyses, that help refining vector components to obtain remarkable properties (each component has a unique mgs, saturated knowledge base, statically-equivalent solutions...).

Our case distinction rules take the form of a transition system on vectors S of extended symbolic processes similarly to the vector-simplification rules. There are three different rules, each operating in a similar manner: given a vector S ∪ {Γ}, all rules perform a transformation of the following form on one component Γ:

S ∪ {Γ} → S ∪ {Γ + , Γ -} ( )
where Γ + (the positive branch) is intuitively obtained by applying a mgs Σ on each symbolic processes of Γ and Γ -(the negative branch) by adding the formula ¬Σ to each symbolic process S ∈ Γ, where

¬Σ = ∀S. X∈dom(Σ) X = ? XΣ with S = vars 2 (img(Σ)) vars 2 (S)
Intuitively this refines the component Γ by considering the cases where Σ is a solution or not. After that, normalising the refined components Γ + and Γ -with the simplification rules-in particular Rules (Vect-rm-Unsat) and (Vect-Split)-will discard impossibles cases and separate processes with newly-found non-statically-equivalent solutions. The four case distinction rules (Sat), (Eq), (Rew) and (Chan) are presented in the next sections by specifying how Γ + and Γ -are computed from Γ. They are applied using a particular strategy defined by the following ordering on rules (where < means "has priority over"):

Sat < Eq < Rew < Chan
Note that only the fact that Rew < Chan is needed to prove the correctness of the procedure, while the minimality of Sat will be needed in Chapter 6 for complexity. The relative ordering of (Eq) and (Rew) is arbitrary.

Rule Sat

The first rule focuses on satisfiability: its goal is to separate extended constraint systems of Γ that have not the same solutions. For example if we have S = (P, C, C e ) ∈ Γ and Σ ∈ mgs (C e ), all other symbolic processes S ∈ Γ should also have a solution that is an instance of Σ (and if not, the component Γ should be split to separate S and S ). In particular this ensures that when this rule cannot be applied anymore, all extended constraint system in Γ share a common, unique mgs (in particular they are in solved form). The same mechanism can be used to consider the solutions Σ making trivial some disequations of E 1 or hypotheses of some formulas in F. In particular the normalisation rules defined earlier in Section 3.2 will then handle the now trivial or unsatisfiable constraints. All this can be formalised as an instance of ( ) with:

Γ + = {S:Σ | S ∈ Γ} Γ -= {S[E 2 → E 2 ∧ ¬Σ] | S ∈ Γ} (Sat)
where there exists S ∈ Γ such that either 1 S not solved and Σ ∈ mgs (S); or 2 there exists ψ ∈ F(S) not solved and Σ ∈ mgs (S[E 1 → E 1 ∧ hyp(ψ)]); or 3 E 1 (S) contains a disequality ψ = ∀x.φ and Σ ∈ mgs (S[E 1 ∧ ψ → E 1 ]mgu(¬φ)).

Rule Eq

The second case distinction rule focuses on the static equivalence between solutions of extended constraint systems. More specifically, the rule (Eq) checks whether an entry ξ 1 ? u 1 of one knowledge base of Γ can deduce the same term as another recipe ξ 2 consequence of K. The rule is formalised as an instance of ( ) with

Γ + = {S:Σ[F → F ∧ ψ:(Σ 0 Σ, S:Σ)] | S ∈ Γ} Γ -= {S[E 2 → E 2 ∧ ¬Σ] | S ∈ Γ} (Eq) if there exist S ∈ Γ, Σ ∈ mgs (S[E 1 → E 1 ∧ hyp(ψ:(Σ 0 , S))]
), such that ψ:(Σ 0 Σ, S:Σ) is a solved formula and: f Y with X: k, Y : k, z fresh variables.

1 either Σ 0 = {X → ξ 1 , Y → ξ 2 } for some (ξ 1 ? u 1 ), (ξ 2 ? u 2 ) ∈ K(S) and for all (ϕ ⇒ H) ∈ F(S), H = (ξ 1 = ? f ξ 2 ); or 2 Σ 0 = {X → ξ 1 , Y → f(X 1 , . . . , X n )} for some (ξ 1 ? u 1 ) ∈ K(S)
Similarly to Rule (Vect-add-Formula) the rule uses the generic equality formula ψ and the hypotheses of ψ:(Σ 0 , S) express that XΣ 0 and Y Σ 0 deduce the same term. Since a recipe consequence of K can either be coming from a deduction fact in K or be a recipe with a constructor symbol at its root, we consider the two cases 1 and 2 each with the appropriate instantiation Σ 0 of the placeholders X and Y . The side requirements that head-equivalent formulas should not already be present in F(S) are simply here for termination purpose, thus avoiding infinite aggregation of redundant formulas.

Rule Rew

The third case distinction rule focuses on saturating the knowledge base. For example when outputting a term u, the corresponding symbolic rule (E-Out) will add a deduction fact ax n ? u to F; the rule (Rew) will apply rewrite rules on u to determine whether new messages can be learned by the attacker. Typically if u = u 1 , u 2 the following actions will happen: 1 after ax n ? u has been added to F by the symbolic rule (E-Out), it will be copied to the knowledge base K by the simplification rules (Vect-add-Conseq) (assuming u is not already deducible from any knowledge base of the component) 2 after that, the case-distinction rule (Rew) will add the two deduction facts fst(ax n ) ? u 1 and snd(ax n ) ? u 2 to F, which may in turn be transferred to K as well.

More precisely, given a deduction fact ξ 0 ? u 0 , the rule checks whether one may apply a rewrite rule → r to u 0 , which may require to first apply a context on u 0 (for example if u 0 = h(a) and = f(g(h(x)))). For that we introduce a notion of skeleton of .

Definition 4.10 (rewriting skeleton)

Let p be a position of a first-order term . A skeleton for ( , p) is a tuple (ξ, t, D) such that ξ ∈ T (F ∪ F 0 ∪ X 2 ), t ∈ T (F ∪ F 0 ∪ X 1 ), D is a set of deduction facts and (root(ξ |q ), root(t |q )) = (root( |q ), root( |q )) for any strict prefix q of p (X q , x q ) for any other position q of ξ where the set of variables X q (resp. x q ), q a position of ξ, are fresh pairwise distinct secondorder (resp. first-order) variables and D is the set of all the deduction facts X q ? x q . The set of all such skeletons (which, notably, are all identical up to variable renaming but may therefore differ on the second-order-variable types) is written Skel( , p).

For a skeleton (ξ, t, D) ∈ Skel( , p), the recipe ξ represents the context that the attacker will apply on top of the deduction fact ξ 0 ? u 0 at the position p to obtain the left-hand side . The term t represents the corresponding generic term on which the rewrite rule will be applied. Finally D is the set of deduction facts linking the variables of ξ and t.

Consider now a component Γ, a symbolic process S ∈ Γ, a deduction fact (ξ 0 ? u 0 ) ∈ K(S), and a context C. The first role of Rule (Rew) is to saturate the knowledge base, that is, to deduce the new term C[u 0 ]↓ using C[ξ 0 ]. However after adding the new deduction fact C[ξ 0 ] ? C[u 0 ] ↓ to F(S), a head-equivalent formula should be added to all other symbolic processes of Γ whenever it is possible, so that the vector-simplification rule (Vect-Split) (which separates processes with non-statically-equivalent solutions) only separates S ∈ Γ from S if C[ξ 0 ] yields a valid message in S but not in S . Yet the behaviour of a destructor symbol may be described by multiple rewrite rules: the rewrite rule used to normalise C[u 0 ] may therefore not be the same as the one used to normalise the term deduced by C[ξ 0 ] in S . Because of this we have to add to F(S ) all formulas corresponding to using all possible rewrite rules. For that we consider the following set of generic formulas:

RewF(ξ, → r, p) =    ∀S. (D ∧ mgu( = ? t)) ⇒ ξ ? r → r ∈ R (ξ, t, D) ∈ Skel( , p) S = vars (D, )   
Let us now give a complete example to illustrate all these notions. The goal is to detail what formulas will be added to F by Rule (Rew) on a concrete case as the actual definition of the rule is quite technical and hard to read-although the intuition behind it is rather simple.

Example 4.3

Consider a theory defined by a binary symbol h and the two rewrite rules getOther(h(x, y), x) → y getOther(h(x, y), y) → x

These two rewrite rules give access to either argument of h assuming the other one is known. Now consider a component Γ containing two extended symbolic processes S 1 and S 2 with the respective frames, given k, k , s, s ∈ N :

Φ(S 1 ) = {ax 1 → h(k, k ), ax 2 → k} Φ(S 2 ) = {ax 1 → h(s, s ), ax 2 → s }
They are are statically equivalent, even if the recipe getOther(ax 1 , ax 2 ) is not normalised using the same rewrite rule in Φ(S 1 ) and Φ(S 2 ). We assume that K(S 1 ) = ax 1 ? h(k, k ) ∧ ax 2 ? k and K(S 2 ) = ax 1 ? h(s, s ) ∧ ax 2 ? s . We describe the application of Rule (Rew) that uses the rewrite rule ( → r) = (getOther(h(x, y), x) → y) to deduce a new term in S 1 by putting ax 1 at the position of h(x, y) in . To begin the rule considers a skeleton (ξ, t, D) ∈ Skel( , 1):

ξ = getOther(X 1 , X 2 ) t = getOther(x 1 , x 2 ) D = X 1 ? x 1 ∧ X 2 ? x 2
The set RewF(ξ, → r, 1) therefore contains the following two formulas (normalised by the simplification rules on formulae):

ψ 1 = ∀X 1 , X 2 , x, y. (X 1 ? h(x, y) ∧ X 2 ? x) ⇒ getOther(X 1 , X 2 ) ? y ψ 2 = ∀X 1 , X 2 , x, y. (X 1 ? h(x, y) ∧ X 2 ? y) ⇒ getOther(X 1 , X 2 ) ? x
They are only generic formulas indicating that when the left side of a rewrite rule can be computed then the right side can be computed as well. Since our goal is to apply the rewrite rule → r where the deduction fact ax 1 ? h(k, k ) is used to deduce the subterm |1 , we have to replace the variable at position 1 in ξ, namely X 1 , by ax 1 in these formulas. We do this by applying the substitution Σ 0 = {X 1 → ax 1 } to ψ 1 , ψ 2 (in the sense defined in Section 2.1, again normalised by simplification rules):

ψ 1 :(Σ 0 , S 1 ) = ∀X 2 . X 2 ? k ⇒ getOther(ax 1 , X 2 ) ? k ψ 2 :(Σ 0 , S 1 ) = ∀X 2 . X 2 ? k ⇒ getOther(ax 1 , X 2 ) ? k
Rule (Rew) will then compute most general solutions to instantiate X 2 in a way that satisfies the hypotheses of these formulas. In the case of the first formula we have the unique solution mgs (S 1 [D → D ∧ X 2 ? k]) = {Σ} where Σ = {X 2 → ax 2 }; the algorithm will therefore add the following deduction fact to F(S 1 ):

ψ 1 :(Σ 0 Σ, S 1 :Σ) = getOther(ax 1 , ax 2 ) ? k
On the contrary for the second formula we have mgs (S 1 [D → D ∧ X 2

? k ]) = ∅, meaning that no solutions satisfy its hypotheses. Then we are almost done: as explained earlier it only remains to add a head-equivalent formula to F(S 2 ), if any, so that the vector-simplification rule (Vect-Split) does not split Γ if the recipe getOther(ax 1 , ax 2 ) yields a valid message in both S 1 and S 2 . That is, we should add to F(S 2 ):

ψ 1 :(Σ 0 Σ, S 2 :Σ) = (s = ? s ⇒ getOther(ax 1 , ax 2 ) ? s ) ψ 2 :(Σ 0 Σ, S 2 :Σ) = (s = ? s ⇒ getOther(ax 1 , ax 2 ) ? s)
This time the situation is reversed compared to S 1 : the first formula has unsatisfiable hypotheses (and will therefore be discarded at the next round of normalisation rules by Rule (Norm-Formula)) and the second one will be simplified to getOther(ax 1 , ax 2 ) ? s. This illustrates why we add one formula for each rewrite rule: should we have only considered ψ 1 , we would have missed the head-equivalent formula getOther(ax 1 , ax 2 ) ? s in S 2 , resulting in the incorrect conclusion that Φ(S 1 ) ∼ Φ(S 2 ).

Let us now formalise Rule (Rew) in full generality. It can now be defined as an instance of ( ) under the following conditions:

Γ + = {S:Σ[F → F ∧ F S ]) | S ∈ Γ} Γ -= {S[E 2 → E 2 ∧ ¬Σ] | S ∈ Γ} (Rew) if there exist S ∈ Γ, → r ∈ R, p position of , ξ ∈ T (F ∪ X 2 k ) with k = |dom(Φ(S))|, ψ 0 ∈ RewF(ξ, → r, p), (ξ 0 ? u 0 ) ∈ K(S)
, such that the following conditions are met:

1 p = ε and |p / ∈ X 1 2 F S = {ψ:(Σ 0 ΣΣ 1 , S:Σ) | ψ ∈ RewF(ξ, → r, p)} 3 Σ 0 = {ξ |p → ξ 0 } and Σ ∈ mgs (S[D → D ∧ D(ψ 1 ), E 1 → E 1 ∧ hyp(ψ 1 )]) if ψ 1 = ψ 0 :(Σ 0 , S) 4 ψ 0 :(Σ 0 Σ, S:Σ) is a formula of the form ∀S. ( n i=1 X i ? x i ) ⇒ H with all X i , x i distinct 5 Σ 1 is an injection from {X i } n
i=1 to fresh constants, and for any such injection Σ 1 , we have ψ 0 :(Σ 0 ΣΣ 1 , S:Σ) / ∈ F(S).

The conditions are rather technical but simply capture the steps of the example. Commenting the requirements of the rule, Item 1 ensures that the rewriting is not performed at a trivial position. Items 2 and 3 describe the formulas added to each symbolic process of Γ: just as in the example they are obtained by choosing one S ∈ Γ, computing a formula ψ 0 (ψ 1 in the example) corresponding to applying one given rewrite rule → r in S, replacing the position p of by an entry of K(S) by applying Σ 0 and computing a solution Σ of the hypotheses of the resulting formula. Finally all other symbolic processes S ∈ Γ receive the formulas of F S , each attempting to apply a rewrite rule to yield a valid message with the same recipe as in ψ 0 .

Note that the computation of the mgs Σ may leave some second-order variables X 1 , . . . , X n unconstrained because they do not need to be instantiated in a particular way to obtain a solution. This is where Items 4 and 5 come into play, replacing these pending variables by fresh constants.

Rule Chan

Finally we present a rule dedicated to the treatment of internal-communication channels in the private semantics. Due to the solving strategy mentioned at the beginning of the section, this rule will only by applied when Rule (Rew) is not applicable anymore, ensuring that K has been saturated, i.e., that any deducible term is a consequence of the knowledge base. The rule can therefore be formalised as an instance of ( ) with

Γ + = {S:Σ | S ∈ Γ {S 0 }} Γ -= S[E 2 → E 2 ∧ ¬Σ] | S ∈ (Γ {S 0 }) ∪ {S 0 } (Chan) if S 0 ∈ Γ and S 0 = S 0 [D ∧ ϕ → D] for some ϕ = (∀X: i. X ? u) ∈ D(S 0 ) such that either 1 Σ ∈ mgs (S 0 [D ∧ D ∧ X ? u]); or 2 mgs (S 0 [D → D ∧ X ? u]) = ∅ and Σ = ⊥ (with the convention Γ + = ∅).
The rule picks an arbitrary extended symbolic process S 0 ∈ Γ such that D(S 0 ) still contains a non-deducibility constraint ϕ. Then the rule checks whether a solution Σ that falsifies ϕ exists. If there is one (case 1), S 0 is removed from the positive branch and ϕ is removed from the negative branch. If there are no such solutions (case 2) this means that the adversary has no mean to compute the channel u: the positive branch is therefore entirely aborted, while the constraint ϕ is safely removed from the negative branch without adding new constraints.

5 All in all: computing a partition tree

Section summary

In this section we gather all of our constraint-solving relations to give a complete procedure for computing a partition tree, thus detailing the informal algorithm provided in Chapter 3. We prove that the constraint solving is partially correct, i.e. that it has the expected outcome when it terminates (termination itself being studied in Chapter 6).

Overall procedure We make reference to the various constraint-solving relations defined in the previous sections using the following notations: All these transition relations are interpreted as binary relations on vectors. We recall that we call a component a set Γ of extended symbolic processes and a vector a set S of components, and that all (P, C, C e ) ∈ Γ induce a predicate π on second-order solutions of C such that

Sol π (C) = {(Σ |vars 2 (C) , σ |vars 1 (C) ) | (Σ, σ) ∈ Sol (C e )}
We therefore propose in Algorithm 1 a procedure to compute the partition tree of two bounded plain processes, where the nodes are labelled by components instead of regular partition-tree configurations; in particular the proof of correctness of this algorithm has to justify that the above predicate π can be defined uniformly across the entire nodes of the computed tree.

Correctness arguments To conclude we mention that the core arguments justifying that Algorithm 1 effectively generates a partition tree can be found in Appendix B. Technically, most of the theorem statements rely on a collection of invariants, with a proof of their preservation at each step of the procedure (called with "Inv" names such as Inv wf , Inv sound ,...). For the sake of precision they will be mentioned in another technical chapter of this thesis (termination proof in Chapter 6) but knowing their exact definition is not necessary to understand the body of the thesis. // Generates the root and then an entire partition tree of P 1 and P 2 Procedure PTree(P 1 , P 2 : Processes) :

Tree = Γ 1 ← {S | P ε = ⇒ s S} Γ 2 ← {S | Q ε = ⇒ s S} {Γ} ← applySimpl({Γ 1 ∪ Γ 2 }) // in
the root, simplification rules never split the vector return generateSubtree(Γ)

Chapter 5:

Exploiting proof symmetries: equivalence by session Summary.

In this chapter we study how the procedure for trace equivalence developed in the previous chapters can exploit the symmetries that often arise during practical verification. Indeed in our formalism, privacy is often modelled as the equivalence of two processes that only differ on the value of a sensitive attribute: in particular they share a very similar structure that is often reflected as symmetries in the equivalence proof. We present here equivalence by session, a sound refinement of trace equivalence that benefits from partial-order reduction optimisations that factor out this redundant proof work. Experiments exhibit verification times reduced by orders of magnitude using this technique.

Equivalence by session

Section summary

We introduce equivalence by session, a novel refinement of trace equivalence and an abstract notion of correct refinement to help proving optimisations correct in a modular way. We also compare it with other existing techniques that also exploit the structural properties of processes to prove equivalence properties (diff-equivalence and partial order reductions for determinate processes).

Motivations: exploiting the process structure in equivalence proofs

In this chapter we focus on optimisations for the decision of trace equivalence in the private semantics. The procedure of the previous chapter relies on a constraint-solving procedure that enumerates a finite set of symbolic traces that abstracts all traces of the processes to be proved equivalent. This results into a general procedure that can handle arbitrary (bounded) processes. However the processes to be proved equivalent are generally not completely arbitrary: in our benchmarks for example we always prove statements of the form P ≈ Q where P and Q have the same overall structure but differ on the value of the attributes to be proved private. Exploiting this structural information may lead to a more efficient procedure generating less traces in practice. We mention below several approaches to achieve this goal.

Restricted optimisations

The first appraoch consists of developing optimisation techniques that are only sound for some classes of processes. This is for example the case of [START_REF] Baelde | Partial order reduction for security protocols[END_REF] that develops partial order reductions for proving equivalence of action-determinate processes. Intuitively a process P is action-determinate if it contains no private channels and no sequences of transitions from P can reach a process where two inputs (resp. outputs) on the same channel are executable in parallel, which ensures that the traces of two equivalent processes always have identical actions available in parallel. We define this property formally later in Section 1. For this class of processes the optimisation of [START_REF] Baelde | Partial order reduction for security protocols[END_REF] takes the form of a strategy when executing transitions that may discard exponentially-many traces (typically the strategy always executes public outputs in priority over public inputs). We already mentioned this work in Chapter 3, Section 3.2 as this optimisation is integrated into the DeepSec prover. Just as this resulted in decreasing the verification time of the APTE tool by orders of magnitude in [START_REF] Baelde | Partial order reduction for security protocols[END_REF], significant improvements could also be observed after integration into the DeepSec prover. To illustrate the gain we used a simple model of anonymity in the Private Authentication Protocol, similar to the one used in Chapter 3 but with a fixed scenario: Many processes in practice can be turned determinate: consider the simple example of two processes of the form

Number of
P = P 1 | • • • | P n and Q = Q 1 | • • • | Q n where P i , Q i do
not contain parallel operators and use a unique, public channel c. If proving P ≈ t Q only requires to match actions of each P i with actions of Q π(i) (π permutation of 1, n ) then for some fresh channels c 1 , . . . , c n the processes

P 1 [c → c i ] | • • • | P n [c → c i ] Q π(1) [c → c i ] | • • • | Q π(n) [c → c i ]
are trace equivalent as well and determinate. Although this kind of structural property is rather common it does not hold in many cases: among the examples studied in Chapter 2 we can mention the Helios protocol (due to the presence of private channels) and BAC (because the choice of the permutation π depends on dynamic values such as attacker inputs). An extension of some partial order reductions of [START_REF] Baelde | Partial order reduction for security protocols[END_REF] has also been considered for arbitrary processes [START_REF] Baelde | POR for security protocol equivalences -beyond action determinism[END_REF], but has a less spectacular impact on performances than [START_REF] Baelde | Partial order reduction for security protocols[END_REF]. Moreover the technique requires a precomputation that limits the efficiency gain, resulting in an overall rather weak reduction of the verification time.

Restricted equivalences

The second approach, similar in spirit, is to design more restricted notions of equivalence, expected to be easier to prove than trace equivalence while overlapping with it as much as possible in practice. This is for example the case of diff equivalence, which can intuitively be seen as an analogue of trace equivalence where the two equivalent processes are required to follow the exact same control flow. It is used by the popular ProVerif tool that exploits the structural properties of diff equivalence to prove it using a translation of the problem into Horn clauses, making the verification very efficient in practice. Some variants of diff-equivalence (in the sense that the formalism differs) are also implemented in Tamarin and Maude-NPA. We define formally this equivalence notion in the context of the applied pi calculus later in Section 1. The counterpart of this proof technique is precision: processes that are non-diff-equivalent may be trace equivalent or labelled bisimilar and the analysis is therefore not always conclusive regarding the latter equivalences. Because of these reasons, ProVerif may typically have difficulty analysing protocols using private channels or that cannot be converted into determinate processes, similarly to the previous paragraph.

Approach of this chapter

In this chapter we use, similarly to diff-equivalence, a sound refinement of trace equivalence that is easier to prove in practice. We call it equivalence by session in that it proves the equivalence of protocols session by session: the approach is therefore also similar to the one turning the processes determinate. Equivalence by session however permits to conclude equivalence proofs than cannot be successful using diff-equivalence or determinate processes. Typically if we consider the theory defined by the rewrite rules, where 0, 1, ok ∈ F 0 :

bool(0) → ok bool(1) → ok ¬0 → 1 ¬1 → 0
then the following processes P and Q are trace equivalent and labelled bisimilar:

P = c(x). if bool(x) = ok then (c 0 | c 1 ) Q = c(x). if bool(x) = ok then (c x | c ¬x )
They also appear to be equivalent by session: the intuition is that for all values of x ∈ {0, 1}, there exists a bijection between the subprocesses of P (i.e., { {c 0 , c 1 } }) and the subprocesses Q (i.e., { {c x , c ¬x } }) matching equivalent processes. The matching is however different for each value of x, which is why the equivalence proof cannot be successful if P and Q are transformed in determinate processes. On the contrary the matching will be selected dynamically when proving equivalence by session, which is the reason why the proof is successful with this new technique. Similarly the definition of diff-equivalence will only consider the identity matching, that is, c 0 is required to be matched with c x and c 1 with c ¬x ; P and Q can therefore not be proved trace equivalent using diff-equivalence neither. Yet, some modelling tricks can make this simple example provable by the ProVerif tool1 due to extensions of its theory beyond the original definition of diff-equivalence [START_REF] Cheval | Proving more observational equivalences with proverif[END_REF]. The situation is however different for more complex, real-world examples such as the BAC protocol that induces similar issues as the above example.

In addition to the scope improvement, we prove that most of the partial order reductions developed in [START_REF] Baelde | Partial order reduction for security protocols[END_REF] as well as novel ones (e.g., for internal communications) can be used for proving equivalence by session of any process. This results in improvements of the verification time of non-determinate processes of several orders of magnitude. Altogether this significantly improves DeepSec's scalability on many examples such as the Helios and BAC protocols.

Equivalence by session

We now formalise equivalence by session: as explained above the main idea is that, when proving the equivalence of P and Q, every action of a given parallel subprocess (i.e., session) of P should be matched by the actions of a same subprocess in Q. By requiring to match sessions rather than individual actions, this yields a more fine-grained equivalence and effectively reduces the combinatorial explosion.

Session traces

We first define a relation that discharges most of the deterministic, unobservable transitions of the semantics so that the strucural requirements of our new equivalence can focus on the other types of transitions only. The relation is defined in Figure 5.2 and gets rid of 0 processes, unexecutable instructions (i.e., inputs and outputs involving non-message terms) and evaluate conditionals and new instructions at toplevel. We say that a process P on which no more rules apply is in -normal form, which means it is of the form

u v .P 0 if ¬msg(u, v) u(x).P 0 if ¬msg(u) P | 0 P 0 | P P (P | Q) | R P | (Q | R) P | Q P | Q Q | P Q | P if P P P Q if P τ -→ Q by Rules (Test) or (New)
P = P 1 | (P 2 | (P 3 | • • • | P n )) def = P 1 | • • • | P n
where each P i starts with a replication, an input or an output instruction. This witnesses a change of paradigm compared to trace equivalence, where only public inputs and outputs were considered as visible actions. Here unobservable actions are those discharged to the relation and all other types of actions will somewhat be visible, in the sense that the structure of equivalence by session will require that two equivalent traces take even the τ -→ transitions simultaneously, apart from those embedded in . This typically makes internal communications visible, as well as the action of unfolding a replication. Most of the incoming definitions will therefore only operate on processes in -normal form.

We write P a -normal form of P (and A its natural extension to an extended process A), which is unique up to bijective renaming of names generated by new instructions. From this we can formalise a notion of session of a process, that is intuitively the (possibly infinite) multiset of its parallel subprocesses.

Definition 5.1 (session)

The multiset of sessions of a plain process P in -normal form is defined by: sessions(u(x).P ) = { {u(x).P } } sessions(P

1 | • • • | P n ) = n i=1 sessions(P i ) sessions(u v .P ) = { {u v .P } } sessions(!P ) = i∈N sessions(P ) i ( i ) i∈N fresh renamings of names(P ) names(P )
This induces a form of "compact" trace that relegates deterministic unobservable transitions to -normalisation and uses sessions instead of Rules (Par) and (Repl). We formalise this using a labelled transition relation α -→ ss defined by the two rules: A session trace of an extended process A 0 in -normal form is a sequence of transitions

A α -→ ss B if A α -→ C
t : A 0 α 1 -→ ss • • • αn --→ ss A n ,
which may be referred to as t : A 0

α 1 •••αn ====⇒ ss A n .
We emphasise in particular that the τ actions are not erased from the word actions(t

) = α 1 • • • α n .

The set of session traces of A is written T(A).

In particular trace equivalence can be characterised in terms of session traces. For that we extend the notion of static equivalence to (session) traces by writing t ∼ t if t : A If A and B are two extended processes in -normal form, the following points are equivalent:

1 A t B 2 ∀t ∈ T(A), ∃t ∈ T(B), t ∼ t
Twin processes We now formalise the notion of session matchings at the core of the definition of equivalence by session. For that we define a notion of skeleton of a process that indicates its toplevel action:

Definition 5.3 (skeleton equivalence)
The skeleton of a process starting with an input or an output is defined by skel(u(x).P ) = in u and skel(u v .P ) = out u . Let then A = (P, Φ) and B = (Q, Ψ) be two extended processes, and S A = R∈P sessions(R) and S B = R∈Q sessions(R) their respective sessions. We say that A and B are skeleton equivalent, written A ≈ skel B, if there exists a bijection π :

S A → S B such that for all R ∈ S A , either (skel(R), skel(π(R))) = (in u , in u ) or (skel(R), skel(π(R))) = (out u , out u ) with, for all recipes ξ, ξΦ 0 = E u iff ξΦ 1 = E u .
Intuitively skeleton equivalence simply states that the same actions can be performed at toplevel from A and B, or more precisely by R ∈ S A and π(R); typically if Φ 0 ∼ Φ 1 this means that u is a public channel (i.e., u is deducible from Φ 0 ) iff u is public as well, and if they are, they can be deduced by at least one same recipe ξ. Relying on this notion we can then consider the following notion of process pairing: Definition 5.4 ((extended) twin process)

A twin process is a pair (P, Q) of plain processes in -normal form. An extended twin process is a triple A 2 = (P 2 , Φ 0 , Φ 1 ) where Φ 0 , Φ 1 are two frames of same domain and P 2 is a multiset of twin processes such that for all (P, Q) ∈ P 2 , ({ {P } }, Φ 0 ) ≈ skel ({ {Q} }, Φ 1 ).

An extended twin process thus models two regular extended processes, matched together, able to perform the same action, and that can be retrieved by projection using the notations:

fst(A 2 ) = ({ {P 0 | (P 0 , P 1 ) ∈ P 2 } }, Φ 0 ) snd(A 2 ) = ({ {P 1 | (P 0 , P 1 ) ∈ P 2 } }, Φ 1 )
An operational semantics lifting the transition relation α -→ ss to twin processes is then defined in Figure 5.3: the new relation α -→ ss 2 intuitively makes two projections follow the same reduction steps using a session-matching mechanism that replaces Rules (Par) and (Repl). We stress that, by definition, a transition A 2 α -→ ss 2 B 2 is possible only if the resulting process B 2 verifies the equivalent-skeleton requirement.

({ {(P 0 , Q 0 ), (P 1 , Q 1 )} } ∪ P 2 , Φ 0 , Φ 1 ) α -→ ss 2 ({ {(P 0 , Q 0 ), (P 1 , Q 1 )} } ∪ P 2 , Φ 0 , Φ 1 ) (IO 2 ) if ({ {P 0 , P 1 } }, Φ 0 ) α -→ ss ({ {P 0 , P 1 } }, Φ 0 ) and ({ {Q 0 , Q 1 } }, Φ 1 ) τ -→ ss ({ {Q 0 , Q 1 } }, Φ 1 ) by Rule (IO) ({ {(P, Q)} } ∪ P 2 , Φ 0 , Φ 1 ) τ -→ ss 2 ({ {(R, π(R))} } R∈sessions(P ) ∪ P 2 , Φ 0 , Φ 1 ) (Match)
if |sessions(P )| > 1 and π : sessions(P ) → sessions(Q) bijection

= P 1 | • • • | P n and Q = Q 1 | • • • | Q n in -normal
form, the application of Rule (Match) from (P, Q) (assuming P and Q have equivalent skeletons) can be characterised as follows: 1 if n = p the rule is not applicable but there is a contradiction with the fact that P and Q have equivalent skeletons (sessions(P ) and sessions(Q) are finite but do not have the same number of elements) 2 if n = p an application will result in a ({ {(P 1 , Q π(1) ), . . . , (P n , Q π(n) )} }, ∅) for some π ∈ S n (S n being the set of permutations of 1, n ) such that the skeleton-equivalence requirement is satisfied. For example if we assume that P i = c i (.)P i and

Q i = d i (.)Q i with c i , d i ∈ F 0 ,
the set of valid permutations π in the above application of the rule are

{π ∈ S n | ∀i ∈ 1, n , c i = d π(i) }
Since P and Q are assumed to have equivalent skeletons, this set is not empty. If P and Q are not bounded the matching may be more complex. For example let us consider a model of unlinkability in the BAC protocol, inspired by the model presented in Chapter 2 but with an implicit key distribution and no getChallenge messages:

P = ! new k. ! (Reader (k) | Passport (k)) Q = ! new k. (Reader (k) | Passport (k))
with processes of the form Reader (k) = d(x).Q (k) and Passport (k) = new n.c n .P (k) with c, d ∈ F 0 . For now no more details are needed but we will later give a full definition of Reader and Passport , as they will serve as a running example throughout this chapter. If E is a multiset, we write E ω = i∈N E, that is, the multiset obtained by duplicating E an infinite countable number of times. With this notation we have, given a family (k i ) i∈N of fresh names:

sessions(P ) = sessions(Q) ω sessions(Q) = {Reader (k i ), Passport (k i ) | i ∈ N}
Since sessions(P ) and sessions(Q) are infinite countable, there exist bijections of sessions(P ) to sessions(Q). The ones suitable from an application of Rule (Match), that is, those that satisfy the equivalent-skeleton requirement, are the permutations π such that for all R ∈ sessions(P ),

1 if R = Reader (k i ) then there exists j ∈ N such that π(R) = Reader (k j ); 2 if R = Passport (k i ) then there exists j ∈ N such that π(R) = Passport (k j ).
Definition 5.5 (twin trace)

We write T(A 2 ) the set of traces of the extended twin process A 2 w.r.t. the transition relation α -→ ss 2 (called twin traces). In particular, given a twin trace

t 2 : A 2 α 1 -→ ss 2 A 2 1 • • • αn --→ ss 2 A 2 n ∈ T(A 2 ) ,
we lift the projection functions by writing

fst(t 2 ) : fst(A 2 ) α 1 -→ ss fst(A 2 1 ) α 2 -→ ss • • • αn --→ ss fst(A 2 n+1 ) ∈ T(fst(A 2 )) snd(t 2 ) : snd(A 2 ) α 1 -→ ss snd(A 2 1 ) α 2 -→ ss • • • αn --→ ss snd(A 2 n+1 ) ∈ T(snd(A 2 ))
Similarly to session traces, t 2 may be referred to as

t 2 : A 2 α 1 •••αn ====⇒ ss 2 A 2
n when the intermediary processes are not relevant in the context.

Equivalence by session Equivalence by session is similar to trace equivalence but only considers the traces of Q matching the structure of the trace of P under study. This structural requirement is simply formalised by considering twin traces of (P, Q).

Definition 5.6 (equivalence by session)

Let P and Q be two skeleton-equivalent plain processes in -normal form. We write P s Q when ∀t ∈ T(P ), ∃t 2 ∈ T(P, Q), t = fst(t 2 ) and t ∼ snd(t 2 ) .

We say that P and Q are equivalent by session, written P ≈ s Q, when P s Q and Q s P .

Although we have designed equivalence by session to increase efficiency of verification procedures, it is also of independent interest. Equivalence by session captures a notion of indistinguishability against an adversary that is able to distinguish actions originated from different protocol sessions. Such an adversarial model may for instance be considered realistic in protocols where servers dynamically allocate a distinct ephemeral port to each session. An attacker would therefore observe these ports and always differentiate one session from another. When considering equivalence by session, this allocation mechanism does not need to be explicitly modelled as it is already reflected natively in the definition. On the contrary for trace equivalence, an explicit modelling within the processes would be needed. For example equivalence by session of two protocol sessions operating on a public channel c,

! n P (c) ≈ s ! n Q(c)
can be encoded by relying on dynamically-generated private channels that are revealed to the attacker. This can be expressed in the applied pi-calclulus by:

! n P fresh ≈ t ! n Q fresh
where P fresh = new e. c e . P (e)

and Q fresh = new e. c e . Q(e)

Such encodings are however incompatible with determinacy as defined for the partial-order reductions of [START_REF] Baelde | Partial order reduction for security protocols[END_REF]. Our dedicated equivalence offers similar-in-spirit optimisations that are applicable on all processes.

Comparison to other equivalences

Relation to trace equivalence We first show that equivalence by session is a sound refinement of trace equivalence.

Proposition 5.2 (soundness of equivalence by session)

If P ≈ s Q then P ≈ t Q.
This is immediate as t 2 ∈ T(P, Q) entails snd(t 2 ) ∈ T(Q). The converse does not hold in general, meaning that two processes that are not equivalent by session might be trace equivalent. The simplest example is, for n ∈ F 0 ,

P = c n . c n Q = c n | c n
We call false attacks traces witnessing a violation of equivalence by session, but that can still be matched trace-equivalence-wise (which does not mean that the processes are effectively trace equivalent). In this example even the empty trace is a false attack since the two processes fail to meet the requirement of having identical skeletons. Such extreme configurations are however unlikely to occur in practice: privacy is usually modelled as the equivalence of two protocol instances where some private attributes are changed. In particular the overall structure in parallel processes remains common to both sides. More realistic false attacks may arise when the structural requirements of equivalence by session are too strong, i.e., when matching the trace requires mixing actions from different sessions. Consider for example:

P = s n . a n | s(x). b n Q = s n . b n | s(x). a n
with a, b ∈ F 0 and s ∈ N . These processes first synchronise on a private channel s using an internal communication and then perform two parallel outputs on public channels a, b. They are easily seen to be trace equivalent. However the skeletons at toplevel constrain the session matchings, i.e., the application of rule (Match). Hence any trace executing an output on a or b is a false attack. This being said, we have a completeness result for determinate processes:

Definition 5.7 (determinate process)

A process P is action determinate if it verifies the following two properties: 1 no private channels: for all session traces P tr = ⇒ ss (P, Φ), if R ∈ P ∈P sessions(P ) with skel(R) ∈ {in u , out u }, u is deducible from Φ; 2 unambiguous traces: if

P tr = ⇒ ss A, P tr = ⇒ ss B and A ∼ B then A ≈ t B.

123

This notion of determinacy is introduced in [CCD13] and subsumes the notion of actiondeterminacy used in the partial-order reductions of [START_REF] Baelde | Partial order reduction for security protocols[END_REF]. We discuss in more details in Chapter 7 the different definitions of determinacy in the context of protocol analysis and their consequences on the decidability of equivalence properties [CCD13, BDH15, CKR19, BCK20].

Proposition 5.3 (completeness of equivalence by session for determinate processes)

If P, Q are determinate plain processes such that P ≈ t Q then P ≈ s Q.

The core argument is the uniqueness of session matchings, that is, there is always one permutation (up to exchanging trace equivalent processes) that can be chosen when applying the rule (Match) to a pair of determinate processes. The proof can be found in Appendix C.

Relation to diff-equivalence ProVerif, Tamarin and Maude-NPA are semi-automated tools that can provide equivalence proofs for an unbounded number of protocol sessions. For that they rely on another refinement of trace equivalence, called diff-equivalence (≈ d ). It relies on a similar intuition as equivalence by session, adding (much stronger) structural requirements to proofs. To prove diff-equivalence of P and Q, one first requires that P and Q have syntactically the same structure and that they only differ by the data (i.e., the terms) inside the process. Second, any trace of P must be matched in Q by the trace that follows exactly the same control flow. Consider for example

P = c u | c v | R Q = c u | c v | R
For P and Q to be diff-equivalent, traces of P starting with c u need to be matched by traces of Q starting with c u . In the original definition of diff-equivalence in [START_REF] Blanchet | Automated verification of selected equivalences for security protocols[END_REF] the conditional branchings were also required to result into the same control-flow. This condition has however been relaxed within [START_REF] Cheval | Proving more observational equivalences with proverif[END_REF]: the resulting diff-equivalence can be defined in our formalism as equivalence by session where Rule (Match) only performs the identity matching.

Definition 5.8 (diff-equivalence)

We write T d (P, Q) the subset of T(P, Q) by replacing Rule (Match) by the two rules

({ {(P 1 | • • • | P n , Q 1 | • • • | Q n )} } ∪ P 2 , Φ 0 , Φ 1 ) τ -→ ss 2 ({ {(P i , Q i )} } n i=1 ∪ P 2 , Φ 0 , Φ 1 ) (Par 2 ) ({ {(! P, ! Q)} } ∪ P 2 , Φ 0 , Φ 1 ) τ -→ ss 2 ({ {(P , Q ), (! P, ! Q)} } ∪ P 2 , Φ 0 , Φ 1 ) (Repl 2 )
Then we define P d Q as the statement ∀t ∈ T(P ), ∃t 2 ∈ T d (P, Q), t = fst(t 2 ) and t ∼ snd(t 2 ) .

We say that P and Q are diff-equivalent, written P ≈ d Q, when P d Q and Q d P .

Proposition 5.4 (relation between diff-equivalence and equivalence by session)

If P ≈ d Q then P ≈ s Q.
This follows from the fact that T d (P, Q) ⊆ T(P, Q) by definition. The converse however does not hold in general, typically,

P = c a | c b Q = c b | c a a, b ∈ F 0 distinct
This example is extreme as a pre-processing on parallel operators would make the processes diff-equivalent. Such a pre-processing is however not possible for more involved, real-world examples such as our models of unlinkability in the BAC protocol, or for the simpler example earlier mentioned at the end of Section 1.1. The reason is that the matchings have to be selected dynamically, that is, different session matchings are needed to match different traces.

Relation to labelled bisimilarity Just as equivalence by session, labelled bisimilarity is known to be an intermediate refinement between diff-equivalence and trace equivalence:

Proposition 5.

(relation between diff, observational, and trace equivalences [CD09])

We have ≈ d ⊆ ≈ l ⊆ ≈ t . Besides, ≈ l and ≈ t coincide for determinate processes.

In particular by Proposition 5.3 we obtain that trace equivalence, labelled bisimilarity and equivalence by session coincide for determinate processes. However in general:

Proposition 5.6 (relation between equivalence by session and labelled bisimilarity)

The relations ≈ s and ≈ l are incomparable.

Proof. If we write

P = c(x).c(x) and Q = c(x) | c(x), then P ≈ l Q but P ≈ s Q. Besides if a, b ∈ F 0 are distinct we have R(a
R(t 0 , t 1 , t 2 ) = new k 0 . new k 1 . new k 2 . (c k 0 | c k 1 | c k 2 | S(t 0 , t 1 , t 2 )) S(t 0 , t 1 , t 2 ) = c(x). if x = k 0 then c t 0 else if x = k 1 then c t 1 else if x = k 2 then c t 2
Proposition 5.7 (summary of the relations between all equivalences)

If ≈ ∈ {≈ l , ≈ s } then ≈ d ≈ ≈ t and, for determinate processes, ≈ = ≈ t .

Formalising optimisations

Section summary

In this section we introduce some theoretical notions that will help presenting all of our optimisations in a uniform and modular way. This includes a notion of trace refinement that formalises how to define and compose optimisations, and basic notions and notations of group theory.

Global assumptions

The optimisations we present are specific to the bounded fragment of the calculus, in the private semantics. For example one of our optimisations consists of always executing public outputs in priority over other actions, which is unsound in presence or replication due to our formalisation (since Rule (Sess) may make infinitely-many public outputs available) or in the classical semantics (where the public outputs may be used later for an internal communication). We also make a stability assumption on private channels, which will ensure the preservation of skeleton equivalence within twin processes through transitions:

Definition 5.9 (stable channels)

A plain process P has stable channels if for all traces of P of the form P

tr 1 =⇒ ({ {u(x).Q} } ∪ P 1 , Φ 1 ) tr 2 =⇒ ({ {u(x).Q} } ∪ P 2 , Φ 2 ), if u is deducible from Φ 2 then it is deducible from Φ 1 .
The notion of stable channels prevents private channels to become public, i.e., if a channel can be used for an internal communication, it will never be used for a public communication later. This does not exclude dynamically generated channels such as in new e. c e . P .

Trace refinements

Definition We present an abstract notion of optimisation, based on trace refinements. This comes with several properties on how to compose them, providing a unified way of presenting different concrete optimisations for the decision of equivalence by session. Intuitively, an optimisation reduces the set of traces that are considered when verifying equivalence: when proving P s Q, only traces of T(P ) ∩ O ∀ and T(P, Q) ∩ O ∃ will be considered. That is, we define the equivalence

≈ O = O ∩ O where P O Q means ∀t ∈ T(P ) ∩ O ∀ , ∃t 2 ∈ T(P, Q) ∩ O ∃ , t = fst(t 2 ) ∼ snd(t 2 ) .
Typically ≈ O all is the equivalence by session on the bounded fragment, where O all = (O ∀ all , O ∃ all ) contains all traces of bounded processes. Also note that for a few of our refinements (Section 4), the definition of O ∀ may depend on both P and Q. Of course, using refinements may induce different notions of equivalence, hence the need for correctness arguments specific to each layer of optimisation. We specify this as follows: if

O α = (O ∀ α , O ∃ α ) and O β = (O ∀ β , O ∃ β ), O α is a correct refinement of O β when O ∀ α ⊆ O ∀ β and O ∃ α ⊆ O ∃ β and ≈ Oα = ≈ O β .
Properties The remainder of this section provides elementary properties useful when constructing, and composing optimisations. First, we can refine optimisations progressively: Proposition 5.8 (transitivity)

If O 1 is a correct refinement of O 2 , and O 2 is a correct refinement of O 3 , then O 1 is a correct refinement of O 3 .
Moreover, we can prove universal and existantial optimisations correct in a modular way: Proposition 5.9 (combination)

If (O ∀ opt , O ∃ ) and (O ∀ , O ∃ opt ) are both correct refinements of (O ∀ , O ∃ ), then (O ∀ opt , O ∃ opt ) is a correct refinement of (O ∀ , O ∃ ). Proof. Let ≈ ×× , ≈ •× , ≈ ו and ≈ •• denote the equivalences induced by the optimisations (O ∀ , O ∃ ), (O ∀ opt , O ∃ ), (O ∀ , O ∃ opt ) and (O ∀ opt , O ∃ opt ), respectively. As ≈ •× = ≈ ×× = ≈ ו by hy- pothesis, the result follows from the straightforward inclusions ≈ •• ⊆ ≈ •× and ≈ ו ⊆ ≈ •• .
Relying on this result, we see a universal optimisation O ∀ (resp. existential optimisations

O ∃ ) as the optimisation (O ∀ , O ∃ all ) (resp. (O ∀ all , O ∃ )).
This lightens presentation as we can now meaningfully talk about universal (resp. existential) optimisations being correct refinements of others. Finally, when implementing such optimisations in tools, deciding the membership of a trace in the sets O ∀ or O ∃ may sometimes be inefficient or not effective. In these cases we may implement these optimisations partially, using for example sufficient conditions. The following proposition states that such partial implementations still result into correct refinements.

Proposition 5.10 (partial implementability)

Let us consider the optimisations O

∀ opt ⊆ O ∀ part ⊆ O ∀ and O ∃ opt ⊆ O ∃ part ⊆ O ∃ . If O ∀ opt is a correct refinement of O ∀ and O ∃ opt is a correct refinement of O ∃ , then (O ∀ part , O ∃ part ) is a correct refinement of (O ∀ , O ∃ ).

Reminders of group theory

Our presentation and proofs can benefit from some group-theoretical terminology recalled here. The reader familiar with elementary results of group theory may skip this section.

Basic notions A group G is a set equipped with a binary operation * verifying the following properties; there should exist an element e ∈ G called the identity of G such that ∀g ∈ G, g * e = e * g = g (identity)

∀g ∈ G, ∃g ∈ G, g * g = g * g = e (invertibility) ∀g, g ∈ G, g * g ∈ G (closure by composition) ∀g 1 , g 2 , g 3 ∈ G, (g 1 * g 2 ) * g 3 = g 1 * (g 2 * g 3 ) (associativity)
In particular the identity element is necessarily unique, as well as the inverse of an element g which can therefore be referred to as g -1 . By analogy with multiplicative notations, we sometimes write gg instead of g * g and g n instead of g * • • • * g (n times).

Definition 5.11 (symmetric group)

If E is a set, the set G of all permutations of E equipped with function composition • is a group. If E = 1, n , G is called the symmetric group of order n and is written S n .

In symmetric groups we often use cycle notations: (a 1 a 2 • • • a p ) refers to the permutation π such that for all i ∈ 1, p , π(a i ) = a (i+1) mod p , and π(a) = a if a ∈ dom(π) {a 1 , . . . , a p }. In particular a 2-cycle (a b) is called a transposition. Another key notion is subgroups: we say that G is a subgroup of G if G ⊆ G and G and G are two groups with the same operation. The following results are classical subgroup criteria: Proposition 5.11 (generated subgroup)

If G is a group and S ⊆ G, we write S the intersection of all subgroups of G containing S. Then S is a subgroup of G, called the subgroup of G generated by S. It is the smallest non-empty subset of G containing S and that is closed under composition and inverse.

Proof. It is immediate that an intersection of subgroups is also a subgroup. Then let S be a non-empty subset of G containing S that is closed under composition and inverse and let us show that S ⊆ S . We know that S contains the identity of G because if we let x ∈ S , we have by hypothesis x -1 ∈ S and then xx -1 ∈ S . In particular S is a subgroup of G, hence S ⊆ S by definition.

Proposition 5.12 (subgroup of finite order)

Let G be a group and S a non-empty, finite subset of G that is closed under composition. Then S is a subgroup of G.

Proof. It sufficies to prove that S is closed by inverse (and it will ensure that the identity of G is in S as well). Since S is closed under composition, if x ∈ S then x n ∈ S for all n > 1. Besides S is also finite, hence there exists i > j such that x i = x j . In particular by multiplying by the inverse of x j in G, we obtain that x i-j-1 is the inverse of x in S.

Group actions An action of a group G on a set X is an application G × X → X, written using a "dot" notation (the image of (g, x) is written g.x). A group action is required to satisfy: ∀x ∈ X, e.x = x (identity) ∀g, g ∈ G, ∀x ∈ X, g.(g .x) = (gg ).x (compatibility)

A typical example that we will consider in this thesis is the action of the symmetric group on words of actions, writing π.(α

1 • • • α n ) = α π(1) • • • α π(n) .
We will use two related notions:

Definition 5.12 (stabiliser)

Let G a group action on X and ≡ an equivalence relation on X compatible with this action, in the sense that for all g ∈ G, if x ≡ y then g.x ≡ g.y. If x ∈ X, the stabiliser of x quotiented by ≡ is the set

Stab(x) = {g ∈ G | g.x ≡ x}.
Proposition 5.13 (stabiliser subgroup)

With the notations of the definition, Stab(x) is a subgroup of G.

Proof. It is immediate that Stab(x) contains e the identity of G. It is also closed by composition: if g.x ≡ x implies g .x ≡ x, then by hypothesis on ≡ we have g .g.x ≡ g .x ≡ x, hence gg ∈ Stab(x). The conclusion then follows from Proposition 5.12.

Definition 5.13 (orbit)

If G is a group action on X and x ∈ X, the orbit of x in G is the set Orb(x) = {g.x | g ∈ G}.

3 Partial-order reductions

Section summary

We present partial-order reductions for equivalence by session and prove their correctness (without restriction to determinate processes). While some are directly inspired from the previous work of [START_REF] Baelde | Partial order reduction for security protocols[END_REF], several of them are novel (in particular regarding the treatment of private channels).

Some partial-order reductions we present in this section are inspired by similar techniques developed for proving trace equivalence of determinate processes [START_REF] Baelde | Partial order reduction for security protocols[END_REF], although they differ in their technical development to preserve correctness in our more general setting.

Labels and independence

Labels Partial-order reduction techniques identify commutativity relations in a set of traces and factor out the resulting redundancy. Here we exploit the permutability of concurrent actions without output-input data flow. For that we introduce labels to reason about dependencies in the execution: 1 Plain processes P are labelled [ P ] , with a word of integers reflecting the position of P within the whole process. 2 Actions α are labelled [ α ] L to reflect the label(s) of the process(es) they originate from.

That is, L is either a single integer word (for inputs and outputs) or a pair of such, written 1 | 2 (for internal communications). Labels are bootstrapped by the empty word ε and are propagated in session traces by assigning incomparable labels to each new session when applying Rule (Sess), and preserving the label when applying Rule (IO). Formally the relation α -→ ss is lifted to labelled processes as follows; we recall that we only operate on bounded processes, hence the simpler shape of (Sess): Rule (Sess):

({ {[ P 1 | • • • | P n ] } } ∪ P, Φ) [ τ ] --→ ss ({ {[ P i ] .i } } n i=1 ∪ P, Φ)
Rule (IO), inputs / outputs:

({ {[ P ] } } ∪ P, Φ) [ α ] ---→ ss ({ {[ P ] } } ∪ P, Φ )
Rule (IO), internal comm.:

({ {[ P ] , [ Q ] } } ∪ P, Φ) [ τ ] | ----→ ss ({ {[ P ] , [ Q ] } } ∪ P, Φ)
In particular, we always implicitly assume the invariant preserved by transitions that extended processes contain labels that are pairwise incomparable w.r.t. the prefix ordering.

Independence Labels are used to materialise flow dependencies. Two actions α = [ a ] L and α = [ a ] L are said sequentially dependent if one of the (one or two) words constituting L, and one of those constituting L , are comparable w.r.t. the prefix ordering. Regarding inputoutput dependencies, we say that α and α are data dependent when {a, a } = {ξ ax , ξ c (ξ t )} with ax appearing in ξ c or ξ t . The two notions combine into the following property: Definition 5.14 (independence) Two actions α and α are said to be independent, written α || α , when they are sequentially independent and data independent.

We identify some redundancy in a set of traces when, intuitively, swapping adjacent independent actions in a trace has no substantial effect. Still, this is a rather weak notion: for example the recipe fst( n, ax ) is artificially dependent in the axiom ax, which would prevent optimisations from applying. Such spurious dependencies can be erased using the following equivalence notion: Definition 5.15 (recipe equivalence)

Two input transitions A [ ξ 1 (ζ 1 ) ] -----→ ss B and A [ ξ 2 (ζ 2 ) ]
-----→ ss B are said to be recipe equivalent when ξ 1 Φ(A) = E ξ 2 Φ(A) and ζ 1 Φ(A) = E ζ 2 Φ(A). Two traces are recipe equivalent if one can be obtained from the other by replacing some transitions by recipe-equivalent ones.

The rest of this section formalises the intuition that equivalence by session can be studied up to transformation of traces into recipe-equivalent ones, and arbitrary permutation of their independent actions. Technical proofs can be found in Appendix C.

Correctness of por techniques

If tr = α 1 • • • α n and π is a permutation of 1, n , we write π.tr = α π(1) • • • α π(n)
. This is an action of S n the symmetric group of order n on the set of action words of length n. We say that π permutes independent actions of tr if either π = id , or π = π 0 • (i i+1) with α i || α i+1 and π 0 permutes independent actions of (i i+1).tr. Although not a subgroup of S n in a strict sense, permutations of independent actions have some sorts of group-like properties: Proposition 5.14 (inversion and composition) If π permutes independent actions of tr, π -1 permutes independent actions of π.tr. Moreover if π permutes independent actions of π.tr, π • π permutes independent actions of tr.

We will use these two properties implicitly in most of our proofs. But more importantly, the action of the symmetric group can be uplifted to an action on traces: Proposition 5.15 (trace permutability) If t : A tr = ⇒ ss B and π permutes independent actions of tr, then A π.tr = = ⇒ ss B. This trace is unique if we take labels into account, and will be referred as π.t.

Together with recipe equivalence, this is the core notion for defining partial-order reductions. We gather them into ≡ por the smallest equivalence relation over traces containing recipe equivalence and such that t ≡ por π.t for all permutations π of independent actions of t. The key result below justifies that any optimisation that discards traces t when there exists another trace t ≡ por t is correct. The statement is even slightly more general by allowing to discard t if t is equivalent to an extension t ext of t.

Theorem 5.16 (correctness of por)

Let O ∀ 1 ⊆ O ∀
2 be universal optimisations. We assume that for all t ∈ O ∀ 2 , there exists t ext such that t is a prefix of t ext , and

t ∈ O ∀ 1 such that t ≡ por t ext . Then O ∀ 1 is a correct refinement of O ∀ 2 .

Compression optimisations

We first present a compression of traces into blocks of actions of a same type (inputs, outputs and parallel, or internal communications) by exploiting Theorem 5.16. The optimisation is a generalisation of the compressed traces of [START_REF] Baelde | Partial order reduction for security protocols[END_REF]. We formalise this idea by using reduction strategies based on polarity patterns.

Polarities and phases

We assign polarities to processes depending on their toplevel actions: public inputs are positive (+1), public outputs and parallels are overwhelmingly negative (-∞), and others are null.

polar Φ (u(x).P ) = 1 polar Φ (u v .P ) = -∞ u deducible from Φ polar Φ (u(x).P ) = 0 polar Φ (u v .P ) = 0 u not deducible from Φ polar Φ (0) = 0 polar Φ (P | Q) = -∞
Note that the assumption of channel stability ensures executing an instruction, thus potentially increasing the frame, does not change the polarity of the other processes in parallel. This notion is lifted to extended processes by summing:

polar (P, Φ) = R∈P polar Φ (R) .
In particular, extended processes containing an executable parallel operator or public output has polarity -∞, and executing public inputs makes polarity nonincreasing. We then identify the trace patterns at the core of our partial-order reductions. We say that a session trace

t : A 0 [ a 1 ] L 1 ----→ ss • • • [ an ] Ln ----→ ss A n
is a negative phase when all transitions are outputs or parallels, and polar

(A n ) = -∞.
is a null phase when polar (A 0 ) 0, n = 1 and the transition is an internal communication. is a positive phase when polar (A 0 ) > 0, all transitions are inputs, all labels L i are identical, and polar (A 0 ) > polar (A n ). Rephrasing, a negative phase executes all available outputs and parallels, a null phase is one internal communication, and a positive phase executes a maximal non-empty chain of inputs.

Basic compression

The first optimisation is to only consider traces that can be decomposed into phases. Formally we write O ∀ c,b the set of traces of the form

t : b - 0 • b + 1 • b - 1 • b + 2 • b - 2 • • • b + n • b - n
where each b + i is a positive or null phase, and each b - i is a negative phase. We show in Appendix C that any maximal trace can be decomposed this way after application of a wellchosen permutation of independent actions. Hence by Theorem 5.16: Proposition 5.17 (correctness of basic compression)

O ∀ c,b is a correct refinement of O ∀ all .
Example 5.2: running example Let us introduce a running toy example to illustrate what kind of traces are discarded by the different optimisations in this chapter. This will give an intuition of why they often reduce the number of symbolic traces by an exponential factor.

Let us consider again the example of the BAC protocol with an implicit key distribution and no getChallenge messages. For that we define the two processes

Passport (k) = new n. c n . c(x). Reader (k) = d(x). if rsdec(x, k) = n then c ok new r. d rsenc(x, r, k) else c error
We study the traces of the bounded process

System = ! n new k. ! p Reader (k) | ! p Passport (k).
This first optimisation imposes to follow a reduction strategy executing public outputs in priority; typically all of the np outputs of the various instances of Passport will be executed first, without interleaving actions from Reader . Moreover, after these outputs have been executed, the remaining two actions of each instance of Passport and Reader are executed in one bloc without interleaving other concurrent actions. All only considering traces respecting basic compression reduces the number of interleaving by an exponential factor in np.

Determinism of negative phases Negative phases are non-deterministic by essence, but the underlying combinatorial explosion is artificial in that most of the actions within negative phases are independent: we show that they can actually be executed purely deterministically. We fix an arbitrary total ordering on labelled actions. A negative phase b -, with actions(b -) = α 1 • • • α n , is said to be consistent when for all i < n such that α i || α i+1 , we have α i α i+1 . We write O ∀ c the subset of O ∀ c,b of traces whose negative phases are all consistent.

Proposition 5.18 (correctness of compression)

O ∀ c is a correct refinement of O ∀ c,b .
Proof. By Theorem 5.16, it sufficies to prove that for all negative phases b -, there exists π permuting independent actions of b -such that π.b -is consistent. This follows from a well-founded induction on actions(b -) with respect to the lexicographic extension of on words of actions.

Example 5.3 Consider again the process System introduced in the running example (Example 5.2), this optimisation fixes the order of the np initial outputs of the trace, reducing again the number of interleavings by an exponential factor.

Blocks We have established that, to prove equivalences by session, it is sufficient to consider traces of a certain shape, namely, traces alternating between nonnegative and negative phases. The rest of our partial-order reductions reason at the granularity of these phases, by reordering so-called blocks. A block is a positive or null phase followed by a negative phase. Any trace of O ∀ c is therefore composed of an initial negative phase and a sequence of blocks. Two blocks b and b are said independent, written b || b , if all actions of the former are independent of all actions of the latter. Analogously to actions, we refer to permutations π permuting independent blocks of traces of O ∀ c . The link between the two notions is given by: Proposition 5.19 (block-to-action permutation conversion)

Let t : b p • • • b n a sequence of blocks, tr i = actions(b i ).
If π permutes independent blocks of tr = actions(t), then there is π permuting independent actions of tr s.t.

π .tr = π.tr = tr π(p) • • • tr π(n) .
Note in particular the following corollary of Theorem 5.16 that will be at the core of the results of the next sections, where ≡ b-por is the analogue of ≡ por where permutation of independent actions is replaced by permutation of independent blocks: Theorem 5.20 (correctness of por: block version)

Let O ∀ 1 ⊆ O ∀ 2 ⊆ O ∀ c .
We assume that for all t ∈ O ∀ 2 , there exists

t ext ∈ O ∀ c such that t is a prefix of t ext , and t ∈ O ∀ 1 such that t ≡ b-por t ext . Then O ∀ 1 is a correct refinement of O ∀ 2 .

Improper positive phases

We now introduce improper blocks: intuitively, they conclude the execution of a process but do not bring new knowledge to the attacker. Such blocks can always be relegated to the end of traces because they are not essential to execute other blocks. This takes inspiration from the improper blocks of [START_REF] Baelde | Partial order reduction for security protocols[END_REF] despite some technical differences.

Definition 5.16 (improper block)

We say that a block b : (P, Φ)

tr = ⇒ ss (Q, Φ ∪ {ax 1 → t 1 , . . . , ax n → t n }) is improper if 1 it
starts with an input, i.e., tr is of the form ξ c (ξ t ) • tr ; and 2 all labels appearing in tr do not appear in Q, except maybe on null processes; and 3 for all i ∈ 1, n , t i is deducible from Φ.

Formally we write O ∀

c+i the subset of O ∀ c of traces not containing an improper block followed by a proper block.

Example 5.4

Let us consider again the running example System. The notion takes inspiration, but generalises, the notion of improper blocks used in [START_REF] Baelde | Partial order reduction for security protocols[END_REF]CKR19] that requires n = 0. Our more general notion of improper block captures for example 1 the block of any Passport (k), since the error codes error, ok are public values; 2 the block of Reader (k) assuming a previous instance of Reader (k) has already been executed with the same input x.

Let us comment on the first item of the above definition discarding improper blocks starting with an internal communication: although the optimisation would have been correct without this restriction, this is not the case anymore when combined with those of the next sections. They advance the execution of some blocks starting with an internal communication: we shall therefore ensure that such blocks are never deemed improper since, as such, they would also have to be delayed, yielding a deadlock. The following results, proved in Appendix C, justify the correctness of the refinement.

Proposition 5.21 (correctness criterion)

For all t ∈ O ∀ c , there exists t ≡ b-por t such that t ∈ O ∀ c+i and t has the same number of improper blocks t.

The fact that t has the same number of improper blocks as t is not necessary to apply Proposition 5.20, but it will help establishing further optimisations on improper blocks in the next section.

Corollary 5.22 (correctness of improper-block delay)

O ∀ c+i is a correct refinement of O ∀ c .
Note that when restricting the definition to n = 0, we obtain a weaker optimisation than the one presented in [START_REF] Baelde | Partial order reduction for security protocols[END_REF] for determinate processes. The latter indeed considers traces with at most one improper block. This, however, relies on determinate-specific arguments that are unsound for equivalence by session in general.

Stabilising proper blocks

We introduce in this section a refinement O ∀ c+i * ⊆ O ∀ c+i of improper blocks. It is not included in DeepSec as we found it quite hard to implement; it should rather be seen as a convenient proof tool in the sense that the correctness of refinements of O ∀ c+i * is easier to prove than the correctness of refinements of O ∀ ∩ O ∀ c+i . Intuitively, it solves the problem that properness is not stable by permutation of independent blocks. For example consider processes built from signatures F = {h/1, a, c ∈ F 0 , k ∈ N , and

P = c(x).c h(k) | c(x).c k
The traces of P can contain two blocks, one outputting h(k) and one outputting k: the former may be improper or not depending on whether it is executed second or first. This highlights that permutations of independent, proper blocks of a trace t ∈ O ∀ c+i may lead to a trace π.t / ∈ O ∀ c+i . To get around this issue we let O ∀ c+i * be the set of traces of the form u • v where u, v ∈ O ∀ c ; for all π permuting independent blocks of u, π.u does not contain any improper blocks; v only contains improper blocks.

Example 5.5 If we consider the processes of the running example, if we let

S = new k.(c(x).c k | Passport (k) | Reader (k))
then executing Reader (k) results in a proper block. However it becomes improper if we execute the block c(x).c k first, and the optimisation will therefore only consider traces that do so, discarding one more interleeaving in this example.

In particular this optimisation has the important property of being stable under permutation of proper blocks: Proposition 5.23 (stability of the refinement under permutation)

Let t ∈ O ∀
c+i * with t = u • v and u containing only proper blocks and v, only improper blocks. Then for all π permuting independent blocks of u, (π.u

• v) ∈ O ∀ c+i * .
We then prove the correctness of this optimisation.

Proposition 5.24 (correctness criterion)

For all t ∈ O ∀ c+i , there exists t ≡ b-por t such that t ∈ O ∀ c+i * .
Proof. We proceed by induction on the number of proper blocks of t. If t ∈ O ∀ 1 (which subsumes the case where t has no proper blocks) it sufficies to choose t = t. Otherwise let us write t = u • v with u containing only proper blocks and v improper blocks, and let π permuting independent blocks of u such that π.u contains an improper block. By Proposition 5.21 there exists u ≡ b-por π.u such that u ∈ O ∀ c+i and u contains the same number of improper blocks as π.u. In particular if we write s = u • v, we have s ∈ O ∀ c+i , s has less proper blocks than t, and s ≡ b-por t. Hence the conclusion by induction hypothesis applied to s.

Corollary 5.25 (correctness of stabilised improper blocks)

O ∀ c+i * is a correct refinement of O ∀ c+i .

High-priority null phases

We introduce a condition for prioritising the execution of some internal communications (whose correctness therefore heavily relies on the assumption of stable channels). where c ∈ F 0 and d ∈ N . Assuming that the channel d does not appear in P 1 , all (maximal) traces will contain an internal communication on d between the rightmost three processes, regardless of the potential prior execution of c(x).P 1 . Our optimisation will typically execute such internal communications in priority.

Definition 5.17 (high-priority channel)

Let A = ({ {[ P 1 ] 1 , . . . , [ P n ] n } }, Φ) be an extended process with polar (A) 0. If d ∈ N is a private channel, we write L A (d) ⊆ { 1 , .
. . , n } the set of labels i such that P i starts with an input or output on d. When an internal communication is effectively possible on d ∈ N , we say that d is high-priority (in A) if for all session traces A tr = ⇒ ss B such that no labels of

L A (d) appear in tr, we have L A (d) = L B (d).
This formalises the property that, in all traces of A, the first internal communication on d needs to be between an input and an output that were already available in A. By extension, a transition is high-priority when it is an internal communication on the minimal high-priority channel w.r.t. an arbitrary total ordering ch on channels. Rephrasing, it is a null phase on one deterministically-chosen, high-priority channel.

We define O ∀ 0 to be the subset of traces of O ∀ c that do not contain non-high-priority transitions from processes a high-priority transition is possible from. To combine it with the previous optimisations we let O ∀ c+i * +0 be the set of traces of the form

b -• t p • t i ∈ O ∀ c+i *
where b -is a negative phase, t p ∈ O ∀ 0 only contains proper blocks, and t i ∈ O ∀ c only contains improper blocks. The following propositions state the correctness of this optimisation; their proofs are detailed in Appendix C and rely as usual on Proposition 5.20.

Proposition 5.26 (correctness criterion)

Let t = u • v a maximal trace, where u, v ∈ O ∀
c and v does not contain any high-priority transitions. Then there exists π permuting independent blocks of u such that π.u ∈ O ∀ 0 .

Corollary 5.27 (correctness of high-priority transitions)

O ∀ c+i * +0 is a correct refinement of O ∀ c+i * .

Reduction of independent blocks

Finally, as sequences of independent blocks can be permuted arbitrarily, we define an optimisation that fixes their order. For that we let be an ordering on words of actions such that two words of independent actions are always strictly comparable (≺). We then define a predicate Minimal(t, b), ensuring that it is not possible to obtain an action word lexicographically-smaller than actions(t • b) by inserting b inside t using permutations of independent blocks.

-• t p • t i ∈ O ∀ c+i * +0
where b -is a negative phase, t p ∈ O ∀ r only contains proper blocks, and t i ∈ O ∀ r only contains improper blocks.

Example 5.6 Consider again the running example System. This process contains np instances of the process Passport (k) for various values of k. Let us number them with labels from 1 to np. After executing the np initial outputs (one for each process), all remaining actions of these processes form np improper blocks that are therefore independent: this optimisation thus allows us to execute them in increasing label order. The correctness of this optimisation is stated below and proved in Appendix C.

Proposition 5.28 (correctness criterion)

For all maximal traces t ∈ O ∀ c+i * +0 , there exists π permuting independent blocks of t such that π.

t ∈ O ∀ por . Besides π.t ≺ lex t if t / ∈ O ∀
por , with lex the lexicographic extension of .

The decreasing argument w.r.t. lex is not necessary to obtain correctness, but will be important to prove the compatibility with the reduction by symmetry of the next section.

Corollary 5.29 (correctness of lexicographic reduction)

O ∀ por is a correct refinement of O ∀ c+i * +0 .

Reductions by symmetry

Section summary

In practice we analyse processes that consist of several parallel copies of a same session, which induces a lot of redundancy in the trace space. We develop and prove correct some optimisations that factor this redundancy out for equivalence by session.

Symmetries often appear during practical verification: verifying multiple sessions of a same protocol results into parallel copies of almost identical processes. We first provide a grouptheoretical characterisation of internal process redundancy and then design two optimisations. In spirit, this approach shares some similarities with classical work in model checking modelling symmetries by the group of the automorphisms of the system to be analysed [START_REF] Emerson | Symmetry and model checking[END_REF].

Structural equivalence

We exhibit an equivalence relation identifying processes with an identical structure and whose data are equivalent w.r.t. the equational theory and alpha-renaming of private names. This will be the basis of our symmetry-based refinements. We define the relation ≡ ac on plain processes as the smallest equivalence relation such that

P | Q ≡ ac Q | P (P | Q) | R ≡ ac P | (Q | R)
and that is closed under context (that is, composition of equivalent processes with either a same process in parallel, or an input, output, or conditional instruction at toplevel). To account for the equational theory, we extend it to ≡ E defined by the inference rule:

σ, σ substitutions P ≡ ac Q σ = E σ P σ ≡ E Qσ
Moreover we extend the relation to capture alpha equivalence of private names and channels; intuitively, two agents executing the same protocol are behaving similarly even though they use their own session nonces. Formally we define structural equivalence ≡ on extended processes by the following inference rule ∀i,

P i ≡ E Q i permutation of N ({ {[ P 1 ] 1 , . . . , [ P n ] n } }, Φ) ≡ ({ {[ Q 1 ] 1 , . . . , [ Q n ] n } }, Φ)

Group actions and process redundancy

Let a labelled extended process (as defined in Section 3.1) and a labelled extended twin process

A = ({ {[ P 1 ] 1 , . . . , [ P n ] n } }, Φ) 1 < • • • < n A 2 = ({ {([ P 1 ] 1 , Q 1 ), . . . , ([ P n ] n , Q n )} }, Φ 0 , Φ 1 )
where < is an arbitrary total ordering on labels; the roles of these labels and this ordering is only to fix the position of processes in the multiset. They will often be omitted for succinctness, assuming an implicit ordering.

Definition 5.19 (action of the symmetric group on processes)

Using the above notations, if π ∈ S n we define the following two group actions of S n :

π.A = ({ {[ P π(1) ] 1 , . . . , [ P π(n) ] n } }, Φ) π.A 2 = ({ {([ P π(1) ] 1 , Q 1 ), . . . , ([ P π(n) ] n , Q n )} }, Φ 0 , Φ 1 )
The notation π.A 2 is only well defined if for all i, P π(i) and Q i have equivalent skeletons w.r.t. Φ 0 and Φ 1 ; or, equivalently, if Q i and Q π(i) have equivalent skeletons w.r.t. Φ 1 .

Process redundancy within an extended process is then simply captured by the stabiliser:

Stab(A) = {π ∈ S n | π.A ≡ A} .
Example 5.7 Stab({ {P, . . . , P } }, Φ) = S n models the case where all parallel subprocesses are identical. On the contrary, the case where Stab(A) = {id } models that there is no redundancy at all between parallel processes. Intermediate examples model partial symmetries: the larger the stabiliser, the more redundancy. For example Stab({ {P, P, Q, Q, Q} }, Φ) will contain at least the subgroup of S n generated by the transpositions (1 2), (3 4) and (3 5).

We also extend the action of the symmetric group to capture symmetries up to channel renaming. Indeed, permuting public channels does not affect the executability of processes in the private semantics; therefore two processes that are structurally-equivalent but differ on their public channels still have a similar set of traces.

Definition 5.20 (action of the channel-permutation group on processes)

The channel-permutation group of A is the group S ch A of permutations of ground terms deducible from Φ(A). It acts on extended processes as follows; if ∈ S ch A we obtain A. by replacing all ground channels u of A deducible from Φ(A) by (u).

Typically to prove the equivalence of P (c) | P (d) and Q(c) | Q(d) where P (x), Q(x) are processes operating on a single channel x, matching a trace starting with an action of either P (c) or P (d) results into a similar analysis, provided the channels c and d are known to the attacker. The symmetry will typically be expressed by the fact that the pair of permutations

((1 2), (c d)) is simultaneously in Stab ch (P (c) | P (d)) and Stab ch (Q(c) | Q(d))
, where:

Stab ch (A) = {(π, ) ∈ S n × S ch A | π.A. -1 ≡ A} .

Universal symmetry optimisations

We first present a universal optimisation that reduces the number of possibilities when applying rules (In) and (Comm) at the start of a nonnegative phase. It captures the idea that, when considering the traces of several parallel protocol sessions, starting the trace by an action from one session or an other does not make a substantial difference, even when they use distinct public channels. To formalise this idea, let us consider a labelled trace t ∈ O ∀ c :

t : [ P ] ε tr = ⇒ ({ {[ P i ] i } } n i=1 , Φ 0 ) = A .
The goal is to exhibit conditions discarding some possible transitions directly following t. For that we define two subgroup Sym 1 and Sym 2 of the symmtric group to characterise symmetries. They capture an intuition that the symmetries in P shall be reflected in one way or an other in T(P, Q) to be exploited.

Symmetry by matching

We first define a notion of symmetry within P that is required to be reflected in the matching with Q. We let the group Sym 1 = Sym P 1 ∩ Sym Q 1 where

Sym P 1 = Stab(A) Sym Q 1 = t 2 :(P,Q) tr = ⇒A 2 t=fst(t 2 )∼snd(t 2 ) {π ∈ S n | s 2 : (P, Q) tr = ⇒ ss π.A 2 , fst(s 2 ) = t}
Intuitively π ∈ Sym P 1 means that for all a, P a and P π(a) have the same traces, and π ∈ Sym Q 1 means that they can be matched by the same sessions of Q. In particular if π ∈ Sym 1 , executing first an action from P a or P π(a) results into symmetric equivalence proofs.

Simultaneous symmetry

We now define a notion of symmetry capturing redundancy occurring at the same time in P and Q, up to bijective renaming of public channels. We let

Sym 2 = {π ∈ S n | ∃ , (π, ) ∈ Sym P 2 ∩ Sym Q 2 }, where
Sym P 2 = Stab ch (A) Sym Q 2 = t 2 :(P,Q) tr = ⇒ssA 2 t=fst(t 2 )∼snd(t 2 ) Stab ch (snd(A 2 ))
Intuitively π ∈ Sym P 2 means that for all a, P a and P π(a) have the same traces, and π ∈ Sym Q 2 means that all matching traces of Q have this symmetry as well. Hence, like Sym 1 , π ∈ Sym 2 captures a process symmetry reflected in the equivalence proof.

The optimisation: for input transitions In the following, Sym is the group generated by Sym 1 and Sym 2 . We write I ⊆ 1, n for the set of indexes i such that an input transition is applicable from P i in O ∀ c+i * +0 . If i ∈ I we consider the orbit of i w.r.t. the action of Sym:

Orb(i) = {π(i) | π ∈ Sym} ∩ I .
Intuitively starting a trace of A by an action of P i or P j results into a similar analysis if i and j are on the same orbit. Thus a correct optimisation is to consider only one index per orbit when listing the possible transitions from A. Yet this representant should be chosen carefully for compatibility with prior optimisations, namely O ∀ por that discards traces that are not minimal w.r.t. an ordering on blocks. We should pick a representant i such that the execution of P i induces a minimal block w.r.t. . For that we assume that the ordering is entirely determined by the label of the first action of the block. Hence the following extension of to I is well-defined:

i j ⇐⇒ actions(b i ) actions(b j )
where b i (resp. b j ) is an arbitrary block starting with an input from P i (resp. P j ). An input transition on process P a following the trace t is said well-formed if a is minimal w.r.t. within Orb(a).

The optimisation: for internal communications The optimisation is the same as the one above, except that the symmetries should apply to the input and output processes at the same time. We write IO ⊆ 1, n 2 the set of pairs of indexes (i, j) such that an internal communication is possible between

(P i , P j ) in O ∀ c+i * +0
, where the input is at the start of P i . If (i, j) ∈ IO we consider

Orb(i, j) = {(π(i), π(j)) | π ∈ Sym} ∩ IO .
Intuitively starting a trace of A by an internal communication between processes P i , P j or P k , P l results into a similar analysis if (i, j) and (k, l) are on the same orbit. Then similarly to inputs we extend the ordering on blocks to IO by writing

(i, j) (k, l) ⇐⇒ actions(b) actions(b )
where b (resp. b ) is the block starting with the internal communication between P i and P j (resp. P k and P l ). We thus qualify an internal communication between P a and P b following the trace t as well-formed if (a, b) is minimal w.r.t.

within Orb(a, b).

Correctness We say that a trace is well-formed when all its transitions (In) and (Comm) at the start of nonnegative phases are well-formed. We then define the optimisation O ∀ sym as the set of well-formed traces of O ∀ c+i * +0 . Its correctness is proved in Appendix C.

Proposition 5.30

O ∀ por ∩ O ∀ sym is a correct refinement of O ∀ por .
the integration easier, we used an alternative characterisation of equivalence by session that is closer to trace equivalence. In essence it expresses the structural constraints imposed by twin processes as explicit bijections between labels that we call session matchings. A precise definition is given in Appendix C, with a proof that this is equivalent to the twin-process-based definition of equivalence.

In practice, our implementation consists of keeping track of these session matchings into the nodes of the partition tree generated by DeepSec. For obvious resource reasons, doing so by naively enumerating all subprocess permutation is prohibitive, hence the need for designing a symbolic treatment of these structural constraints (see example below). Our approach is to carry out a symbolic representation of all possible process matchings in each node of the partition tree. The set of all these bijections is then updated at each new symbolic transitions in the partition tree, among others to satisfy the requirement that matched subprocesses should have the same skeleton.

Example 5.8 Consider two initial processes

P = c(x).P 0 | c(x).P 1 | c u .P 2 Q = c(x).Q 0 | c u .Q 1 | c(x).Q 2 .
In the root of the partition tree, P and Q will be labeled by 0, i.e., the root will contain the two symbolic processes

({[ P ] 0 }, ∅, ∅) ({[ Q ] 0 }, ∅, ∅) .
There is only a single bijection between their labels, i.e., the identity 0 → 0. Upon receiving this initial node, DeepSec applies the symbolic transition corresponding to our rule (Par), hence generating the two symbolic processes

({ {[ c(x).P 0 ] 0.1 ; [ c(x).P 1 ] 0.2 ; [ c u .P 2 ] 0.3 } }, ∅, ∅) ({ {[ c(x).Q 0 ] 0.1 ; [ c u .Q 1 ] 0.2 ; [ c(x).Q 2 ] 0.3 } },∅, ∅)
There are then only two possible bijection of labels that respect the skeleton requirement of twin processes:

0.1 → 0.1 0.1 → 0.3 0.2 → 0.3 and 0.2 → 0.1 0.3 → 0.2 0.3 → 0.2
These bijections are kept within the node of the partition tree and updated along side the other transformation rules of DeepSec. For obvious performance reasons, we cannot represent them by a naive enumeration of all process permutations. Fortunately, the skeleton requirement ensures an invariant that the set S of session matchings between two processes A and B is always of the form

S = {π | ∀i, ∀ ∈ C i , π( ) ∈ D i }
where the sets C 1 , . . . , C n form a partition of the labels of A and D 1 , . . . , D n a partition of the labels of B. In particular, S can succinctly be stored as a simple association list of equivalence classes.

Decision of equivalence Finally, as our trace refinements depend on two sets O ∀ and O ∃ , we annotate each symbolic process in the node by ∀, ∃ or ∀∃ tags. They mark whether the trace from the root of the partition tree to the tagged process is determined to be in O ∀ , O ∃ or both respectively. For instance, the two initial symbolic processes in the root of the partition tree are labeled by ∀∃. We also provide a decision procedure for inclusion by session s that consists of tagging one of the initial processes as ∀ and the other one as ∃.

The final decision criterion for equivalence by session is then strenghtened compared to the one for trace equivalence (recall Chapter 3, Theorem 3.3). For equivalence to hold, not only each node of the partition tree should contain at least one process originated from P and one process originated from Q, but each of them that has the tag ∀ should be paired with at least one other process of the node with the tag ∃.

Integration

From a high-level of abstraction, the integration of the universal optimisations described in Sections 3 and 4 prune some branches of the partition tree-those that abstract traces that do not belong to O ∀ por ∩ O ∀ sym . For instance in Section 3.2, we showed that to prove equivalence by session, we can always perform non-input actions in priority. Therefore on a process c u .P | c(x).Q, we prevent DeepSec from generating a node corresponding to the execution of the input due to the presence of the output.

The integration of other optimisations is more technical in a symbolic setting, in particular the lexicographic reduction O ∀ c+r described in Section 3.6. Remember that it discards traces that do not satisfy the predicate Minimal, that identifies lexicographically-minimal traces among those obtained by permutation of independent blocks. Unfortunately, the definition of independence (Definition 5.14) is only defined for ground actions-and not their symbolic counterpart, that intuitively abstracts a set of ground actions. A branch may therefore be removed only if all its solutions violate the predicate Minimal. However, by Proposition 5.10, it is correct to only partially implement such optimisations.

In practice Based on the high-level description of the previous section, we extended the implementation of DeepSec to decide equivalence by session of P and Q. Upon completing an analysis, two cases can arise: 1 The two processes are proved equivalent by session. Then they are also trace equivalent by Proposition 5.2. 2 The two processes are not equivalent by session and DeepSec returns an attack trace t, say, in P , as a result. In the second case, when using equivalence by session as a heuristic for trace equivalence, the conclusion is not straightforward. As discussed in Section 1.3, the witness trace t may not violate trace equivalence (false attack). We integrated a simple test to our prototype, that checks whether this is the case or not. For that we leverage the internal procedure of DeepSec by, intuitively, restricting the generation of the partition tree for checking P t Q to the unique branch corresponding to the trace t.

If this trace t appears to violate trace equivalence, which is the case for example in our analysis of two sessions of the BAC protocol, we naturally conclude that P ≈ t Q. Otherwise, the false attack may guide us to discover a real attack: our analysis of session equivalence consider traces with a specific shape (see Sections 3 and 4). Thus, we implemented a simple heuristic that, whenever a false attack is discovered, also checks whether different permutations of actions of this false attack could lead to a true attack. For instance, this heuristic allowed us to disprove trace equivalence in some analyses of n 3 sessions of BAC. When our heuristic cannot discover a true attack, the result is not conclusive: the processes may well be trace equivalent or not. We leave as future work the design of a complete decision procedure for trace equivalence that builds on a preliminary analysis of equivalence by session.

Experimental setting

We report experiments (Figure 5.4) comparing the scope and efficiency of the following two approaches for proving trace equivalence:

1 The original version of DeepSec as a baseline; 2 The analysis leveraging our contributions (preliminary analysis of equivalence by session, test of false attack if it fails, and then the heuristic attempting to reconstruct a true attack).

Benchmarks were carried out on 20 Intel Xeon 3.10GHz cores, with 50 Gb of memory. The result table using the following graphical conventions for the result of the analysis: analysis terminates and equivalence holds analysis terminates and a true attack is found analysis aborted due to timeout (12 hours) unable to conclude whether trace equivalence holds (false attack) Let us comment the results of Figure 5.4. First, the analysis of Helios for two voters and an honest ballot box only benefits from an underwhelming gain in verification time when exploiting process symmetries. This is however not surprising: with an honest ballot box, when a voter casts their vote, the protocol's execution can only carry on once the ballot box has effecitvely received the ballot in question, which greatly already limits the combinatorial explosion due to concurrency. A slightly better improvement can be observed when increasing the number of voters, allowing to scale to 10 ballots instead of 9 for 3 voters. However the real improvement appears when considering a dishonest ballot box: due to the ability of the adversary to permute or drop ballot, an effective combinatorial explosion arise, giving the opportunity to exploit proof symmetries. When the baseline approach fails to conclude in 12h for 4 ballots, using equivalence by session only requires 2s.

The case of BAC is also interesting: analysing the model as defined in Chapter 2 results in a false attack. This is due to the initial key distribution that restricts the possible matchings, making it impossible to conclude a proof of equivalence by session. However, since the key distribution only fixes a bijection between readers and passports using unobservable communications, we could consider a model of unlinkability where this distribution is implicit (that is, each reader is defined by a process that is already paired with a passport). Using this equivalent model, equivalence by session can be proved up to 5 sessions and significantly outperforms the baseline approach. We included in the result table some experiments for each variant studied in Chapter 2 (honest sessions, arbitrary sessions, and fixed scenarios). Note in particular that in the cases of 3 or more fixed sessions, the attacks found when using equivalence by session were false attacks; true attacks could however be retrieved by using our simple heuristic.

Protocol

Introduction

The theoretical boundaries of the problem

In Part II wee have designed and evaluated the performances of an algorithm for proving trace equivalence and of some optimisations. In Part III we will focus more on the theoretical understanding of the problem.

As mentioned in the previous introductions, there exist many decidability results for reachability properties in symbolic models. We argue that the development of mature automated tools such as ProVerif or Tamarin has been eventually possible due to such more theoretical work, by permitting to understand the precise limits and possibilities of the problem in terms of decidability and complexity. Although the tool support for equivalence properties is steadily improving as discussed in Part II, our theoretical understanding of equivalence is still not at the level of reachability's. In Part III we give a more detailed snapshot of the state of the art.

1 Chapter 6 is a technical chapter were we prove the termination of the algorithm introduced in Part II for deciding equivalences, and study the theoretical complexity of the problem. More precisely we prove that the problems of deciding trace equivalence, labelled bisimilarity and equivalence by session are coNEXP complete for bounded processes and constructor-destructor subterm convergent theories. Interestingly, the worst-case complexity of equivalence by session is therefore the same as trace equivalence, which may be surprising due to the practical differences in performances between observed in Chapter 5. 2 In Chapter 7 we include this result in a more complete overview of the state of the art by surveying complexity results for the decidability of equivalences in the bounded fragment for various classes of theories. In particular we found during this survey several classes of processes and theories whose complexity had not been investigated before, or where existing complexity results could be improved; this survey thus includes several new or streghtened results. Moreover, we identified some variations in how the problems were stated across the literature. The most relevant variations are a the operational semantics used in the applied pi calculus, more precisely the treatment of internal communications (classical or private semantics, see Chapter 1); b whether the theory is considered as a constant of the problem. Although the complexity results we provide seem to be relatively stable when changing semantics, considering fixed theories or not has an impact on some complexity results. Note that Delaune and Hirschi [DH17] also survey symbolic methods for verifying equivalence properties; they mainly discuss tool support whereas we focus on computational complexity. Technical Chapter. In this chapter we prove the termination of the constraint solving procedure used by DeepSec to generate partition trees (Chapter 4). This shows that, in addition of being correct, the overall verification algorithm carried out by the DeepSec tool (Chapter 3, Algorithm 1) is guaranteed to terminate. Besides we prove that, whenever equivalence does not hold, a witness of non-equivalence of exponential size can be extracted from the generated partition tree, thus justifying that trace equivalence, labelled bisimilarity and equivalence by session are decidable in coNEXP. We then show that this bound is tight, i.e., that the three problems are actually coNEXP complete.

A summary table of all complexity results can be found in

Preliminary word

Organisation of the chapter In Chapter 3 we introduced the notion of partition tree and showed how trace equivalence and labelled bisimilarity could be decided assuming such a tree had been computed (procedure adapted to equivalence by session in Chapter 5). Then we provided a tree-generation procedure in Chapter 4 for arbitrary constructor-destructor subterm convergent theories (Algorithm 1). The structure of the current chapter is the following: 1 In Section 1 we prove that Algorithm 1 uses a finite number of constraint-solving rules to compute each branch of the partition tree. This proves the three equivalences to be decidable. 2 For complexity purposes we then refine this result in Section 2: we prove that Algorithm 1 applies at most an exponential number of rules and that the nodes of the resulting partition tree have most general solutions of exponential (DAG) size. 3 Relying on these bounds, we show that two processes are not equivalent iff there exists a non-equivalence witness of exponential size (as defined in Chapter 3). This shows the three equivalences to be decidable in coNEXP time. 4 Finally we show in Section 4 that the equivalences are coNEXP hard as well. All in all: Theorem 6.1 (complexity of equivalences)

The decision problems TraceEquiv, Bisimilarity and SessEquiv are coNEXP complete for bounded processes and constructor-destructor subterm convergent theories.

149

Notations We also introduce some notations that will be used in most sections of this chapter. We recall that we study complexity w.r.t. the DAG size of terms (which provides stronger results compared to complexity bounds w.r.t. the tree size of terms); in particular the DAG size of a substitution σ is |σ| dag = |subterms (img(σ))|, hence the many occurrences of subterm sets below. Given an extended constraint system C e = (Φ, D, E 1 , E 2 , K, F) we write

µ 1 = mgu(E 1 )
(first-order mgu)

µ 2 = mgu(E 2 ) (second-order mgu)

T 1 = subterms 1 (img(Φµ 1 ), img(µ 1 ), Kµ 1 , Dµ 1 ) (first-order terms)

T 2 = subterms 2 (img(µ 2 ), K, D) (second-order terms)

used 2 = subterms c (img(µ 2 ), K ∪ D) ∪ vars 2 (D) (solution recipes)
When the extended constraint system is not clear from context we write explicitly µ 1 (C e ), µ 2 (C e ), T 1 (C e ),... Intuitively µ i are the mgu's of the equations of E i and we recall in particular that mgs (C e ) = {µ 2 } when C e is solved (Chapter 4, Section 2.4, Proposition 4.1). The other notations assume µ 1 = ⊥ (if µ 1 = ⊥, C e will be discarded by the normalisation rule (MGS-Unsat) anyway). The sets T 1 and T 2 respectively represent the first-order and secondorder terms appearing in the system, while used 2 ⊆ T 2 models the set of recipes used to build the solution of C e (i.e., µ 2 ) from K ∪ D. We recall that it is the same set as the one used when defining the constraint-solving rules for most general solutions (Chapter 4, Section 2.2).

Remark: uniformity of second-order terms across components Due to an invariant of the procedure (Inv str formalised in Appendix B, Section 1), we know that all extended constraint systems in a component Γ have the same second-order structure. Here this means that µ 2 (C e 1 ) = µ 2 (C e 2 ) and T 2 (C e 1 ) = T 2 (C e 2 ) for any (P 1 , C 1 , C e 1 ), (P 2 , C 2 , C e 2 ) ∈ Γ. For this reason we may write µ 2 (Γ) or T 2 (Γ) instead of µ 2 (C e ) or T 2 (C e ) for some arbitrary (P, C, C e ) ∈ Γ.

Termination of the constraint solving

Section summary

As we showed in Chapters 3 and 4, our algorithm for producing equivalence proofs constructs a partition tree using a constraint solving procedure. We prove here that it terminates and give some preliminary complexity arguments.

Termination of the computation of most general solutions

We first study the termination of the procedure for computing most general solutions of Chapter 4, Section 2. The proof mostly relies on the following measure that characterises the set of first-order terms of an extended constraint system C e that are not used in mgs (C e ), that is, that are not deduced by any recipe ξ ∈ used 2 (C e ):

unused 1 (C e ) = {t ∈ T 1 | t ∈ X 1 ∧ ∀ξ ∈ used 2 (C e ) X 2 , (ξ, t) / ∈ Conseq(Kµ 1 ∪ Dµ 1 )}
The simplification rules for mgs' do not affect this value (except maybe if C e is replaced by ⊥ by (MGS-Unsat)). The application of (MGS-Conseq) will ensure that unused 1 is at least non-increasing, while (MGS-Res) and (MGS-Cons) make it strictly decreasing. We summarise this as the following proposition, proved in Appendix D; we recall that, similarly to the correctness arguments in Chapter 4, the statements makes reference to some procedure invariants formalised in Appendix D: Proposition 6.2 (decrease of unused first-order terms during constraint solving)

Let C e be an extended constraint system such that C e = C e and the invariants Inv

Termination of the computation of partition trees

To bound the number of rule applications in Algorithm 1 we define a well-founded measure that decreases after each case-distinction, simplification, normalisation and vector-simplification rules. More precisely the rule applications are always of the form

S ∪ {Γ} → S ∪ {Γ 1 , . . . , Γ p } p ∈ {1, 2}
and we show that for all i ∈ 1, p , Γ > Γ p w.r.t. to a well-founded measure on components (under the invariants of the procedure defined in Appendix B). This therefore bounds the number of rule applications to compute a given branch of the partition tree. The measure in question is a tuple of 10 integer components that is ordered w.r.t. the lexicographic ordering.

Measure 1: sizes of the processes As first element of the measure, we compute a maximum on the sizes of the processes in the multisets P, that is,

M 1 (Γ) = max (P,C,C e )∈Γ R∈P |R| dag (Meas. 1)
Notice that this stays unchanged for any simplification or case distinction rules but strictly decreases when applying the extended symbolic transitions.

Measure 2: Number of non-deducibility facts The second element of the measure is the number of non-deducibility facts ∀X.X ? u appearing in D. This types of formulas can only be added by symbolic rules (that already decrease the first component of the measure) and strictly decrease when Rule (Chan) is applied.

M 2 (Γ) = S∈Γ |{(∀X. X ? u) ∈ D(S)}| (Meas. 2)
Measure 3: Number of constraint systems The third element of the measure considers the number of extended symbolic processes in the set, i.e., |Γ|, that may increase only when applying a symbolic transition; however it strictly decreases when applying the simplification rules (Vect-Split) and (Vect-rm-Unsat). Moreover it also strictly decreases for the positive branch of Rule (Sat) when applied with the case 3 of its application conditions. In such a case, we consider a disequation ψ and a mgs Σ of C e j that does not satisfy ψ, which will lead to at least one S ∈ Γ being discarded by the simplification rule (Vect-rm-Unsat). Typically it corresponds to the terms that are not deducible by the attacker but could potentially be (because the knowledge base is not saturated yet). In fact, when the simplification Rule (Vect-add-Conseq) is applied, i.e., when a deduction fact ξ ? u is added to K(C e ), the term u is necessarily a subterm of the frame by the invariant Inv wf (C e ). Moreover by definition of Rule (Vect-add-Conseq) we know that u is not already consequence, meaning that the size of set K (C e ) will strictly decrease. Finally the case distinction rules never increase the number of elements of set K (C e ): indeed they all consist of applying substitutions Σ that are most general solutions of some systems having K(C e ) as their knowledge base, hence their first-order terms are consequence by K-basis. All in all we choose the following component:

M 4 (Γ) = min (P,C,C e )∈Γ |set K (C e )| (Meas. 4)
Measure 5: Number of unsolved extended constraint systems We recall that the aim of Rule (Sat), case 1 of its application conditions, is to put extended constraint systems in solved form (that is, in a form where they trivially have µ 2 as a unique mgs). If then this measure is strictly decreasing when applying the rule in question. Once a system has a unique mgs, intantiating its second variables does not change this fact and the other case distinction rules are therefore non-increasing w.r.t. this measure.

Measure 6: Applicability of Rule REW The next element represents the number of applications of Rule (Rew) that are still possible. Typically, we consider all the parameters of the rule (Rew) (the deduction facts from K, the rewrite rule, etc...) on which the rule would be applied with a most general solutions that does not already corresponds to a deduction fact in F. If C e is an extended constraint system we therefore consider set Rew (C e ) the set of tuples (ψ, → r, p, ψ 0 , Σ) that satisfy all the application conditions of Rule (Rew), and M 6 (Γ) = Measure 7: Number of unsolved deduction formulas We recall that Rule (Sat), case 2 of its application conditions, applies a most general solution to remove the hypotheses of one formula ψ ∈ F(C e ) for some (P, C, C e ) ∈ Γ (the formula becomes solved in the positive branch, and is removed by (Norm-Formula) in the negative branch). This rule application is therefore strictly decreasing w.r.t. the measure

M 7 (Γ) = |{ψ ∈ F(C e ) | (P, C, C e ) ∈ Γ, ψ unsolved deduction formula}| (Meas. 7)
We only consider deduction formulas ψ for this component. In particular the only rule that may increase this measure (i.e., generate unsolved deduction formulas) is (Rew) which is already decreasing w.r.t. the previous component of the measure.

Measure 8: Applicability of Rule EQ Similarly to the analogue component for Rule (Rew), we now define the next component that bounds the maximal number of possible applications of Rule (Eq). The application conditions stipulate that it can be applied either 1 on two deduction facts of K(C e i ), or 2 on one deduction fact of K(C e i ) in combination with a construction function symbol.

Even if the application conditions also consider a mgs Σ, the number of applications of Rule (Eq) will not depend on their number; this is intuitively because after applying the rule with one arbitrary mgs Σ, the conditions forbid any later applications with identical parameters except Σ. Formally consider for example the case 1 (case (2) follows the same reasoning). The rule is applied on two deduction facts (ξ 1 ? u 1 ), (ξ 2 ? u 2 ) ∈ K(C e ). Thus, an equality formula with ξ 1 Σ = ? f ξ 2 Σ as head will be added in F(C e :Σ). However, in further applications of the rule, the condition that "for all (ϕ ⇒ H) ∈ F(C e :Σ), H = (ξ 1 = ? f ξ 2 )" will prevent a new application with the same (up to instantiation of Σ) deductions facts from K(C e :Σ).

We therefore conclude that the rule (Eq) can be applied only once per pair of deduction facts in K and once per deduction fact in K and function symbol in F c . If C e is an extended constraint system we therefore consider set Eq (C e ) the set of pairs (ψ, ψ ) ∈ K(C e ) 2 or (ψ, f) ∈ K × F c that satisfy all the application conditions of the rule (Eq), and M 8 (Γ) = As before Rule (Sat) makes this measure decrease in the case 2 of its application conditions. On the contrary unsolved equality formulas can be generated by two rules: the case distinction rule (Eq) or the vector-simplification rule (Vect-add-Formula).

Measure 10: Remaining most general solutions So far, every time we showed that one of the previous element of the measure (strictly) decrease by application of a case distinction rule, we always focused on the positive branches of case-distinction rules. The negative branches on the contrary only add recipe disequations to the system, which does not increase any the previous components of the measure but strictly decreases the number of most general solutions we can compute for the same instance of the rule. For example, if Σ ∈ mgs (C e ) then |mgs (C e )| > |mgs (C e [E 2 ∧ ¬Σ])|. Hence it sufficies to consider the last component:

M 10 (Γ) = Σ |
there exists a case distinction rule applicable from C e with parameter Σ, (P, C, C e ) ∈ Γ (Meas. 10)

Conclusion

This gives the termination of the algorithm for computing T ∈ PTree(P, Q). We study more precisely the Components 1 to 9 of the measure in Appendix D and prove that they can all be bound by an exponential in |P, Q, E| dag (with E the theory). Hence: Theorem 6.4 (termination for partition trees) For all P, Q plain processes, Algorithm 1 terminates with arguments P, Q. Moreover each branch of the resulting tree is generated by applying at most an exponential number (in |P, Q, E| dag ) of rules, not counting the negative branches of case distinction rules.

Bounding the increase of the second-order terms

When applying a mgs We first study the growth of T 2 (C e ) when applying a mgs to C e , which means proving Theorem 6.5 in the case of Rule (Sat). Similarly to our previous results on most general solutions (Section 1.1), our bounds depend on unused 1 (C e ) the number of first-order terms of C e that are not already used in the solution, i.e., in µ 2 . We also recall that by Proposition 6.2, this measure is non-increasing when applying any of the mgs simplification and constraint-solving rules, and is even strictly decreasing in the case of Rule (MGS-Res) and (MGS-Cons). Let us now show that its growth is actually inverted compared to T 2 , that is, how much T 2 increases can be bounded by how much unused 1 decreases: Proposition 6.7 (evolution of second-order terms when applying mgs) For all extended processes C e that verify the invariants Inv wf (C e ) and Inv sound (C e ), we have

∀Σ ∈ mgs (C e ), |T 2 (C e :Σ)| ≤ |T 2 (C e )| + |F| × (|unused 1 (C e )| -|unused 1 (C e :Σ)|)
Proof. We assume |F| > 0 by convention. It sufficies to prove this property when replacing C e :Σ by C e for C e → C e = ⊥ obtained by a mgs simplification or constraint-solving rules. We perform a case analysis on the rule in question.

case 1: simplification rule on formulas

The simplification rules on formulas only affect first-order terms and second-order disequations and we therefore have T 2 (C e ) = T 2 (C e ).

case 2: mgs simplification rule

We only need to consider Rule (MGS-Unif). Since it only affects first-order terms, the reasoning is identical to the previous case. case 3: mgs constraint-solving rule Rules (MGS-Conseq) and (MGS-Res) apply a second-order substitution Σ = mgu(ξ = ? ζ) to C e for some ξ, ζ ∈ T 2 (C e ). In particular we deduce that |T 2 (C e )| |T 2 (C e )| and the conclusion thus follows from the fact that unused 1 (C e ) -unused 1 (C e ) 0 by Proposition 6.2. Finally the only rule that increases T 2 (C e ) is the last one, (MGS-Cons), that generates n fresh second-order variables for some constructor symbol f/n. In particular |T 2 (C e )| |T 2 (C e )| + n, hence the result since unused 1 (C e ) -unused 1 (C e ) > 0 by Proposition 6.2.

In particular we obtain Proposition 6.6 for Rule (Sat) case 1, provided we prove that unused 1 (C e ) is bounded by a polynomial. We explain in Appendix D how to extend the argument to Rules (Eq), (Rew) and (Vect-add-Conseq).

Bound of unused terms To conclude let us therefore establish a polynomial bound on |unused 1 (C e )|. In order to do so we explore the relation between C and C e in (P, C, C e ) ∈ Γ. Intuitively unused 1 (C e ) always has less elements then unused 1 (C) because 1 the symbolic rules always add the same constraints to C and C e , ensuring that unused 1 (C e ) increases at most as much as unused 1 (C) by these rules 2 the other rules leave C untouched and do not make unused 1 (C e ) increase. Proof. We agree on the convention that |P | dag , |Q| dag and |E| dag are strictly positive. By Propositions 6.7 and 6.8, it sufficies to prove that for all symbolic traces P tr = ⇒ s (P, C), Φ(C)µ 1 (C), µ 1 (C) dag 9 |P, E| 2 dag (which, as we will see, is a very rough approximation). For that a quick induction on the length of tr allows to construct a set of |tr| variables Y = {y i } |tr| i=1 and finite set of equations S such that 1 µ 1 (C) ∈ mgu E (S) 2 for all (u = ? v) ∈ S, u (resp. v) is either a subterm of a term appearing in P or a variable of Y 3 for all terms u ∈ img(Φ(C)µ 1 (C)), there exists u 0 subterm of a term appearing in P such that u 0 µ 1 (C) = u The variables of Y model the fresh channel variables introduced when executing (s-In) or (s-Out) transitions, and the set of equations S collects the equality tests performed during the trace and how each variable of P is instantiated by E 1 (including by private communications). Independently from this, by induction on a straightforward algorithm to compute mgu's modulo theory, we have if E is constructor-destructor subterm convergent

|subterms (σ)| |subterms (S)| + |E| dag × |{t ∈ subterms (S) | root(t) ∈ F d }| 2|subterms (S)| × |E| dag (E)
Altogether we therefore obtain Building on the results of this chapter we design theoretical decision procedures for equivalence properties in coNEXP. For that we prove the existence, whenever equivalence does not hold, of a witness of non-equivalence (in the sense of Chapter 3, Section 2) of exponential size. This proof is contructive and relies on the partition tree computed by Algorithm 1.

Φ(C)µ 1 (C), µ 1 (C) dag |subterms (P )| + 2 µ 1 (C) dag ( by

Complexity of trace equivalence and equivalence by session

The goal of this section is to prove the following theorem:

Theorem 6.10 (complexity of trace equivalence and equivalence by session)

TraceEquiv and SessEquiv are coNEXP for bounded processes and constructor-destructor subterm convergent theories.

We only prove it for trace equivalence; the proof for equivalence by session can be done along the same lines, using the arguments described in Chapter 5, Section 5. The proof for trace equivalence relies on the following arguments that were developed in previous chapters: 1 charactering trace inclusion with partition trees: Theorem 3.3 (Chapter 4, Section 2.2) 2 existence of a mgs of exponential size: Theorem 6.5 3 soundness and completeness of the symbolic semantics: see Chapter 3 Using these ingredients we prove the core property: Proposition 6.11 (witness of non-trace equivalence of exponential size)

Let P 1 , P 2 be two plain processes w.r.t. a constructor-destructor subterm convergent theory E. The following points are equivalent: 1 P 1 t P 2 2 there exists a trace t : P 1 tr = ⇒ A 1 such that |t| dag is exponential in |P, Q, E| dag and for all

P 2 tr = ⇒ A 2 , A 1 ∼ A 2 .
Proof. The proof of 2⇒1 is trivial and we therefore focus on 1⇒2. Let us assume that P 1 t P 2 , and let T ∈ PTree(P 1 , P 2 ) the partition tree computed by Algorithm 1. By Theorem 3.3 we obtain a partition-tree trace P 1 tr = ⇒ T (P, C), n such that there exist no traces of the form P 2 tr = ⇒ T (P , C ), n. But by Theorem 6.5 we know that the (DAG) size of mgs (n) is of exponential in |P, Q, E| dag , which gives a solution (Σ, σ) ∈ Sol π(n) (C) of exponential size as well by definition of a mgs.

Let us then consider the trace t : P 1 trΣ = = ⇒ (Pσ, Φ(C)σ↓) (that exists by soundness of the symbolic semantics) and show that it satisfies the conditions of 2. It is indeed of exponential DAG size. Besides assume by contradiction that there exists a trace P 2 trΣ = = ⇒ (Q, Ψ) such that Φ(C)σ ∼ Ψ. By using the completeness of the symbolic semantics and the properties of the partition tree (Lemma 3.4 in Chapter 2.2), we would obtain a symbolic process (P , C ) such that P 2 tr = ⇒ T (P , C ), n, yielding a contradiction.

To obtain a decidability result we also use the following result on static equivalence rephrased from [AC06]: Proposition 6.12 (witness of non-static equivalence of polynomial size)

If two frames Φ and Ψ are not statically equivalent w.r.t. a subterm convergent theory E, there exist two recipes ξ and ζ such that |ξ, ζ| dag is polynomial in |Φ, Ψ, E| dag , ξΦ = E ζΦ and ξΨ = E ζΨ.

Wrapping everything together we obtain the following NEXP decision procedure for nontrace equivalence:

1 Given two processes P 1 , P 2 , guess an integer i ∈ 1, 2 and a trace P 1 tr = ⇒ (P, Φ) of exponential size. In particular, although |dom(Φ)| |tr|, the sizes of the terms in img(Φ) may be exponential as well.

2 For each of the exponentially-many traces of the form t : P 2 tr = ⇒ (Q, Ψ), guess two recipes ξ t , ζ t of exponential size. 3 if for one such trace t we do not have

ξ t Φ = E ζ t Φ ⇔ ξ t Ψ = E ζ t Ψ, conclude that P 1 ≈ t P 2 .

Complexity of labelled bisimilarity

The goal of this section is to prove the following theorem: Theorem 6.13 (complexity of labelled bisimilarity)

Bisimilarity is coNEXP for bounded processes and constructor-destructor subterm convergent theories.

Similarly to trace equivalence we build on the results of the previous chapters, this time using the characterisation of labelled bisimilarity based on symbolic witnesses (Theorem 3.7 in Chapter 3, Section 2.3). Given a partition tree with most general solutions of exponential size, our goal is therefore to derive from it a symbolic witness of non-equivalence and a solution of this witness (Definition 3.14 in Chapter 3, Section 2.3), both of exponential size as well. Proposition 6.14 (witness of non-labelled bisimilarity of exponential size)

Let P 1 , P 2 be two plain processes w.r.t. a constructor-destructor subterm convergent theory E. The following points are equivalent: 1 P 1 ≈ l P 2 2 there exists a witness w for (P 1 , P 2 ) such that |w| dag is exponential in |P, Q, E| dag .

Proof. The proof of 2⇒1 is trivial and we therefore focus on 1⇒2. Let us assume that P 1 ≈ l P 2 , and let T ∈ PTree(P 1 , P 2 ) the partition tree computed by Algorithm 1. By Theorem 3.7 we obtain a symbolic witness w s for (P 0 , P 1 , root(T )) such that Sol (w s ) = ∅, and it sufficies to prove that there exists a solution of w s of exponential size (where the size of a solution f sol is N ∈dom(f sol ) |f sol (N )| dag ). More precisely we construct by induction on w s a function f mapping the nodes of w s to second-order substitutions (not necessarily ground) such that: 1 (f mgs f ) ∈ Sol (w s ), where f mgs (S, n) = mgs (n) and the notation f = gh is defined by f (N ) = g(N )h(N ) for all nodes N of w s 2 for all f sol ∈ Sol (w s ), there exists f such that f sol = f mgs f f In particular since f mgs is of exponential size by Theorem 6.5, it sufficies to ensure that f is of exponential size as well.

case 1: w s is reduced to a leaf N .

Then it sufficies to choose f (N ) = id . case 2: w s has a root labelled (S, n) and children N 1 , . . . , N p labelled (S 1 , n ), . . . , (S p , n ) Let us write S = {A 0 , A 1 } with, by definition, a symbolic trace

A 0 α -→ s A 0 such that each trace A 1 ᾱ = ⇒ s A i 1 corresponds to a child S i = {A 0 , A i 1 }.
We apply the induction hypothesis to the children to obtain their respective functions f 1 , . . . , f p . We recall that Sol (w s ) = ∅ by hypothesis and that all solutions f sol verify f sol (N 1 ) = • • • = f sol (N p ); thus, since by induction hypothesis all solutions of w s are instances of f mgs f i , we obtain:

mgu(mgs (n )f 1 (N 1 ) 1 ∧ . . . ∧ mgs (n )f p (N p ) p ) = ⊥
for 1 , . . . , p fresh variables renamings of img(f 1 (N 1 )), . . . , img(f p (N p )), respectively. In particular, assuming without loss of generality that all the f i (N i ) have the same domain (vars 2 (n ) dom(mgs (n ))) ∪ img(mgs (n )), we can write

Σ = mgu(f 1 (N 1 ) 1 ∧ . . . ∧ f p (N p ) p ) = ⊥
Note that this mgu is only polynomially bigger than each f i (N i ). Since mgs (n ) is an instance of mgs (n), we also let Σ 0 such that mgs (n ) = mgs (n)Σ 0 . We then conclude the proof by defining f as follows:

1 f (root(w s )) = (Σ 0 Σ) |vars 2 (n)
2 for all i ∈ 1, p , for all nodes N in the subtree of w s rooted in N i , f (N ) = f i Σ.

coNEXP hardness: a reduction from succinct satisfiability

Section summary

We show that the coNEXP upper bound proved in this chapter is tight, i.e. deciding the three equivalences are coNEXP hard in general. This result holds in various restrictive settings, e.g. without else branches or private channels or with a fixed set of cryptographic primitives.

Extensions of the calculus

As we explained in Chapter 1, Section 2.3 many extensions can be encodeed in the original calculus for modelling convenience. However, as soon as complexity is involved, one should be careful that using these encodings does not affect the complexity of deciding the related decision problems. In this section we introduce various syntax extensions that will be useful when doing our reduction of coNEXP hardness to process equivalences, and formalise a polynomial-size encoding in the original calculus.

Internal non-deterministic choice We recall the encoding of non-deterministic choice introduced in Chapter 1, Section 2.3. We formally defined it by a process transformation • :

P + Q def = s s | s(x). P | s(y). Q
where s ∈ N and x, y ∈ X 1 are fresh (6.1) and all other cases of the syntax are handled as homomorphic extensions of • . As for the parallel operator we will sometimes use the big operator assuming right-associativity. The correctness of this translation with respect to ≈ t and ≈ l will be stated later on in this section.

We also introduce the Choose(x) construct which non-deterministically assigns either 0 or 1 to x. Choose(x).P silently reduces to either P {x → 0} or P {x → 1} and Choose( x).P is defined as Choose(x 1 ).Choose(x 2 ) . . . Choose(x n ).P where x = x 1 , • • • , x n . Formally, we extend the operational semantics with the rule Boolean circuits and formulae Complete problems in complexity theory often involve boolean formulae (e.g., SAT or QBF). The ability to evaluate boolean formulae, or boolean circuits in general, within the applied π-calculus is therefore curcial. We can implement such a feature by the means of private channels and internal communication: each edge of a boolean circuit Γ indeed mimics a channel transmitting a boolean over a network (Figure 6.1). Formally, the essence of circuits lies in so-called logical gates which are boolean functions with at most two inputs. We assume without loss of generality that the gate has at most two (identical) outputs, to be given as input to other gates. Logical gates usually range over the constants 0 and 1 and the predicates ∧, ∨ and ¬ with the usual truth tables but we may use other common operators such as =. From that a boolean circuit is an acyclic graph of logical gates: each input (resp. output) of a gate is either isolated or connected to a unique output (resp. input) of an other gate, which defines the edges of this graph.

(P ∪ { {Choose(x).P } }, Φ) ε - → (P ∪ { {P {x → 0}} }, Φ) (Choose-0) (P ∪ { {Choose(x).P } }, Φ) ε - → (P ∪ { {P {x → 1}} }, Φ) (Choose-
Such a circuit Γ with m isolated inputs and p isolated outputs thus models a boolean function Γ : B m → B n (where B = {0, 1}). We write (c 1 , c 2 , g, c 3 , c 4 ) ∈ Γ to state that g : B 2 → B is a gate of Γ whose inputs are passed through edges c 1 and c 2 and whose output is sent to edges c 3 and c 4 . This notation is naturally lifted to other in-outdegrees.

Embedding into the calculus The syntax of plain processes is now extended with the construction

x 1 , • • • , x n ← Γ(b 1 , • • • , b m
).P where Γ : B m → B n is a circuit, x 1 , . . . , x n variables and b 1 , • • • , b m terms. We fix two distinct terms 0, 1 ∈ F 0 to model B within the calculus, and the labelled operational semantics is extended with the rule:

(P ∪ { { x ← Γ( b).P } }, Φ) ε - → (P ∪ { {P { x → Γ( b↓)}} }, Φ) if msg( b) and b↓⊆ B (Valuate)
Now we have to extend the definition of • (previous subsection) to handle the new operator. For simplicity we only consider the case where gates have two inputs and two outputs: handling lower arities is straightforward. If (c 1 , c 2 , g, c 3 , c 4 ) ∈ Γ, we first define:

c 1 , c 2 , g, c 3 , c 4 def = c 1 (x).c 2 (y). b,b ∈B if x = b then if y = b then (c 3 g(b, b ) | c 4 g(b, b ) )
where c 1 , c 2 , c 3 , c 4 ∈ N (assuming that different circuits in a process do not share edges). To sum it up, we simply see circuit edges as private channels and simulate the logical flow of the gate. It is then easily extended:

x ← Γ( b).P def = m k=1 c i k b k |   (c 1 ,c 2 ,g,c 3 ,c 4 )∈Γ c 1 , c 2 , g, c 3 , c 4   | c o 1 (x 1 ) . . . c on (x n ). P where (c i k ) m k=1 (resp. (c o k ) n k=1
) are the isolated input (resp. output) edges of Γ. Note that when b and b are fixed booleans, g(b, b ) denotes the boolean obtained from the truth table of g: we emphasise that g is not a function symbol of the signature F.

Remark: simplifying assumption

We assume that every input of a circuit goes through at least one gate and has at least one output. This is to avoid irrelevant side cases in proofs.

Correctness of the translation Now we dispose of an extended syntax and semantics as well as a mapping • removing the new constructors from a process. The correctness of this translation is proven in Appendix D: Proposition 6.15 (correctness of the encodings) Let ≈ + t and ≈ + l be the notions of trace equivalence and labelled bisimilarity over the extended calculus (the flag + being omitted outside of this lemma). For all extended processes A = (P, Φ), the translation A = ( P , Φ) = ({ { P | P ∈ P} }, Φ) can be computed in polynomial time, A ≈ + t A and A ≈ + l A .

Remark: stability of common fragments As the finite and pure fragments of the applied π-calculus are closed under • , sums and circuits can be safely used within any intersection of such fragments. The encoding does not use else branches either.

Reduction of SuccinctSAT to process equivalence

Consider an instance of SuccinctSAT, Γ, with m + 2 inputs and n + 1 outputs and we design F, E subterm destructor and A and B positive processes such that A ≈ t B iff A ≈ l B iff Γ ϕ is satisfiable.

Term algebra Terms are built over the following signature:

F def = 0, 1, (booleans B)
Node/2, π/2, (binary trees) h/2, (one-way binary hash)

h N /2, h B /2, Test N /1, Test B /1 (testable binary hashes)
We equip this term algebra with the rewriting system E containing the following rules modelling subtree extraction (for binary trees) and argument testing (for hashes): π(Node(x, y), 0) → x π(Node(x, y), 1) → y

Test N (h N (Node(x, y), z)) → 1 Test B (h B (0, z)) → 1 Test B (h B (1, z)) → 1
In particular E is subterm and destructor, the destructor symbols being π, Test N and Test B . We will also use a shortcut for recursive subtree extraction: if is a finite sequence of first-order terms, the notation t | is inductively defined by:

t |ε def = t t |b• def = π(t, b) |
Core of the reduction Let us give the intuition behind the construction before diving into the formalism. Recall that we are studying a formula in CNF Γ ϕ with 2 n variables and 2 m clauses. In particular, given a valuation of its 2 n variables, we can verify in non-deterministic polynomial time in n, m that it falsifies Γ ϕ : 1 guess an integer i ∈ 0, 2 m -1 as a sequence of m bits; 2 obtain the three literals of the i th clause of Γ ϕ (requiring three runs of the circuit Γ) and verify that the valuation falsifies the disjunction of the three literals. This non-deterministic verification is the essence our reduction. In the actual processes: 1 a process CheckTree(x) checks that x is a correct encoding of a valuation, that is, that x is a complete binary tree of height n whose leaves are booleans; 2 a process CheckSat(x) implements the points 1. and 2. above.

All of this is then formulated as equivalence properties within A and B (see the intermediary lemmas in the next paragraph for details). Intuitively, we want to express the following statement by equivalence properties: "for all term x, either x is not an encoding of a valuation or falsifies a clause of Γ ϕ ". A schematised definition is proposed in Figure 6.2.

Remark: reduction for equivalence by session

The construction for equivalence by session is more technical due to the requirement that equivalent processes share the same structure. We focus in this section on the cases of trace equivalence and labelled bisimilarity, and refer to Appendix E for equivalence by session.

+ CheckSat(x) CheckTree(x) c h(0, s) c h(1, s) CheckSat(x) Choose(p 1 , . . . , p m ) b 1 , 1 ← Γ( p, 0, 1) b 2 , 2 ← Γ( p, 1, 0) b 3 , 3 ← Γ( p, 1, 1) v ←   b 1 = x | 1 ∨ b 2 = x | 2 ∨ b 3 = x | 3   c h(v, s) c h(1, s) CheckTree(x) + n-1 i=0
Choose(p 1 , . . . , p i ) Formal construction Let us now define the processes depicted in Figure 6.2 properly; note that all the proofs about the correctness of this construction are relegated to Appendix D but we still state several intermediary lemmas in order to highlight the proof structure. But first of all, let us give a name to a frame which is at the core of our reduction:

c h N (x | p , s) c h(1, s) Choose(p 1 , . . . , p n ) c h B (x | p , s) c h(1, s)
Φ 0 = {ax 1 → h(0, s), ax 2 → h(1, s)}
Φ 0 is reached after executing the central branch of B and everything is about knowing under which conditions a frame statically equivalent to Φ 0 can be reached in A. Let us define the processes themselves now. We fix s ∈ N and define, if x is a protocol term:

CheckTree(x) def = n-1 i=0 Choose(p 1 , . . . , p i ). c h N (x |p 1 •••p i , s) . c h(1, s) + Choose(p 1 , . . . , p n ). c h B (x |p 1 •••pn , s) . c h(1, s)
Proposition 6.16 (correctness of the tree checker) Let x be a message which is not a complete binary tree of height n with boolean leaves. Then there exists a reduction CheckTree(x) ε = ⇒ ({ {P } }, ∅) such that P ≈ l c h(0, s) . c h(1, s) . Now let us move on to CheckSat(x). This process binds a lot of variables: 1 p = p 1 , . . . , p m models the non-deterministic choice of a clause number in 0, 2 m -1 ; 2 b i , i , i ∈ 1, 3 , where i is a sequence of n variables, model the literals of the clause chosen above (b i is the negation bit and i the identifier of the variable); 3 v stores whether the chosen clause is satisfied by the valuation modelled by x.

CheckSat(x) def = Choose( p). b 1 , 1 ← Γ( p, 0, 1). b 2 , 2 ← Γ( p, 1, 0). b 3 , 3 ← Γ( p, 1, 1). v ← (b 1 = x | 1 ∨ b 2 = x | 2 ∨ b 3 = x | 3 ). c h(v, s) .c h(1, s)
Proposition 6.17 (correctness of the sat checker)

Let x be a complete binary tree of height n whose leaves are booleans, and val x be the valuation mapping the variable number i of Γ ϕ to x |p 1 •••pn ∈ B where p 1 • • • p n is the binary representation of i (i.e., i = n k=1 p k 2 k-1 ). If val x does not satisfy Γ ϕ then there exists

CheckSat(x) ε = ⇒ P such that P ≈ l c h(0, s) . c h(1, s) .
We can finally wrap up everything by defining A and B and stating the last part of the correctness theorem. We recall that all the proofs can be found in Appendix D.

Γ ϕ is satisfiable iff A ≈ t B iff A ≈ l B.
As a conclusion we obtain the coNEXP hardness of the three equivalence properties for constructor-destructor subterm convergent theories. This is stated by the theorem below, which additionally puts an emphasis on the fact that the theory used in our reduction is constant, that is, it does not depend on Γ.

Theorem 6.19 (hardness of equivalences)

There exists a fixed constructor-destructor subterm convergent theory E such that the decision problems E-TraceEquiv, E-SessEquiv and E-Bisimilarity are coNEXP hard for bounded positive processes.

As mentioned earlier, the more involved construction for equivalence by session is provided in Appendix E. However a generic P completeness result would not make sense in the context of a fixed theory, since choosing one theory or another may influence the effective complexity of the problem. This is typically illustrated by the following result: Theorem 7.2 (static equivalence in the pure fragment)

In the pure pi-calculus (i.e., with the empty theory) StatEquiv is in LOGSPACE.

Proof. In the pure π-calculus, two frames Φ and Φ of same domain can only contain constants and names. Hence since F = ∅ static equivalence can be characterised as follows:

Φ ∼ Φ iff dom(Φ) = dom(Φ ) ∧ ξ,ξ ∈T ξΦ = ξ Φ ⇔ ξΦ = ξ Φ
where T = dom(Φ)∪img(Φ, Φ ). This characterisation is easily implementable by a quadratic procedure storing a finite number of counters only, each of which being bounded by the size of T which is linear in the size of the problem and whose binary representation is of logarithmic size. In particular, note that there is no need for T to be computed and stored (since it can be read on-the-fly directly on the input) and analogously, testing an equality ξΦ = ξ Φ does not require additional storage space. We therefore obtain the expected LOGSPACE bound.

Despite the potential variations of complexity when considering very simple theories as above, we can show that the P bound is optimal in the following sense in the context of cryptographic protocols: Theorem 7.3 (hardness of static equivalence for fixed theories) For all fixed theories E containing symmetric encryption, E-StatEquiv is P hard.

Proof sketch. We proceed by reduction from HornSAT. Let X be the set of variables of a Horn formula ϕ = C 1 ∧ . . . ∧ C n , and k x be names for all x ∈ X ∪ {⊥}. Then to each clause C i = x 1 , . . . , x n ⇒ x, x ∈ X ∪ {⊥} we associate the term

t C i = senc(. . . senc(senc(k x , k x 1 ), k x 2 ), . . . , k xn ) .
Putting k x under several layers of encryption ensures that k x is deducible if all the keys k x 1 , . . . , k xn are deducible as well. In particular k ⊥ is deducible from the terms t C 1 , . . . , t Cn iff the formula ϕ is unsatisfiable. Then if 0, 1 ∈ F 0 and Φ = {ax 1 → t C 1 , . . . , ax n → t Cn }, the following two frames are statically equivalent iff ϕ is satisfiable:

Φ ∪ {ax → senc(0, k ⊥ )} Φ ∪ {ax → senc(1, k ⊥ )}
However automated tools have improved since then and some provers like Kiss [CDK12], Yapa [START_REF] Baudet | YAPA: A generic tool for computing intruder knowledge[END_REF] or Fast [START_REF] Conchinha | Fast: an efficient decision procedure for deduction and static equivalence[END_REF] are able to handle user-defined theories. It is therefore interesting today to account for the size of the theory in the complexity analysis. When not considering the theory as a constant of the problem the complexity is upgraded as follows:

Theorem 7.4 (static equivalence for subterm convergent theories)

StatEquiv is coNP complete for subterm convergent theories.

Proof sketch. The results of [START_REF] Abadi | Deciding knowledge in security protocols under equational theories[END_REF] cited for Theorem 7.1 actually justify that StatEquiv is coNP. More precisely they imply that whenever Φ ∼ Ψ for a subterm convergent theory, there exist two recipes ξ, ζ such that |ξ, ζ| dag is polynomial in |Φ, Ψ, E| dag and ξΦ = E ζΦ and ξΨ = E ζΨ. In particular a straightforward coNP procedure consists of guessing two recipes ξ and ζ of polynomial size and verifying whether ξΦ = E ζΦ and ξΨ = E ζΨ (which can be done in polynomial time in |Φ, Ψ, E| dag for subterm convergent theories).

We now prove that non-equivalence is NP hard by reduction from SAT. We let ϕ a SAT formula and construct a theory E and two frames Φ, Ψ such that Φ ∼ Ψ iff ϕ is satisfiable. For that we consider 0, 1 ∈ F 0 , k ∈ N , f /2, g/2 ∈ F c and the two frames

Φ = {ax 0 → f (0, k), ax 1 → f (1, k)} Ψ = {ax 0 → g(0, k), ax 1 → g(1, k)}
Interpreting 0 and 1 as the booleans false and true, Φ and Ψ intuitively point to terms that can be seen as booleans but that can only be accessed by reference through the axioms ax 0 , ax 1 . For example, since k is a name the only recipes permitting to deduce f (0, k) will use ax 0 in Φ. Given the variables x 1 , . . . , x n of ϕ we then add another symbol eval/n ∈ F d and rewrite rules so that the following points are equivalent for all valuations v : {x 1 , . . . , x n } → B of ϕ: 1 v falsifies ϕ, 2 eval(g(v(x 1 ), k), . . . , g(v(x n ), k)) → 0. Such a theory can be defined by the p rewrite rules: eval(g(t i 1 , y), . . . , g(t i n , y)) → 0 where 1 i p and if C i is the i th clause of ϕ:

t i j =    x j if x j does not appear in C i 0 if x j appears positively in C i 1 if x j appears negatively in C i
Note that this definition assumes that no clause of ϕ contains both a litteral and its negation. Such clauses are tautological and can be removed by a preprocessing step in LOGSPACE, inducing no loss of generality. Then if we add the rewrite rule eval(f(x 1 , y), . . . , f(x n , y)) → 0 we obtain that ϕ is satisfiable iff Φ ∼ Ψ (proof formalised in Appendix E).

Beyond subterm convergence

As rewriting is Turing complete, unsurprisingly static equivalence is undecidable in general for convergent rewriting systems [START_REF] Abadi | Deciding knowledge in security protocols under equational theories[END_REF]. It is also proved in [START_REF] Abadi | Deciding knowledge in security protocols under equational theories[END_REF] that Deducibility reduces to StatEquiv. As a consequence, the results of [START_REF] Siva Anantharaman | Intruders with caps[END_REF] imply that static equivalence is also undecidable for so-called optimally-reducing rewrite systems, a subclass of rewrite systems that have the finite-variant property [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocols[END_REF].

Some complexity results also exist outside of subterm theories. We can for example mention the decidability in polynomial time of monoidal theories [START_REF] Cortier | Deciding knowledge in security protocols for monoidal equational theories[END_REF], combination of disjoint theories where static equivalence is decidable [START_REF] Cortier | Decidability and combination results for two notions of knowledge in security protocols[END_REF], or group theories [START_REF] Delaune | Security protocols, constraint systems, and group theories[END_REF]. It is also proved in [START_REF] Ciobâcă | Computing knowledge in security protocols under convergent equational theories[END_REF] that static equivalence was in P for theories modelling blind signatures, trapdoor commitment schemes and malleable encryption.

Complexity of dynamic equivalences

Section summary

We survey or prove some complexity results for trace equivalence and labelled bisimilarity in addition of the coNEXP completeness result of Chapter 6. We cover the case of the pure picalculus in the bounded fragment for the sake of completeness, and then study various classes of unbounded processes.

Classical fragments of the calculus

In addition to the assumptions on the theory (e.g., subterm convergence), there are several common restrictions made on the processes to obtain decidability.

Conditionals and patterns

We first present some classes of processes defined by restrictions on the conditionals. The first one excludes negative tests [Bau07, CCD13, CKR18a]: Definition 7.1 (positive fragment)

For succinctness we often write [u = v] P instead of if u = v then P else 0. We say that a process is positive if all of its conditionals have trivial else branches like this one.

Another common retriction consists of only allowing tests that are performed by patterns on input variables: Definition 7.2 (patterned fragment)

We say that a process is patterned if it contains no conditionals but may use the patternedinputs syntax extension (as defined in Chapter 1, Section 2.3).

We recall that a condition for using a pattern is that it can be simulated by conditionals without else branches, in particular the patterned fragment is a subset of the positive fragment.

Ping pong protocols These protocols [CCD15b, DY81, HS03] consist of an unbounded number of parallel processes receiving one message and sending a reply. Although the precise formalisms may differ from one work to another, the mechanisms at stake are essentially captured by processes P = ! P 1 | • • • | ! P n where each P i can be written under the form

P i = c i (x). [u i 1 = v i 1 ] • • • [u i n i = v i n i ]new k 1 • • • new k r i . c i w i
In particular ping-pong protocols are positive.

Simple processes A common middleground in terms of expressivity and decidability is the class of simple processes, for example studied in [START_REF] Cheval | Deciding equivalence-based properties using constraint solving[END_REF][START_REF] Chrétien | Decidability of trace equivalence for protocols with nonces[END_REF]. Intuitively, they consist of a sequence of parallel processes that operate each on a distinct, public channel-including replicated processes that generate dynamically a fresh channel for each copy. Formally they are of the form

P 1 | • • • | P m | ! ch P m+1 | • • • | ! ch P n
with ! ch P = ! new c P . c P c P . P

where each P i does not contain parallel operators nor replications and uses a unique, distinct communication channel c P i , and

! ch P = ! new c P . c P c P . P .
Unlike ping pong protocols, each parallel process may input several messages and output messages that depend on several previous inputs. Determinate process (as defined in Chapter 5, see more discussions on this later in this chapter) are a generalisation of simple processes.

Complexity results: bounded fragment

The bounded fragment is a common restriction to study decidability, as removing replication bounds the length of traces. However, as the attacker still has an unbounded number of possibilities for generating inputs, the transition system still has infinite branching in general.

Besides additional restrictions are necessary on the cryptographic primitives (at least because static equivalence is undecidable in general). Typically we mention once again the main result of Chapter 6: Theorem 6.1 (complexity of equivalences)

The decision problems TraceEquiv, Bisimilarity and SessEquiv are coNEXP complete for bounded processes and constructor-destructor subterm convergent theories.

We recall that the decision procedures use a dedicated constraint solving approach to show that, whenever equivalence is violated, there exists a non-equivalence witness of exponential DAG size, thus proving non-equivalence to be decidable in NEXP. As before, we may also study the problem for fixed theories to investigate their influence on the complexity. Typically with the empty theory: Theorem 7.5 (equivalences in the pure pi calculus)

In the pure pi-calculus, Bisimilarity (resp. TraceEquiv and SessEquiv) is PSPACE complete (resp. Π 2 complete) for bounded processes, and for bounded positive processes.

Although the PSPACE and Π 2 upper bounds follow from the definitions in a rather straightforward manner (see the definition of the polynomial hierarchy in Chapter 1), the corresponding complexity lower bounds rely on a non-trivial reduction to QBF 2 and QBF that we detail in Appendix E. However, unlike static equivalence, fixing the theory does not make it possible to obtain a better bound than the general one for all theories due to the reduction presented in Chapter 6, Section 4:

Theorem 6.19 (hardness of equivalences)

There exists a fixed constructor-destructor subterm convergent theory E such that the decision problems E-TraceEquiv, E-SessEquiv and E-Bisimilarity are coNEXP hard for bounded positive processes.

The reduction indeed relied on a fixed theory which, we recall, modelled some forms of binary trees and testable functions. Actually we also prove in Appendix E that, provided we discard the positivity requirement, it is possible to manage the proof with a theory limited to symmetric encryption and pairs. This shows that the problem remains theoretically hard even with a minimal theory. Besides, in the case of trace equivalence and equivalence by session, the reduction can be done without private channels (whereas the reduction of Chapter 6 heavily relies on private communications, which may give the false intuition that they are the cause of the high complexity).

Complexity results: unbounded fragment

Equivalence is undecidable in general since the calculus is Turing complete even for simple theories. For example, Hüttel [START_REF] Hüttel | Deciding framed bisimilarity[END_REF] shows that Minsky's two counter machines can be simulated within the spi-calculus (and hence the applied pi-calculus with symmetric encryption only). It is not difficult to adapt the proof to a simulation using only a free symbol, i.e., a function symbol h of positive arity and an empty rewrite system. These two encodings can be performed within the finite-control fragment, typically not Turing complete in the pure pi-calculus (i.e., without this free function symbol) [START_REF] Dam | On the decidability of process equivalences for the π-calculus[END_REF].

For ping pong protocols While equivalence is undecidable for ping-pong protocols [CCD15b, HS03] some decidability results exist under additional assumptions. For example [START_REF] Hüttel | Recursive ping-pong protocols[END_REF] studies a problem that can be described in our model essentially as Bisimilarity for ping-pong protocols with 2 participants or less (namely n 2 with the notations of the definition). This is proved decidable under some model-specific assumptions that we do not detail here. We also mention a result for patterned ping-pong protocols (cf Section 2.1) without a limit on the number of participants [START_REF] Chrétien | From security protocols to pushdown automata[END_REF].

Definition 7.3 (deterministic ping-pong protocol)

Given a constructor-destructor theory, a ping-pong protocol P is deterministic when each P i (using the same notations as the definition) can be written under the form

P i = c i (u i ). new k 1 • • • new k r i .c i v i
with c i a constant and u 1 , . . . , u n a family of patterns verifying the following properties: 1 binding uniqueness: for all i, u i does not contain two different variables; 2 pattern determinism: for all i = j, if u i and u j are unifiable then c i = c j .

In [START_REF] Chrétien | From security protocols to pushdown automata[END_REF] there is an additional, technical syntactic restriction on the structures of u i and v i that is specific to the fixed theory considered in [START_REF] Chrétien | From security protocols to pushdown automata[END_REF] for randomised symmetric and asymmetric encryption and digital signature. Intuitively the terms u i and v i are defined by grammars essentially imposing that the encryption randomness (resp. keys) they contain are indeed fresh nonces (resp. long-term keys), that is, they are names among k 1 , . . . , k r i (resp. are of the form k or pk(k) for some name k / ∈ {k 1 , . . . , k r i }). We refer to [START_REF] Chrétien | From security protocols to pushdown automata[END_REF] for details about this last assumption.

Theorem 7.6 (trace equivalence for deterministic pin-pong protocols [START_REF] Chrétien | From security protocols to pushdown automata[END_REF])

For a theory limited to randomised symmetric and asymmetric encryption as well as digital signature, TraceEquiv is PRIMREC for deterministic ping-pong protocols.

Decidability is obtained by a reduction of the problem to the language equivalence of deterministic pushdown automata, which is decidable in primitive recursive time. A complexity lower bound for this problem is open (beyond the P hardness trivially inherited from static equivalence, recall Theorem 7.3).

For simple processes We now study a decidability result for patterned simple processes [START_REF] Chrétien | Decidability of trace equivalence for protocols with nonces[END_REF]. In this work the theory is limited to symmetric encryption and pairs, and the processes must be type compliant and acyclic. These notions are rather technical and we only formalise them in Appendix E in the vocabulary of our model, but give an intuition of their meaning here. Type compliance relies on a type system to ensure that, whenever two (subterms of) terms u, v appearing in the process are unifiable then they can only be instantiated by terms of the same structure during a process execution. Then acyclicity is a property of the dependency graph of the process. The vertices of this graph are the instructions of the process. There is an edge a → a when it may be necessary to execute a before a to perform some attacker actions.

Example 7.1 There are three kind of edges in a dependency graph. Sequential dependency is for actions following each other, for example in β.α.P there is an edge α → β. Pattern and deduction dependencies are for actions that allow the attacker to produce a term of a given pattern or deduce a subterm of an output message, respectively. For example in α.

P | β.Q | γ.R with α = c senc(u, k) β = d(senc(x, k)) γ = e k
there is an edge β → α because the term senc(u, k) could be used as an input term for the pattern senc(x, k). Also γ → α because the term k output in γ can be used to deduce u from senc(u, k) in α. Similarly note that there is a cyclic dependency in

! ch β.α with α = c senc(u, k) β = c(senc(x, k)) .
We have α → β by sequential dependency, but also β → α by pattern dependency across the different copies of β.α.

There is also a restriction to atomic keys, i.e. for all encryptions senc(u, v) appearing in the process, v ∈ F 0 ∪ N ∪ X . This restriction is also applied to attacker's recipes in the semantics by strenghtening the msg predicate (which therefore also impacts the definition of static equivalence).

Theorem 7.7 (trace equivalence for type-compliant acyclic processes [START_REF] Chrétien | Decidability of trace equivalence for protocols with nonces[END_REF])

For a theory limited to pairs and symmetric encryption, TraceEquiv is coNEXP for patterned, simple, type-compliant, acyclic processes with atomic keys.

Proof. Given a trace we consider its so-called execution graph: its vertices are the actions of the trace and its edges mirror those of the dependency graph of the process. It is proved in [START_REF] Chrétien | Decidability of trace equivalence for protocols with nonces[END_REF] that when two patterned, simple, type-compliant, acyclic processes P and Q are not trace equivalent, there exists an attack trace, say, in P , whose execution graph D has these properties: 1 D is acyclic and depth(D) (max length of a path of D) is polynomial in the size of P . 2 width(D) (maximal number of outgoing edges from a vertex of D) is exponential in the size of P and of the type system. 3 nbroots(D) (number of vertices of D that have no ingoing edges) is exponential in the size of P and of the type system. From each root of D, the number of reachable vertices is at most the size of a tree of width width(D) and of depth depth(D), i.e. width(D) depth(D)+1 -1. Hence the number of vertices of D is bounded by nbroots(D) • width(D) depth(D)+1 which is exponential in the size of P . Since the number of vertices of D is an upper bound on the number of sessions needed to execute the underlying trace, it suffices to prove the equivalence of P and Q for an exponential number number of sessions. This leads to an overall coNEXP procedure since trace equivalence of bounded, positive, simple processes is coNP for subterm theories (see the combination of Theorem 7.17 and Proposition 7.19 later in Section 4). Note that complexity was not the focus of [START_REF] Chrétien | Decidability of trace equivalence for protocols with nonces[END_REF] and the authors only claimed a triple exponential complexity for their procedure, hence the contribution of the above complexity analysis. Moreover no lower bounds were investigated but we prove that the problem is actually coNEXP complete.

Theorem 7.8 (hardness of trace equivalence for type-compliant acyclic processes)

For the theory of pairs and symmetric encryption, TraceEquiv is coNEXP hard for patterned, simple, type-compliant, acyclic processes with atomic keys.

The reduction shares some similarities with the proof of coNEXP hardness for trace equivalence of bounded processes (see Theorem 6.19), compensating the more deterministic structure of simple processes by the use of replication. We give below an intuition of our construction, detailed in Appendix E.

Proof sketch. We proceed by reduction from SuccinctSAT. Let ϕ be a formula with 2 m clauses and 2 n variables x 0 , . . . , x 2 n -1 and Γ be a circuit encoding this formula. We construct two simple, type-compliant, acyclic processes that are trace equivalent iff ϕ is unsatisfiable. Using pairs u, v we encode binary trees: a leaf is a non-pair value and, if u and v encode binary trees, u, v encodes the tree whose root has u and v as children. Given a term t, we build a process P (t) behaving as follows:

1 P (t) first waits for an input x from the attacker. This term x is expected to be a binary tree of depth n with boolean leaves, modelling a valuation of ϕ (the i th leaf of x being the valuation of x i ). 2 The goal is to make P (t) verify that this valuation satisfies ϕ; if the verification succeeds the process outputs t. Given two constants 0 and 1, P (0) and P (1) will thus be trace equivalent iff ϕ is unsatisfiable. 3 However it is not possible to inline, within a process of polynomial size, the verification that the valuation encoded by x satisfies the 2 m clauses of ϕ. Hence we replicate a process that, given x, verifies one clause at a time. Intuitively, the attacker will guide the verification of the 2 m clauses of ϕ and, when the i th clause is successfully verified, the process reveals the binary representation of i (encrypted using a key unknown to the attacker). [START_REF]Vincent Cheval est le contributeur majoritaire de cette implémentation[END_REF] In particular, the attacker obtains the encryption of all integers i ∈ 0, 2 m -1 only after successfully verifying that the initial input x effectively encodes a valuation satisfying all clauses of ϕ. It then suffices to design a process that outputs t if the attacker is able to provide all such ciphertexts. This can be encoded by a replicated process that, upon receiving the encryption of two integers that differ only by their least significant bit, reveals the encryption of these integers with the least significant bit truncated. The verification ends when revealing the encryption of the empty binary representation.

Complexity of constraint solving

Section summary

The decision of equivalence properties has often been reduced to forms of constraint solving as in Chapter 3. We formalise and study the complexity of such problems which will be at the core of our last complexity results for equivalence properties.

Constraint solving

Although the models we survey differ in their technical definition, their proof techniques often share a similar core. In the bounded fragment for example it is common to abstract the infinitely-branching transition relation by symbolic constraints as in Chapter 3 or [START_REF] Baudet | Sécurité des protocoles cryptographiques: aspects logiques et calculatoires[END_REF][START_REF] Cheval | Deciding equivalence-based properties using constraint solving[END_REF]. We recall that in our model, a constraint system is a triple C = (Φ, D, E 1 ) where Φ is a frame, D is a conjunction of constraints indicating which terms should be deducible or not, and E 1 expresses the relations between the protocol messages. This approach reduces reachability or equivalence properties to the study of equivalences to various flavours of constraint-solving problems; in our decision procedure for trace equivalence and labelled bisimilarity for example, the role of the constraint solver was to refine a set of constraint systems to group those with statically-equivalent solutions. We did not study the precise complexity of this problem, but we survey in the rest of this section some decidability and complexity results for simpler constraint-solving problems (satisfiability and equivalence).

Decision problem -CSysSAT

Input: a theory E, a constraint system C Question: Is Sol (C) empty w.r.t. E? More generally, the Weak Secrecy problem can be decided in non-deterministic polynomial time with oracle to CSysSAT, intuitively as follows: 1 guess non-deterministically one symbolic execution of P (which is of polynomial size) and collect the corresponding constraints into a constraint system C = (Φ, D, E 1 ) 2 answer yes Sol (Φ, D ∧ X ? x, E 1 ∧ x = ? t) = ∅, with X: n, x fresh and n = |dom(Φ)|.

Regarding equivalence properties, as recalled above, the situation is more complex if we want to handle trace equivalence or labelled bisimilarity of arbitrary processes as in Chapter 4. However a simpler variant has been considered for deciding equivalence properties in more restrictive settings [START_REF] Baudet | Sécurité des protocoles cryptographiques: aspects logiques et calculatoires[END_REF][START_REF] Cheval | Deciding equivalence-based properties using constraint solving[END_REF]: This problem is called S-equivalence in [START_REF] Baudet | Sécurité des protocoles cryptographiques: aspects logiques et calculatoires[END_REF]. Note that this can be seen as a generalisation of the StatEquiv problem which can be retrieved with

Decision problem -CSysEquiv Input: A theory, two constraint systems (Φ i , D i , E 1 i ), i ∈ {1, 2}, with dom(Φ 1 ) = dom(Φ 2 ) Question: Do the constraint systems (Φ i , D i ∧ ϕ, E 1 i ∧ x = ? y)
D 1 = D 2 = E 1 1 = E 1 2 = .

Complexity

We now present some decidability and complexity results for CSysSAT and CSysEquiv; they will be at the core of the results presented in the next sections. These two problems have been studied in majority in [START_REF] Baudet | Sécurité des protocoles cryptographiques: aspects logiques et calculatoires[END_REF] for the decidability of reachability properties and diff equivalence, in the case of fixed subterm theories in the positive fragment.

Proposition 7.9 (constraint solving for fixed subterm convergent theories [START_REF] Baudet | Sécurité des protocoles cryptographiques: aspects logiques et calculatoires[END_REF])

For all fixed subterm convergent theories, CSysSAT (resp. CSysEquiv) is NP (resp. coNP for positive constraint systems).

As far as we know the complexity of this problem has only been studied for fixed theories. However the result of [START_REF] Baudet | Sécurité des protocoles cryptographiques: aspects logiques et calculatoires[END_REF] above can be adapted to parametric theories; inspecting the proof we observe that 1 in the complexity bounds, the dependencies in the theory are polynomial and 2 the proof uses the fact that static equivalence is P for fixed theories (Theorem 7.1) but the arguments still hold if we only assume static equivalence to be coNP. Since it has also been proved in [START_REF] Baudet | Sécurité des protocoles cryptographiques: aspects logiques et calculatoires[END_REF] that CSysSAT was NP hard if the theory includes at least a free binary function symbol, we obtain the more general complexity result: Theorem 7.10 (constraint solving for subterm convergent theories) CSysSAT (resp. CSysEquiv) is NP complete (resp. coNP complete) for subterm convergent theories and positive constraint systems. Moreover CSysSAT is also NP complete without the positivity assumption.

Regarding the complexity lower bounds for fixed theories, similarly to the problems we surveyed in the previous sections, the complexity may vary from one theory to the other: Proof. It suffices to prove that CSysEquiv is LOGSPACE. We let two constraint systems C 1 and C 2 such that dom(Φ 1 ) = dom(Φ 2 ) = {ax 1 , . . . , ax p } and vars 2 (C 1 ) = vars 2 (C 2 ) = {X 1 , . . . , X n }. In the pure fragment there are finitely-many second-order substitutions Σ for C 1 and C 2 up to bijective renaming of fresh constants (which does not affect whether Σ is a solution of C 1 or C 2 ). Indeed for all i ∈ 1, n , the recipe X i Σ is either 1 a constant appearing either in Φ 1 , Φ 2 , in an equation of S 1 or S 2 or in some X j Σ, j < i 2 a fresh constant (i.e., a constant not captured by the previous case) 3 an axiom ax j such that j < arity(X i ). Given a second-order substitution Σ, we can verify that it is a solution of C 1 and C 2 in LOGSPACE since the constraint systems only contain equations and disequations between constants, names and variables. The problem can thus be solved in LOGSPACE by bruteforce, using three nested loops: 1 the first two loops are of size in n and p and are used to enumerate all second-order substitutions Σ up to bijective renaming of fresh constants 2 the third loop of size polynomially-bounded by

|C 1 | + |C 2 | verifying that Σ is a solution of C 1 iff it is a solution of C 2 .
Since CSysEquiv is a generalisation of StatEquiv it can also be interesting to compare their complexity. Regarding fixed theories, StatEquiv is P (Theorem 7.1) and this is optimal in the sense that the problem is P hard for all theories containing symmetric encryption (Theorem 7.3). The coNP bound is also optimal for CSysEquiv in the same sense: Theorem 7.12 (hardness of constraint solving for fixed theories) For all theories E containing symmetric encryption, CSysSAT (resp. CSysEquiv) is NP hard (resp. coNP hard) for positive constraint systems.

Proof. It suffices to prove that CSysSAT is NP hard. By reduction from SAT we let ϕ = p i=1 C i a SAT formula with variables x 1 , . . . , x n . Given a family of distinct names k 1 , . . . , k n , we first consider the following frame with n free variables

Φ val = {ax 1 → senc(x 1 , k 1 ), . . . , ax n → senc(x n , k n )} . Given a clause C of ϕ, we let x i 1 , x i 2 , x i 3 its variables, b i 1 , b i 2 , b i 3 its negation
bits, and a fresh name k c . We define a frame Φ c such that, for all valuations σ of x 1 , . . . , x n , the name k c is deducible from Φ val σ ∪ Φ c iff σ satisfies C (i.e. iff there exists j ∈ 1, 3 such that x i j σ = b i j ):

Φ c =    ax c 1 → senc(k c , senc(b i 1 , k i 1 )) ax c 2 → senc(k c , senc(b i 2 , k i 2 )) ax c 3 → senc(k c , senc(b i 3 , k i 3 ))   
All in all the following constraint system (Φ, D, E 1 ) is satisfiable iff ϕ is satisfiable, with:

Φ = Φ val ∪ Φ c 1 ∪ • • • ∪ Φ cp D = n i=1 X i ? x 1 ∧ p j=1 Y i ? y 1 E 1 = p i=1 y j = ? k c j
with X 1 : 0, . . . , X 1 : 0, Y 1 : n, . . . , Y p : n, y 1 , . . . , y p fresh.

The complexity of the general problem (that is, with disequations) is open. However it is easily seen less general than trace equivalence and thus inherits its complexity upper bounds. Proposition 7.13 (reduction of constraint solving to trace equivalence)

CSysEquiv is logspace-reducible to TraceEquiv of bounded processes with the same theory.

Proof. Consider a constraint system C = (Φ, D, E 1 ) with Φ = {ax 1 → t 1 , . . . , ax n → t n } and

D = {X 1 ? x 1 , . . . , X p ? x p } E 1 = {u 1 ∼ 1 v 1 , . . . , u q ∼ q v q }
where for all i ∈ 1, q , ∼ i ∈ {= ? , = ? E }. Assuming that the second-order variables X i are sorted by increasing arity, we let

1 = i 0 i 1 • • • i n i n+1 = p + 1 the sequence of integers such that arity(X i ) = iff i i < i +1 .
We then let c be a constant and define the following process given another process R:

P (C, R) = c(x i 0 ). • • • c(x i 1 -1 ). c t 1 .c(x i 1 ). • • • c(x i 2 -1 ). . . . c t n .c(x in ). • • • c(x i n+1 -1 ). [u 1 ∼ 1 v 1 ] • • • [u q ∼ q v q ] R
where [u ∼ v]P is a shortcut for either "if u = v then P else 0" (when ∼ is = ? ) or "if u = v then 0 else P " (when ∼ is = ? E ). The process P (C, R) is well-defined (i.e. does not contain variables that are not bound by a prior input) if C verifies the origination property. In P (C, R), the subprocess R can be executed iff x 1 , . . . , x n are instanciated by recipes that define a solution of C. In particular given a constant d and two constraint systems C 0 , C 1 verifying the hypotheses of the problem CSysEquiv, C 0 and C 1 are equivalent iff for all traces t of P (C i , d d ) containing an output on d, i ∈ {0, 1}, there exists a trace t of P (C 1-i , d d ) such that t ∼ t . In particular C 0 and C 1 are equivalent iff

P (C 0 , d d ) ⊕ P (C 1 , 0) and P (C 0 , 0) ⊕ P (C 1 , d d )
are trace equivalent where, for k, k ∈ N and e ∈ F 0 fresh:

A ⊕ B = e k | e k | e(x). ( [x = k] A | [x = k ] B )
Theorem 7.14 (constraint equivalence for subterm convergent theories)

CSysEquiv is decidable in coNEXP for subterm convergent constructor-destructor theories.

Diff equivalence and determinacy

Section summary

In this section we survey complexity results that can be derived from the results about constraint solving detailed in the previous section. The new results are mostly applicable to diff equivalence and equivalence of determinate processes.

Diff equivalence

Although undecidable in general, diff equivalence can be decided in the bounded positive fragment by using a reduction to CSysEquiv [Bau07]:

Proposition 7.15 (reduction of diff equivalence to constraint solving [Bau07])

In the bounded (resp. bounded positive) fragment, given a non-deterministic algorithm A for non-CSysEquiv (resp. for non-CSysEquiv of positive constraint systems), non-DiffEquiv is NP, where a call to A is seen as an elementary instruction.

Proof sketch. The decision procedure of [START_REF] Baudet | Sécurité des protocoles cryptographiques: aspects logiques et calculatoires[END_REF] for non equivalence consists of 1 guessing a symbolic trace t, 2 consider the unique (if it exists) candidate equivalent trace t in the other process, and 3 conclude that the processes are not diff-equivalent if the constraint systems corresponding to t and t are not equivalent. In the case of the positive fragment, an additional argument is required to prove that it is not necessary to consider symbolic traces that produce disequation constraints.

In particular when composing this with the different complexity results for CSysEquiv mentioned in Section 3.2: Theorem 7.16 (diff equivalence of bounded processes)

DiffEquiv is 1 coNEXP for bounded processes and constructor-destructor subterm convergent theories, 2 coNP for bounded positive processes and subterm convergent theories.

The problem is also known coNP hard even in the positive fragment for a theory containing only a free binary symbol h [START_REF] Baudet | Sécurité des protocoles cryptographiques: aspects logiques et calculatoires[END_REF]. However a simple proof justifies that DiffEquiv is actually coNP hard even for the empty theory and, hence, for any fixed theory: Theorem 7.17 (diff equivalence in the pure fragment)

In the pure pi-calculus, DiffEquiv is coNP complete for positive bounded processes.

Proof. By reduction from SAT let a formula ϕ = m i=1 C i in CNF and x = x 1 , . . . , x n its variables. For each clause C i , let k i be a fresh name and define

CheckSat i ( x) = [x i 1 = b i 1 ]c k i | • • • | [x ip = b ip ]c k i
where x i 1 , . . . , x ip are the variables of C i and b i 1 , . . . , b ip their negation bits. That is, at least one output of k i is reachable in CheckSat

i ( x) if x is a valuation of ϕ that satisfies C i . If CheckSat = c(x 1 ). . . . c(x n ).(CheckSat 1 ( x) | • • • | CheckSat m ( x)) Final (t) = c(y 1 ).[y 1 = k 1 ] . . . c(y m ).[y m = k m ] c t then for 0, 1 ∈ F 0 , CheckSat | Final (0) ≈ d CheckSat | Final (1) iff ϕ is unsatisfiable.
In particular this gives the exact complexity of DiffEquiv in the bounded positive fragment. As far as we know the question remains open without the positivity assumption.

Corollary 7.18 (diff equivalence of bounded processes, fixed and parametric theories) DiffEquiv is coNP complete for subterm convergent theories (fixed or not) and bounded positive processes.

The case of determinacy

Definition(s) We now focus on determinate processes, already defined in Chapter 5. This class has been investigated significantly in the literature [BDH15, CCCK16, CCD13] but several variants coexist, as discussed in [START_REF] Babel | On the semantics of communications when verifying equivalence properties[END_REF]. For example we recall that the partial-order reductions for trace equivalence [START_REF] Baelde | Partial order reduction for security protocols[END_REF] mentioned in Chapters 3 and 5 are valid for actiondeterminate processes; such processes shall never reach an intermediary state where two inputs (resp. outputs) on the same communication channel are executable in parallel. On the other hand a more permissive definition is used in [START_REF] Cheval | Deciding equivalence-based properties using constraint solving[END_REF] (not detailed in this survey). There also exists a notion that is stricter than all of these, referred as strong determinacy [START_REF] Babel | On the semantics of communications when verifying equivalence properties[END_REF].

Definition 7.4 (strongly determinate process)

A process is strongly determinate when it verifies all of the following properties: 1 it does not contain private channels, 2 it is bounded, 3 all its syntactic subprocesses are strongly determinate, 4 in case the process is of the form P | Q there exist no channels c such that both P and Q contain an input (resp. output) on c.

For example this process is action-determinate but not strongly-determinate:

if a = b then c(x) else 0 | if a = b then 0 else c(x) .

Effects on equivalences

The following proposition summarises the relation between the different notions we presented so far and their implications in terms of decidability.

Proposition 7.19 (main properties of determinate and simple processes [CCD13, BCK20])

In particular Item 2 follows from the fact that, up to a reordering of parallel operators at toplevel, equivalence by session and diff-equivalence are the same decision problem for simple processes. Regarding complexity, it is shown in [START_REF] Cheval | Deciding equivalence-based properties using constraint solving[END_REF] that, for bounded simple positive processes, the equivalence problem can be reduced to CSysEquiv similarly to Theorem 7.15 for diff-equivalence. Their arguments can be generalised from simple to strongly-determinate processes in a straightforward manner; however it is not clear whether this would also be true for action-determinate processes in general or for processes with else branches. We thus obtain the same complexity as diff-equivalence for this fragment: Theorem 7.20 (reduction of equivalences to constraint solving [START_REF] Cheval | Deciding equivalence-based properties using constraint solving[END_REF])

TraceEquiv, Bisimilarity and SessEquiv are coNP-complete for subterm convergent theories and positive strongly-determinate processes. The coNP completeness also holds for all fixed subterm convergent theories.

Summary of the results

Section summary

We summarise in Table 7.1 all the complexity results that were proved, surveyed or streghtened in this chapter. We highlight in particular some remaining open problems and the impact of choosing a fixed rewrite system in the complexity analysis. For instance, for subterm-convergent constructor-destructor theories and bounded processes, DiffEquiv is known coNEXP and coNP hard, but the precise complexity remains unknown. Consistently with the results of the paper we also include some complexity results with the theory seen as a constant of the problem (denoted as "fixed" in the theory columns). The corresponding cells contain bounds applying to all theories of the class; e.g. for Bisimilarity of bounded processes, with fixed subterm-convergent constructor-destructor theories, the problem is decidable in coNEXP and PSPACE hard. Despite the gap between the two bounds, they are optimal since there exist theories for which the problem is PSPACE complete and others for which it is coNEXP complete. Therefore this cell is not highlighted. In our opinion the most interesting open questions are: 1 Can upper bounds on constructor-destructor theories be lifted to more general subterm convergent theories? 2 Without the positivity assumption, can we tighten the complexity for diff equivalence, and strongly determinate processes? This last question might allow to better understand why strongly determinate processes benefit from optimisations that improve verification performance that much. Finally, as witnessed by the contrast between the high complexity of equivalence by session and its practical efficiency, worst-case complexity may not always be an adequate measure.

General conclusion

We now conclude this thesis by a summary of our approach and results and consider some potential future work.

In this thesis we have contributed to the theory and practice of the automated verification of security protocols in symbolic models, with a focus on privacy-type properties modelled by behavioural equivalences. Our main contributions are: 1 a decision procedure for trace equivalence and labelled bisimilarity of bounded processes for constructor-destructor subterm convergent theories, implemented as the DeepSec prover that compares favorably to the similar state-of-the-art tools in terms of expressivity and performances; 2 a tight complexity analysis of the problem, proving it to be coNEXP complete, and several other complexity results integrated in a survey to give a clearer view of the theoretical limits and open problems; 3 a refinement of trace equivalence (equivalence by session) used as a powerful optimisation technique permitting to make analyses scale that were out of the scope of many state-ofthe-art automated provers in terms of expressivity of resources; 4 the application of all of our verification techniques to carefully modelled examples, illustrating the capabilities of DeepSec on real cases. We now identify some possible future work related to our contributions.

Short term There are some natural extensions of our results to be investigated. First, all aspects of the completeness of equivalence by session, that is, how to handle false attacks when they arise: when an analysis of equivalence by session concludes that two processes are not equivalent, but may be trace equivalent, it would be interesting to build up on this preliminary analysis to prove trace equivalence so that the proof does not have to be done from scratch. One would typically exploit the branches of the partition tree that have already been treated successfully, and only focus on failed branches.

Some other theoretically less demanding future work can be mentioned, such as implementing a native procedure for reachability in DeepSec (which would be a simplification of the current procedure for equivalence, using a lighter version of the partition tree) to verify natively a larger class of properties in the tool. It is proved in [START_REF] Baelde | Partial order reduction for security protocols[END_REF] that the partial order reductions developed for proving the equivalence of determinate processes can be applied to any process when proving reachability properties, suggesting a rather efficient procedure without the need to rely on techniques analogue to equivalence by session.

We can also investigate implementing a native procedure for verifying trace inclusion: currently when we want to verify P t Q we prove equivalently that P + Q ≈ t Q which however involves bigger processes. A preliminary experimental implementation suggests that the verification time can be cut by half by using a native procedure, but a theoretical and engineering effort would be needed to design a clean procedure (in particular to adapt the partial order reductions integrated to DeepSec for determinate processes to the decision of trace inclusion).

Although this may require more work due to the more complex, rather impractical, theoretical decision procedure we provided in this thesis, it may also be useful to implement a decision procedure for labelled bisimilarity of bounded processes in DeepSec in addition to the current implementation that only supports trace equivalence.

Longer term There are also several tracks to be investigated in the long run. The straightforward ones are the generalisation of the algorithm of DeepSec to larger theories that are not subterm, or remove the constructor-destructor restriction. This would require to rethink the whole data structure behind the algorithm (for example the finite knowledge base used to model the attacker knowledge heavily relies on the assumptions on the theory). This extension comes with its own set of theoretical challenges as far as complexity is concerned, as there are many open issues with its regard (typically the complexity of equivalences when removing the constructor-destructor assumption, or in some classes with else branches). Another central complexity question is whether the worst-case, asymptotic complexity is the right tool in our context: our results show for example that equivalence by session and trace equivalence have the same theoretical complexity in the context of DeepSec's framework despite the significant difference in practice performance. A finer analysis taking more parameters into account-for example relying on the notion of parametrised complexity-may be a better fit to explain the improve the understanding of the computational difference between the two equivalences.

Another interesting track would be to see to which extent is DeepSec generalisable to different types of properties. In this thesis we have defined and used the partition tree to decide equivalence properties. We also mentioned earlier in the conclusion that the same approach could be used to decide reachability properties. One may wonder whether the notion of partition tree (or a generalisation) could actually be used at the core of a decision procedure for more general relational hyperproperties. Taking inspiration from the decision procedure provided in this thesis, we could investigate whether some fragments of the HyperLTL logic could be decided using a similar approach for example.

Finally, another interesting result, directly tied to our experiments, is the investigation of reduction results for concrete protocols. Since the scope DeepSec is limited to the bounded fragment, its only way to provide complete security guarantees are theoretical results of the form "if ! P ≈ t ! Q then ! n P ≈ t ! n Q" (where n is explicit). For example we mentioned in Chapter 2 such results for the Helios voting protocol: when ballot privacy is modelled using vote swap, it is known that some parameters of the problem can be bounded without loss of generality (number of voters, number of ballots accepted by the ballot box). Bounding the other parameters (number of ballots emitted by each voter) and investigating whether similar arguments could apply to the BPRIV definition would be interesting tracks to improve the guarantees offered by DeepSec for this protocol.

Lemma A.1

Let n be a node of a partition tree T and A 0 , A 1 ∈ Γ(n). We let A i = (P i , C i ) and Σ, σ 0 , σ 1 such that (Σ, σ i ) ∈ Sol π(n) (C i ). If A c i = (P i σ i , Φ(C i )σ i ↓), the following points are equivalent:

1 A c 0 ≈ l A c
1 2 there exist a symbolic witness w s for A 0 , A 1 , n and a solution f sol ∈ Sol (w s ) such that f sol (root(w s )) = Σ

To prove this lemma we first observe that, by definition of a configuration (Definition 3.9), A c 0 ∼ A c 1 because these two processes are obtained by instanciating two symbolic processes from a same node n with a common solution Σ. We then prove the two directions of the theorem separately.

Proof of Lemma A.1, 1⇒2. We prove the result by induction on |P 0 , P 1 |. The conclusion is immediate if |P 0 , P 1 | = 0 as it yields a contradiction: the multisets P 0 and P 1 can only contain null processes and the fact that A c 0 ∼ A c 1 justifies that A c 0 ≈ l A c 1 . Otherwise we let by Proposition 3.6 a witness w of Then we define w s to be the tree whose root is labelled ({A 0 , A 1 }, n) and that has a unique child labelled ({A b }, n ). We then consider f sol mapping the child to Σ and the root to Σ |vars 2 (n) = Σ, which is a solution of w s .

case 1b: otherwise

In this case we define w s as follows. Its root is labelled ({A 0 , A 1 }, n) and its children are all the nodes labelled ({A 0 , A 1 }, n ), with A 1-b , n αs = ⇒ T A 1-b , n . For each such node, as explained in the beginning of the proof we have A c 0 ≈ l A c 1 which permits to apply the induction hypothesis with the solution Σ . This gives a symbolic witness rooted in this node and f sol a solution mapping this node to Σ . Let us write more explicitly these witnesses w 1 s , . . . , w p s and f 1 sol , . . . , f p sol the corresponding solutions. To conclude it then sufficies to choose w 1 s , . . . , w p s as the children of the root of w s , and f sol maps the root of w s to Σ |vars 2 (n) = Σ and each node n of w i s to f i sol (n). case 2: α = τ The property that the hypotheses of the formula only contain syntactic equations can be obtained by a straightforward inspection of each case-distinction and simplification rules. Note in particular that whenever a formula ψ with deduction-fact hypotheses is considered (in Rules (Rew) and (Eq)), they are applied to a substitution Σ so that ψ:(Σ, C e ) only has equations as hypotheses. As for the second part of property 5 we write 1 the property subterms 2 = (H) ⊆ Conseq(K ∪ D) and 2 the rest (the property about the head terms of deduction formulas). We perform a case analysis on the rule that added the formula to Γ . rule (Vect-add-Formula): the proof of 2 directly follows from Inv wf (Γ) since the rule does not add a deduction formula. Regarding 1, using the notations of the rule, the head of the formula is ξ = ? f ζ where ξ ? u ∈ F for some u, and ζ ∈ Conseq(K ∪ D). In particular the conclusion follows from Inv wf (Γ) (property 4 for the subterms of ξ and property 5 for the subterms of ζ) rule (Rew): we first prove 1. Using the notations of the rule, all non-root positions of the head of a formula of F 0 are either variables X such that D contains a deduction fact X ? x (generated by the skeleton), a position of ξ 0 , or a public function symbol (since the rewriting system is constructor, the left-hand sides of the rewrite rules only contain a destructor at their roots). In particular all strict subterms of H are consequences of K∪D. Now let us prove 2. By definition of the rule, u is a constructor term in normal form obtained after applying one rewrite rule → r at the root of C[u 0 ] for some context C (not containing names but possibly containing variables x such that X ? x ∈ D for some X). We recall that the rewriting system is constructor-destructor and subterm convergent, which leaves two cases. The first is that r is a ground constructor term, and then u = r is trivially a consequence of K ∪ D for the recipe ζ = r. Otherwise r is a subterm of , meaning that u is a subterm of C[u 0 ]. This implies that u is either a subterm of u 0 , a subterm of the context C, or a term of the form C [u 0 ] for some subcontext C of C. In all cases, since u 0 ∈ subterms (Φ) by Inv wf (Γ) (property 4), this gives the expected conclusion. rule (Eq): the proof of 2 follows from Inv wf (Γ) since the rule does not add a deduction formula. Regarding 1, this follows from Inv wf (Γ) (property 4). We have to prove that (Φ, Σ, σ) |= ψ. Here we prove more precisely that the conclusion holds when applying one time any of the case-distinction or simplification rules. First of all we Rule (Rew) (positive branch): using the notations of the rule, the only case that does not directly follow from the assumption Inv comp (Γ) is the case where ψ ∈ F 0 . The hypothesis (Φ(C e 2 ), Σ, σ) weakly models the head of ψ can then be rephrased as msg(ξ ΣΦ(C e 2 )σ) for some recipe ξ = C[ξ 0 ] such that root(C) ∈ F d , by definition of F 0 . Let us write u = ξ 0 ΣΦ(C e 2 )σ↓. Since the rewriting system is constructor-destructor and root(C[u]) ∈ F d , there exists at least one rewrite rule → r ∈ R such that C[u] and are unifiable. In particular it sufficies to choose ψ the formula of F 0 corresponding to picking this rule in the definition of RewF(ξ, → r, p). Rule (Eq) (positive branch): easily follows from Inv comp (Γ) since the rule only adds to each (P, C, C e ) ∈ Γ the same solved formula.

Proof of preservation of

Proof of preservation of Inv satur . Let C = (Φ, D, E 1 , E 2 , K, F) for some (P , C , C e ) ∈ Γ and k such that vars 2 (D(C)) ⊆ X 2 k . We also let f/n ∈ F d and (ξ 1 , u 1 ), . . . , (ξ n , u n ) ∈ Conseq(K(C)) such that ξ 1 , . . . , ξ n ∈ T 2 k , and f(u 1 , . . . , u n ) ↓ is a constructor term. We have to prove that there is ξ ∈ T 2 k such that (ξ, f(u 1 , . . . , u n ) ↓) ∈ Conseq(K(C) ∪ D(C)). This can be justified by Inv wf (Γ) (in particular the item "shape of K"). Indeed, by definition the term f(u 1 , . . . , u n ) contains a single destructor, which is the symbol f at its root. In particular if f(u 1 , . . . , u n )↓ is indeed a constructor protocol term u, this has been obtained after applying a single rewriting rule at the root of f(u 1 , . . . , u n ) since the rewriting system is constructordestructor. Therefore, by subterm convergence, u is either a ground protocol term (without names, by definition of a rewrite rule) or a subterm of one of the u i s. In the former case the conclusion is immediate, in the latter it follows from the invariant Inv wf .

Proof of preservation of Inv sol . The preservation of this invariant is straightforward: the case distinction and simplification rules only modify the extended constraint systems by 1 applying a mgs, or 2 adding formulas to E 1 , E 2 , K,..., or 3 removing formulas from F, or 4 removing trivially-false disequations from E 1 . In particular such operations restrict the set of solutions.

We can then extend this property to the whole procedure by proving the preservation by symbolic rules.

Lemma B.2

Let Γ be a set of extended symbolic processes such that Inv all ({Γ}). We assume that no case-distinction or simplification rules can be applied to Γ. We then let Proof. Most invariants are either easily seen to be preserved by application of any symbolic or simplification rules, or are a straightforward consequence of the fact that no simplification rules can be applied to S. The only substantial case is the Invariant 4 stating that the Proof. First of all the non-applicability of Rule (Sat) case 1 gives that either C e is solved or mgs (C e ) = ∅; due to normalisation rules not being applicable we deduce that mgs (C e ) = ∅ meaning that C e is solved. Sinmilarly by the non applicability of case 2 we know that for all ψ ∈ F, either ψ is solved or mgs (C e [E 1 → E 1 ∧ hyp(ψ)]) = ∅. But since the normalisation rules are also not applicable, we know that mgs (C e [E 1 → E 1 ∧ hyp(ψ)]) = ∅: therefore ψ is solved. Finally the non applicability of case 3 and of the normalisation rules also gives us that E 1 is only composed of syntactic equations.

Lemma B.16

Let S be a set of sets of extended symbolic processes such that Inv all (S) and no instance of the rule (Sat) or normalisation rules are applicable. For all S ∈ S, for all (P, C, C e ) ∈ S, |mgs (C e )| = 1.

Proof. Let us denote C e = (Φ, D, E 1 , E 2 , K, F). By Lemma B.15 we know that C e is solved, that all formulas ψ ∈ F are solved, and that E 1 only contain equations.

Step 1: Construction of (Σ, σ) such that (Φ, Σ, σ)

|= D ∧ E 1 ∧ E 2
Since C e is solved, we deduce that all deduction facts in D = {X i ? x i } n i=1 for some n and pairwise distinct x i s and X i s. Consider now the substitutions Σ 0 = {X i → n i } n i=1 and σ 0 = {x i → n i } n i=1 where the n i s are pairwise distincts public names, i.e. n i ∈ F 0 . Since no more normalisation rules are applicable, we know that the disequations in E 2 not trivially unsatisfiable. Therefore by replacing the free variables of the disequations by names allow us to obtain that Σ 0 the disequations of E 2 . By considering Σ = mgu(E 2 )Σ , we obtain that Σ |= E 2 . Moreover we proved that E 1 does not contain any disequations, we directly obtain that mgu(E 1 )σ 0 |= E 1 . Therefore, by defining σ = mgu(E 1 )σ 0 , we obtain that (Φ, Σ, σ) |= D ∧ E 1 ∧ E 2 .

Step 2: Proof that (Σ, σ) is a solution To prove that (Σ, σ) is an actual solution of C e it remains to prove that it verifies the additional required two conditions: K-basis and uniformity. Let us first prove the K-basis, i.e. that for all ξ ∈ subterms (img(Σ))∪subterms 2 = (KΣ), msg(ξΦσ) and (ξ, ξΦσ) ∈ Conseq(KΣσ). The case ξ ∈ subterms 2 = (KΣ) directly follows from Inv wf (C e ). Let us therefore consider the case ξ ∈ subterms (img(Σ)). Since Inv wf (C e ) holds we have that img(mgu(E 2 )) ⊆ Conseq(K ∪ D); for the same reason we have that for all ζ ? u ∈ K, subterms (ζ) ⊆ Conseq(K ∪ D). Therefore by applying Lemma B.6, and by a quick induction on the size of the recipe in img(Σ), we obtain that ξ ∈ Conseq(KΣ). Finally, by definition of consequence and since Inv sound (C e ) holds, we have msg(ξΦσ) hence the K-basis.

Let us now prove uniformity. We know that C e is solved which therefore means that for all recipes ξ, ζ ∈ subterms c (img(mgu(E 2 )), K∪D) 2 ∪(F 0 ×vars 2 (D)), (ξ, u), (ζ, u) ∈ Conseq(K∪D) implies ξ = ζ. Since Σ = mgu(E 2 )Σ 0 we directly obtain that for all ξ, ζ ∈ subterms c (Σ, KΣ), (ξ, u), (ζ, u) ∈ Conseq(KΣ) implies ξ = ζ, which is exactly the uniformity.

Step 3: Unicity of the solution This step is rather straightforward: considering that Σ = mgu(E 2 )Σ 0 and any other solutions (Σ , σ ) ∈ Sol (C e ) satisfy Σ |= E 2 , we deduce that mgs (C e ) = {mgu(E 2 )} and so |mgs (C e )| = 1.

there is u 2 ∈ T(P, Q) such that t = fst(u 2 ) ∼ snd(u 2 ) .

Therefore by Proposition C.10, there exists t 2 ∈ T(P, Q) such that t = fst(t 2 ) ∼ snd(t 2 ).

Additional results

We provide some utility results on independent permutations of actions. First, about composition of permutations:

Proposition C.11
Let t be a trace, π permuting independent actions of t, and π permuting independent actions of π. This formalises that the group-action properties of (π, tr) → π.tr carry on to traces. Then, we also discuss the domain extension of permutations. If π is a permutation of 1, n , we define π +q +p permutation of 1, n + p + q by π +q +p (x) = p + π(x -p) if p < x n + p x otherwise in particular, the following result is immediate:

Proposition C.12 (extension)

If π permutes independent actions of v, π +|w| +|u| permutes independent actions of uvw.

Decomposition into phases

In this section we prove correct the refinement at the very basis of our partial-order reductions, namely that all traces can be decomposed into phases (modulo permutation of independent actions). Proposition 5.17 (correctness of basic compression)

O ∀ c,b is a correct refinement of O ∀ all . Proof. By Proposition 5.16, it sufficies to prove that for all traces t that are maximal (i.e. whose last process is irreducible), there exists π permuting independent actions of t such that π.t can be decomposed into phases.

We prove this by induction on the length of t. If t is empty the result is immediate: π is the identity and the phase decomposition consists of a unique empty negative block. Otherwise let us write t : (A α -→ B) • t .

Note in particular that the trace t is also maximal. By induction hypothesis, there exists π

We also consider the phase of t in which the first action of P is executed, i.e. the first phase b such that appears in actions(b). Note that, thanks to the invariant that any label appearing in t is either incomparable or a suffix of , α is independent of all actions of all phases of t preceding b.

• tr + 1 • tr - 1 • • • tr + i-1 • tr - i-1
such that, writing s = (A

α -→ B) • b - 0 • b + 1 • b - 1 • • • b + i-1 • b - i-1 ,
• b + 1 • b - 1 • • • b + i • (π - i .b - i ),

Improper positive phases

In this section we prove the correctness of the optimisation O ∀ c+i consisting of delaying improper blocks as much as possible in traces, as introduced in Section 3.3. First we prove that improper The goal of our reductions by symmetry is to identify subprocesses that will behave identically, so that the execution of one is prioritised over the others; we formalise this by a notion that identifies traces that are identical up to their labels and public channels. Formally we write X Ch Y when X and Y are two identical objets up to renaming of public channels, i.e. X = Y for permutation of F 0 ; then we say that two traces u, v are almost identical, written u ∼ = v, when there exists a session matching σ for u and v (notion introduced in Appendix 1) and an α-renaming such that

u : A 0 [ a 1 ] 1 ----→ • • • [ an ] n ----→ A n v : (B 0 [ b 1 ] 1 σ ----→ • • • [ bn ] nσ -----→ B n )
where for all i, a i Ch b i and A i , B i are of the form

A i = ({ {[ P 1 ] 1 , . . . , [ P m ] m } }, Φ) B i Ch ({ {[ Q 1 ] 1 σ , . . . , [ Q m ] m σ } }, Φ )
with P j ≡ E Q j for all j and Φ = E Φ . We sometimes make the session matching explicit by writing u σ ∼ = v. Almost identity is an equivalence relation on traces, which is mostly justified by Proposition C.3. We now identify some transformations that produce almost identical traces and we give the core property that we expect such traces to verify. where π is the extension of π that coincides with π on dom(π) and is the identity on the labels of t.

But the most important property is that structurally equivalent processes have almost identical traces (again with the identity renaming of channels).

Proposition C.27

Let A 0 , B 0 two extended processes such that A 0 ≡ B 0 , and L the set of labels appearing in A 0 and B 0 (which is the same). Then for all traces u ∈ T(A 0 ), there exists v ∈ T(B 0 ) such that u π ∼ = v with π |L = id and u ∼ v.

Proof. Intuitively the trace v is constructed by mirroring all transitions of u in B 0 . The technical part is that structural equivalence includes associative-commutative reordering of parallel operators, making the labels of u and v different after the first transition. Let us session matching for t and z such that ω |L(Z) = ω |L(Z) • π, where L(Z) is the set of labels of Z. In particular for z = s t and ω = σ t we obtain s t ∈ T(Q) and σ t session matching for t and s t such that for all i ∈ 1, n , σ t ( i ) = σ t ( π(i) ) = σ w ( π(i) )

(because σ t and σ w coincide on L)

= φ( i ) (because σ |L = id )
This justifies that the following mapping ψ of domain dom(σ t ) ∪ dom(φ) is well defined

ψ |dom(σ t ) = σ t ψ |dom(φ) = φ
All in all it sufficies to choose s = s t • s w since ψ is a session matching for u and s, and s ∼ u because actions(s) = actions(s t ) • actions(w) = actions(t) • actions(u 0 • v) = actions(u)

Part 2: Proof in the case π ∈ Sym 2 . We use the same initial notations for u and u 0 as in the previous Part, with in particular

(u 0 • v)π : (π -1 .A [ a ] π ---→ B) • vπ
But by hypothesis π ∈ Sym 2 , or equivalently π -1 ∈ Sym 2 since Sym 2 is a group. Therefore there exists permutation of F 0 such that π -1 .A ≡ A . Hence by Proposition C.27 there exists w ∈ T(A ) such that w ∼ u 0 • v and u 0 • v σa ∼ = w for some σ a such that σ a|L = id . In particular u ∼ = t • w -1 by Proposition C.26 and t • w -1 is therefore of the form ( ) (and its first action is [ a -1 ] π). Hence by hypothesis there exists s ∈ T(Q) such that s ∼ t • w -1 and σ a session matching for t • w -1 and s . We also let σ t and σ w the restrictions of σ to the labels of t and w, respectively. Decomposing s = s t • s w with |s t | = |t|, σ t (resp. σ w ) is a session matching for t and s t (resp. w -1 and s w ). Hence we have established so far: σ t is a session matching for t and s t σ w • σ a • π is a session matching for u 0 • v and s w However this is not sufficient to construct a session matching for u = t • u 0 • v, among other things because the last extended process of s t (let us write it Z) is not the same as the first extended process of s w (which is Z ). This is where we use the hypothesis π -1 ∈ Sym Q 2 , which implies that π -1 ∈ Stab (Z). In this instance of Stab (Z), the implicit ordering of the labels of Z is the one mirroring the ordering on the labels of A: namely the labels of Z are ordered σ w ( 1 ), σ w ( 2 ) . . . , σ w ( n ). In particular in our context, the hypothesis π -1 ∈ Stab (Z) means:

(π -1 .(Zσ -1 w ))σ w ≡ Z or more succinctly:

Zφ ≡ Z -1 with φ = σ w • π-1 • σ -1 w φ ∈ Sym 2 )
we know that it sufficies to prove that H(u ) for all u ∼ = u of the form

u : t • (A [ a ] π ----→ B ) • v .
Since ∼ = is transitive all such u also verify u ∼ = u, hence the conclusion by hypothesis. This is the core technical lemma to justify the correctness of our universal symmetry.

Compatibility with POR So far we have provided the core argument to prove that O ∀ sym is a correct refinement of O ∀ c+i * . However it is more complex to prove it compatible with O ∀ por , i.e. with high-priority transitions and the lexicographic reduction. In essence we will have to reuse the core corectness arguments developed in Appendices 3.5 and 3.6 to prove their correctness, but with the handicap of applying symmetries at the same time. Proposition 5.30

O ∀ por ∩ O ∀ sym is a correct refinement of O ∀ por .
Proof. Since the reasoning will be the same anyway, we prove the stronger result that

O ∀ sym ∩ O ∀
por is a correct refinement of O ∀ c+i * +0 . We let sym and 0 the notions of inclusion respectively induced by these two optimisations and show that they coincide. The inclusion 0 ⊆ sym is immediate. Regarding the converse inclusion, let P, Q two processes such that P sym Q and let us prove that P 0 Q. For that we prove that for all traces u ∈ T(P ) ∩ O ∀ c+i * +0 , there exists u 2 ∈ T(P, Q) such that u = fst(u 2 ) ∼ snd(u 2 ). We proceed by well founded induction w.r.t. the ordering lex on compressed traces. Note that labelled attacks are not the direct translation of the above intuition since they allow the attacker to choose several transitions in a row; this intuitively entails no loss of generality since it is equivalent to the attacker selecting some transitions non-adaptatively (i.e. independently of the answer of the defender). Here is the formal statement of correctness:

Proposition D.5
For all extended processes A and B, A ≈ l B iff there exists a labelled attack S such that ASB.

Proof. The forward implication is immediate since ≈ l is a labelled attack (we can even choose tr = ε everytime). Let then S be a labelled attack such that ASB and let us prove that S ⊆ ≈ l . More precisely, we prove that S ⊆ S ⊆ ≈ l for some relation S . We will construct S in such a way that for all A, B extended processes, AS B entails: Let then A and B be two extended processes such that AS B. We consider a proof-tree of AS B in the inference system above and perform a case analysis on the rule at its root: case 1 (Axiom): ASB. As S is a labelled attack, we apply the case analysis of Definition D. We argue that ξΦ↓ = ζΦ↓ and ξΦ 0 ↓ = ζΦ 0 ↓. Either of the two equalities being verified would indeed imply that s ∈ {ζ 2 Φ, ζ 2 Φ 0 }: this is impossible as ζ 2 is a ground recipe in normal form and s ∈ N (one easily shows that ζ 2 Φ and ζ 2 Φ 0 are either public names, constants, or termes of height 1 or more). As msgξΦ and msgξΦ 0 , the preliminary observation justifies that ξ ↓ and ζ ↓ function symbols are all constructor. In particular no other cases than the three above need to be considered, which concludes the proof.

With this lemma in mind, the proofs of Propositions 6.16 and 6.17 become quite straightforward: Proposition 6.16 (correctness of the tree checker) Let x be a message which is not a complete binary tree of height n with boolean leaves. Then there exists a reduction CheckTree(x) ε = ⇒ ({ {P } }, ∅) such that P ≈ l c h(0, s) . c h(1, s) .

Proof. Let x be a message which is not a complete binary tree of height n whose leaves are booleans. Proposition 6.17 (correctness of the sat checker) Let x be a complete binary tree of height n whose leaves are booleans, and val x be the valuation mapping the variable number i of Γ ϕ to x |p 1 •••pn ∈ B where p 1 • • • p n is the binary representation of i (i.e., i = n k=1 p k 2 k-1 ). If val x does not satisfy Γ ϕ then there exists CheckSat(x) ε = ⇒ P such that P ≈ l c h(0, s) . c h(1, s) .

Proof. Let x be a complete binary tree of height n whose leaves are booleans, that is to say, a message such that x | p ∈ B for all p ∈ B n . Naming x 0 , . . . , x 2 n -1 the variables of Γ ϕ in this order, val x refers to the valuation mapping x i to x | p where p is the binary representation of i (of size n with padding head 0's).

The processes P (x, y) and Q (x, y) execute one of their n+3 branches (or none) depending on the input y, expectedly forwarded from Choice. Referring to the intuition of the construction provided in the previous paragraph, the process Print corresponds to Item 3, CheckSat to Item 2, and the collection of processes CheckTree i to Item 1 (each CheckTree i is dedicated to the verification of the depth i of the branch). In particular the various branch extractions of the tree x (resp. the evaluations of Γ and of the clauses of ϕ) that need to be performed by the different processes are simulated by interactions with the process Extract (resp. with the process Eval ).

Formally the processes are defined as follows. For conceitness we use pattern notations in the definitions of the other processes below, recall Section 2.1. All the patterns used below can easily be encoded within the positive fragment of the calculus. We recall in particular that, for any fixed term k, it is possible to test that a term is of the form senc(y, k) (in the constructor-destructor semantics, the conditional [sdec(x, k) = sdec(x, k)] succeeds iff x is of the form senc(y, k) for some term y). We also use a wildcard notation ( _ ) for input variables that will not be used afterwards.

Definition of Choice

We first define a process Choice that will serve as an oracle for performing the n + m + 1 non-deterministic choices the executions of P and Q require.

Choice = n+2 i=0 senc(b i , k) | n+m i=1 (senc(b 0 , k i ) | senc(b 1 , k i ))
Other processes select a boolean b non-deterministically by inputting senc(b, k i ) for some i (and each k i should be used for only one such non-deterministic choice).

Definition of Extract Then we define the process performing branch extraction from a binary tree modelled by nested pairs.

Extract = 4n

i=1 E i | E dummy i with E i = c(senc( x 0 , x 1 , z , r i )). 1 j=0 [z = b j ] c senc(x j , a i ) E dummy i = c(senc(x, s i )). c senc(x, a i ) That is, Extract is able to answer to 4n pair-extraction requests, potentially including some dummy requests where the argument is returned unchanged. In the other processes, if t, t 1 , . . . , t n are terms and 1 i 3n + 1, the branch extractions are written u n ← Extr i (t, t 1 , . . . , t n ). P instead of: c senc( t, t 1 , r i ) . c(senc(u 1 , a i )). c senc( u 1 , t 2 , r i+1 ) . c(senc(u 2 , a i+1 )). . . . c senc( u n-1 , t n , r i+n-1 ) . c(senc(u n , a i+n-1 )). P

On the other hand, the dummy extractions are written

DummyExtr n i . P

Lemma E.6

Let i ∈ 1, n -1 (resp i = n), a term t ∈ T (F, F 0 ). Then the processes Print and R i (t) are not labelled bisimilar iff there exists t 0 , t 1 ∈ T (F, F 0 ) such that t = t 0 , t 1 (resp. t ∈ B).

Proof. The proof for i = n essentially follows from the fact that the two frames Similarly the frames Φ 1 = {ax 1 → senc(t, α), ax 2 → senc( t 0 , t 1 , α), ax 3 → β} Φ 2 = {ax 1 → α, ax 2 → β, ax 3 → γ} are statically equivalent iff t = x, y . In particular it easily follows that, if i < n and t ∈ T (F, F 0 ), then A and B are labelled bisimilar iff there exists two terms t 0 , t 1 ∈ T (F, F 0 ) such that t 0 , t 1 = t.

Φ 1 = {ax 1 → senc(t,
Definition of CheckSat The process CheckSat(x) operates in the same way as its counterpart in Section 1.2: it guesses a clause of ϕ, recovers its variables and negation bits by evaluating Γ, computes its valuation ω by three tree extractions from x, and outputs three terms that are statically equivalent to fresh names iff ω = b 1 .

CheckSat(x) = Choose(a 1 ) . . . Choose(a m ).

ω 1 , x 1 , . . . , x n ← Γ(a 1 , . . . , a m , b 0 , b 0 ). ω 2 , y 1 , . . . , y n ← Γ(a 1 , . . . , a m , b 0 , b 1 ). ω 3 , y 1 , . . . , y n ← Γ(a 1 , . . . , a m , b 1 , b 0 ). ω 1 ← Extr (x, x 1 , . . . , x n ). ω 2 ← Extr (x, y 1 , . . . , y n ). ω 3 ← Extr (x, z 1 , . . . , z n ). ω ← Γ v (ω 1 , ω 1 , ω 2 , ω 2 , ω 3 , ω 3 ).

R(ω)

where Γ v : B 6 → B is a circuit computing the boolean formula Γ v (x, x , y, y , z, z ) = (x = x ∨ y = y ∨ z = z ) and for all terms t: R(t) = c senc(t, α) c senc(b 1 , α) c β Following a similar argument as in the construction of CheckTree n , we have the following property:

Lemma E.7

For all terms t, the processes Print and R(t) are labelled bisimilar iff t = b 1 .

In particular, after verifying all clauses of ϕ the attacker obtains the encryption of all integers of 0, 2 m -1 . Hence the process Final (t) checks that the attacker knows them all (using a dichotomy-based procedure to avoid the process containing explicitly an exponential number of verification steps) and eventually outputs t. The definition will also use the following atomic data: for some names k, k . However there are several reasons why the situation requires a more complex construction. First, this process does not verify the acyclicity property: a process would need to perform several round-trip with Extract to extract a leaf from a binary tree, node by node, which highlights a circular dependency (more precisely a pattern dependency from the outputs to the inputs). Type-compliance would not be satisfiable neither. This problem can be solved by stratifying the construction: Extract is split into n replicated processes, each performing pair extractions for trees of a given height. The second problem is that, since all answers are encrypted with the same key, we need a form of marker to identify the different requests. A solution is to add a nonce to each request which is forwarded together with the answer. Altogether we have

Extract = Extract 1 | Extract 2 | Extract 3
where Extract i = n j=1 E j i where for all j ∈ 1, n :

E j i = ! ch c(senc( x, y , z, 0 , r i,j Extr )).c senc( x, z , a i,j Extr ) | ! ch c(senc( x, y , z, 1 , r i,j Extr )).c senc( y, z , a i,j Extr )

In the other processes, if t, t 1 , . . . , t n are terms and i ∈ 1, 3 , branch extractions are written u n ← Extr i (t, t 1 , . . . , t n ). P instead of: new r. c senc( t, r, t 1 , r i,1 Extr ) . c(senc( u 1 , r , a i,1 Extr )). c senc( u 1 , r, t 2 , r i,2

Extr ) . c(senc( u 2 , r , a i,2 Extr )). . . . c senc( u n-1 , r, t n , r i,n Extr ) . c(senc( u n , r , a i,n Extr )). P

Efficient verification of observational equivalences of cryptographic processes: theory and practice

Abstract. This thesis studies the analysis of cryptographic protocols. They are sequences of instructions permitting to interact with a recipient remotely while protecting the sensitive content of the communication from a potential malicious third party. Classical cases where the confidentiality and the integrity of the communication are critical are, among others, online payments and medical-service booking, or electronic voting.

We study notions of security defined technically by observational equivalences (which includes among others confidentiality, anonymity or nontraceability). We designed a program, DeepSec, which, from the description of a protocol for a fixed number of participants, verifies in a fully-automated way whether the protocol offers a security guarantee of this type. We demonstrate the ability of this tool to analyse complex attack scenarios through several examples.

After that, we present an optimisation technique exploiting symmetries in security proofs.

Typically, participants with similar roles in the protocol often have similar instructions to follow, inducing redundant work during the analysis. On several examples, using this technique allowed to reduce the analysis time of DeepSec by several orders of magnitude.

Finally, we also studied the theoretical aspect the problem in order to determine to which extent DeepSec's algorithm could be improved (can we make the tool faster?) or made more expressive (can we get rid of some of the limitations of the tool?). For that we carried out a complete analysis of the computational complexity of DeepSec's algorithm, and integrated it to a detailed survey of the state of the art regarding complexity results in similar contexts. This meticulous survey allowed us to expose subtle variations in how the problem is formalised across the literature-sometimes impacting its complexity. We also include new results and improve some of the surveyed ones, resulting in a clearer understanding of the problem. Nous étudions les notions de sécurité définies techniquement par des équivalences observationelles (ce qui inclut entre autre la confidentialité, l'anonymat ou la non-traçabilité). Nous avons conçu un programme, DeepSec, qui, à partir de la description d'un protocole pour un nombre fixé de participants, vérifie de manière entièrement automatisée si le protocole offre une garantie de sécurité donnée de ce type. Nous démontrons ensuite la capacité de cet outil à analyser des scenarios d'attaques complexes à travers plusieurs exemples.

Dans un deuxième temps, nous présentons une technique d'optimisation reposant sur l'exploitation de symétries dans les preuves de sécurité. Typiquement, les participants ayant des roles similaires dans le protocole ont souvent les mêmes instructions à suivre, ce qui induit des tâches redondantes lors de l'analyse. Sur plusieurs exemples, l'utilisation de cette technique d'optimisation a permis de réduire le temps d'analyse de DeepSec de plusieurs ordres de magnitude.

Enfin, nous avons également étudié l'aspect théorique du problème afin de déterminer dans quelle mesure l'algorithme de DeepSec pouvait être amélioré (peut-on rendre l'outil plus rapide?) ou rendu plus expressif (peut-on rendre l'outil capable d'analyser plus de protocoles, i.e., nous débarasser de certaines de ses limitations?). Nous avons pour cela fait une analyse de complexité calculatoire complète de l'algorithme de DeepSec, et l'avons intégré à une revue détaillée de l'état de l'art des résultats de complexité dans des contextes similaires. Cette revue minutieuse nous a permis de mettre au jour des variations subtiles dans la formalisation du problème à travers la littérature -parfois ayant un impact sur sa complexité. Nous y incluons de nouveaux résultats et améliorons certains ce ceux passés en revue, offrant une compréhension plus claire du problème.

xii 1 . 2

 12 Les Livraisons dangereusesNous vous offrons ce gâteau en remerciement de votre fidélité.

  Situation 2: client immunisé Situation 1: client normal Un client commande un gâteau à Isabelle et le mange après l'avoir reçu.

xviii

  Situation 2: tarte à la pomme Situation 1: gâteau au chocolat Un client commande un gâteau à Isabelle.

Situation 2 :

 2 le client est Alice Situation 1: le client est Bob Un client commande un gâteau à Isabelle.

  Situation 2: immune client Situation 1: normal clientA client orders a cake from Isabelle and eats it after receiving it.

Situation 2 :

 2 the client is Alice Situation 1: the client is BobA client orders a cake from Isabelle.

Figure 1 . 1

 11 Figure 1.1 Operational semantics of the applied pi-calculus

  Definition 1.11 (trace equivalence) If A and B are extended processes, we write A t B when for all traces A tr = ⇒ A , there exists a trace B tr = ⇒ B such that A ∼ B . We say that A and B are trace equivalent, written A ≈ t B, when A t B and B t A. Definition 1.12 (labelled bisimilarity) Labelled bisimilarity ≈ l is the largest symmetric relation such that for all extended processes A, B, A ≈ l B entails 1 A ∼ B, and 2 for all transitions A α -→ A , there exists a trace B ᾱ = ⇒ B such that A ≈ l B , where ᾱ = ε if α = τ and ᾱ = α otherwise.

Figure 2 . 1

 21 Figure 2.1 Control flow of the Helios protocol ("vanilla")

Figure 3

 3 Figure 3.1 A symbolic semantics for the applied pi-calculus

Figure 3 . 2

 32 Figure 3.2 Tree of all constraint systems reachable by executing B symbolically

  Proposition 3.2 (soundness and completeness of the symbolic semantics) Let (P, C) be a symbolic process. 1 Soundness: for all symbolic traces (P, C) trs =⇒ s (Q, C ) and (Σ, σ) ∈ Sol (C ), there exists a concrete trace of the form (Pσ, Φ(C)σ↓) trsΣ ==⇒ (Qσ, Φ(C )σ↓) 2 Completeness: for all symbolic processes (P, C), (Σ, σ) ∈ Sol (C) and concrete traces (Pσ, Φ(C)σ↓) tr = ⇒ (Q, Φ), there exists a symbolic trace (P, C)

Figure 3 . 4

 34 Figure 3.4 Partition tree with the theory extended with testEnc(raenc(x, y, pk(z))) → ok

Figure 3 . 5

 35 Figure 3.5 Computing the subtree of a partition tree rooted in a node n

Figure 3 . 7

 37 Figure 3.7 Performances of DeepSec (20 cores) (parametric scenario)

  3): in particular if ξ ∈ Conseq(S), the context C in the above definition is unique. Writing ξ = C[ξ 1 , . . . , ξ n ] it is therefore possible to define unambiguously the set of consequential subterms of ξ subterms c (ξ, S) = {ξ |p | p position of C} If R is a set of recipes we write subterms c (R, S) = ξ∈R subterms c (ξ, S). From this we can define solutions of extended constraint systems.

Definition 4 . 4 (

 44 solution of an extended constraint system)

  KΣ, FΣ) where D = (D D dom ) ∪ D fresh with the sets of: 1 deduction facts removed by the application of Σ: D dom = {Y ? u ∈ D | Y ∈ dom(Σ)} 2 binding facts: D fresh = {Y ? y | Y ∈ vars 2 (img(Σ |vars 2 (C e ) )) vars 2 (C e ), y fresh} 3 linking equations:

  and Σ be a substitution. We denote ψ:(Σ, C e ) (or ψ:(Σ, S) by abuse of notations if S = (P, C, C e )) the formula ∀S . (D ∧ hyp(ψ) ∧ E Σ ) ⇒ HΣ where D = (D(ψ) D dom ) ∪ D fresh , S = (S dom(Σ)) ∪ vars 1 (D fresh ) and: 1

  ), and provided Σ = , Σ = ⊥, and ∃u.(ξ, u), (ζ, u) ∈ Conseq(K(C e ) ∪ D(C e )) (MGS-Conseq)

XFigure 4 . 1

 41 Figure 4.1 Simplification rules on formulae

  the invariants of the procedure we compute a set of most general solutions of C e as the set {Σ |vars 2 (C e ) | C e Σ = ⇒ C e , C e solved} .

Proposition 4 .

 4 2 (soundness of one step of the mgs constraint solving) Let C e be an extended constraint system such that C e = C e . If C e Σ -→ C e and (Σ, σ) ∈ Sol (C e ) then (Σ |vars 2 (C e ) , σ |vars 1 (C e ) ) ∈ Sol (C e ).

Theorem 4 . 4 (

 44 partial correctness of mgs computation) Let C e be an extended constraint system such that Inv wf (C e ) and Inv sound (C e ) hold. Then, assuming there exist no infinite sequences of -→ reductions from C e , we have mgs (C e ) = {Σ |vars 2 (C e ) | C e Σ = ⇒ C e , C e solved} Proof. Since a set of mgs' of C e is also a set of mgs' of C e , we assume without loss of generality that C e = C e . Let us write S = {Σ |vars 2 (C e ) | C e Σ = ⇒ C e , C e solved} and prove that S is a set of mgs' of C e . By the termination assumption, we can reason by well-founded induction on the reduction relation -→ from C e .

Figure 4 . 2

 42 Figure 4.2 Normalisation rules on extended constraint systems

  and for all second-order term ζ, (ζ, u S ) / ∈ Conseq(K(S) ∪ D(S)) S ∪ {Γ} S ∪ {{S[F → F ∧ ψ:(Σ, S))] | S ∈ Γ}} (Vect-add-Formula) if ψ = ∀X, Y, z. (X ? z ∧ Y ? z) ⇒ X = ? f Y and Σ = {X → ξ, Y → ζ}, and for all S ∈ Γ, 1 S is solved 2 F(S) contains a formula of the form ξ ? u S and, for at least one of the first-order terms u S , we have (ζ, u S ) ∈ Conseq(K(S) ∪ D(S)) 3 for all (ϕ ⇒ ζ 1 = ? f ζ 2 ) ∈ F(S), ζ 1 = ξ and ζ 2 = ξ

Figure 4 . 3

 43 Figure 4.3 Vector-simplification rules for sets of sets of extended symbolic processes

  and f/n ∈ F c with X 1 : k, . . . , X n : k fresh and for all (ϕ ⇒ ζ 1 = ? f ζ 2 ) ∈ F(S), ζ b = ξ 1 implies root(ζ 1-b ) = f. where k = |dom(Φ(S))| and ψ = ∀X, Y, z. (X ? z ∧ Y ? z) ⇒ X = ?

  simpl : simplification rules on formulas norm : normalisation rules vect : vector-simplification rules Sat --→ : (Sat) case-distinction rule Eq --→ : (Eq) case-distinction rule Rew ---→ : (Rew) case-distinction rule Chan ---→ : (Chan) case-distinction rule

Algorithm 1 :

 1 Computation of the partition tree, with nodes labelled with components // Application of simplification rules, as much as possible Procedure applySimpl(S : Vector) : Vector = if S simpl S then return applySimpl(S ) else if S norm S then return applySimpl(S ) else if S vect S then return applySimpl(S ) else return S // Application of case-distinction rules, with simplification rules in between Procedure applyCase(S : Vector) : Vector = if S Sat --→ S then return applyCase(applySimpl(S )) else if S Eq --→ S then return applyCase(applySimpl(S )) else if S Rew ---→ S then return applyCase(applySimpl(S )) else if S Chan ---→ S then return applyCase(applySimpl(S )) else return S // Generates the subtree rooted on a node labelled by the component Γ Procedure generateSubtree(Γ : Component) : Tree = Γ in ← {S | S Y (X) ===⇒ s S , S ∈ Γ} Γ out ← {S | S Y ax ===⇒ s S , S ∈ Γ} if Γ in = Γ out = ∅ then return a tree reduced to its root, labelled Γ else S ← applyCase(applySimpl({Γ in , Γ out })) T ← tree with root Γ and children generateSubtree(Γ ) for each Γ ∈ S return T

Figure 5 . 1

 51 Figure 5.1 Verification times for a fixed scenario of anonymity in the PAP

Figure 5 . 2

 52 Figure 5.2 Simplification rules for plain processes

  by Rules (In), (Out) or (Comm), and C = B (IO) ({ {P } } ∪ P, Φ) τ -→ ss (sessions(P ) ∪ P, Φ) if |sessions(P )| > 1 (Sess) Definition 5.2 (session trace)

  tr = ⇒ B, t : A tr = ⇒ B , B ∼ B and actions(t) = tr and actions(t ) = tr are identical up to erasure of τ actions. The characterisation is then formalised by the following proposition: Proposition 5.1 (characterisation of trace equivalence with session traces)

Figure 5 . 3

 53 Figure 5.3 Operational semantics for twin processes

  , b, b) ≈ s R(b, a, a) and R(a, b, b) ≈ l R(b, a, a) where

  Definition 5.10 (optimisation) An optimisation is a pair O = (O ∀ , O ∃ ) with O ∀ a set of traces of extended processes (universal optimisation), and O ∃ a set of traces of extended twin processes (existential optimisation).

  Consider for example c(x).P 1 | d u .P 2 | d v .P 3 | d(x).P 4

Definition 5 .

 5 18 (lexicographic minimality) We say that b can follow b n when either of the following conditions is met: (a) actions(b n ) ≺ actions(b); or (b) b n starts with a high-priority transition but not b; or (c) both b n and b start with a high-priority transition, but on different private channels. Given some blocks b 1 , . . . , b n , b we then write Minimal(b 1 • • • b n , b) when either 1 n = 0; or 2 ¬(b n || b); or 3 b can follow b n and Minimal(b 1 • • • b n-1 , b). Intuitively, we say that a block b can follow an other block b n when actions(b n ) ≺ actions(b), but the test may be ignored in some cases to ensure compatibility with prior optimisations. We then define O ∀ r to be the smallest subset of O ∀ c containing the empty trace, and such that t ∈ O ∀ r and Minimal(t, b) implies t • b ∈ O ∀ r . To account for improper blocks, we let O ∀ por the set of traces b

  wf (C e ) and Inv sound (C e ) hold. Then let C e Σ -→ C e = ⊥. If this transition is derived with: 1 Rule (MGS-Conseq): |unused 1 (C e )| |unused 1 (C e )| 2 Rules (MGS-Res) or (MGS-Cons): |unused 1 (C e )| < |unused 1 (C e )| Using this proposition we can then easily prove the computation of the set of most general solutions to be terminating, and actually to give an upper bound on its cardinality: Theorem 6.3 (termination for most general solutions) There exist no infinite sequences of transitions w.r.t. -→ . Besides if C e is an extended constraint system such that the invariants Inv wf (C e ) and Inv sound (C e ) hold, we have |mgs (C e )| (|K(C e )| + 1) |unused 1 (C e )| Proof. First of all we observe that consecutive applications of Rule (MGS-Conseq) are terminating, since applying this rule strictly decrease the cardinality of the set m(C e ) of parameters (ξ, ζ) the rule can be applied with. Combining this with Proposition 6.2 we obtain that if C e Σ -→ C e = ⊥ then C e < C e w.r.t. the lexicographic composition of unused 1 and m. Besides consecutive applications of Rule (MGS-Conseq) are also confluent by unicity of mgu's. For the same reason the applications of Rules (MGS-Res) or (MGS-Cons) can be performed on one deterministically-chosen deduction fact (X ? u) ∈ D. We therefore obtain mgs (C e ) = {Σ |vars 2 (C e ) | C e Σ = ⇒ C e normalised, C e solved} where a reduction C e Σ = ⇒ C e is said to be normalised when all applications of Rule (MGS-Conseq) and the choice of deduction facts in Rules (MGS-Res) or (MGS-Cons) are done in a fixed, deterministic way. Since for any C e , there are at most |K(C e )| normalised applications of Rule (MGS-Res) and 1 normalised application of Rule (MGS-Cons), we deduce by Proposition 6.2 that |mgs (C e )| (|K(C e )| + 1) |unused 1 (C e )| .

Measure 4 :

 4 Number of terms not consequence Given C e an extended symbolic constraint system, let us consider the following set representing the set of terms that are not consequence of K(C e ) and D(C e ): set K (C e ) = {t ∈ T 1 | ∀ξ, (ξ, t) / ∈ Conseq(K(C e ) ∪ D(C e ))}

M

  5 (Γ) = |{(P, C, C e ) ∈ Γ | C e unsolved}| (Meas. 5)

(

  P,C,C e )∈Γ |set Rew (C e )| (Meas. 6) By definition |set Rew (C e )| strictly decreases for at least one (P, C, C e ) ∈ Γ (and non-increasing for the others) when applying Rule (Rew). Then let (P, C, C e ) ∈ Γ: the other case distinction rules (Sat) and (Eq) do not increase |set Rew (C e )|. Indeed if we consider one of their applications C e Σ -→ C e :Σ , we have set Rew (C e :Σ ) = {(ψΣ , → r, p, ψ 0 , ΣΣ ) | (ψ, → r, p, ψ 0 , Σ) ∈ set Rew (C e )} . Note however that |set Rew (C e )| may increase by application of Rule (Vect-add-Conseq) since |K(C e )| will increase; yet this rule is already decreasing by the component M 4 .

  (P,C,C e )∈Γ |set Eq (C e )| (Meas. 8) Measure 9: Number of unsolved equality formulas We now introduce the analogue of Component 7 for equality formulas, that is, M 9 (Γ) = |{ψ ∈ F(C e ) | (P, C, C e ) ∈ Γ, ψ unsolved equality formula}| (Meas. 9)

  Proposition 6.8 (approximation of unused terms) For all (P, C, C e ) ∈ Γ,|unused 1 (C e )| Φ(C)µ 1 (C), µ 1 (C) dag .Proof. Considering C instead of C e , we have the trivial approximation|unused 1 (C)| |T 1 (C)| = subterms (Φ(C)µ 1 (C), µ 1 (C)) = Φ(C)µ 1 (C), µ 1 (C) dag .It therefore sufficies to prove that |unused 1 (C e )| |unused 1 (C)|. For that we show that the inequality |unused 1 (C e )| |unused 1 (C)| is preserved when applying any of the constraintsolving rules. case 1: symbolic rules These rules add the same constraints to C e and C (up to an additional deduction fact added to F(C e ) in the case of Rule (E-Out), but this does not affect unused 1 (C e )). In particular since E 2 (C) = K(C) = ∅, if we consider an instance (P, C, C e ) α -→ s (P , C , C e ) of a symbolic rule we therefore have |unused 1 (C e )| -|unused 1 (C e )| |unused 1 (C )| -|unused 1 (C)| which gives the expected result.

  case 2: simplification, normalisation, vector-simplification rules By definition these rules only affect C e and leave C untouched, hence the conclusion since these rules do not increase unused 1 (C e ).

case 3 :

 3 case distinction rules Let us consider CompatSubs(C e ) the set of substitutions Σ such that the notation C e :Σ is well defined, that is, such that 1 if dom(Σ) ⊆ vars 2 (D(C e )) 2 for all X ∈ dom(Σ), there exists t such that (XΣ, t) ∈ Conseq(K(C e ) ∪ D ) where D = {Y ? u ∈ D(C e ) | Y / ∈ dom(Σ)} ∪ D fresh with D fresh = {Y ? y | Y ∈ vars 2 (img(Σ |vars 2 (C e ) )) vars 2 (C e ), y fresh} This is intuitively the set of substitutions Σ whose image is constructed from K(C e ), up to the new variables of D fresh introduced by Σ. In particular we have for all Σ ∈ CompatSubs(C e ), |unused 1 (C e :Σ)| |unused 1 (C e )| (which follows in more details from Proposition B.5 in Appendix B), hence the conclusion. This relation allows to eventually reduce the problem to give a polynomial bound on Φ(C) and µ 1 (C) which are only affected by symbolic rules (we recall that the other constraint-solving rules do not modify C). All in all this concludes the proof of the expected polynomial bound: Corollary 6.9 (polynomial evolution of second-order terms) For all extended processes C e that verify the invariants Inv wf (C e ) and Inv sound (C e ), we have ∀Σ ∈ mgs (C e ), |T 2 (C e :Σ)| ≤ |T 2 (C e )| + 9 |P, Q, E| 3 dag

  3) |P | dag + 4|subterms (S)| × |E| dag (by 1 and (E)) |P | dag + 4(|P | dag + |tr|) |E| dag (by 2) 9 |P, E| 2 dag 3 Complexity upper bounds for equivalence properties Section summary

  1) and define Choose(y).P def = (d 0 + d 1 ) | d(y). P with d ∈ N is fresh

Figure 6 . 1

 61 Figure 6.1 Simulation of an OR-gate within the applied π-calculus

Figure 6 . 2

 62 Figure 6.2 Informal definition of A and B

  x).(CheckSat(x) + CheckTree(x)) B def = c(x).(CheckSat(x) + CheckTree(x) + c h(0, s) .c h(1, s) )Proposition 6.18 (correctness of the reduction)

  have the same set of solutions, where ϕ = X ? x ∧ Y ? y with X: n, Y : n, x, y fresh and n = |dom(Φ 1 )|

  Theorem 7.11 (constraint solving in the pure fragment)With the empty theory, CSysSAT and CSysEquiv are LOGSPACE.

Figure 7 .

 7 Figure 7.1 summarises the main results of this chapter and highlights remaining open questions. Cells for which the complexity results are not tight have coloured background.For instance, for subterm-convergent constructor-destructor theories and bounded processes,

  (A c 0 , A c1 ). Thus, by definition, there exist b ∈ {0, 1} and a transitionA c b α -→ A c b = (Q, Φ) such that for all traces A c 1-b ᾱ = ⇒ A c 1-b such that A c 0 ∼ A c 0 , we have (A c 0 , A c 1 ) ∈ w (and therefore A c 0 ≈ l A c 1 by Proposition 3.6).Let us now construct a symbolic witness w s of A 0 , A 1 , n and a suitable solution f sol . case 1: α = τ By completeness of the symbolic semantics (Proposition 3.2) applied to the transition A c b α -→ A c b , we let a symbolic transition A b αs -→ s A b = (Q s , C) and a solution (Σ , σ ) ∈ Sol (C) such that Σ ⊆ Σ , α = α s Σ , Q = Q s σ and Φ = Φ(C)σ ↓. Note that by hypothesis Σ verifies π(n) and, therefore, so does its extension Σ (since by definition predicates are stable by domain extension, recall Definition 3.9). Then since the symbolic transition A b αs -→ s A b is reflected in T (in the sense of Definition 3.10, Item 2), we obtain a transition A b , n αs -→ T A b , n and Σ such that (Σ , σ ) ∈ Sol π(n ) (C) and Σ |vars 2 (n) = Σ |vars 2 (n) (= Σ).

  case 1a: there exist no A 1-b such that A 1-b , n αs = ⇒ T A 1-b , n

  (ζ, u) not being a consequence of D(C e ).property 5 (Shape of F): For all ϕ ⇒ H ∈ F(C e ), ϕ only contains syntactic equations as hypothesis, i.e. no deduction facts. Moreover subterms 2 = (H) ⊆ Conseq(K ∪ D), and if H = ξ ? u then either u ∈ subterms (Φ) or there exists a recipe ζ such that (ζ, u) ∈ Conseq(K ∪ D).

  Inv sound . Let C = (Φ, D, E 1 , E 2 , K, F) for some (P , C , C e ) ∈ Γ , ψ ∈ K ∪ F,and (Σ, σ) such that(Φ, Σ, σ) |= ψ ∈D vars 2 (ψ )⊆vars 2 (ψ) ψ ∧ E 1 =

Γ

  in = {(P , C , C e ) | (P, C, C e ) ∈ Γ, (P, C, C e ) Y (X) ===⇒ s (P , C , C e )} Γ out = {(P , C , C e ) | (P, C, C e ) ∈ Γ, (P, C, C e ) Z ax |Φ(C e )|+1 = ======== ⇒ s (P , C , C e )}and the set of set of symbolic processes S obtained by normalising {Γ in , Γ out } with the simplification rules. Then Inv all (S).

  t. Then π.π .t = (π • π ).t. Proof. By definition, if t : A tr = ⇒ B, π.π .t is the unique trace of the form A π.π .tr = === ⇒ B, and (π • π ).t is the unique trace of the form A (π•π ).tr = ==== ⇒ B. Hence the result since π.π .tr = (π • π ).tr by definition of a group action.

  case 3a: b = b + i is a positive or null phase. Then we fix σ permuting independent actions of α • tr with tr = tr - 0

  If b = b + i is a null phase, A α -→ A is a positive phase. If b is a positive phase, (A α -→ A ) • b is a positive phase too. In both cases, it sufficies to choose π = σ +p +0 • (π ) +0 +1 with p = n j=i |b + j | + |b - j | case 3b: b = b - i is a negative phase.Similarly to case 2, we fix E the multiset of actions appearing in the word tr - i and we partition it asE = F G F = {β ∈ E | α || β} G = {[ a ] ∈ E | pref } .And again we let π - i permuting tr - i such thatπ - i .b - i : R tr F = = ⇒ S tr G = = ⇒ T tr F ∈ F tr G ∈ G .Then we let σ permuting independent actions ofα • tr • tr F with tr = tr - 0 • tr + 1 • tr - 1 • • • tr + i such that, writing s = (A α -→ B) • b - 0

  For the same reason as in case 2, Atr F = = ⇒ A and S tr G = = ⇒ T are negative phases. It therefore sufficies to choose π = σ +p +0 • (π - i ) p 1+|tr| • (π )

Proposition C. 25

 25 If π is consistent w.r.t. t then t π ∼ = tπ. The proof of this proposition is straightforward (≡ E and Ch can be replaced by syntactic equalities). An other property is: Proposition C.26 If u π ∼ = v and is a permutation of F 0 then u π ∼ = v . Besides if u and v have the same initial extended process B, π |L = id for L the set of labels of B, and t : A tr = ⇒ B, then t • u π ∼ = t • v

por

  We consider an arbitrary maximal extension u ∈ O ∀ c obtained by executing arbitrary blocks after u as long as possible. Then by Propositions 5.21, 5.24, 5.26 there exists ū ≡ b-por u such that ū ∈ O ∀ c+i * +0 . Since ū is maximal, by Proposition 5.28 there exists π permuting independent blocks of ū such that π.ū ∈ O ∀ por ⊆ O ∀ c+i * +0 and π.ū ≺ lex u. In particular by applying the induction hypothesis to π.ū we obtain u 2 such that π.ū = fst(u 2 ) ∼ snd(u 2 ). Hence the conclusion by Proposition C.10, since π.ū ≡ b-por u.case 2: u ∈ O ∀ por ∩ O ∀ symThen the conclusion follows from the hypothesis P sym Q.case 3: u ∈ O ∀ por O ∀ sym Let us write u = u 1 • b • u 2 with u 1 , u 2 ∈ O ∀ c and b ∈ T(A) a block such that b / ∈ O ∀ sym . Let 1 , .. . , k be the labels A and the label of its first action. case 3a: the first action of b is an input.We write = i 0 . Referring to the notations of the definition of O ∀ sym we let π ∈ Sym such that π(i 0 ) = min Orb(i 0 ) .The conclusion will follow from Proposition C.31 provided we manage to comply with its hypothesis. Thus let u ∼ = u a trace of the following formu : u 1 • b • u 2

  (i) either: A ∼ B; (ii) or: ∃A α -→ A , ∀B α = ⇒ B , A SB ; (iii) or: ∃B α -→ B , ∀A α = ⇒ A , A SBThe inclusion S ⊆ ≈ l is indeed clear if this property is verified, hence the expected conclusion provided such a relation S . We concretely define it as the smallest relation on extended processes saturated by the following inference rules:In particular, note that S ⊆ S thanks to the rule (Axiom). As for the two other rules (Dec-L) and (Dec-R), they intuitively decompose sequences α -→ tr = ⇒ into atomic transitions in order to switch from points 2. or 3. of Definition D.4 to points (ii) or (iii).

4 :

 4 case 1.a : A ∼ B. Then (i) is satisfied. case 1.b : there exists A α -→ A tr = ⇒ A such that A SB for all B α.tr = = ⇒ B . In particular, keeping in mind that S ⊆ S due to the rule (Axiom), we have A S B for all B α.tr = = ⇒ B . Let us then show that the transition A α -→ A satisfies (ii). We therefore have to show that A S B for all B α = ⇒ B . If A = A then the result follows from the hypothesis. Otherwise let us write A α -→ A α -→ tr = ⇒ A where α .tr = tr and immediate (ξΦ↓ = ζΦ↓ and ξΦ 0 ↓ = ζΦ 0 ↓). case 2 : ξ↓∈ AX and ζ↓∈ AX . If ξ = ζ the conclusion is immediate and so is it when ξ = ζ since Φ(ax 1 ) = Φ(ax 2 ) and Φ 0 (ax 1 ) = Φ 0 (ax 2 ). case 3 : ξ↓∈ AX and ζ↓= f (ζ 1 , . . . , ζ p ) with f ∈ F c .

case 1 :

 1 there exists a position π ∈ B such that | π| = i ∈ 0, n -1 and rootx | π = Node. The result follows from Lemma D.9 after writing the following sequence of transitions:CheckTree(x) ε = ⇒ Choose(p 1 , . . . , p i ). c h N (x |p 1 •••p i , s) . c h(1, s) ε = ⇒ c h N (x | π , s) . c h(1, s)case 2 : there exists a position π ∈ B n such that x | π / ∈ B. The result follows from Lemma D.9 after writing the following sequence of transitions:CheckTree(x) ε = ⇒ Choose(p 1 , . . . , p n ). c h N (x |p 1 •••pn , s) . c h(1, s) ε = ⇒ c h B (x | π , s) . c h(1, s)

  α), ax 2 → senc(b 0 , α), ax 3 → senc(b 1 , α)} Φ 2 = {ax 1 → α, ax 2 → β, ax 3 → γ} are statically equivalent iff t, b 0 , b 1 are pairwise disjoint terms, i.e. iff t / ∈ B.

  const. : 0, 1 booleans nil empty list names : r i,j Extr , a i,j Extr , 1 i 3, 1 j n encr. keys for Extract k 0 Final , . . . , k m Final encr. keys for Final k encr. key for Init Definition of Extract Following the same intuition as in Appendix 1.1, we could define Extract as a process ! ch c(senc( x, y , 0 , k)).c senc(x, k ) | ! ch c(senc( x, y , 1 , k)).c senc(y, k )

  Vérification efficace d'équivalences observationnelles de processus cryptographiques : théorie et pratique Résumé. Cette thèse porte sur l'analyse des protocoles cryptographiques. Ce sont des suites d'instructions permettant d'interagir à distance avec un interlocuteur tout en protégeant le contenu sensible de la communication d'une potentielle tierce partie malveillante. Des cas classiques où la confidentialité et l'intégrité de la communication sont critiques sont, parmi d'autres, les paiements et services de santé en ligne, ou le vote électronique.

  Performances of DeepSec (20 cores) against other protocol analysers (fixed scenario)

	Protocol (# of roles)	Akiss	APTE	SPEC	SatEquiv DeepSec
	Denning-Sacco Wide Mouth Frog Yahalom-Lowe Private Authentication 3G-AKA Passive Authentication BAC Prêt-à-Voter Helios Vanilla Helios ZKP (vote swap) Private authentication (anonymity and strong secrecy) ZKP with revote vanilla Helios (BPRIV ballot privacy) weeding Figure 3.6 Protocol + roles 3 <1s 6 <1s 7 6s 10 OM 12 29 3 <1s 6 <1s 7 <1s 10 10s 12 22m16s 14 OM 23 3 <1s 6 2s 7 42s 34m38s <1s 1s 3s 9m49 <1s <1s 1s 3m35 <1s 41s 10 OM 12 14 Strong secrecy 17 2 <1s <1s 4 <1s 1s 6 21s 4m18s 8 OM 10 Anonymity 15 4 1m35s 1h23m 6 OM 4 <1s 1s 6 2m15s 1m27s 7 1h40m 1m44s 9 2h08m 15 21 4 OM 38m56s Unlinkability 6 6 6 47s <1s 10 OM 11 Ballot privacy 12 only honest roles arbitrary roles arbitrary roles (+ decoy nonce excl.) 2 voters + honest ballot box 3 voters + honest ballot box 2 voters + ∼dishonest ballot box 2 voters + honest ballot box 2 voters + honest ballot box 2 voters + ∼dishonest ballot box BAC only honest sessions	11s OM 5s 1h11m <1s <1s <1s <1s <1s <1s <1s <1s OM <1s <1s <1s <1s <1s 7s <1s OM <1s 1s 1s 4s 7s 12s Analysis 7m 24s <1s <1s <1s <1s <1s 1s <1s <1s <1s 1s <1s <1s 1s <1s <1s <1s <1s 2s 2s 8s <1s <1s <1s 1s 2s 32s <1s 2s <1s <1s 1s <1s 9s 15s 1s 2s <1s <1s 1h 38m 4 roles <1s 7 roles 6s 8 roles 43s 9 roles 7m 41s 10 roles 1h 30m 1 role <1s 2 roles <1s 3 roles 1s 4 roles 30s 5 roles 1h 18m 3 ballots <1s 8 ballots 44s 9 ballots 4m 33s 10 ballots 10m 44s 11 ballots 3h 21m 3 ballots <1s 6 ballots 11s 7 ballots 1m 25s 8 ballots 11m 52s 9 ballots 1h 40m 1 ballot <1s 2 ballots <1s 3 ballots 1m 3s 1 ballot <1s 2 ballots <1s 1 ballot <1s 2 ballots <1s 1 ballot <1s 2 ballots <1s 2 sessions 13m 12s

Table 7

 7

	.1, p.182.

Table 7 .

 7 1 Summary of the results. Coloured cells indicate configurations with open problems. Naturally, in the case of StatEquiv and CSysEquiv, the non-applicable hypotheses on processes (e.g. boundedness) should be ignored when reading the table. All results of this table for diff-equivalence also apply to trace equivalence / labelled bisimilarity / equivalence by session of strongly-determinate processes.

		StatEquiv	CSysEquiv	DiffEquiv	Bisimilarity	SessEquiv	TraceEquiv
	theory	process

Dans ce chapitre je motive le problème de recherche que j'ai étudié au cours de ma thèse, à savoir la vérification automatisée de protocoles de sécurité. Mais avant tout, intéressons-nous à une petit énigme qui, surprenamment, cristallise plusieurs problématiques centrales de ce domaine de recherche malgré son ton enfantin; j'expliciterai par la suite le lien avec mes contributions.1 L'énigme du livreur gloutonIsabelle Bob voudrait acheter un gâteau à une pâtisserie de renom tenue par Isabelle. La boutique étant trop éloignée pour y aller en personne, il demande une livraison à domicile. Malheureusement le livreur est connu pour sa gourmandise : il a tendance à manger compulsivement les gâteaux qu'il est censé livrer. C'est une situation complexe : Isabelle et Bob ont besoin du livreur mais savent aussi qu'ils ne peuvent pas lui faire confiance.En discutant du problème par téléphone, ils se rendent compte qu'ils ont tous les deux des cadenas chez eux; ainsi, quand ils utiliseront ce service postal peu fiable, ils pourraient mettre les livraisons dans des coffrets cadenacés pour limiter le risque de vol.

les données envoyées pendant le protocole sont sensibles, un manque de confidentialité ou d'intégrité de la communication peut avoir des conséquences économiques ou politiques (pensez au cas des paiements en ligne ou des élections électroniques) ;

les protocoles sont déployés sur des réseaux peu fiables comme Internet : n'importe qui peut utiliser une antenne pour espionner les communications, ou même interférer avec elles.

Résistance au vol (ou confidentialité du contenu du coffre) : il n'existe aucune exécution du protocole permettant au livreur de manger le gâteau.

Résistance à l'usurpation d'identité (ou authentification) : il n'existe aucune execution du protocole où Bob accepte une commande qui ne vient pas d'Isabelle.

sauf s'il souffre de troubles du goût, ce qui rendrait son obsession pour les gâteaux d'Isabelle relativement incompréhensible

Dans[RK19] nous étudions dans quelle mesure des implémentations particulières de primitives cryptographiques telles que RSA ou AES sont sujettes à ce qu'on appelle des attaques par chronomètre (timing attack ). Ce type de faille, connu depuis des travaux en 1996-1998 sur l'exponentiation modulaire [Koc96, DKL + 98], repose sur la fuite d'information due au temps d'exécution des programmes. Nous proposons dans ce papier un modèle d'attaquant mieux adapté pour expliquer et comprendre les attaques par chronomètre, avec un accent particulier sur les stratégies d'attaque utilisant un paradigme de "diviser pour régner". Nous formalisons des conditions suffisantes, sous la forme de notions d'indépendance, garantissant que de telles attaques puissent être mises en pratique et étudions leur

complexité. 6 J'ai aussi ponctuellement participé à un effort de longue haleine sur le protocole QUIC dans [DLFP + 21], porté entre autre par Microsoft Research. QUIC est un protocole initialement proposé par Google en 2012 et qui se trouve être actuellement en cours de standardisation par l'IETF. Bien que la motivation initiale de l'IETF fût de concevoir un protocole héritant des garanties de sécurité de TLS 1.3 (qui ont nécessité des années à être démontrées), beaucoup d'abstractions de TLS ont été brisées dans le processus, aboutissant à un nouveau protocole, avec de nouvelles primitives cryptographiques, et donc peu de recul sur sa sécurité. J'ai contribué à démontrer dans l'assistant de preuve F certaines propriétés fonctionelles de QUIC, ainsi qu'à étudier certains problèmes de sécurité dûs à l'authentification faible de certains paramètres du protocole.

perfect lock security: he cannot break the locks or make the cake ooze through potential cracks in the chest (which permits to eat part of the cake without breaking anything).

key incorruptibility: he cannot sneak into Isabelle's or Bob's houses to steal the keys.

passivity: despite his greed, he never lies to the recipient about the content of the chest, that is, he follows the flow of the protocol without actively disrupting it.

up to potential taste disorders, which would make his obsession for Isabelle's cakes rather ununderstandable

Note: Vincent Cheval is the main implementor of this decision procedure

[START_REF] Cheval | DEEPSEC: Deciding equivalence properties in security protocols theory and practice[END_REF] presents our decidability and complexity results at the core of the DeepSec prover, therefore corresponding to Chapters 3,4,6. Note however that the performances of DeepSec and the presentation of the theory have significantly improved since this publication.

[CKR18b] is a tool paper presenting DeepSec, therefore with an emphasis on the engineering effort deployed. As above, both the performances and the user interface have significantly evolved since then.

[CKR19] describes the optimisation technique presented in Chapter 5, although the version presented in this manuscript is done in a slightly more general framework.

[CKR20] finally contains the decidability and complexity results of Chapter 7 without significant changes.

In[RK19] we study to which extent particular implementations of encryption primitives such as RSA or AES are subject to so-called timing attacks. This kind of vulnerabilities, known since early works in 1996-1998 on modular exponentiation [Koc96, DKL + 98], relies

In other formalisations of the applied pi-calculus, e.g.,[START_REF] Cheval | DEEPSEC: Deciding equivalence properties in security protocols theory and practice[END_REF], there are finitely many constants but a dedicated infinite set of public names. Here both are merged in F0 as in, e.g.,[START_REF] Chrétien | From security protocols to pushdown automata[END_REF].

digital signature, with a verification mechanism that recovers the signed message:F c = {pk/1, sign/3} F d = {verify/2}verify(sign(m, r, k), pk(k)) → m

cryptographic hash, using a function symbol of positive arity, e.g., F = F c = {h/1}, and no rewrite rules involving this symbol (in which case we say that h is free). The absence of rewrite rules models the expected properties of a cryptographic hash function, typically one-wayness or collision resistance.

zero-knowledge proofs, to prove that a given statement is true without revealing any related information: a typical example in cryptography being to prove to a party that one knows a value x without revealing the value itself. The modelling of such theories in the applied picalculus is for instance studied in[START_REF] Backes | Zero-knowledge in the applied pi-calculus and automated verification of the direct anonymous attestation protocol[END_REF] but we present here a more specific example that will be used in some of the protocol models presented in this thesis. Say that a recipient only accepts a message if the sender provides a proof that they have encrypted it themselves.

The classical semantics, which is the original semantics of the applied pi-calculus[START_REF] Abadi | The applied pi calculus: Mobile values, new names, and secure communication[END_REF], where internal communications are possible on any channel u (i.e., the condition that u should not be deducible from Φ is discarded).

The private semantics which is the one described in Figure1.1: internal communications are only allowed on channels that are not computable by the adversary. This models an attacker that continuously spies on compromised channels, rather than the classical attacker that simply has the capability to do so.

The eavesdrop semantics that allows internal communication on any channel like the classical semantics, but the attacker gets knowledge of the underlying message if the channel is compromised. This semantics has been introduced in[START_REF] Babel | On the semantics of communications when verifying equivalence properties[END_REF].

A voter oracle O voter that simulates the behaviour of the honest voters during the election, that is, the voters that have not been compromised by the adversary.

A cast oracle O cast that simulates the behaviour of dishonest voters, that is, voters that follow the voting instructions of the adversary.

A public bulletin board oracle that provides the current (public) state of the election. It can typically return, for example, the set of all ballots cast so far.

The tally that computes the final result of the election that the attacker simulated by its successive calls of the above oracles.

The voters: a compromised voter reveals its secret credentials (such as signing keys, if any) to the adversary and receives its voting instructions from them.

The tally: a compromised tally reveals the secret key of the election to the adversary, making it critical for security.

The ballot box : if compromised the ballot box may remove some ballots or modify them before submitting them to the tally.

If A 1-b is not reducible by ᾱ = ⇒ T then N has a unique child labelled ({A b }, n );

otherwise the children of N are the nodes labelled({A 0 , A 1 }, n ), A 1-b , n ᾱ = ⇒ T A 1-b , n .We say that w s is a symbolic witness for A 0 , A 1 , n when root(w s ) is labelled by ({A 0 , A 1 }, n).

only patterns of the form u1, . . . , un are allowed where each ui is either a free variable or a term without free variables. That is, we only allow patterns that decompose tuples and possibly check that some components are equal to a given term.

A set of rules to compute most general solutions (Section

2).2 A set of symbolic rules (Section 3.1) that formalise how to apply symbolic transitions to extended symbolic processes. 3 Various sets of simplification rules (Sections 2.3, 3.2 and 3.3) that simplify vectors to remove unsatisfiable systems, or to split components that contain processes with nonstatically-equivalent solutions. 4 A set of case distinction rules (Section 4) that refines the current vector based on case analyses to enforce the various properties of the partition tree (unique mgs in each component, maximal components w.r.t. static equivalence...).

ProVerif successfully proves P ≈ Q where Q = c(x). if bool(x) = ok then if x = 0 then R(x) else R(x) and R(x) = c x | c ¬x .

≈ t , ≈ s and ≈ l coincide for action-determinate processes.

DiffEquiv, TraceEquiv, SessEquiv and Bisimilarity are logspace-reducible to each others for simple processes.

3 Strongly-determinate processes are action determinate, simple processes are action determinate, and bounded simple processes are strongly determinate.

private types were called honest types in[START_REF] Chrétien | Decidability of trace equivalence for protocols with nonces[END_REF].

Part II

DEciding Equivalence Properties in SECurity protocols

Existential symmetry optimisation

The goal of this optimisation is to exploit symmetries when applying the matching rule: when several processes are structurally equivalent then we do not need to consider redundant matchings. For instance, suppose that we need to match P 1 | P 2 with Q | Q. Just considering the identity permutation would be sufficient, and the permutation (1 2) should be considered as redundant. Formally, let us consider an instance of the rule (Match)

We only consider S p instead of the usual S n for convenience as it will ease the formalisation of the optimisation, in particular the definition of the following relation on S p :

Proposition 5.31

∼ is an equivalence relation on S p .

Proof. We first observe that A ≡ B implies π.A ≡ π.B, in particular Stab(snd(A 2 )) is a group by Proposition 5.13. The conclusion is then immediate (reflexivity: a group of permutations contains the identity; symmetry: a group is closed by inverse; transitivity: a group is closed by composition).

We say that an instance of rule (Match) is well-formed when the underlying permutation π is minimal within its equivalence class for ∼, w.r.t. an arbitrary total ordering on permutations. We denote by O ∃ sym the set of traces of extended twin processes whose instances of rule (Match) are all well-formed. The correctness of this optimisation is stated below and proved in Appendix C. Proposition 5.32

sym is a correct refinement of O ∃ all .

5 Symbolic analysis and implementation

Section summary

We show that the construction of the partition tree (Chapter 4) can be adapted to equivalence by session and its optimisations. We then compare the performances of the modified algorithm with the procedure for trace equivalence, in terms of expressivity and verification time.

Symbolic matching

Subprocess matchings All optimisations aside, the essence of equivalence by session is to add structural requirements on top of the decision procedure for trace equivalence. As such we build on the procedure described in Chapter 3 to generate a partition tree. To make 2 Bounding the size of most general solutions

Section summary

Using the results of the previous section, we now prove that the partition trees generated by Algorithm 1 have the remarkable property that all nodes have a most general solution of exponential size. This will be the core argument to prove equivalences to be decidable in coNEXP.

Overall approach

Objective We now focus on the theoretical complexity of the decision problems TraceEquiv, Bisimilarity and SessEquiv. Our goal for now is to prove that these three equivalences are decidable in coNEXP and the core argument to achieve this is to prove the theorem: Theorem 6.5 (size of most general solutions)

If T is a partition tree of P, Q (w.r.t. a theory E) generated by Algorithm 1, then for all nodes n of T , |mgs (n)| dag is exponential in |P, Q, E| dag .

We will detail in Section 3 how to derive a coNEXP decision procedure for equivalence properties by using this result. To bound the size of most general solutions we rely on the results previously established in Section 1.1: in the final partition tree mgs (n) = µ 2 (Γ(n)) and it therefore sufficies to prove that for all nodes, µ 2 (Γ(n)) dag is exponential in |P, Q, E| dag . However we will instead study the easier-to-track bound:

Evolution of second-order terms Let us now consider each constraint-solving rule and determine how T 2 evolves along the components along a branch of the partition tree. 1 Symbolic rules: only Rules (E-In) and (E-Out) increase the size of T 2 by adding at most two new second order variables. 2 Simplification, normalisation, vector-simplification rules: only Rule (Vect-add-Conseq) may increase the size of T 2 (Γ). Indeed, it transfers a deduction fact from F in K for each extended constraint systems in the current component Γ. 3 Case distinction rules: the positive branches of these rules increase the size of T 2 whereas the negative branches leave it unchanged. It therefore sufficies to prove the following result to obtain Theorem 6.5: Proposition 6.6 (evolution of second-order terms in partition trees) If S ∪ {Γ} → S ∪ S where S = {Γ } is obtained by Rule (Vect-add-Conseq) or Γ ∈ S is the positive branch of a case distinction rule, then T 2 (Γ ) dag -T 2 (Γ) dag is bounded by a polynomial in |P, Q, E| dag . Indeed we recall that by Theorem 6.4, we already know that each branch of the partition tree is obtained after applying at most an exponential number of rules (negative branches of case distinction rules excluded). Hence we obtain the expected exponential bound on T 2 when combined with the above proposition. The remaining of Section 2 is dedicated to its proof.

Chapter 7:

The big picture: survey and new results

Summary.

In the previous chapter we proved the equivalence problems to be coNEXP complete for a quite large class of processes; however they may naturally be decidable more efficiently in specific subclasses of bounded (or even unbounded) processes. In this chapter we survey in more details, and cast in a common formalism, the existing complexity results about the decision of equivalence properties in the applied pi-calculus. This effort allowed us to identify subtle differences across the literature on how the problems were stated, sometimes influencing the complexity. We also include a couple of new results (see Table 7.1 in Section 5 for a summary).

NB. We found it interesting to outline some proofs of the surveyed results, even when they are not novel. However due to the number of results of this chapter, for readability reasons most of the proofs of our own results are only sketched in this chapter. Detailed proofs in Appendix E.

Complexity of static equivalence

Section summary

We first study the complexity of the StatEquiv problem. The main result is that it is P for subterm convergent theories provided they are considered as a constant of the problem, and coNP complete without this assumption.

Subterm convergent theories

We first focus on the class of subterm convergent theories. Historically, the complexity of static equivalence has only been considered for fixed theories [START_REF] Abadi | Deciding knowledge in security protocols under equational theories[END_REF][START_REF] Baudet | Sécurité des protocoles cryptographiques: aspects logiques et calculatoires[END_REF], that is, the theory was not part of the input of the problem and its size was seen as a constant in the complexity analysis. We recall that this corresponds to the decision problem E-StatEquiv defined in Chapter 1, Section 4.3. This was consistent with most formalisms and verification tools at the time, which would not allow for user-defined theories and only consider a fixed set of cryptographic primitives, such as in the spi-calculus for example [START_REF] Abadi | A calculus for cryptographic protocols: The spi calculus[END_REF]. For example: Theorem 7.1 (static equivalence for fixed subterm convergent theories [START_REF] Abadi | Deciding knowledge in security protocols under equational theories[END_REF])

For all subterm convergent theories E, E-StatEquiv is in P. In this appendix we prove the technical results used in Chapter 3 to decide trace equivalence and labelled bisimilarity of bounded processes using partition trees.

For trace equivalence

We first prove the two technical properties used in the criterion for trace equivalence. They essentially generalise the properties of the partition tree, stated for edges in Definition 3.10, to arbitrary branches. We first generalise the fact that the nodes of the tree are labelled by maximal configurations, i.e., Definition 3.10, Item 4: Lemma 3.4

Assume that (P 1 , C 1 ), n tr = ⇒ T (P 1 , C 1 ), n and (P 2 , C 2 ) tr = ⇒ s (P 2 , C 2 ) with (P 2 , C 2 ) ∈ Γ(n). We also consider, for all i ∈ {1, 2}, a solution (Σ , σ i ) ∈ Sol π(n ) (C i ) such that Φ(C 1 )σ 1 ∼ Φ(C 2 )σ 2 . Then we have (P 2 , C 2 ), n tr = ⇒ T (P 2 , C 2 ), n .

Proof. We proceed by induction on the length tr. The case tr = ε follows from the saturation of nodes under τ -transition (Definition 3.10, Item 1). Otherwise we let, with tr = α • tr,

We also consider the restrictions Σ = Σ |vars 2 (n) and Σ = Σ |vars 2 (ñ) . In particular Σ ⊆ Σ and there exist σ 2 , σ1 , σ2 such that

The hypothesis that Φ(C 1 )σ 1 ∼ Φ(C 2 )σ 2 also implies that Φ( C1 )σ 1 ∼ Φ( C2 )σ 2 . Besides since predicates are refined along branches (Definition 3.10, Item 3) and are defined on the variables of their configurations (Definition 3.9, Item 1), we know that Σ and Σ verify π(n) and π(ñ), respectively.

All in all we can use the maximality of the node ñ (Definition 3.10, Item 4 applied to the edge n α -→ ñ), which gives that ( P2 , C2 ) ∈ Γ(ñ). Hence (P 2 , C 2 ), n α = ⇒ T ( P2 , C2 ), ñ by definition 195 Appendix and the conclusion then follows from the induction hypothesis applied to the remaining of the traces.

We now generalise the fact symbolic transitions are reflected in the tree, in the sense of Definition 3.10, Item 2: Lemma 3.5

Let n be a node of a partition tree T and (P, C) ∈ Γ(n). If (P, C) tr = ⇒ s (P , C ) and (Σ, σ) ∈ Sol π(n) (C ) then there exist a node n and a substitution Σ such that (P, C), n tr = ⇒ T (P , C ), n and (Σ , σ) ∈ Sol π(n ) (C ). By induction hypothesis we therefore obtain ñ, Σ such that (P, C), n tr = ⇒ T ( P, C), ñ and ( Σ, σ |vars 1 (ñ) ) ∈ Sol π(ñ) ( C). Let us then consider the extension

To conclude the proof it sufficies to apply the Item 2 of Definition 3.10 to the symbolic transition ( P, C) α = ⇒ s (P , C ) and the solution ( Σe , σ); what remains to prove is therefore that we effectively have ( Σe , σ) ∈ Sol π(ñ) (C ). First of all we indeed have by construction dom( Σe ) = vars 2 (C ) and dom(σ) = vars 1 (C ). We also know that Σe satisfies the predicate π(ñ) because Σ = Σe |vars 2 (ñ) satisfies it. The first-order solution σ satisfies the constraints of E 1 (C ) since (Σ, σ) ∈ Sol (C ) by hypothesis. Finally we let ϕ ∈ D(C ) and prove that (Φ(C ), Σe , σ) |= ϕ:

The conclusion follows from the fact that ( Σ, σ |vars 1 (ñ) ) ∈ Sol ( C).

The conclusion follows from the fact that (Σ, σ) ∈ Sol (C ). case 3: ϕ = ∀X. X ? x

We have to prove that xσ is not deducible from the frame Φ(C )σ, which is a consequence from the fact that (Σ, σ) ∈ Sol (C ).

For labelled bisimilarity

We now prove a technical lemma that proves the correctness of the criterion for deciding labelled bisimilarity (Theorem 3.7). We proceed by induction on the structure of the (symbolic) witness and have to strengthen the statement of the theorem for this purpose.

Analogue to case 1 in the simpler case where n = n and Σ = Σ = Σ . Note also that the analogue of case 1a cannot arise.

Proof of Lemma A.1, 2⇒1. We construct a concrete witness w of (A c 0 , A c 1 ) as follows:

w = ((P 0 σ 0 , Φ(C 0 )σ 0 ↓), (P 1 σ 1 , Φ(C 1 )σ 1 ↓)) N node of w s labelled ((P 0 , C 0 ), (P 1 , C 1 ), n), ∀i ∈ {0, 1}, (f sol (N ), σ i ) ∈ Sol (C i )

The fact that all (B 0 , B 1 ) ∈ w verify B 0 ∼ B 1 follows from Definition 3.9. Then let us consider ((P 0 σ 0 , Φ(C 0 )σ 0 ↓), (P 1 σ 1 , Φ(C 1 )σ 1 ↓)) ∈ w using the notations of the construction of w above. By definition of a symbolic witness there exists b ∈ {0, 1} and a transition (P b , C b ), n . By completeness of the symbolic semantics (which is possible to apply since f sol (N ) ⊆ f sol (N ) by definition of a solution of a symbolic witness) and maximality of the node n (Definition 3.10, Item 4), there cannot exist any concrete trace of the form

-----→ (P, Φ) such that Φ ∼ Φ(C b )σ b , hence the conclusion. case 2: the children of N = root(w s ) are all the nodes N labelled ({(P 0 , C 0 ), (P 1 , C 1 )}, n ), where (P 1-b , C 1-b ), n α = ⇒ T (P 1-b , C 1-b ), n (and there is at least one such child)

Let N be an arbitrary child of N , labelled ({(P 0 , C 0 ), (P 1 , C 1 )}, n ) with the above notations. As in the previous case we consider the concrete transition obtained by soundness of In this appendix we prove the technical results used in Chapter 4 to construct the partition tree of two bounded processes using constraint solving.

Invariants of the procedure

In this section we present some additional properties that are verified all along the procedure by the nodes of the partition tree under construction. Such nodes are sets of extended symbolic processes (i.e. tuples (P, C, C e ) with P a process, C a constraint system and C e an extended constraint system). Understanding the technical details of these invariants is not necessary to understand the algorithm itself, however most of our subprocedure (e.g. the generation of most general solutions) are only correct in their context.

Invariant 1: Well-formedness The first invariant is about the shape of the extended constraint systems. Two important properties are that all equations of E 1 and E 2 are trivially satisfiable (they are essentially of the form x = ? u where x appears nowhere else in the constraint system) and that those of E 2 only use terms that can be constructed from the knowledge base (i.e. they are consequences of K ∪ D).

Definition B.1

We define the predicate Inv wf on extended constraint systems as follows; we have that Inv wf ((Φ, D, E 1 , E 2 , K, F)) holds when Variables in K and F: vars 2 (K, F) ⊆ vars 2 (D) Equation: mgu(E i ) = ⊥, dom(mgu(E i ))∩vars i (D) = ∅, vars i (img(mgu(E i ))) ⊆ vars i (D). Solution is consequence: img(mgu(E 2 )) ⊆ Conseq(K ∪ D). Shape of K: For all ψ = (ξ ? u) ∈ K, ψ ∈ F, u / ∈ X 1 , u ∈ subterms (Φ) and subterms (ξ) ⊆ Conseq(K ∪ D). Shape of F: For all ∀S. ϕ ⇒ H ∈ F(C), S is empty and ϕ only contains syntactic equations as hypothesis, i.e. no deduction facts. Moreover subterms 2 = (H) ⊆ Conseq(K ∪ D), and if H = ξ ? u then either u ∈ subterms (Φ) or there exists a recipe ζ such that (ζ, u) ∈ Conseq(K ∪ D).

199

Appendix

This invariant is lifted to sets of extended constraint systems in the natural way, i.e. Inv wf (S) holds iff for all C ∈ S, Inv wf (C) holds.

Invariant 2: Formula soundness The second invariant states that any substitution that satisfies the deduction facts of D and the equalities of E 1 also satisfies all formulas of K ∪ F. This means that the procedure only adds correct formulas to the constraint system, sometimes under some hypothese for the formulas of F.

Definition B.2

We define the predicate Inv sound on extended constraint systems as follows; we have that Inv sound ((Φ, D, E 1 , E 2 , K, F)) holds when for all ψ ∈ K ∪ F, for all substitutions Σ, σ, if

Invariant 3: Formula completeness Given a formula ψ = ϕ ⇒ H in F, the soundness invariant above states that when some substitutions satisfy ϕ then they also satisfy the head H. The next invariant can be seen as a kind of converse statement: when some substitutions satisfy the head H, there exists a formula ψ ∈ F (not necessarily the same) that has the same head and whose hypotheses are satisfied. This means that the procedure always covers all cases when generating the potential hypotheses of a given head H.

Definition B.3

In this definition, we say that (Φ, Σ, σ) weakly satisfies a head H when:

if H = ξ ? u then msg(ξΣΦσ), i.e. the recipe ξ leads to a valid message if H = ξ = ? f ζ then (Φ, Σ, σ) satisfies H in the usual sense, i.e. the recipes ξ, ζ lead to the same valid message. Given a set of extended processes Γ, the predicate Inv comp (Γ) holds when for all C e 1 , C e 2 ∈ Γ, for all (ϕ ⇒ H) ∈ F(C e 1 ), for all (Σ, σ) ∈ Sol (C e 2 ), if (Φ(C e 2 ), Σ, σ) weakly satisfies H then there exists

Invariant 4: Knowledge-base saturation The next invariant states that the knowledge base K is saturated, i.e. that we do not miss solutions by imposing that they are constructed from K (see Definition 4.4).

Definition B.4

We define the predicate Inv satur on extended constraint systems as follows. We have that Inv satur (C) holds when, considering the minimal k such that vars

Invariant 5: Preservation of solutions Finally the last invariant states that all the constraint solving performed on the additional data of extended constraint systems (E 2 , K, F) preserves the solutions. That is, in an extended symbolic process (P, C, C e ), where C is the constraint system obtained by only collecting constraints during the execution of the process P (i.e. without additional constraint solving), all solutions of C e are solutions of C.

Definition B.5

We define the predicate Inv sol defined on extended symbolic processes where Inv sol ((P, C, C e )) holds when for all i ∈ N,

We restrict the substitutions to the variables of C since our extended constraint system may introduce new variables (e.g. by applying most general solutions) but all these variables are uniquely defined by the instantiation of the variables of C.

Invariant 6: Component structure Finally we state an invariant on components stating that all of their constraint systems have the same second-order structure. This invariant is preserved during the procedure by the fact that the constraint-solving rules that modify K or E 2 are always applied to the entire components.

Definition B.6

We define the predicate Inv str defined on sets of extended symbolic processes where Inv sol (Γ) holds when for all

Overall invariant As we mentioned, all invariants are lifted to sets of extended symbolic processes in the natural way if needed. We refer as

the invariant of the whole procedure on the nodes of the partition tree (i.e. sets of extended symbolic processes).

Preservation of the invariants

In this section we prove that the invariants of the procedure stated in Section 1 are preserved all along the procedure. First of all we prove the case of the case distinction rules:

Let S be a set of set of extended symbolic processes such that Inv all (S). Let S → S by Appendix applying one case distinction rule and then normalising the result with the simplification rules. We have that Inv all (S ).

For the proof we let Γ ∈ S and write Γ ∈ S the set from which Γ is originated, i.e. Γ is one of the sets obtained after applying one case distinction rule to Γ (either the positive or the negative branch) and then normalising with the simplification rules.

Proof of preservation of Inv wf . Let C e = (Φ, D, E 1 , E 2 , K, F) for some (P , C , C e ) ∈ Γ . We consider each item of the definition of the predicate (Definition B.1) and show that C e verifies them.

property 1 (Variables in K and F):

We first observe that this property is preserved by all simplification rules: therefore it sufficies to prove that it is preserved by application of case distinction rules. For that we also observe that if C e is an extended constraint system verifying this property then for all second-oder substitutions Σ, C e :Σ verifies it as well (which is precisely why we consider this notation rather than a raw application C e Σ). This is sufficient for getting the expected result for Rule (Sat). The case of the negative branches of Rules (Rew) and (Eq) are trivial. Regarding their positive branches, we only treat the case of Rule (Eq) since the treatment of (Rew) can be obtained by using a similar reasoning on each formulas added by the rule (the sets F 0 in the notations of Rule (Rew)). The rule (Eq) does not introduce elements in K and the only second-oder variables introduced in F that are not trivially added to D are from recipes ξ 1 , ξ 2 such that ξ 1 ? u 1 , ξ 2 ? u 2 ∈ K(C e ) for some (P, C, C e ) ∈ Γ. In particular by hypothesis vars 2 (ξ 1 , ξ 2 ) ⊆ vars 2 (D(C e )) ⊆ vars 2 (D(C e )), hence the conclusion.

property 2 (first and second-order equations): we have mgu(E i ) = ⊥, dom(mgu(E i )) ∩ vars i (D) = ∅, and vars i (img(mgu(E i ))) ⊆ vars i (D).

The fact that mgu(E i ) = ⊥ is a direct consequence of the facts that C e = ⊥ and that C e is already normalised by the simplification rules of Figure 4.2, in particular Rules Norm-Unif and the rules inherited from Figure 4.1. The remaining properties are simple invariants of the mgu's that are straightforward to verify.

This property comes from the fact that mgu(E 2 ) is only modified in the positive branches of the case distinction rules by applying a mgs Σ to the extended constraint systems C e ∈ Γ. A quick induction on the constraint solving relation for computing mgs show that img(Σ) ⊆ Conseq(K(C e ) ∪ D(C e )), hence the conclusion.

The only rule adding a deduction fact to K is the rule (Vect-add-Conseq); in particular this gives ψ ∈ F. The added deduction facts are of the form ξ ? u where, for some

for any recipe ζ. The fact that ξ ? u ∈ F(C e ) and Inv wf (Γ) (property 5) justify that subterms (ξ) ⊆ Conseq(K ∪ D); this justifies that u ∈ subterms (Φ) as well when taking into account that u is not a consequence of D(C e ) (in particular it cannot be a ground contructor term without names otherwise it would even be consequence of the empty set). Finally the property u / ∈ X 1 also follows from

Appendix

observe that this property is preserved by the application of a mgs to an extended constraint system. In particular this makes the conclusion immediate for all rules except the following: Rule (Rew) (positive branch): using the notations of the rule and recalling Inv sound (Γ), the conclusion follows from the fact that if ξ 0 ΣΦσ↓= u 0 ↓, → r ∈ R and C[u] = σ for some substitution σ , then C[ξ 0 ]ΣΦσ↓= rσ ↓. Rule (Eq) (positive branch): using the notations of the rule and recalling Inv sound (Γ), if ψ is the formula added to F by this rule, we have (Φ, Σ, σ) |= ψ iff for some recipes ξ 1 , ξ 2 , if ξ 1 ΣΦσ↓= z and ξ 2 ΣΦσ↓= z then ξ 1 ΣΦσ↓= ξ 2 ΣΦσ↓. This naturally holds. Rule (Vect-add-Conseq): since the element added to K is originated from F, the conclusion follows from Inv sound (Γ).

Rule (Vect-add-Formula): the reasoning is identical to the one for (Eq).

Proof of preservation of

We assume that (Φ(C e 2 ), Σ, σ) weakly satisfies H. We want to prove that there exists ψ = (ϕ ⇒ H ) ∈ F(C e 2 ) such that H h H and (Φ(C e 2 ), Σ, σ) |= ϕ . We prove the strenghtened property stating that the invariant is preserved after the application of each case-distinction and simplification rules.

Rules (Norm-Unif), (Norm-no-MGS), (Norm-Diseq): the conclusion directly follows from Inv comp (Γ). Rule (Norm-Formula): by Inv comp (Γ) we let

2 ), Σ, σ) |= ϕ 0 . The conclusion directly follows from this, except if ψ 0 is the formula removed by the rule, i.e. if mgs

However this would yield a contradiction with (Φ(C e 2 ), Σ, σ 2 ) |= ϕ 0 , hence the conclusion. Rule (Norm-Dupl): using the same notations as in the previous case, we let ψ 0 by Inv comp (Γ) and the only non-trivial case is again the one where ψ 0 is removed from C e 2 by the rule. This means that there exists ψ ∈ F(C e

2 ) solved such that ψ h H 0 , hence the conclusion since hyp(ψ ) = and H 0 h H. Rules (Vect-rm-Unsat) and (Vect-Split): the conclusion follows from the Inv comp (Γ) since Γ ⊆ Γ. Rule (Vect-add-Conseq): directly follows from Inv comp (Γ). Rule (Vect-add-Formula): Let us write

with the notations and assumptions of the rule. If i ∈ {1, 2} we write S i = (P, C, C e i ). The only case that does not directly follows from Inv comp (Γ) is the case where ψ = ψ:(Σ, C e 1 ). But since there exists a formula ξ ? u S 2 ∈ F(C e 2 ) by hypothesis, we know by Inv sound (Γ) that ξΦ(C e 2 )Σσ 2 ↓= u S 2 . In particular since (Φ(C e 2 ), Σ, σ 2 ) weakly satisfies ξ = ? f ζ, we can write u S 2 = ζΣΦ(C e 2 )σ i ↓ and have u S 2 = u S 2 . Since we also have by definition (after formula normalisation, see Figure 4.1)

we obtain the expected conclusion. Any case-distinction rule (negative branch) or Rule (Sat): follows from Inv comp (Γ).

knowledge base is saturated. Let us then consider (P, C, C e ) ∈ Γ for some Γ ∈ S and we let k the minimal index such that vars 2 (D(C)) ⊆ X 2 k . We then let f/n ∈ F d and (ξ 1 , u 1 ), . . . , (ξ n , u n ) ∈ Conseq(K(C e )) such that u↓, with u = f(u 1 , . . . , u n ) is a constructor term. We recall that no case-distinction rules can be applied to {Γ}, in particular (Rew). But since the rewriting system is constructor-destructor, f ∈ F d , and u↓ is a constructor term, this means that a rewrite rule is applicable at the root of u. We distinguish two cases. case 1: there exists a rule → r applicable at the root of u, i ∈ 1, n and p a position such that |i•p / ∈ X 1 and (ξ i|p ? v) ∈ K(C e ) for some v.

We consider the instance of Rule (Rew) with the following parameters: the position i • p, the rule → r, a recipe ξ ∈ T (F, X : |Φ(C e )|), the formula ψ 0 obtained by considering the rule → r in RewF(ξ, → r, i • p), the deduction fact ξ i|p ? v, Σ 0 = {ξ |i•p → ξ i|p }, and a mgs Σ such that the head of ψ 0 :(Σ 0 Σ, C e :Σ) is of the form ζ ? u↓ for some recipe ζ. Since this instance of the rule is not applicable by hypothesis, we deduce that there already exists a solved formula ψ ∈ F(C e ) of the form ζ ? u↓. Since no simplification rules are applicable neither, in particular (Vect-add-Conseq), we deduce that there exists a recipe ξ such that (ξ , u↓) ∈ Conseq(K(C e ) ∪ D(C e )).

case 2: otherwise We let → r an arbitrary rewrite rule applicable at the root of u. By hypothesis for all positions i • p of that are not variables we know that ξ i|p is not the recipe of a deduction fact from K(C e ); since ξ i ∈ Conseq(K(C e )), root(ξ i|p ) is therefore a constructor symbol. We rule out the immediate case where r is a ground term and only consider the one where r is a strict subterm of . Then, since the rewriting system is constructor-destructor, we can fix a ground constructor context C such that r = C[x p , . . . , x q ] for x p , . . . , x p the variables numbered p to q of (w.r.t. the lexicographic ordering on the positions of the term ). In particular the recipe (C[ξ p , . . . , ξ q ], u↓) ∈ Conseq(K(C e )).

Preliminary technical results

In this section we prove some low level technical results that will be useful during the incoming proofs.

Preservation by application of substitutions In this section, we show that applying substitution preserves in some cases the different notions we use in our algorithms, namely first-order and second-order equations, deduction and equality facts; and uniformity.

Lemma B.3

Let ψ be either a deduction fact, or an equality fact or a first-order equation or a second-order equation. For all ground frame Φ, for all substitutions Σ, Σ , σ, σ if dom(Σ) ∩ dom(Σ ) = ∅ and dom(σ) ∩ dom(σ ) = ∅ then (Φ, ΣΣ , σσ ) |= ψ is equivalent to (Φ, ΣΣ , σσ ) |= ψΣσ and is equivalent to (Φ, Σ , σ ) |= ψΣσ.

Proof. The proof of this lemma is done by case analysis on ψ.

Case u = ? v: Consider (Φ, ΣΣ , σσ ) |= u = ? v. This is equivalent to uσσ = vσσ . Since 207 vars (Σ) ∩ X 1 = ∅, we deduce that (Φ, ΣΣ , σσ ) |= u = ? v is equivalent to uΣσσ = vΣσσ . This is also equivalent to uΣσσσ = vΣσσσ and so (Φ, ΣΣ , σσ ) |= uΣσ = ? vΣσ. Note that uΣσσ = vΣσσ is also equivalent to (Φ, Σ , σ ) |= uΣσ = ? vΣσ.

Case ξ = ? ξ : Similar to the previous case.

Case ξ ? u: Consider (Φ, ΣΣ , σσ ) |= ξ ? u. It is equivalent to ξΣΣ Φ ↓= uσσ and msg(ξΣΣ Φ). But (ξ ? u)Σσ = ξΣ ? uσ. Moreover, by definition of substitution (in particular the acyclic property), we deduce that ξΣΣ Φ = ξΣΣΣ Φ and uσσ = uσσσ . Hence, msg(ξΣΣ Φ) is equivalent to msg(ξΣΣΣ Φ); and ξΣΣ Φ ↓= uσσ is equivalent to ξΣΣΣ Φ↓= uσσσ . Hence (Φ, ΣΣ , σσ ) |= ξ ? u is equivalent to (Φ, ΣΣ , σσ ) |= ξ ? uΣσ. Note that msg(ξΣΣ Φ) and ξΣΣ Φ↓= uσσ are also equivalent to (Φ, Σ , σ ) |= ξΣ ? uσ.

Case ξ = ?

f ξ : Similar to previous case.

Properties on consequence of set of deduction facts This section contains some results about the consequence relation when modifying a set of deduction facts. The first lemma is about the application of substitutions.

Lemma B.4

Let S be a set of solved deduction facts. For all substitutions σ of protocol terms, for all (ξ, t) ∈ Conseq(S), (ξ, tσ) ∈ Conseq(Sσ).

Proof. We know that (ξ, t) ∈ Conseq(S) implies ξ = C[ξ 1 , . . . , ξ n ] and t = C[t 1 , . . . , t n ] for some public context C and for all i, (ξ i ? t i ∈ S. Hence (ξ i ? t i σ ∈ Sσ which allows us to conclude.

Proposition B.5 (transitivity of consequences)

Let S, S be two sets of solved deduction facts. Let ϕ = {X i ? u i } n i=1 such that all X i are pairwise distinct, let (ξ, t) ∈ Conseq(S ∪ ϕ) and Σ, σ be two substitutions. If for all i ∈ 1, n , (X i Σ, u i σ) ∈ Conseq(SΣσ ∪ S ) then (ξΣ, tσ) ∈ Conseq(SΣσ ∪ S ).

Proof. We prove this result by induction on |ξ|. The base case (|ξ| = 0) is trivial as there are no terms of size 0 and we hence focus on the inductive step. We perform a case analysis on the hypothesis (ξ, t) ∈ Conseq(S ∪ ϕ).

We directly have by definition that (ξΣ, tσ) ∈ Conseq(SΣσ ∪ S ).

case 2: there are ξ 1 , t 1 , . . . , t m , ξ m and f ∈ F c such that ξ = f(ξ 1 , . . . , ξ m ), t = f(t 1 , . . . , t m ) and for all i ∈ 1, m , (ξ i , t i ) ∈ Conseq(S ∪ ϕ)

By induction hypothesis we know that for all j ∈ 1, m , (ξ j Σ, t j σ) ∈ Conseq(SΣσ ∪ S ). Writing ξΣ = f(ξ 1 Σ, . . . , ξ m Σ) and tσ = f(t 1 σ, . . . , t m σ), we conclude that (ξΣ, tσ) ∈ Conseq(SΣσ ∪ S ). case 3: ξ ? t ∈ S ∪ ϕ If (ξ ? t) ∈ S then (ξΣ ? tσ) ∈ SΣσ and the result directly holds. Otherwise ξ ? t ∈ ϕ Appendix and hence by hypothesis (ξΣ, tσ) ∈ Conseq(SΣσ ∪ S ).

The previous lemma showed that a consequence (ξ, t) is preserved when applying some substitution Σ, σ under the right conditions. However, it is quite strong since we ensure that ξΣ is consequence with tσ. In some cases, we cannot guarantee that ξΣ is consequence with tσ but with some other first-order term. This is the purpose of the next lemma.

Lemma B.6

Let S, S be two sets of solved deduction facts. Let ϕ = {X i ? u i } n i=1 such that all X i are pairwise distinct. For all Σ, for all ξ ∈ Conseq(S ∪ ϕ), if for all i ∈ {1, . . . , n}, X i Σ ∈ Conseq(SΣ ∪ S ) then ξΣ ∈ Conseq(SΣ ∪ S ).

Proof. We prove this result by induction on |ξ|. The base case (|ξ| = 0) being trivial as there is no term of size 0, we focus on the inductive step.

Since ξ is consequence of S ∪ ϕ, we know by definition that there exists t such that one of the following conditions hold: 1 ξ = t ∈ F 0 2 there exists ξ 1 , t 1 , . . . , t m , ξ m and f ∈ F c such that ξ = f(ξ 1 , . . . , ξ m ), t = f(t 1 , . . . , t m ) and for all i ∈ {1, . . . , m}, (ξ i , t i ) is consequence of S ∪ ϕ. 3 there exists t such that ξ ? t ∈ S ∪ ϕ.

In case 1, we directly have by definition that (ξΣ, t) is a consequence of SΣ ∪ S . In case 2, by our inductive hypothesis on ξ 1 , . . . , ξ m , we have that for all j ∈ {1, . . . , m}, ξ j Σ is a consequence of SΣ ∪ S hence there exists t 1 , . . . , t m such that for all j ∈ {1, . . . , m}, (ξ j Σ, t j ) is a consequence of SΣ ∪ S . With ξΣ = f(ξ 1 Σ, . . . , ξ m Σ) and t = f(t 1 , . . . , t m ), we conclude that (ξΣ, t ) is consequence of SΣ ∪ S . In case 3, if ξ ? t ∈ S then ξΣ ? t ∈ SΣ and so the result directly holds. Else ξ ? t ∈ ϕ and so by hypothesis ξΣ ∈ Conseq(SΣ ∪ S ).

In the next lemma, we show that when a recipe is consequence of the sets of solved deduction formulas KΣσ where (Σ, σ) is a solution of the constraint system, then all subterms of that recipe are also consequence of KΣσ. This property is in fact guaranted by the fact that K contains itself recipes consequence of itself. This is an important property that allows us to generate solutions that satisfy the uniformity property.

Lemma B.7

Let C = (Φ, D, E 1 , E 2 , K, F) be an extended constraint system such that Inv wf (C). For all ξ ∈ Conseq(K ∪ D), subterms (ξ) ⊆ Conseq(K ∪ D).

Proof. Since ξ ∈ Conseq(K ∪ D), we know that ξ = C[ξ 1 , . . . , ξ n ] where C is a public context and ξ 1 , . . . , ξ n are recipes of deduction facts from K or D. Hence since ξ ∈ subterms (ξ), we have that the position p of ξ in ξ is either a position of C thus ξ ∈∈ Conseq(K ∪ D) from the definition of consequence; or is a position of one of the ξ i and thus we conclude by the predicate Inv wf (C).

Lemma B.8

Let C = (Φ, D, E 1 , E 2 , K, F) be an extended constraint system such that Inv wf (C). For all (Σ, σ) ∈ Sol (C), for all ξ ∈ Conseq(KΣσ), subterms (ξ) ⊆ Conseq(KΣσ).

Lemma B.9

Let S be a set of ground deduction facts. Let Φ be a ground frame. Assume that for all ψ ∈ S, Φ |= ψ. For all (ξ, t) ∈ Conseq(S), Φ |= ξ ? t.

Proof. We prove this result by induction on |ξ|. The base case being trivial, we focus on the inductive step. Since (ξ, t) is consequence of S then one of the following properties holds:

for all i ∈ {1, . . . , n}, (ξ i , t i ) is consequence of S 3 ξ ? t ∈ S. In Case 1, the result trivially holds. In case two, a simple induction on (ξ 1 , t 1 ), . . . , (ξ n , t n ) allows us to conclude. In case 3, we know by hypothesis that Φ |= ξ ? t hence the result holds

Correctness of most general solutions

In this section we prove the correctness of the constraint solving procedure for computing mgs' in Section 2. We show that given an extended constraint system C, the Rules (MGS-Conseq), (MGS-Res), (MGS-Cons), (MGS-Unsat), and (MGS-Unif) allow to compute the most general solutions of C.

Lemma B.10

Let C an extended constraint system such that Inv wf (C) and Inv sound (C). If any rule is applicable on C then for all (Σ, σ) ∈ Sol (C), there exists C , Σ such that C = ⇒ C and (ΣΣ , σ) ∈ Sol (C ).

Proof. First, assume that there exist ξ, ζ ∈ R(C) 2 and u such that ξ = ζ and (ξ, u), (ζ, u) ∈ Conseq(K ∪ D). By Inv sound (C) and Lemmas B.9 and Proposition B.5, we deduce that Φσ |= ξΣ ? uσ ∧ ζΣ ? uσ. As such we have ξΣ↓= uσ = ζΣ↓. However by definition of a solution it implies that ξΣ = ζΣ. Thus there exists Σ = mgu(ξ = ? ζ) such that Σ = ∅ and Σ = ⊥.

In such a case, let us show that (Σ, σ) ∈ Sol (C ) with C → C by Rule (MGS-Conseq). We already know that Σ |= E 2 (C) and since ξΣ = ζΣ with Σ = mgu(ξ

Hence, the two bullets of the definition of solutions is trivially satisfied by that fact that (Σ, σ) ∈ Sol (C). Therefore, we conclude that (Σ, σ) ∈ Sol (C ).

Let us now consider the case where our assumption do no hold. Thus since we assume that at least one rule is applicable on C, there exists X ? u ∈ D(C) where u / ∈ X 1 . Let us do a case analysis on XΣ since XΣ ∈ Conseq(KΣσ) by definition of a solution.

either XΣ ∈ F 0 : in such a case, we have C → C by Rule (MGS-Conseq) and we can prove similarly as in the previous case that (Σ, σ) ∈ Sol (C );

Appendix

or XΣ = f(ξ 1 , . . . , ξ n ) where ξ i ∈ Conseq(KΣσ) for all i: note that we know that XΣΦσ↓= uσ. Hence u = f(u 1 , . . . , u n ) for some u 1 , . . . , u n . We deduce that for all i, Φσ |= ξ i ? u i σ. Thus, by considering Σ = {X i → ξ i } n i=1 , we can conclude that C → C by Rule (MGS-Cons) and (ΣΣ , σ) ∈ Sol (C ); or XΣ ? uσ ∈ KΣσ (since once again XΣΦσ↓= uσ): thus there exists ξ ? v ∈ K such that ξΣ = XΣ and uσ = vσ. Hence mguξX exists and σ |= u = ? v. Thereofore, we can conclude that C → C by Rule (MGS-Res) and (Σ, σ) ∈ Sol (C ).

Lemma B.11

Let C = ⊥ an extended constraint system such that C = C, Inv wf (C) and Inv sound (C). If C -→ and C is a solved extended constraint system then mgs (C) = {mgu(E 2 )}.

Proof. We know that for all (Σ, σ) ∈ Sol (C), Σ |= E 2 (C) thus we directly obtain the existence of Σ such that Σ = mgu(E 2 )Σ . Consider now the second bullet point of the definition of most general solutions. We know that C is solved. Hence consider a fresh bijective renaming

Moreover, by Lemma B.8, we know that the first bullet of the definition of solution is satisfied. Finally, the second bullet is satisfied otherwise Rule (MGS-Unsat) would be applicable which contradict C = C. Therefore, (mgu(E 2 )Σ 1 , mgu(E 1 (C))σ 1 ) ∈ Sol (C). We conclude that mgs (C) = {mgu(E 2 )}.

Lemma B.12

Let C an extended constraint system such that C = C, Inv wf (C) and Inv sound (C). If C -→ and C is not solved then Sol (C) = ∅.

Proof. Since C is not solved, we have two possibilities: Either (a) all deduction facts in D are have variables as right hand term but not pairwise distinct. But in such a case Rule (MGS-Conseq) would be applicable which contradicts C -→ ; or (b) there exists (X ? u) ∈ D(C) such that u / ∈ X 1 . Since Rule (MGS-Conseq) is not applicable, we deduce that u / ∈ F 0 and for all ξ, ζ ∈ used 2 (C) \ {X}, (ξ, u) / ∈ Conseq(K ∪ D). But rule Rule (MGS-Cons) is not applicable therefore, we deduce that u ∈ N .

Assume now that Sol (C) = ∅ and so (Σ, σ) ∈ Sol (C). Thus XΣΦ↓= u. By definition of a solution, we know that (XΣ, u) ∈ Conseq(K(C)Σσ). Since u ∈ N it implies that there exists (ξ ? v) ∈ K(C) such that XΣ = ξΣ and u = vσ. Note that by Inv wf (C), we also have that v / ∈ X 1 and so u = v. In such a case, we obtain a contradiction with the fact the Rule (MGS-Res) is not applicable.

Correctness of the partition tree

In this section we prove the correctness of the procedure generating the partition tree, using the invariants proved in Appendix 1. Let us first start by noticing that the case distinction rules and simplification rules preserves the first order solutions of the extended constraint systems. This property is stated in the following lemma.

Lemma B.13

Let S be a set of set of extended symbolic processes such that Inv all (S). Let S → S by applying only case distinction or simplifications rules (i.e. no symbolic transitions). Then:

Soundness: for all S ∈ S, for all (P, C, C e ) ∈ S, for all (Σ, σ) ∈ Sol Proof. We do a case analysis on the rule applied.

case 1: Normalisation rules (simplification rules of Figure 4.2)

First, let us notice the result directly hold for Rules Norm-Unif, Norm-Formula, Norm-Dupl. Indeed, Rule Norm-Diseq does not modify constraints on recipe and preserves the constraints on protocol terms. Moreover, Rule Norm-Formula,Norm-Dupl affect F which do not impact the solutions of the extended constraint system. For Rule Norm-no-MGS, since mgs (C e ) = ∅, we have by definition of most general unifiers that Sol (C e ) = ∅ (otherwise the first bullet of the definition is contradicted). Hence the result holds since Sol (⊥) = ∅. Similarly, Rule Norm-Formula checks whether the disequations ∀x.φ is trivially true meaning that the rule preserves the solutions.

case 2: Simplification rules on partitions of extended symbolic processes (Figure 4.3)

The rule Vect-rm-Unsat only removes an extended symbolic process with an extended constraint systems having no solution hence the result holds. Rule Vect-Split splits a set of S into two sets thus preserving the extended symbolic processes, and Rule Vect-add-Formula only adds element in F which do not impact the solutions of a constraint system. Therefore, for all these rules, the result hold. For Rule Vect-add-Conseq however, the result is not direct since the rule adds an element in the set K which has an impact on the solutions of a constraint system. However, we know from the application condition of the rule that the head protocol terms of the deduction facts added in K i are not consequence of K i ∪ D i . But we also know that Inv satur (S) and Inv wf (S) hold hence it implies that the recipe ξ (see Figure 4.3) contains

Hence, ξ cannot appear in the second order solutions C e i which allows us to conclude that the solutions are preserved.

case 3: Case distinction rules The case of case distinction rules is straightforward. Indeed, by definition all rules (Sat), (Eq) and (Rew) always refine a set of extended symbolic process Γ into Γ 1 , Γ 2 where Γ 1 is obtained by applying a substitution Σ to Γ, and Γ 2 by adding the constraint ¬Σ to Γ. In particular this refinement preserves the solutions as expected. Now we can show that the static equivalence is preserved by application of the case distinction and simplification rules.

Appendix

Lemma B.14

Let S be a set of set of extended symbolic processes such that Inv all (S). Let S → S by applying only case distinction or simplifications rules (i.e. no symbolic transitions), Γ ∈ S,

Proof. Once again, let us consider the potential rule applied.

case 1: Simplification rules The only non trivial case is Rule Vect-Split (the other ones do not refine the partition and the conclusion is therefore immediate). However by Lemma applied to S we know that if a deduction fact occurs in constraint systems C e 1 but no recipe equivalent formula can be found in the constraint system C e 2 , then no solution of C e 2 can satisfy the head of the formula. Besides by Inv sound (S) we also know that all solutions of C e 1 satisfy this deduction fact. Then since (Σ, σ 1 ) ∈ Sol (C e 1 ), (Σ, σ 2 ) ∈ Sol (C e 2 ) and Φ(C 1 )σ 1 ∼ Φ(C 2 )σ 2 , we obtain a contradiction. Therefore, C e 1 and C e 2 are necessarily in the same set of S . case 2: Case distinction rules Note that for case distinction rules, the proof is simple since each rule create a partition of the second-order solutions with respect to some mgs Σ 0 . Thus, assume w.l.o.g. that (Σ , σ 1 ) ∈ Sol (C e 1 ). case 2a: negative branch of the rule First consider that S corresponds to branch in which we applied ¬Σ 0 . In such a case, since we already know that Σ satisfies ¬Σ 0 and no other constraint is added, we directly obtain from (Σ, σ 2 ) ∈ Sol (C e 2 ) that (Σ , σ 2 ) ∈ Sol (C e 2 ) (in this case, we even have σ 2 = σ 2 ). case 2b: positive branch of the rule Now consider that S corresponds to the branch in which we applied Σ 0 . In such a case, the application of Σ 0 on C e 2 regroups all the solution of C e 2 that satisfies Σ 0 . Since we know that (Σ, σ 2 ) ∈ Sol (C e 2 ) and

, the result holds.

The previous two lemmas allow us to obtain the soundness and completeness properties of the partition tree. Note that the monoticity of the second-order predicate is also proved by B.13 (Completeness part) since a solution of a child constraint system is also a solution of parent one. We now need to prove that all nodes of the partition tree are valid configurations. For that we prove properties on extended constraint systems such that no more case distinction rules are applicable.

Lemma B.15

Let S be a set of sets of extended symbolic processes such that Inv all (S) and no instance of the rule (Sat) or normalisation rules (i.e. the simplification rules of Figure 4.2) are applicable. For all S ∈ S, for all (P, C, C e ) ∈ S, writing C e = (Φ, D, E 1 , E 2 , K, F) we have that 1 C e is solved 2 all formulas ψ ∈ F are solved 3 E 1 does not contain disequations

Appendix

Let us now show that all extended constraint systems in the set have the same solutions and that they are statically equivalent.

Lemma B.17

Let S be a set of set of extended symbolic processes such that Inv all (S) and no instances of the rules (Sat), (Eq) or (Rew) or simplification rules are applicable. For all S ∈ S, for all

Proof. Since (Sat) and normalisation rules are not applicable, we know by Lemma B.15 that all extended constraint systems C e ∈ S have a particular form, that is 1 all deduction facts in D(C e ) have pairwise distinct variables as right hand side; and 2 E 1 (C e ) only contain syntactic equations. Moreover, we know that all extended constraint systems have the same structure. Therefore, if (Σ, σ 1 ) ∈ Sol (C e 1 ), we deduce that Σ |= E 2 (C e 1 ) and for all ξ ∈ subterms (img(Σ)),

Since the first order solutions are always completely defined by the second-order substitutions, we can build σ 2 such that for all X ? x ∈ D(C e 2 ), XΣ(Φ(C e 2 )σ 2 ) ↓= xσ 2 . Moreover, since Inv sound (C e 1 ) and Inv sound (C e 2 ) both hold and since for all ξ ∈ subterms (img(Σ)), ξ ∈ Conseq(K(C e 2 )Σ), we deduce that for all ξ ∈ subterms (img(Σ)), msg(ξΦ(C e 2 )σ 2 ). Note that we also need to satisfy the syntactic equations in E 1 . However thanks to Inv wf (C e 2 ) holding, we know that

. Note that by origination property of an extended constraint system, we have Φ(C e 2 )σ 2 = Φ(C e 2 )σ 2 . Therefore, since we already prove that for all ξ ∈ subterms (img(Σ)), msg(ξΦ(C e 2 )σ 2 ) and ξ ∈ Conseq(K(C e 2 )Σ), it only remains to prove the second bullet point of Definition the definition of solutions extended constraint system to obtain that (Σ, σ 2 ) ∈ Sol (C e 2 ). To prove this it sufficies to prove that Φ(C e 1 )σ 1 ∼ Φ(C e 2 )σ 2 : the conclusion will then follow since (Σ, σ 1 ) ∈ Sol (C e 1 ). Therefore we let recipes ξ, ξ and show that:

and C e 2 have the same structure, we have

Impossible since there exist no terms of size 0.

Assume msg(ξΦ(C e 1 )σ 1 ). Let us also assume by contradiction that ¬msg(ξΦ(C e 2 )σ 2 ). Since we know that N (ξ, ξ ) > 0, there exists ζ ∈ subterms (ξ, ξ ) such that ζ ∈ Conseq(K(C e 1 ). Without loss of generality we can consider that ζ ∈ subterms (ξ) (otherwise we can apply our inductive hypothesis on ξ twice since N (ξ, ξ ) would be equal to 0 and so we would obtain a contradiction). Moreover, let us consider ζ such that |ζ| is minimal. Therefore, by definition of consequence, we deduce that ζ = g(ζ 1 , . . . , ζ n ) with g ∈ F d and for all i ∈ {1, . . . , n},

). Since msg(ξΦ(C e 1 )σ 1 ) we also deduce that g(ζ 1 , . . . , ζ n )Φ(C e 1 )σ 1 ↓ is a protocol term. Therefore, there exist a rewrite rule g( 1 , . . . , n ) → r and a substitution γ such that i γ = ζ i Φ(C e 1 )σ 1 ↓ for all i = 1 . . . n. Recall that the rule (Rew) is not applicable on C e 1 and C e 2 . Therefore we can show that provided ¬msg(ξΦ(C e 2 )σ 2 ) and g(ζ 1 , . . . , ζ n )Φ(C e 1 )σ 1 ↓ is a protocol term then we necessarily have that there exists ζ 1 , . . . , ζ n and u such that g(ζ 1 , . . . , ζ n ) ? u 1 ∈ F(C e 1 ) and

)σ 1 ↓. Moreover, since the normalisation rules are also not applicable (in particular Rule Vect-Split), we deduce that there exists u 2 such that g

. By Inv wf (C e 1 ), we know that for all i ∈ {1, . . . , n}, ζ i ∈ Conseq(K(C e 1 )∪D(C e 1 )) and so ζ i Σ ∈ Conseq(K(C e 1 )Σ). Moreover, by hypothesis on ζ i , we know that ζ i ∈ Conseq(K(C e 1 )Σ). Thus, by applying our inductive hypothesis, we obtain that

2 )σ 2 ↓ is a protocol term and thus msg(ξΦ(C e 2 )σ 2 ) gives us a contradiction. subgoal 2b: Proof of (ii) Assume now that ξΦ(C e 1 )σ 1 ↓= ξ Φ(C e 1 )σ 1 ↓, msg(ξΦ(C e 1 )σ 1 ) and msg(ξ Φ(C e 1 )σ 1 ). Let us once again take the smallest ζ ∈ subterms (ξ, ξ ) such that ζ ∈ Conseq(K(C e 1 ). We already proved above that there exist

1 ), we know that there exists β such that (β, u 1 ) ∈ Conseq(K(C e 1 ) ∪ D(C e 1 ). However the normalisation Rule Vect-add-Formula is not applicable on the set of extended symbolic processes. Thus, we deduce that there exists β such that (β , u 1 ) ∈ Conseq(K(C e 1 ) ∪ D(C e 1 ) and

. Once again due to the normalisation Rule Vect-Split, we obtain that g

Thus by applying our inductive hypothesis, we obtain that

In such a case, we know that ξ, ξ ∈ Conseq(K(C e 1 )Σ) and ξ, ξ ∈ Conseq(K(C e 2 )Σ). By definition of consequence and by Inv sound (C e 1 ) and Inv sound (C e 2 ), we directly obtain that msg(ξΦ(C e 1 )σ 1 ) and msg(ξΦ(C e 2 )σ 2 ) (same thing for ξ ). Now assume that (Φ(C e 1 )σ 1 , Σ, σ 1 ) |= ξ = ? f ξ . Since both ξ, ξ are consequences of K(C e 1 )Σ, we deduce that:

f ξ i for all i. Therefore, we can apply our inductive hypothesis on the (ξ i , ξ i )s to conclude. or ξΣ, ξ Σ ∈ K(C e 1 )Σ: Since we know that the rule (Eq) is not applicable, it implies that ξ = ? f ξ ∈ F(C e 1 ) and so ξ = ? f ξ ∈ F(C e 2 ) thanks to the normalisation Rule Vect-Split.

Appendix

Since Inv sound (C e 2 ) holds, we can conclude that (Φ(C e 2 )σ 2 , Σ, σ 2 ) |= ξ = ? f ξ . or ξΣ ∈ K(C e 1 )Σ and ξ = f(ξ 1 , . . . , ξ n ) with f ∈ F c ; Once again since the rule (Eq) is not applicable, we deduce that there exists

and so by Inv sound (C e 2 ), we obtain that

Appendix C:

Proofs of Chapter 5

Summary.

In this appendix we prove the correctness of the partial order reductions and reductions by symmetry introduced in Chapter 5 to optimise the decision of equivalence by session. For simplicity of the notations, all along this appendix, the conditions on skeleton equivalence are written as skel equalities.

Explicit session matchings

In this section we present an alternative characterisation of equivalence by session. The process matchings modelled by twin processes are here represented by an explicit permutation with properties mirroring the structure of twin processes. This formalisation makes closer link with the definition of trace equivalence and is more convenient convenient for some proofs (see e.g. Appendices 2 and 4). Besides, note that this is the characterisation we use in the implementation, fitting better to the existing procedure of the DeepSec prover for trace equivalence.

Session matchings We first characterise the condition under which, given two traces t, t , there exists t 2 such that fst(t 2 ) = t and snd(t 2 ) = t . For that we rely on the notion of labels introduced in Section 3.1 to make reference to subprocess positions. In the rest of the paragraph, we refer to two labelled extended processes A 0 , B 0 such that skel(A 0 ) = skel(B 0 ), and as usual we assume that neither of them contains two labels such that one is the prefix of the other. We also let t ∈ T(P ), t ∈ T(Q)

We write L and L the sets of labels appearing in t and t .

Definition C.1

A session matching for t and t is a bijection π : L → L verifying the following properties 1 for all i ∈ 0, n , π defines a bijection from the labels of A i to the labels of B i . Besides if

The following two points are equivalent: 1 actions(t) = actions(t ) (labels removed) and there exists a session matching for t and t . 2 ∃t 2 , fst(t 2 ) = t and snd(t 2 ) = t . Besides in the i th extended twin process of t 2 , the process labelled in A i is paired with the process labelled π( ) in B i .

Proof of 1 ⇒ 2. The trace t 2 can be easily constructed by induction on the length of t:

Item 1 of Definition C.1 ensure that the twin processes in t 2 are composed of pairs of processes with the same skeleton, Item 2 ensures that pairs of transitions of P and Q can be mapped into transitions of twin-processes, and The permutations that are required by applications of the rule (Match) can be inferred from Item 3. Indeed, consider two instances of the rule (Par) in t and t :

Given π a session matching for t and t , we consider the permutation of 1, n mapping i ∈ 1, n to the (unique) j such that π( • p) = • j. This permutation can be used to construct the instance of rule (Match) corresponding to these two (Par) transitions.

Proof of 2 ⇒ 1. Let t 2 be a trace given by Item 2. We lift the labellings of t = fst(t 2 ) and t = snd(t 2 ) to the twin processes appearing in t 2 . Then as explicited in the theorem statement it sufficies to consider π the mapping from L to L such that π( ) = for all twin process ([ P ] , [ Q ] ) appearing in t 2 . A quick induction on the length of t 2 shows that π is well defined and is a session matching for t and t . We recall in particular the invariant that each A i or B i only contains labels that are incomparable w.r.t. the prefix ordering.

Important properties As a direct corollary, we give an alternative characterisation of equivalence by session.

Proposition C.2

Let P, Q be plain processes in -normal form such that skel(P ) = skel(Q). The following points are equivalent: 1 P s Q 2 for all t ∈ T(P ), there exist t ∈ T(Q) and a session matching for t and t such that t ∼ t (note: in "t ∼ t " the comparison of actions(t) and actions(t ) does not take the labels into account)

Besides the relation ∼ s on traces defined by t ∼ s t iff there exists t 2 such that fst(t 2 ) = t and snd(t 2 ) = t , is an equivalence relation. More precisely:

For all traces t 1 , t 2 , t 3 : 1 id is a session matching for t 1 and t 1 2 if π is a session matching for t 1 and t 2 then π -1 is a session matching for t 2 and t 1 3 if π is a session matching for t 1 and t 2 , and π for t 2 and t 3 , then π • π is a session matching for t 1 and t 3

False attacks and determinacy

In this section we give a detailed proof of the claim of Section 2.2 that false attacks cannot arise for determinate processes, i.e.: Proposition 5.3 (completeness of equivalence by session for determinate processes)

If P, Q are determinate plain processes such that P ≈ t Q then P ≈ s Q.

In the proof, by slight abuse of notation, we may say that an extended process is determinate. We also cast the notion of skeleton to extended processes by writing skel((P, Φ)) = skel(P) = P ∈P skel(P ) , and to traces with

That is, the skeleton of a trace is the sequence of the skeletons of the processes of which it is composed. Thus, if

we have skel(t) = skel(t ) iff n = p and for all i ∈ 0, n , skel(A i ) = skel(B i ).

Simplifying equivalence First we simplify the problem by forcing the application of (Par) rules in priority in traces.

Definition C.2

If P is a plain process in -normal form, we write T τ (P ) the set of traces where the rule (Par) is always performed in priority, i.e. where the rules (In) and (Out) are never applied to extended processes (P, Φ) such that P contains a process with a parallel a its root (i.e. a process P such that |skel(P )| > 1).

Proposition C.4

If P, Q are plain processes in -normal form such that skel(P ) = skel(Q):

The first point is standard. The proof of the second point can be seen as a corollary of the compression optimisations of equivalence by session (see Section 3.2).

Definition C.3

An extended process A = ({ {P 1 , . . . , P n } }, Φ) is τ -deterministic if there is at most one i ∈ 1, n such that P i has a parallel operator at its root (i.e. |skel(P i )| > 1).

The τ -determinism will be an invariant in proofs by induction on the length of traces. More precisely, if A, B are extended processes we call Inv(A, B) the property stating (i) andA i contains a process with a parallel operator at its root (i.e. a process P i such that |skel(P i )| > 1) iff B i does.

Equivalence and inclusion

We prove that trace equivalence coincides with a notion of trace inclusion strengthened with identical actions and skeleton checks.

Proposition C.5

If P, Q are determinate plain processes in -normal form s.t. skel(P ) = skel(Q), then the following points are equivalent

Proof of 2 ⇒ 1. Given A, B two determinate extended processes we write ϕ(A, B) the property stating that

Note that ϕ(A, B) implies skel(A) = skel(B) by choosing the empty trace. In particular, to prove 2 ⇒ 1, it sufficies to prove that for all A, B determinate,

The first implication is immediate. As for the second, we prove that for all extended processes A 0 , B 0 such that ϕ(A 0 , B 0 ) and Inv(A 0 , B 0 ), and all

This is sufficient to conclude as Inv(P, Q) holds for any determinate plain processes P, Q in -normal form s.t. skel(P ) = skel(Q).

We proceed by induction on n. If n = 0 the conclusion is immediate. Otherwise, assume by induction hypothesis that it holds for any trace of length n -1.

We know that B 0 does not contain private channels by determinacy (Inv(A 0 , B 0 ) Item (i)). Therefore, the transition B 0 τ -→ B 1 is derived by the rule (Par). In particular by Inv(A 0 , B 0 ) Item (iv), there also exists a transition A 0 τ -→ A 1 . The conclusion can now follow from the induction hypothesis applied to A 1 , B 1 ; but to apply it we have to prove that ϕ(A 1 , B 1 ) and

and skel(t) = skel(t ). But by τ -determinism of B 0 we deduce that B 1 = B 1 , and s ∈ T τ (B 1 ) satisfies the expected requirements.

→ proof that Inv(A 1 , B 1 ).

(i) A 0 and B 0 are determinate and determinacy is preserved by transitions. (ii) skel(A 1 ) = skel(A 0 ) = skel(B 0 ) = skel(B 1 ) (iii) A 0 ∼ B 0 and the rule (Par) does not affect the frame. (iv) A 0 and B 0 are τ -deterministic and τ -determinism is preserved by transitions (w.r.t. T τ ).

Besides due to the -normalisation, we know that neither of A 1 nor B 1 contain a parall operator, hence the result.

By definition T τ (B 0 ), we know that the rule (Par) is not applicable to B 0 ; neither to A 0 by Inv(A 0 , B 0 ) Item (iv), which means that traces of T τ (B 0 ) may start by an application of rules (In) or (Out). Using this and the fact that skel(A 0 ) = skel(B 0 ) (Inv(A 0 , B 0 ) Item (ii)), we obtain that there exists a transition A 0 α 1 -→ A 1 . The conclusion can now follow from the induction hypothesis applied to A 1 , B 1 ; but to apply it we have to prove that ϕ(A 1 , B 1 ) and

The argument is the same as its analogue in case 1, using the determinacy of B 0 instead of its τ -determinism.

→ proof that Inv(A 1 , B 1 ).

(i) A 0 and B 0 are determinate and determinacy is preserved by transitions. (ii) By applying ϕ(A 0 , B 0 ) with the trace t 0 : A 0

is the only transition from B 0 that has label α 1 , hence B 1 = B 1 and the conclusion. (iii) Identical proof as that of Item (ii) above, using the fact that A 1 ∼ B 1 instead of skel(A 1 ) = skel(B 1 ). (iv) Let us write

Appendix

As we argued already at the beginning of case 2, neither P nor Q contain processes with parallel operators at their roots. Therefore, we only have to prove that P 1 has a parallel operator at its root iff Q 1 does. For cardinality reasons, this a direct corollary of the following points:

skel(P 0 ) = skel(Q 0 ) (same action α 1 being executable at topelevel), -skel(A 0 ) = skel(B 0 ) (hypothesis Inv(A 0 , B 0 )), and skel(A 1 ) = skel(B 1 ) (Item (ii) proved above).

Proof of 1 ⇒ 2. The proof will follow in the steps as the other implication (we construct the trace t by induction on the length of t while maintaining the invariant Inv).

More formally, we prove that for all extended processes A 0 , B 0 such that A 0 ≈ t B 0 and Inv(A 0 , B 0 ), and all

We proceed by induction on n. We proceed by induction on n. If n = 0 the conclusion is immediate. Otherwise, assume by induction hypothesis that it holds for any trace of length n -1.

Similarly to the converse implication, there exists a transition B 0 τ -→ B 1 (derived by (Par)) and it sufficies to prove that A 1 ≈ t B 1 and Inv(A 1 , B 1 ) hold in order to apply the induction hypothesis and conclude.

But by τ -determinism of B 0 we deduce that B 1 = B 1 , and thus s ∈ T τ (B 1 ) and s ∼ s . This justifies that A 1 t B 1 , and a symmetric argument can be used for the converse inclusion

By the exact same arguments as that of the analogue case in the converse implication.

Similarly to the converse implication, there exists a transition B 0 α 1 -→ B 1 and it sufficies to prove that A 1 ≈ t B 1 and Inv(A 1 , B 1 ) hold in order to apply the induction hypothesis and conclude.

The argument is the same as its analogue in case 1, using the determinacy of B 0 instead of its τ -determinism.

→ proof that Inv(A 1 , B 1 ). This is the proof obligation whose arguments substantially differ from that of the converse implication.

(i) A 0 and B 0 are determinate and determinacy is preserved by transitions. (ii) We assume by contradiction that skel(A 1 ) = skel(B 1 ). By symmetry, say that skel(A 1 ) ⊆ skel(B 1 ) and let s ∈ skel(A 1 ) skel(B 1 ). By definition of T τ (A 0 ), we know that the rule (Par) is neither applicable to A 0 nor B 0 ; in particular, there exists a transition A 1 α -→ A derived from rule (In) or (Out) (the one corresponding to the skeleton s) such that B 1 α -→. But by determinacy of B 0 , the transition B 0 α 1 -→ B 1 is the only transition from B 0 that has label α 1 . Thus, this yields a contradiction with A 0 ≈ t B 0 : more precisely the trace

is the only transition from B 0 that has label α 1 . In particular, using the hypothesis A 0 ≈ t B 0 , we obtain that t 0 ∈ T τ (B 0 ) is the only trace such that t 0 : (A 0

In particular A 1 ∼ B 1 . (iv) Same cardinality argument as the analogue case in the converse implication.

Session matchings Prop C.5 is the core result of the proof. We now connect it with the equivalence by session by using the characterisation of Appendix 1.

Proposition C.6

Let P, Q two determinate plain processes in -normal form and two labelled traces t ∈ T τ (A 0 ) and t ∈ T τ (Q) such that actions(t) = actions(t ) and skel(t) = skel(t ). Then there exists a session matching for t and t .

Proof. We prove that for all τ -deterministic, determinate extended processes A 0 and B 0 , and

, then there exists a session matching for t and t . We proceed by induction on n. If n = 0 the session matching is π : ε → ε. Otherwise, let us write

By induction hypothesis, let π be a session matching for the first n -1 transitions of t and t ; in particular, the labels of A n-1 are in the domain of π.

case 1: α n = τ .

In this case we write

First of all, we observe that skel(P ) = skel(Q) because the same observable action α n can be performed at the root of P and Q. In particular, by determinacy (hypothesis), unicity of Appendix the process with a given label (invariant of the labelling procedure), and Item 1 of Definition C.1, we deduce that π( n ) = n .

Therefore by the hypothesis skel(A n-1 ) = skel(B n-1 ), we obtain skel(P) = skel(Q). Hence skel(P ) = skel(Q ) by the hypothesis skel(A n ) = skel(B n ). All in all, π is a session matching for the whole traces t and t . case 2: α n = τ .

In this case we write

Since determinacy excludes private channels, the last transition of t and t is derived from the rule (Par). By τ -determinism, this means that P and Q are the only processes in A n-1 and B n-1 , respectively, that contain a parallel operator at their roots. In particular, by Item 1 of Definition C.1, we deduce that π( n ) = n and skel(P ) = skel(Q); and thus k = k .

Therefore, there exists a permutation σ of 1, k such that for all i ∈ 1, k , skel(P i ) = skel(Q σ(i) ) (although this is not needed for the proof, this permutation appears to be unique by determinacy). Thus if π : L → L is the function extending π and such that

then π is a session matching for t and t . Altogether Prop C.2, C.5, C.6 justify the following corollary (that actually appears to be stronger than Prop 5.3).

Corollary C.7

If P and Q are determinate plain processes in -normal form, P ≈ t Q iff P s Q.

Correctness of POR

In this section we prove the results presented in Section 3.

Permutability of independent actions

We give the proof of the core correctness argument, namely that traces can be considered up to permutation of independent actions (Proposition 5.15). First we prove it for traces of two actions.

Proof. Since the labels of α and β are incomparable w.r.t. the prefix ordering by independence, the trace t needs have the form

). Now we construct the trace u, by a case analysis on α and β. In each case, we omit the construction of the trace t 2 that can be inferred easily.

case 1: α and β are inputs or τ actions.

In particular Φ = Φ = Φ and it sufficies to choose

case 2: α is an output and β is an input or a τ action.

In particular Φ = Φ = Φ ∪ {ax → m} with ax / ∈ dom(Φ) and ax does not appear in β. Then it sufficies to choose the trace

Then Proposition 5.15 can be obtained by induction on the hypothesis of π permuting independent actions of tr, using Proposition C.8. We actually prove the stronger result:

Proof. The uniqueness of π.t is immediate, as a quick induction on the length of traces shows that any labelled trace u is uniquely determined by the action word actions(u) (labels included). We then construct π.t by induction on the hypothesis that π permutes independent actions of actions(t). Let us write

Appendix and π 0 permutes independent actions of tr

, there exists a trace

such that for all u 2 : A 2 tr = ⇒ ss 2 B 2 verifying fst(u 2 ) = u, there exists t 2 : A 2 tr = ⇒ ss 2 B 2 such that fst(t 2 ) = t. Then since π 0 permutes independent actions of tr = actions(u), it sufficies to choose π.t = π 0 .u by induction hypothesis.

Then we can easily extend this result to ≡ por .

Proposition C.10

Let t : A tr = ⇒ B be a trace and t ≡ por t. Then writing actions(t ) = tr we have t :

Proof. For the sake of reference, let us write H(t, t ) the property to prove. We reason by induction on the hypothesis t ≡ por t . case 1 : t = π.t, π permutes independent actions of t.

Direct consequence of Proposition C.9. case 2 : t is recipe-equivalent to t.

Let u 2 with t = fst(u 2 ) ∼ snd(u 2 ) . By static equivence, for any recipes ξ 1 , ξ 2 such that

we also have

In particular, t 2 can be obtained by operating on the second component of u 2 the same recipe transformations that have been operated to transform t = fst(u 2 ) into t.

case 3 : (transitivity) H(t, s) and H(s, t ) for some trace s.

Let u 2 with t = fst(u 2 ) ∼ snd(u 2 ) . By hypothesis H(s, t ) there exists s 2 such that s = fst(s 2 ) ∼ snd(s 2 ). Hence the result by hypothesis H(t, s).

And finally we have the Proposition 5.16 that is a corollary of this result. Theorem 5.16 (correctness of por)

2 be universal optimisations. We assume that for all t ∈ O ∀ 2 , there exists t ext such that t is a prefix of t ext , and

2 . Without loss of generality, we assume t maximal, i.e. that there are no transitions possible from its last process. Therefore by hypothesis, there exists t ≡ por t such that t ∈ O ∀ 1 . Since P 1 Q, Appendix permuting independent actions of t such that

where each b + i is a positive or null phase, and each b - i is a negative phase. case 1 : α is an output or a parallel action.

Let us write E the multiset of actions of the word tr(b - 0 ). We partition it into E = F G where

where pref refers to the prefix ordering on words. This is indeed a partition of E thanks to the invariant that any label appearing in t is either incomparable with 1 and 2 , or a suffix of 1 or 2 . For the same reason, all actions in F are independent of all actions in G: it is therefore straightforward to construct π - 0 permuting independent actions of b - 0 such that

Then, we let σ permuting independent actions of

such that σ.s = A

Let us write

If the label does not appear in actions(t ), then by maximality of t it needs be that polar (P ) = 0 and (A α -→ B) is therefore a positive phase. In particular π .t is already decomposed into phases and it sufficies to choose π = (π ) +0 +1 . Otherwise assume that appears in actions(t ). We write

Appendix blocks are essentially independent of all blocks following them.

Proposition C.13

Let t ∈ O ∀ c of the form t = b • u where u ∈ O ∀ c and b is an improper block. Then there exists u recipe equivalent to u such that b is independent of all blocks of u .

Proof. By definition of improper blocks Item 2, if A tr = ⇒ (P, Φ) is improper then for all [ P ] L ∈ P such that P = 0, the labels of L are prefix-incomparable with all labels of tr. In particular a straightforward induction shows that all actions of b are sequentially independent of all actions of u. Besides let us write by definition b : (P, Φ)

with ξ i a recipe such that ξ i Φ = E t i . We then let the substitution

as well as u the trace obtained by replacing in u all actions of the form c(ξ) by c(ξσ). By definition, u is recipe equivalent to u and, since no axioms introduced in b appear in u , b is data independent of all blocks of u . All in all, b is independent of all blocks of u .

The main argument is then a substantially-simple but technical induction delaying improper blocks one by one. For that we prove the following auxiliary result about the preservation of (im)properness when permuting independent blocks, since it is not the case in general as discussed in Section 3.4.

Proposition C.14

Let a sequence of blocks t = b 1 • • • b n and a transposition π = (i i+1) for some i ∈ 1, n -1 . We assume that b i || b i+1 . Then 1 Delaying an improper block preserves improperness: if b i is improper then the i+1 th block of π.t is also improper. 2 Advancing a proper block preserves properness: if b i+1 is proper then the i th block of π.t is also proper. 3 Swapping two improper blocks preserve improperness: if b i and b i+1 are improper then the i th and i+1 th blocks of π.t are improper.

Proof. Item 1 follows from the fact that for any ground term t, recipe ξ and frame Φ, if ξΦ = E t then ξ(Φ∪Φ ) = E t for all frames Φ such that dom(Φ)∩dom(Φ ) = ∅. Item 2 follows from the fact that for any ground term t and frames Φ, Φ such that dom(Φ) ∩ dom(Φ ) = ∅, if t is not deducible in Φ ∪ Φ then it cannot be deducible in Φ neither. Let us detail more the argument for Item 3, by writing

If we write b i , b i+1 the i th and i+1 th blocks of π.t, respectively, they have the form

To show that b i and b i+1 are improper, it sufficies to verify the Item 3 of the definition since the two other items immediately follow from the fact that b i and b i+1 are improper.

Proof that b i is improper.

Let t ∈ img(Φ 2 ) and let us construct a recipe ξ such that ξΦ 0 = E t. Since b i+1 is improper there exists a recipe ξ 0 such that ξ 0 (Φ 0 ∪ Φ 1 ) = E t. Besides b i is also improper hence for all ax ∈ dom(Φ 1 ) there exists a recipe ξ ax such that ξ ax Φ 0 = E ax Φ 1 . It thus sufficies to choose

Proof that b i+1 is improper.

Proposition 5.21 (correctness criterion)

For all t ∈ O ∀ c , there exists t ≡ b-por t such that t ∈ O ∀ c+i and t has the same number of improper blocks t.

Proof. Let us decompose t in blocks as

We say that i ∈ 1, n -1 is a pending index in t when b i is an improper block and there exists j > i such that b j is a proper block. We prove the proposition by induction on the number of pending indexes.

If there are no pending indexes then t ∈ O ∀ c+i by definition. Otherwise let p be the minimal pending index in t. By Proposition C.13 there exists v recipe equivalent to b p+1 • • • b n such that b is independent of all blocks of v . Thus the permutation

Let us prove that π.s has less pending indexes than t, and as many improper blocks as t. Once this is established this will conclude the proof: this makes it possible apply the induction hypothesis to π.s, thus obtaining t ≡ b-por π.s such that t ∈ O ∀ c+i and t has as many improper blocks as π.s. In particular t ≡ b-por π.s ≡ b-por s ≡ b-por t hence the desired conclusion.

Let us thus compare the number of pending indexes and improper blocks of t and π.s. First of all, (im)properness is preserved under recipe equivalence, and t therefore has as many pending indexes and improper blocks as s. Let us decompose s and π.s in blocks as

We then let i ∈ 1, n .

case 1: i < p. Let us prove that b i and b π.s i are proper (in particular i is not a pending index in π.s).

Appendix

This follows from the fact that b π.s i = b i and b i is proper (otherwise p would not be the minimal pending index in t).

with π a→a = id by convention. As a preliminary result we prove by induction on i that b

= b p which is improper, and if i > p we know that b π p→i-1 .s i is improper by induction hypothesis, hence the result since π p→i = (i i-1) • π p→i-1 and by using Proposition C.14 Item 1.

We now prove the actual property, i.e. that b π.s i is improper iff b s i+1 is improper. Using the preliminary result above we know that b π p→i .s i is improper. In particular, using Proposition C.14 Items 2, 3, we obtain that b The fact that π.s and s have the same number of improper blocks follows from the fact that the bijection ϕ : 1, n → 1, n defined by

is improper, by the cases 1,2,3. Let us then show that π.s has less pending indexes than s. For that, by case 1, it sufficies to prove that b π.s p • • • b π.s n contains less pending indexes than b s p • • • b s n . Let p i < n such that b π.s i is improper. By case 3, there exists j ∈ i + 1, n -1 such that b π.s j is proper iff there exists j ∈ i + 2, n such that b s j is proper, that is, iff i + 1 is a pending index in s. By case 2 this means that i < n is a pending index in π.s iff i + 1 is a pending index in s. Therefore there are as many pending indexes in b

The correctness of the optimisation (Proposition 5.22) then simply follows from this proposition and Proposition 5.20.

High-priority null phases

In this section we prove the correctness of the optimisation based on executing high-priority internal communications in priority in traces as formalised in Section 3.5. First we state and prove the main technical property of high-priority transitions that makes it correct to execute them as soon as they are available: Using this result we can prove that whenever a channel is high-priority at some point A in a maximal trace, there needs be a later transition that executes an internal communication on this channel that was already available in A.

Proposition C.16

Let t ∈ O ∀ c ∩T(A) and d ∈ N that is high-priority in A. We also assume that t is maximal, i.e. that no transitions are possible at the end of t. Then t can be decomposed into

the block b is independent of all blocks of u.

Proof. We decompose t in phases as follows t : b

We proceed by induction on n the number of blocks of t. Since d is high-priority in A, an internal communication on d is possible in A by definition. In particular since t is maximal, we know that b 1 cannot be the empty trace. Let us therefore perform a case analysis on the first transition of b 1 .

case 1: t starts with an internal communication on d.

Then it sufficies to choose

case 2: t starts with a transition that is either a public input or an internal communication on a channel e = d.

Let us write t

By applying Proposition C.15 to each transition of t 0 , we know that d is also high-priority in each A i , in particular in A n . We can therefore apply the induction hypothesis to b 2 • • • b n . By doing so we get i ∈ 2, n such that 1 b i starts with an internal communication on d with action

This implies, since b 1 contains no internal communications on d by hypothesis, that the first transition of b i is sequentially independent-and therefore independent-of all actions of b 1 . In particular b

Proposition 5.26 (correctness criterion)

c and v does not contain any high-priority transitions. Then there exists π permuting independent blocks of u such that π.u ∈ O ∀ 0 .

Appendix

Proof. We decompose u and v in blocks

First of all we observe that for all i > n, there are no high-priority channels in A i . Indeed using Proposition C.15, a quick induction on the length of s shows that for all maximal traces s : A tr = ⇒ B such that there exists a high-priority channel in A, there exists a high-priority transition in s. In the context of our proposition, this would contradict the hypothesis that v does not contain any high-priority transitions. We then prove the property by induction on the number of processes A i , i ∈ 1, n , such that there is a high-priority channel in A i .

If there is no such process then it sufficies to choose π = id . Otherwise let p ∈ 1, n be the minimal index such that there exists a high-priority channel in A p , and d ∈ N the minimal such channel w.r.t. ch . By Proposition C.16 there exists q ∈ p, m such that b q starts with an internal communication on d and for all p r < q, b r || b q . If we consider the minimal such index q, we know by Proposition C.15 that d is high-priority in A q and in particular q n by the preliminary remark. Let us thus assume so. Therefore the permutation

permutes independent blocks of u and the p th block of π 0 .u starts with a high-priority transition. We write u p the trace composed of the first p blocks of π 0 .u. We have u p ∈ O ∀ 0 : no high-priority transitions are possible in the first p -1 blocks of u p by minimality of p, and the p th block starts with a high-priority transition.

We then let u n-p the remaining n -p blocks of π 0 .u, i.e. the trace such that π 0 .u = b - 0 • u p • u n-p . We then apply the induction hypothesis to u n-p • v (which is indeed a maximal trace) which gives π 1 permuting independent blocks of u n-p such that π 1 .u n-p ∈ O ∀ 0 . It therefore sufficies to choose π = π 1 +0 +p • π 0 (notation of the extension lemma, Proposition C.12).

Corollary 5.27 (correctness of high-priority transitions)

Proof. We use the characterisation of Proposition 5.20. Let t ∈ O ∀ c+i * and t ext an arbitrary maximal extension of t (obtained by executing transitions after t as long as it is possible). By Propositions 5.21, 5.24 there exists

only contains proper blocks and v ∈ O ∀ c only contains improper blocks. Note that t i * is maximal since t i * ≡ b-por t ext and t ext is maximal. Recall also that improper blocks never contain high-priority transitions by definition. There we can apply Proposition 5.26 to obtain π permuting independent actions of u such that π

, keeping in mind Proposition 5.23.

Reduction of independent blocks

Now we prove the correctness of the optimisation O ∀ por introduced in Section 3.6. We recall that we assume an ordering on words of actions such that two words of independent actions are always strictly comparable. In particular we can rephrase more simply the definition of the fact that a block cannot follow an other one: We write lex the lexicographic extension of to traces of same number of blocks, i.e. if

By convention, two traces with a different number of blocks are incomparable w.r.t. lex . The core argument to prove the correctness of the optimisation is that O ∀ r contains minimal traces among those obtainable by permutation of independent actions:

We assume i minimal among indexes with this property and write π = (i -1 i). Then π permutes independent actions of u, π.u ≺ lex u and p ∈ O ∀ 0 where p consists of the first i -1 blocks of π.u.

Proof. By definition of the predicate Minimal, b

) has been excluded by minimality of i. In particular π permutes independent blocks of u and π.u ≺ lex u. Thus let b j the j th block of π.u, j ∈ 1, i -1 and let us show that it starts with a high-priority transition if one is available. If j < i -1 then π(j) = j, hence b j = b j . The conclusion thus follows from the assumption u ∈ O ∀ 0 . Otherwise j = i -1 and we write A such that b i-1 ∈ T(A). We recall that b i cannot follow b i-1 ; therefore by Proposition C.17 we are in one of the following cases.

case 1: b i-1 does not start with a high-priority transition In particular the assumption that u ∈ O ∀ 0 ensures that no high-priority transitions are possible from A which appears to be the initial process of the block b j , hence the conclusion. Proof. Consider the block decomposition

. By Proposition C.18, π = (i-1 i) permutes independent blocks of u, π.u ≺ lex u and the first i -1 blocks of π.u form a trace of O ∀ 0 . Besides let s consisting of the last n -i + 1 blocks of π.u. By hypothesis s • v is maximal and v does not contain high-priority transitions: in particular by Proposition 5.26 there exists σ permuting independent blocks of s such that σ.s ∈ O ∀ 0 . Then we define, using the notations of the extension lemma (Proposition C.12), τ = σ +0 +i-1 • π . It permutes independent blocks of u, τ.u ≺ lex u and τ.u ∈ O ∀ 0 .

Proposition C.20

Let t ∈ O ∀ c a maximal trace of the form t = u • v where u ∈ O ∀ 0 , and v ∈ O ∀ c does not contain any high-priority transitions. Then there exists π permuting independent blocks of u such that π.u

Proof. Let us consider the set of traces

The set U is finite (its size is bounded by |u|!). In particular the ordering lex is well-founded on U , i.e. there exist no infinite decreasing sequences of elements of U w.r.t ≺ lex . Let us thus show by well-founded induction on u that for all traces of the form u • v, u ∈ U , there exists π permuting independent blocks of u such that π.u ∈ O ∀ r . If u ∈ O ∀ r it sufficies to choose π = id . Otherwise by Proposition C.19 there exists π 0 permuting independent blocks of u such that π 0 .u ≺ lex u and π 0 .u ∈ U . Hence the result by induction hypothesis applied to π 0 .u .

We can eventually prove the correctness of

Correctness of symmetries

In this section we prove the correctness of the optimisations presented in Section 4, i.e. the reduction by symmetries.

Preliminary notations and results

First of all we introduce some notions that will be at the core of most proofs of correctness of our reductions by symmetry. Intuitively when there is a symmetry between two processes P a and P b , we relabel them (that is, we swap their labels) and the resulting process is structurally equivalent to the initial one. Then we use the fact that structurally equivalent processes produce almost identical traces, meaning that their can be matched equivalently. We formalise these two notions in the following paragraphs.

Relabelling We first define an action of the group of label permutations. It acts on extended (twin) processes, actions and traces by relabelling. Formally if π is a permutation

Appendix of labels, we write

Aπ

A 2 π απ tπ t 2 π respectively the extended process A, extended twin process A 2 , labelled action α, trace t and extended twin trace t 2 where each label • has been replaced by π( ) • . For this transformation to be well defined, we always consider that π is consistent (w.r.t. the object it is applied to) which means that 1 the set supp(π) = { | π( ) = } only contains pairwise incomparable labels w.r.t. the prefix ordering

applied to an extended twin process or an extended twin trace, π is consistent w.r.t. its first projection. We recall that extended twin processes are only labelled on their first projection. This operation has a lot of trivial but important properties that we will use implicitly in incoming proofs:

With the notations above:

and π is the permutation such that π( i ) = σ(i) , Aπ = σ -1 .A. 4 if X is any of the objects above, Xid = X and Xππ = X(π • π).

Structural equivalence Then we list several core properties associated to structural equivalence. The first one is the trivial observation that it is preserved by the action of permutations:

Proposition C.22

If A ≡ B consist of n parallel subprocesses and π ∈ S n , π.A ≡ π.B.

An important corollary is that the function (π, A) → π.A is a group action on the set of extended processes quotiented by ≡. In particular its stabilisers are permutation groups:

For all extended processes A consisting of n processes, Stab(A) is a subgroup of S n .

An other property is that structural equivalence preserves static equivalence and skeletons. This is simply because static equivalence is preserved by bijective renaming of private names.

Proposition C.24

If A ≡ B then A ∼ B, and if P ≡ E Q then skel(P ) = skel(Q ).

for some α-renaming and P i ≡ E Q i for all i. We show by induction on n that there exists a trace

for some session matching π for u and v such that π |L = id , and A i , B i are of the form

with R j ≡ E S j for all j and Φ i = E Φ i .

For n = 0 it sufficies to choose v the empty trace and π = id . For n > 0 we write u = u 0 • u with u 0 : A 0 α -→ A 1 and perform a case analysis on the rule from which the transition u 0 is derived. Below we write L(A) the set of labels appearing in a process A.

case 1: rules (In), (Out) or (Comm)

We write v 0 : B 0 α -→ B 1 , the transition obtained by performing the same action as u 0 in B 0 at the same label. In particular we apply the induction hypothesis to u from A 1 , B 1 , which gives v ∈ T(B 1 ) and π a session matching for u and v . Then π is also a session matching for t and s and π |L(A 0 ) = π |L(A 1 ) = id and it sufficies to choose v = v 0 • v .

with p i=1 P i ≡ E Q and for all i ∈ p + 1, n , P i ≡ E Q i . By Proposition C.24 and since Q is in -normal form by definition, we have Q = p i=1 Q i where, for some permutation σ ∈ S p , Q i ≡ E P σ(i) for all i ∈ 1, p . In particular by applying rule (Par) in B 0 at label we obtain a transition v 0 : B 0 τ -→ B 1 such that we can apply the induction hypothesis from A 1 , B 1 π 0 , where π 0 is the label permutation defined by π 0 ( •i) = •σ(i) and supp(π 0 ) ⊆ { •1, . . . , •p}. Note that B 1 π 0 is well defined since π 0 is consistent w.r.t. B 1 . Let us thus apply the induction hypothesis to the processes A 1 , B 1 π 0 and the trace u . We obtain a trace v ∈ T(B 1 π 0 ) and a session matching π for u and v . To conclude it sufficies to choose v = v 0 • v π -1 0 and π defined by π( ) = and

π is well defined and a session matching for u and v because π is a session matching for u and v such that π |L(A 1 ) = id .

Finally, almost identical traces preserve POR properties. Indeed if u σ ∼ = v, a permutation π permutes independent blocks of u iff it permutes independent blocks of v and, in this case, π.u σ ∼ = π.v. In addition, since the frames of almost identical traces are equal modulo theory and renaming of private names, a block is proper iff an almost identical block is. All in all:

Proposition C.28

Universal symmetries

Permutation groups Let us first prove that the sets Sym 1 and Sym 2 (notation of the optimisation) are subgroups of S n .

In the next two theorems we fix the notations of the optimisation Sym 1 and Sym 2 depend of. We therefore consider a trace t ∈ T(P ) whose final process A consists of n processes.

Proposition C.29

Sym 1 is a subgroup of S n .

Proof. Since Stab(A) is a group, it sufficies to prove Sym Q 1 is a subgroup of S n . We recall that it is the set of permutations π ∈ S n such that for all traces t 2 : (P, Q) tr = ⇒ A 2 such that t = fst(t 2 ) ∼ snd(t 2 ), there exists a trace s 2 : (P, Q) tr = ⇒ π.A 2 such that t = fst(s 2 ). This set contains the identity (it sufficies to choose s 2 = t 2 ). Therefore by Proposition 5.12 it sufficies to prove that Sym Q 1 is closed by composition. Let π, σ ∈ Sym Q 1 . In particular there is s 2 : (P, Q) tr = ⇒ π.A 2 such that t = fst(s 2 ). Since s 2 has the same final frames as t 2 , we also have fst(s 2 ) ∼ snd(s 2 ). Therefore since π ∈ Sym Q 1 , there exists u 2 : (P, Q)

Proposition C.30

Sym 2 is a subgroup of S n .

Proof. Rephrasing the definition, π ∈ Sym 2 iff there exists permutation of F 0 such that π.A ≡ A and, for all twin traces t 2 : (P, Q) tr = ⇒ A 2 such that t = fst(t 2 ) ∼ snd(t 2 ), we have π.snd(A 2 ) ≡ snd(A 2 ) . Similarly to Sym 1 , it sufficies to prove that Sym 2 is closed by composition to conclude by Proposition 5.12, since id ∈ Sym 2 . Thus let π, π ∈ Sym 2 and , permutations of F 0 such that 1 π.A ≡ A and π .A ≡ A 2 for all twin traces t 2 : (P, Q)

Appendix

Then let t 2 : (P, Q) tr = ⇒ A 2 such that t = fst(t 2 ) ∼ snd(t 2 ). With the same reasoning as above we obtain (π • π ).snd(A 2 ) ≡ snd(A 2 ) , hence the conclusion.

Correctness of the reduction by symmetry First of all we prove that the optimisation consisting of discarding transitions based on the analysis of Sym. At first we only study the refinement of O ∀ c+i * and tackle later the question of the compatibility with high-priority transitions and with the lexicographic reduction. We use again the notations of the optimisation and, if π ∈ Sym and L = { i } n i=1 , we let π the label permutation defined by supp(π) ⊆ L and π( i ) = π(i) .

Proposition C.31

Let π ∈ Sym. We also let a trace u ∈ O ∀ c+i * of the form

We assume that for all traces u ∼ = u of the form

there exists s ∈ T(Q) with u ∼ s and a session matching for u and s. Then there exists s ∈ T(Q) with u ∼ s and a session matching for u and s.

Proof. We decompose the proof in three parts, isolating the characterisation based on Sym 1 , the one based on Sym 2 , and how to compose the two.

Part 1: Proof in the case π ∈ Sym 1 . Let u ∈ T(P ) a trace with the same notations as the statement of the theorem. We write

The permutation π is consistent w.r.t. A and the trace (u 0 • v)π is therefore well defined, and of the form

But π ∈ Sym 1 and in particular π ∈ Stab(A). Since Stab(A) is a group we deduce, by definition, that π -1 .A ≡ A. Hence by Proposition C.27 there exists w ∈ T(A) such that

Proposition C.26 and t • w is therefore of the form ( ). Hence by hypothesis there exists s ∈ T(Q) such that s ∼ t • w and σ a session matching for t • w and s . We also let σ t and σ w the restrictions of σ to the labels of t and w, respectively. If we decompose s = s t • s w with |s t | = |t| then σ t (resp. σ w ) is a session matching for t and s t (resp. w and s w ). In particular, σ w • σ is a session matching for (u 0 • v)π and s w . Thus φ = σ w • σ • π is a session matching for u 0 • v and s w .

Besides by hypothesis π -1 ∈ Sym Q 1 because Sym 1 is a group; in terms of session matchings this assumption can be rephrased as follows:

for all z : Q tr = ⇒ Z and ω session matching for t and z, there exists z :

Appendix

Hence by applying Proposition C.27 to the trace s w φ, we obtain s w ∈ T(Z -1 ) such that s w ∼ s w and σ z a session matching for s w φ and s w such that σ z|L(Z) = id for L(Z) = {σ w ( ) | ∈ L} the set of labels of Z. Therefore σ z • φ is a session matching for s w and s w ∈ T(Z). To conclude we choose s = s t • s w . To define the session matching for u and s we consider

We have established that ψ 1 is a session matching for t and s t , and that ψ 2 is a session matching for u 0 • v and s w . Therefore a session matching for u and s would be the matching ψ such that dom(ψ) = dom(ψ 1 ) ∪ dom(ψ 2 ) and ψ dom(ψ 1 ) = ψ 1 and ψ dom(ψ 2 ) = ψ 2 . This function can be defined if ψ 1 and ψ 2 coincide on dom(ψ 1 ) ∩ dom(ψ 2 ) = L. And indeed, for all i ∈ 1, n ,

Finally we also verify that s ∼ u, in particular actions(s) = actions(u):

For succinctness if w ∈ T(P ) we write H(w) the property There exists s ∈ T(Q) such that actions(s) = actions(w) and a session matching for w and s. In particular the property we attempt to prove is that for all π ∈ Sym, assuming that H(u ) for all u ∼ = u of the form ( ), we have H(u). We proceed by induction on a proof that π ∈ Sym.

Since Sym 1 is a group, it contains the identity and this case is already captured by the Part 1 of the proof.

To apply the induction hypothesis to ψ (and thus conclude the proof) we have to prove that H(u ) for all traces u ∼ = u:

Let u be such a trace. Using either Part 1 or Part 2 (depending on whether φ ∈ Sym 1 or where the first action of b ∈ T(A) is an input on the label π(i 0 ) . We recall that u ∈ O ∀ c+i * by Proposition C.28. Besides by hypothesis u 1 • b ∈ O ∀ c+i * +0 , therefore no high-priority transitions are available at the start of b, i.e. in A (since the first transition of b is an input and can therefore not be high-priority). Therefore u 1 • b ∈ O ∀ c+i * +0 . On the other hand there are no guarantees that high-priority transitions are respected in u 2 ; however by Proposition 5.26 we can fix π permuting independent blocks of u 2 such that π.

c+i * +0 but also and u ≺ lex u because actions(b ) ≺ actions(b) by definition of π. By the induction hypothesis applied to u we therefore obtain u 2 such that u = fst(u 2 ) ∼ snd(u 2 ). Using Proposition C.10 we then obtain v 2 such that u = fst(v 2 ) ∼ snd(v 2 ). Hence the expected conclusion by Proposition C.1. case 3b: the first action of b is an internal communication.

We write = i 0 | i 1 where the label of the input is i 0 . Referring to the notations of the definition of O ∀ sym we let π ∈ Sym such that (π(i 0 ), π(i 1 )) = min Orb(i 0 , i 1 ) .

Like the previous case we want to conclude by using Proposition C.31. Let u ∼ = u a trace of the following form

where the first action of b is on the label π(i 0 ) | π(i 1 ) . We recall that by definition Orb(i 0 , i 1 ) ⊆ IO and therefore that an internal communication at label π(i 0 ) | π(i 1 ) respects high-priority transitions. In particular u 1 • b ∈ O ∀ c+i * +0 (using Proposition C.28 again). Besides, using a similar reasoning as in the case 3a we also obtain that u ∈ O ∀ c+i * and a π permuting independent blocks of u 2 such that u

. The conclusion of the reasoning is then similar, applying the induction hypothesis to u and then Propositions C.10 and C.1.

Existential symmetries

In this section we prove the existential optimisation: Proposition 5.32

sym is a correct refinement of O ∃ all . However although the formalism of twin traces makes the formalisation of the optimisation more conceit as a simple restriction of rule (Match), we found it easier to prove it correct using the formalism of session matchings; that is, the optimisation rather consists of reducing the potential number of session matchings considered for a trace. Let us thus first state it in this paradigm.

Let t ∈ T(P ) a trace and an instance of rule (Par) in t:

We also let t ∈ T(Q) such that actions(t) = actions(t ) and assume that there exists a session matching σ for t and t . In particular t contains a unique application of rule (Par) of the form

for some π ∈ S n and σ(

and say that σ is well formed on if π is minimal in its equivalence class for ∼ (w.r.t. an arbitrary fixed ordering on S n ). We say that σ is well formed when it is well formed on all labels on which an application of rule (Par) has been performed in t. In particular we obtain the following characterisation of O ∃ sym by Proposition C.1:

The following statements are equivalent for all processes P, Q

) 2 for all t ∈ T(P ), there exists t ∈ T(Q) and σ a well formed session matching for t and t such that t ∼ t

In the remaining of the section we therefore focus on proving that the second item is equivalent to P s Q. For that we rely again on the results of Appendix 4.1.

Proposition C.33

The following statements are equivalent for all processes P, Q 1 P s Q 2 for all t ∈ T(P ), there exists t ∈ T(Q) and σ a well formed session matching for t and t such that t ∼ t

Proof. The implication 2 ⇒ 1 is immediate. Conversely we assume 1, let t ∈ T(P ) and thus t ∈ T(Q) such that t ∼ t and σ 0 a session matching for t and t . We now construct s ∈ T(Q) and σ a well formed session matching for t and s. We proceed by (decreasing) induction on the number of transitions of t before the first (Par) transition on a label the matching σ 0 is not well formed on. If there are none σ 0 is well formed and it sufficies to choose s = t and σ = σ 0 . Otherwise let be the first such label. We write t = t 0 • p • t 1 with p the transition

Similarly we write t = t 0 • p • t 1 with p the transition

We let u ∈ Stab(A) such that π 0 = π • u is minimal in its equivalence class for ∼. By definition of Stab(A) we have in particular π -1 .A ≡ π -1 0 .A. Therefore by Proposition C.27 we know that there exists s 1 ∈ T(π -1 0 .A) and a session matching σ 1 for t 1 and s 1 such that t 1 ∼ s 1 and σ 1 ( ) = for all labels ∈ L the set of labels appearing in A. In particular we consider the trace

and σ the label permutation defined by

Since σ 0 and σ 1 coincide on L, σ is well defined a session matching for t and s . Besides it is well formed on (and on all labels appearing before in the trace t). Hence we can apply the induction hypothesis to s and σ which gives the expected trace s and session matching σ.

Appendix D:

Proofs of Chapter 6

Summary.

In this appendix we prove the technical results used in Chapter 6 for the termination and complexity of the decision procedure for trace equivalence and labelled bisimilarity.

1 Termination

For mgs

The termination of the computation of most general solutions mostly relied on the following result, yet to be proved: Proposition 6.2 (decrease of unused first-order terms during constraint solving)

Let C e be an extended constraint system such that C e = C e and the invariants Inv They typically apply protocol term substitutions on the constraint system (they also effect recipe disequations that are irrelevant in unused 1 (C e )). Note that the applied substitution is always generated from terms already in the constraint system. As such µ 1 (C e ↓) = µ 1 (C e ) and so

249

Appendix

By applying the same reasonning for the rule (MGS-Res), we can also show that unused 1 (C e ) unused 1 (C e ). However, we can even show that this inequality is strict. Indeed, using the same the notation in the rule (MGS-Res), this rule is only applied if C e = C e ↓ and for all ξ ∈ subterms c (C e ) \ {X}, (ξ, u) ∈ Conseq(K ∪ D). Note that C e = C e ↓ implies that Kµ 1 = K and Dµ 1 = D. Moreover, it also implies that u ∈ unused 1 C e . However, in C e , we have that (ξ, uµ 1 (C e )) ∈ Conseq(K(C e )µ 1 (C e ) ∪ D(C e )µ 1 (C e )). Moreover, we show another invariant on the constraint system (see Definition B.1 in Appendix) that ensures us that X ∈ subterms c (C e ) and so ξ ∈ subterms c (C e ). Hence, we obtain that uµ 1 (C e ) ∈ unused 1 (C e ) allowing us to conclude that unused 1 (C e ) < unused 1 (C e ). By applying the same reasoning, we can also show that unused 1 (C e ) < unused 1 (C e ) when the rule (MGS-Cons) is applied.

Exponential measure

Another argument left pending is that each component of the measure except the last one can be bounded by an exponential in the DAG size of the parameters of the problem. We give a bound for each of them, in particular relying on the bound on unused 1 proved in the body of thesis.

the number of non-deducibility facts is bounded by the maximal number of internal communications possible in a trace, itself bounded by the sizes of the processes.

The measure corresponds to the number of symbolic transitions possible from P and Q for a given symbolic trace, hence the bound. Notice that the part |E|

|P | dag dag

is due to the computation of the most general unifiers modulo E in the symbolic transitions. 4 M 4 (Γ) 9 |P, Q, E| 3 dag : It sufficies to observe that set K (C e ) unused 1 (C e ) and to use the bound proved in the body of the thesis. 5 M 5 (Γ) M 3 (Γ):

Trivial. To bound this number, we need to recall that we always apply the case distinction rules with the priority ordering (Sat) < (Rew). Thus, when we apply a rule (Rew), there is no unsolved deduction formula in any of the extended constraint systems (otherwise we should have applied the rule (Sat)). It means this measure is bounded by the number of deduction formulas produced by one instance of (Rew). By definition, we know that |RewF(ξ, → r, p)| |R| (one formula per rewrite rule). Thus, the rule (Rew) generates at most |E| × M 3 (Γ) deduction formulas.

The application conditions stipulate that the rule can be applied either (a) on two deduction facts of K(C e i ), or (b) on one deduction fact of K(C e i ) in combination with a construction function symbol. Note that even though the rule also consider the existence of a most general solution

), the number of applications of the rule (Eq) will not depend on the number of possible most general solutions. Indeed, consider the case (a) where the rule is applied on two deduction fact (ξ 1 ? u 1 ), (ξ 2 ? u 2 ) ∈ K(C e i ). Thus, an equality formula with ξ 1 Σ = ? f ξ 2 Σ as head will be added in F(C e i :Σ). However, in the application conditions of the rule, we also require that for all (∀S. ϕ ⇒ H) ∈ F(C e i ), H = (ξ 1 = ? f ξ 2 ). Thus, a new application of the rule (Eq) on C e i :Σ with the same (up to instantiation of Σ) deductions facts from K(C e i :Σ) will be prevented. The same situation occurs in case (b) with the condition for all (∀S.

We therefore conclude that the rule (Eq) can be applied only once per pair of deduction facts in K and once per deduction fact in K and function symbol in F c . 9 M 9 (Γ) M 3 (Γ):

Unsolved equality formulas can be generated by two rules: the case distinction rule (Eq) or the simplification Rule Vect-add-Formula. However, once again because of the priority order (Sat) < (Eq), the two rules cannot be triggered simultaneously and the rule (Eq) is only triggered when there is no unsolved equality formulas. Note that due to the condition ∀i.∀(∀S.

Vect-add-Formula, two instances of the Rule Vect-add-Formula with different recipes ζ (e.g. if u 1 can be deducible with two different recipes) cannot be applied sequentially. Thus, at any given moment, there is at most one unsolved equality formula per extended constraint system of Γ, hence the bound.

Bounding the increase of second order terms

In Section 2, Proposition 6.7, we gave a bound on the increase of the size of most general solutions when applying the rule (Sat). We give here the arguments to extend to the other case distinction rules. For that it sufficies to generalise this property to a more general set of substitution Σ:

Let C e be an extended constraint system. Let Σ be a second-order substitution. We say that Σ ∈ CompatSubs(C e ) if dom(Σ) ⊆ vars 2 (D(C e )) and for all X ∈ dom(Σ), XΣ ∈

Intuitively, CompatSubs(C e ) represents the recipe substitutions Σ that can be applied be applied to the constraint system C e , i.e. C e :Σ, and such that the recipes in the of Σ would be consequence of C e :Σ. Note that mgs (C e ) ⊆ CompatSubs(C e ). 2 ). Therefore, we can conclude that for any simplification and case distinction rules, |unused 1 (C e )| never increase for all extended constraint systems in a set of extended symbolic processes.

Appendix

Complexity lower bounds

Advanced winning strategies

Before starting the proofs, we present some characterizations of observational (in)equivalence in order to make the incoming proofs easier to handle.

Remark

The results of this section (2.1) also apply to the extended semantics of Section 4.1.

For the defender The transitions of the semantics which are deterministic and silent are not essential to equivalence proofs as they do not interfere substantially with them. We introduce below a refined proof technique to rule them out.

Definition D.2 (simplification)

A multiset of closed plain processes S is silent in an extended process (P, Φ) when for all transitions (P ∪S, Φ) α -→ (Q, Φ ), it holds that Q = P ∪S with (P, Φ) α -→ (P , Φ ) and S silent in (P , Φ ). Then we define (simplification relation) the relation on extended processes defined by the following inference rules:

In other words, we write A B when B is obtained from A by removing some silent process or applying a deterministic (in the sense of the confluence lemma below) instance of the transition relation τ -→. We call pi the restriction of to the rule (S-npte). Their reflexive transitive closures are denoted τ and pi respectively as usual. Proof. We make a case analysis on the rule used to obtain the reduction A B:

and we conclude by choosing Proof. The termination of pi follows from the termination of the whole calculus. As for the local confluence (which sufficies by Newmann's lemma), we observe that by Lemma D.1, if A pi B and A pi C then either B = C, or there is D such that B pi D and C pi D: in particular, B pi E and C pi E for some E ∈ {C, D}.

In particular, all extended processes A have a unique normal form w.r.t. pi which will be written A ↓ pi . This notation is lifted to multiset of processes, writing P ↓ pi (which is consistent since pi does not modify the frame). With all of this, we eventually gathered all the ingredients to introduce our characterization of bisimilarity:

Definition D.3 (bisimulation up to )

A symmetric relation R on extended processes is then said to be bisimulation up to , or a bisimulation up to simplification, when: R ⊆ ∼; for all extended processes A, B such that ARB, and for all transitions A α -→ A , there

For all extended processes A and B, A ≈ l B iff there exists a bisimulation up to simplification R such that Aτ R B.

Proof. The forward implication follows from the fact that ≈ l is a bisimulation up to simplification (by reflexivity of τ ). For the converse, let us consider R a bisimulation up to and prove that it is contained in ≈ l . In order to do that, it sufficies to show that: τ R is symmetric;

B . These three properties indeed justify that (τ R ) ⊆ ≈ l by definition, hence the expected conclusion as R ⊆ τ R by reflexivity of τ . Yet it appears that the first two points directly follows from the properties of R and the reflexivity of τ , and we thus only need to prove the third point. Let us therefore consider the following hypotheses and notations: For the attacker When taking the negation of labelled bisimilarity, we essentially obtain a set of rules for a game whose states are pairs of processes (A, B): an attacker selects a transition and a defender answers by selecting a equivalently-labelled sequence of transitions in the other process.

Definition D.4 (labelled attack)

A relation S on extended processes is called a labelled attack when for all A, B such that ASB, it holds that: case 2 (Dec-L):

Let us show that the transition A α -→ A 1 satisfies (ii). We therefore have to show that

Correctness of the encodings (Section 4.1)

Now we prove that the translation • of the extended semantics is correct:

Let ≈ + t and ≈ + l be the notions of trace equivalence and labelled bisimilarity over the extended calculus (the flag + being omitted outside of this lemma). For all extended processes A = (P, Φ), the translation

But first of all, a (trivial) observation about the free variables of a translated process:

For all plain processes P and all first-order substitution σ, P σ = P σ.

We will use this lemma implicitly in the remaining of this section. Besides, as we have the inclusion of relations ≈ l ⊆ ≈ t , we only need to prove the observational-equivalence statement of Lemma D.6. We recall that we use notations A ↓ pi and P ↓ pi to refer to normal forms w.r.t. pi (see Corollary D.3).

Proposition D.8

We consider R the symmetric closure of: Then, by a case analysis on the hypothesis ARB: case 2.a : B = A ↓ pi Then we can write:

and we conclude by remarking that B

--→ B = ( P ↓ pi ∪ { { P {x → ζΦ↓}} }, Φ) and:

Note that u = ξΦ↓ cannot be one of the names introduced by the translation • : these names can indeed not appear in Φ since they are chosen private and fresh and since the semantics cannot introduce new private names. In particular we can write:

and we conclude by writing B Then, by a case analysis on the hypothesis ARB: case 3.a : B = A ↓ pi Then we can write:

and we conclude by remarking that B ξ axn ----→ B = ( P ↓ pi ∪ { { P } }, Φ) and:

For the same reason as in case 2.b, we can write:

and we conclude by writing

case 4 (rule (Comm)): α = τ and:

with msgu, msgv, msgt and u↓= v↓

Then, by a case analysis on the hypothesis ARB: case 4.a : B = A ↓ pi Then we can write:

and we conclude by remarking that

and there exists no term w appearing in B such that w↓= u↓ (syntactically) Then u is a fresh name introduced by • . We consider the two disjoint cases where it was introduced for the translation of a sum or a circuit:

-If u ∈ N is a fresh name generated in order to translate a sum of B, or rephrased more formally:

We let B = (Q ∪ { {R} }, Φ) and remark that B τ -→ B by the rule Choice (if R = P and S = Q , or R = Q and S = P ). Besides, let us observe that the name u does not appear in Q ↓ pi , R nor Φ by construction of • and that u(x). S is therefore easily seen to be silent in

In particular it entails that A A by the rule (S-sil) which gives the conclusion:

u ∈ N is a fresh name generated in order to translate a Choose(x): this case can be handle analogously to the previous one. -If u ∈ N is a fresh name generated in order to translate a circuit of B, or formally:

We call (c i ) i the private fresh names introduced by the translation x ← Γ( b).P , stressing that none of them appears in Q ↓ pi , P nor Φ. Here u ∈ {c i } i and we can therefore write:

where

If the sequence b contains a term which is not a message or does not reduce to a boolean, then one easily obtain that ({ {Q } }, Φ) pi (S, Φ) where S is silent in ( Q ↓ pi , Φ) (for that we assume, w.l.o.g. that each input of Γ goes through at least one gate). Hence since { { x ← Γ( b).P } } is also silent in (Q, Φ), we conclude with B = (Q, Φ). Otherwise assume that msg b and b↓⊆ B. Then one easily obtain by induction on the number of gates of Γ that

The arguments of each of these cases are analogous to priorly-met subcases.

In particular note that

A for all extended processes A, hence Lemma D.6.

Appendix

Reduction

Before concretly proving the pending lemmas, let us introduce some notations and prove intermediary results about static equivalence. We fix a private nonce s ∈ N and define the following frames given a protocol term t:

One shall observe that the whole deal with our reduction is about which instances of these three frames are reachable in which conditions. Hence first we prove a lemma investigating the static equivalence between some of them: Lemma D.9

Let t be a message in normal form (t = t↓). The following properties hold:

Proof. We prove the three equivalences together by double implication. (⇒) We prove the three properties by contraposition. We naturally proceed by exhibiting ground recipes ξ, ζ witnessing the non-static-equivalence goal: (i) We assume t = 1 and we choose ξ = ax 1 and ζ = ax 2 : the conclusion follows from ξΦ t ↓= h(1, s) = ζΦ t ↓ and ξΦ 0 ↓= h(0, s) = h(1, s) = ζΦ 0 ↓.

(ii) We assume t = Node(t 1 , t 2 ) and we choose ξ = TestNode(ax 1 ): the conclusion follows from msgξΦ N t and ¬msgξΦ N 0 . (iii) We assume t ∈ {0, 1} and we choose ξ = TestBool(ax 1 ): the conclusion follows from msgξΦ B t and ¬msgξΦ B 0 . (⇐) The key point is an observation about rewriting critical pairs (not specific to R):

if: u is a term; if: σ is a substitution such that for any m ∈ img(σ) there exists no rule → r of R such that m is unifiable with a subterm u ∈ subterms -X ; then: for any rewriting sequence uσ → s, it holds that s = u σ for some u → u (where u is in normal form iff s is in normal form. In particular (uσ)↓= (u↓)σ). One shall note that any frame Φ investigated by the lemma (Φ t when t = 1, Φ N t when roott = Node and Φ B t when t / ∈ B) verifies the second hypothesis. As a consequence, if ξ is a ground recipe such that axiomsξ ⊆ dom(Φ), then msgξΦ iff msgξΦ 0 (iff ∀ζ ∈ subterms ξ, ζ ↓∈ T (F c , F 0 ∪ AX )). This settles the first item of the definition of static equivalence. As for the second item, let us fix two ground recipes ξ, ζ such that msgξΦ and msgξΦ 0 . Let us then prove that ξΦ↓= ζΦ↓ iff ξΦ 0 ↓= ζΦ 0 ↓ by induction on (ξ↓, ζ↓). Note that we will intensively (and implicitly) use the fact that ξΦ↓= (ξ↓)Φ (same for ζ and/or Φ 0 ). case 1 : ξ↓= f (ξ 1 , . . . , ξ n ) and ζ↓= f (ζ 1 , . . . , ζ p ) with f, g ∈ F c . If f = g then the result follows from induction hypothesis and if f = g the conclusion is

Appendix

Let us now assume that val x does not satisfy Γ ϕ . In particular there exists a clause of Γ ϕ , say the i th clause with i = m k=1 π k 2 k-1 , which is falsified by val x . In particular, if the three variable of this clause are called x 1 , x 2 , x 3 with respective negation bits b 1 , b 2 , b 3 , the following formula is evaluated to false (i.e. 0):

Therefore, by choosing the sequence π 1 , . . . , π m to instanciate the initial Choose(p 1 , . . . , p m ) of CheckSat(x), we obtain the following sequence of transitions, which concludes the proof:

We finally gathered all the ingredients needed to prove the main lemma: Proposition 6.18 (correctness of the reduction)

Proof. We name the three properties as follows: (i) Γ ϕ is satisfiable, (ii) A ≈ t B and (iii) A ≈ l B. We reach the conclusion by the following chain of implications. (i) ⇒ (ii) : Let us consider a valuation satisfying ϕ and let t be a message such that val t is equal to this valuation. Then since the trace B c(t).c ax 1 .c ax 2 = ========= ⇒ (∅, Φ 0 ) cannot be matched in A by Lemma D.9, we obtain B t A. Hence the (ii). (ii) ⇒ (iii) : Follows from the inclusion of relations ≈ l ⊆ ≈ t . ¬(i) ⇒ ¬(iii) : Let us consider R the smallest reflexive symmetric relation on extended processes such that: 1. ARB 2. A (x)RB (x) for all message x, where A = c(x).A (x) and B = c(x).B (x) 3. P i RP i , where:

and where {ax 1 → t 1 , . . . , ax p → t p } ∼ {ax 1 → t 1 , . . . , ax p → t p } It easily follows from Lemma D.9,6.16,6.17 that R is a bisimulation up to , hence the conclusion.

Appendix E:

Proofs of Chapter 7

Summary.

In this appendix we prove the technical results used in Chapter 7 surveying the complexity of equivalence properties in the applied pi calculus.

co-NEXP hardness of equivalences in the bounded fragment

In this section we prove various statements of coNEXP-hardness (see Theorem 6.19). They can be seen as extensions of the results of [START_REF] Cheval | DEEPSEC: Deciding equivalence properties in security protocols theory and practice[END_REF] (that studied the complexity of TraceEquiv and Bisimilarity). First we show that the reduction of [START_REF] Cheval | DEEPSEC: Deciding equivalence properties in security protocols theory and practice[END_REF] can be performed without private channels and with a minimal theory, at least for trace equivalence and equivalence by session.

Theorem E.1

For a theory limited to symmetric encryption and pairs, TraceEquiv and SessEquiv are coNEXP-hard for bounded processes whose channels are constants.

We also show how this lower bound can be extended to the positive fragment by using a slightly larger theory. Regarding Bisimilarity our proof required private channels but no else branches:

For a theory limited to symmetric encryption and pairs, Bisimilarity is coNEXP-hard for bounded positive processes.

We prove all these results by reduction from SuccinctSAT, a NEXP problem that we already described in the body of the paper (see the proof sketch of Theorem 7.8). We thus let ϕ a formula with 2 m clauses and 2 n variables x 0 , . . . , x 2 n -1 and Γ a boolean circuit encoding this formula. In each proof we construct two bounded processes P and Q that match the hypotheses of the theorem statement and such that P and Q are equivalent iff ϕ is unsatisfiable. Construction Intuitively the processes P and Q first wait for an input x from the attacker which is expected to be a valuation of the 2 n variables of ϕ (in practice a binary tree of height n modelled using nested pairs). Then the processes non-deterministically chooses a branch of x (i.e. a sequence of {0, 1} n ), a clause of ϕ (i.e. a sequence of {0, 1} m ) and executes one of the following three actions (P can execute either of the three, and Q only the first two): 1 extract the selected branch from x, then simulate a dummy evaluation of the selected clause, and eventually output three messages that are statically-equivalent to three fresh nonces iff the branch extraction failed. 2 simulate a dummy extraction of the selected branch, then evaluate the selected clause w.r.t. the valuation encoded by x, and eventually output three messages that are staticallyequivalent to three fresh nonces iff the clause has been falsified. 3 simulate a dummy extraction of the selected branch and a dummy evaluation of the selected clause, and eventually output three fresh nonces. In the end P and Q are equivalent iff for all terms x ∈ T (F, F 0 ) either x is not a binary tree of height n, or it is one but the valuation it encodes falsifies a clause of ϕ. All in all P and Q are equivalent iff ϕ is unsatisfiable. The processes P and Q to be proved equivalent are then of the following form

where with o i = senc(f (b, b ), k e i ). We then let

where Γ 1 , Γ 2 , Γ 3 are three fresh copies of Γ (with fresh edges) and Γ v a circuit computing the boolean function

For the sake of succinctness, when an other processes interacts with Eval to, say, compute the a circuit C whose input edges (resp. output edges) are e 1 , . . . , e p (resp. f 1 , . . . , f q ), we write x 1 , . . . , x q ← C(t 1 , . . . , t p ). P instead of: c senc(t 1 , e 1 ) . . . c senc(t p , e p ) . c(senc(x 1 , f 1 )) . . . c(senc(x q , f q )). P Process CheckTree i We now move on to the process verifying that the initial input x provided by the attacker is indeed a binary tree of height n.

where the process R i (t) is defined by

The process CheckTree i selects non-deterministically a position p ∈ {0, 1} i in the tree (modelled by the variables v 1 , . . . , v i ) and extracts the corresponding node x i of x by interacting with Extract. Then the process R i , i < n (resp i = n), outputs three messages that are indistinguishable from three fresh nonces iff x i is ill-formed, i.e. if x i is not a pair (resp. not in B). The rest of the process only consists of dummy operations so that CheckTree i performs the same number of actions than Print and Eval .

Definition of CheckSat Next, assuming that the initial input x passes the test of all CheckTree i , we define the process verifying that x encodes a valuation that satisfies the formula ϕ.

The process CheckSat selects non-deterministically one of the 2 m clauses of ϕ (which modelled by the variables v 1 , . . . , v m ) and then computes ω ∈ B the valuation of this clause w.r.t. the valuation encoded by x. For that it evaluates the three copies of Γ to retrieve the three variables and negation bits of the clause, and performs branch extractions to retrive the valuations ω 1 , ω 2 , ω 3 of the three variables. Then the final three outputs are statically equivalent to three fresh nonces iff the clause has been falsified, i.e. ω = b 0 .

Definition of Print

We finally define a process that serves as a baseline for comparison in the equivalence proof: it only performs dummy operations and eventually output three fresh nonces.

Correctness of the construction The correctness of this reduction is summed up by the fact that the following three points are equivalent:

(i ) ϕ is unsatisfiable (ii ) P and Q are equivalent by session (iii ) P and Q are trace equivalent Proof of (i ) =⇒ (ii ).

Partial-order reductions have been developed in [CKR19] to make the verification of equivalence by session of bounded processes easier. Formally we let O ∀ the set of all traces t that have the following properties: 1 t never applies the rules (In) and (Comm) when either the rules (Par) and (Out) are applicable. 2 given an arbitrary fixed total ordering on instances of rules (Par) and (Out), t never applies an instance of these rules when a lower instance (w.r.t. this total ordering) is applicable. 3 given an application of (In) in t of the form ({ {c(x).P } } ∪ P, Φ) c(ξ) --→ ({ {d(y).Q} } ∪ P, Φ) for d ∈ F 0 , then the next transition in t (if any) after -normalisation is an instance of rule (In) of the form ({ {d(y).Q} } ∪ P, Φ)

We write P O ∀ Q when for all traces t of P that belong to O ∀ , there exists a trace t of Q such that t ∼ t and t and t are the two projections of a same twin trace of (P, Q).

Theorem E.3 ([CKR19])

P and Q are equivalent by session iff P O ∀ Q and Q O ∀ P .

In particular we will write O ∀ 0 the set of traces of P or Q that first execute the initial input on c, then all the possible applications of rule (Par), the output of all messages of Choice in this order: senc(b 0 , k), . . . , senc(b n+2 , k), senc(b 0 , k 1 ), senc(b 1 , k 1 ), . . . , senc(b 0 , k n+m ), senc(b 1 , k n+m ) eventually followed by an arbitrary suffix trace of O ∀ . To conclude it then suffices to prove that Q O ∀ 0 P and P O ∀ 0 Q. The first inclusion holds independently of ϕ being unsatisfiable. Indeed let t is a maximal trace of Q belonging to O ∀ 0 and let ξ the recipe fetched to the input c(y) preceding Q and Φ the frame at the time of this input. We also let the term m = sdec(ξΦ, k). If m is not a message, or if m is a message and m↓= b i for i n + 1 then the trace t can trivially be matched in Q. Otherwise m is a message and m↓= b n+2 . Then the trace can be matched in Q by executing the outputs of Choice in the following order:

Let us then prove that, if ϕ is unsatisfiable then P O ∀ 0 Q. Following the same reasoning as in the other inclusion, writing ξ the recipe fetched to the input c(y) preceding P , Φ the frame at the time of this input and m = sdec(ξΦ, k), the only non-trivial case is when it holds that m is a message, m↓= b n+2 , and P executes the three final outputs of Print. We thus let ξ 1 , . . . , ξ n+m the initial n + m input recipes in this execution of Print and Φ the corresponding frame (it stays the same across all inputs since we consider a trace of O ∀ 0 ), as well as m 1 , . . . , m n+m with m i = sdec(ξ i Φ, k i ). Note that in this case, all terms m i 's verify the predicate msg and m i ↓∈ B.

We then make a case analysis on ξ 0 ∈ T (F, F 0 ) the term fetched to the first input of the trace.

case 1: ξ 0 is not a complete binary tree of height n or more. Given a sequence of booleans p, we say that p is a position of ξ 0 when ξ 0 = u 0 , u 1 for some terms u 0 , u 1 and either p is empty, or p = b i • p and p is a position of u i .

In particular there exists a sequence p = p 1 , . . . , p a , 0 a < n, that is not a position of ξ 0 . Without loss of generality we assume this position minimal, i.e. a = 0 or p 1 , . . . , p a-1 is a position of ξ 0 . Then the trace t can be matched in Q by executing CheckTree a and guessing p, i.e. we execute the outputs of Choice in the following order:

where π i are permutations of {0, 1} such that π i = id iff 1 i a and m i ↓ = p i . case 2: ξ 0 is a complete binary tree of height n or more, and one of its nodes at depth n is not a leaf, or is a leaf that does not belong to B. The reasoning is analogous to the previous case, with a = n. case 3: ξ 0 is a complete binary tree of height n with boolean leaves. We let v the valuation of ϕ encoded by ξ 0 , i.e. v(x i ), i ∈ 0, 2 n -1 , is the i th leaf of ξ 0 (ordered w.r.t. a leftmost depth-first search in the binary tree). Since ϕ is unsatisfiable by hypothesis, there exists a clause C p that is falsifies by v. We write p = p 1 , . . . , p m the Appendix binary decomposition of the integer p ∈ 0, 2 m -1 . Then the trace t can be matched in Q by executing CheckSat and guessing p, i.e. we execute the outputs of Choice in the following order:

where π i are permutations of {0, 1} such that π i = id iff n + 1 i n + m and m i ↓ = p i .

Proof of (ii ) =⇒ (iii ). This follows from the soundness of equivalence by session w.r.t. trace equivalence, i.e., Proposition 5.2.

Proof of (iii ) =⇒ (ii ).

Let v : {x 0 , . . . , x 2 n -1 } → B a valuation of ϕ and prove that v falsifies a clause of ϕ. We let ξ 0 the complete binary tree of height n whose i th leaf (ordered w.r.t. a leftmost depth-first search in the binary tree) is v(x i ). Consider then the trace of P that inputs ξ 0 , executes all outputs of Choice and proceeds onto executing the last three outputs of Print. This trace cannot be matched by any trace of Q executing any CheckTree i , 0 i n, because ξ 0 is a complete binary tree with boolean leaves. Hence there exists a matching trace in Q executing CheckSat: let us write ξ 1 , . . . , ξ n+m the n + m first inputs of Print and Φ the frame at the start of the execution of Print in Q. We also let m i = sdec(ξ i Φ, k i ), which verifies msg(m i ) and m i ↓∈ B. Then if p is the integer whose binary representation is m n+1 ↓, . . . , m n+m ↓, the p th clause of ϕ is falsified by v.

Enforcing positivity

Trace and session equivalence In this section we study to which extent the lower bound above can be obtained in the positive fragment. There is actually only one else branch in the process, precisely in the process R i (t), i < n: R i (t) = if fst(t) = fst(t) then c α . c β . c β else c α . c β . c γ for reminder, the role of this process is to output three messages that are indistinguishable from three fresh nonces iff t is not a pair. In particular there are ways to get rid of the else branch:

slightly extending the theory: we add a binary constructor symbol h, a unary destructor TestPair and the rewrite rule TestPair(h( x, y , z)) → ok for some constant ok. Then we replace R i (t) by the process R i (t) = c h(t, α) . c β . c γ getting rid off the constructor-destructor semantics: the reduction of the previous section holds in the altered semantics we use in the constructor destructor semantics, in particular where a conditional if u = v then P else Q executes its negative branch when a destruction failure occurs in u or v. Without conditions on destruction failures we can replace R i (t) by R i (t) = c senc(t, α) . c senc( fst(t), snd(t) , α) . c γ Theorem E.4

There exists a constructor-destructor theory for which TraceEquiv and SessEquiv are coNEXP-hard for bounded positive processes whose channels are constants.

Labelled bisimilarity Now we study the case of Bisimilarity by proving Theorem E.2. This shows that we can get rid of the else branch of R i (t); however internal communications on private channels are needed to make the overall reduction work (in particular because the encoding of non-deterministic choice by encrypted public communications does not work for Bisimilarity).

Formally we build on the results of [START_REF] Cheval | DEEPSEC: Deciding equivalence properties in security protocols theory and practice[END_REF] that defines two extensions of the calculus and encodes them into the original one. The grammar of processes is extended with the constructs P, Q ::= x 1 , . . . , x n ← Γ(t 1 , . . . , t m ).P P 1 + . . . + P n Choose(x).P where x, x 1 , . . . , x n are variables, t 1 , . . . , t m are terms and Γ : B m → B n is a circuit. The semantics is extended as follows

and if for all i, msg(t i ) and t i ↓∈ B, then writing t = t 1 , . . . , t m and Γ(t 1 ↓, . . . , t m ↓) = u:

The following theorem justifies that these three construct do not increase the complexity of Bisimilarity for bounded positive processes:

Theorem E.5 ([CKR18a])

There exists a transformation • from processes to processes such that for any theory 1 P is computable in polynomial time in the size of P 2 • preserves positivity and boundedness (but introduces private channels) 3 P and P are labelled bisimilar

Appendix

Let us now prove Theorem E.2 by reduction from SuccinctSAT in this extended calculus. We consider Γ : B m+2 → B n+1 a circuit encoding a formula ϕ with 2 m clauses and 2 n variables x 0 , . . . , x 2 n -1 . We define two processes P and Q that are labelled bisimilar iff ϕ is unsatisfiable. They have the following form

) where ! a P = P | • • • | P (a parallel copies). The intuition is very similar to the reduction for trace equivalence and equivalence by session:

Print serves as a baseline for comparison Extract performs tree extractions upon request CheckTree i (x) is equivalent to Print iff x is not a complete binary tree of height in i, n with boolean leaves assuming x is a complete binary tree of height n with boolean leaves, writing v the valuation it thus encodes, CheckSat(x) is equivalent to Print iff v satisfies all clauses of ϕ.

In the construction we let a constant c (that will serve as a public channel), a fresh name d (that will serve as a private channel to communicate with Extract) and three fresh names α, β, γ for the final three outputs of the processes.

Definition of Extract

The process simply receives a pair and a boolean on d and outputs back the corresponding component:

In the other processes, we will then use the following shortcut for interacting with Extract:

x k ← Extr (x 0 , a 0 , . . . , a k-1 ). P d x 0 , a 0 . d(x 1 ) . . . d x k-1 , a k-1 . d(x k ).P Definition of Print The process simply performs the following dummy operations, mimicking the control flow of the processes defined below: Print = c(_). c(_). c α . c β . c γ Definition of CheckTree i The process is defined as follows for all terms x 0 : CheckTree i (x 0 ) = Choose(a 0 ). d x 0 , a 0 .d(x 1 ).

. . .

Choose(a

where the process R i (t) is defined as follows if i < n: R i (t) = c(x). c(y). c senc(t, α) . c senc( x, y , α) . c β R n (t) = c(_). c(_). c senc(t, α) . c senc(b 0 , α) . c senc(t, α)

The definition of R i (t) is different from the previous reduction (Section 1.2), adding an interaction with the attacker with two public inputs. This is the only argument in the proof that significantly differs from the previous reduction, making it possible to test that the term t is a pair without extending the theory.

Appendix

Correctness of the construction Now we prove that the following two points are equivalent (i ) ϕ is unsatisfiable (ii ) P and Q are labelled bisimilar Proof of (i ) =⇒ (ii )

To prove (ii ) it suffices to construct a symmetric relation R on extended processes such that P RQ and, for all extended processes A, B, ARB implies the frames of A and B are statically equivalent for all transitions A α -→ A , there exists

= ===== ⇒ B such that A RB or A and B are labelled bisimilar. We define R as the smallest symmetric relation verifying the following properties:

) for all terms t ∈ T (F, F 0 ) and

Let us prove that R verifies the expected properties. The inclusion of R into static equivalence is immediate. Then let two extended processes A adn B such that ARB and let us perform a case analysis on the hypothesis ARB.

The conclusion is immediate by the clause 3. case 2 + symmetry: We now make a case analysis on the term t.

-case c.1: t is not a complete binary tree of height n or more.

Given a sequence of booleans p, we say that p is a position of ξ 0 when ξ 0 = u 0 , u 1 for some terms u 0 , u 1 and either p is empty, or p = b i • p and p is a position of u i .

In particular there exists a sequence p = p 1 , . . . , p a , 0 a < n, that is not a position of t. Without loss of generality we assume this position minimal, i.e. a = 0 or p 1 , . . . , p a-1 is a position of t. In particular by choosing p in the non-deterministic choices of CheckTree a (t), there exists a trace

where t is the node of t rooted at position p. By construction t is not a pair. In particular ({ {R i (t )} }, ∅) and ({ {Print} }, ∅) are labelled bisimilar by Lemma E.6. Since the private channel d does not appear in neither Print nor R i (t ), A and B are therefore labelled bisimilar, hence the conclusion. -case c.2: t is a complete binary tree of height n or more, and one of the nodes at depth n is not a leaf, or is a leaf that is not a boolean. This is the same reasoning as in the previous case, except that a = n. -case c.3: t is a complete binary tree of height n with boolean leaves.

We let v the valuation of ϕ such that for all i ∈ 0, 2 n -1 , v(x i ) is the i th leaf of t (ordered w.r.t. to a leftmost depth-first search in the tree t). Since ϕ is unsatisfiable by hypothesis, there exists p ∈ 0, 2 m -1 such that v falsifies the p th clause of ϕ. We let p the binary representation of p. In particular by choosing p in the non-deterministic choices of CheckSat(t), there exists a trace

and A and B are labelled bisimilar by Lemma E.7. case 3 + symmetry: there exists t ∈ T (F, F 0 ) such that A = ({ {! 3n Extract, Q (t)} }, ∅) and B = ({ {! 3n Extract, P (t)} }, ∅). Then there exists a transition B τ -→ A , hence the conclusion by reflexivity of labelled bisimilarity.

Proof of (ii ) =⇒ (i ) Let v a valuation of ϕ and let us prove that v falsifies a clause of ϕ. We also let t the complete binary tree of depth n whose i th leaf (ordered w.r.t. a leftmost depth-first search in t) is v(x i ). Since P and Q are labelled bisimilar by hypothesis, they are also trace equivalent. In particular consider the following trace t of P :

where Φ = {ax 1 → α, ax 2 → β, ax 3 → γ}. We deduce that there exists a trace t of Q such that t ∼ t . Since t is a complete binary tree of depth n with boolean leaves, we deduce that Appendix t has the following form:

where, if a = a 1 , . . . , a m are the non-deterministic choices performed in this execution of CheckSat(t) and p ∈ 0, 2 m -1 is the integer whose binary representation is a, ω ∈ B is the valuation of the p th clause of ϕ by v. In particular the fact that Φ and Φ are statically equivalent implies that ω = b 0 , hence the conclusion.

co-NEXP hardness for simple patterned processes

In this section we prove the coNEXP-hardness of the problem studied in [START_REF] Chrétien | Decidability of trace equivalence for protocols with nonces[END_REF], namely trace equivalence of patterned, simple, acyclic, type-compliant processes with a theory limited to symmetric encryption and pairs (Theorem 7.8). Due to Proposition 7.19, all results for this fragment also apply for labelled bisimilarity and equivalence by session, and diff equivalence.

Formalising the hypotheses

First of all we formalise the hypotheses of type compliance and acyclicity that were not detailed in the body of the paper.

Type compliance A type system consists of a set of atomic types T 0 and a typing function δ mapping any term (that may contain variables) to types τ defined by the following grammar τ, τ ::= τ (∈ T 0 ) τ, τ senc(τ, τ )

There should be infinitely many constants, names and variables of any type. We say that a type system is structure preserving if it additionally verifies the following property for all constructors f (i.e. f is either symmetric encryption or pairing) and all terms u, v:

In particular a structure-preserving type system is defined by the image of δ on the set of atomic data, i.e. F 0 ∪ N ∪ X . If P is a process we define St(P ) the set of subterms of patterns or outputs appearing in P 2 , where P 2 is the process obtained after replacing all replicated subprocess ! R of P by R | R. This duplication is used to materialise syntactically that ! R implies several parallel copies of R. To avoid name and variable capture when studying the unifiability of terms of St(P ), we assume that all new names and input variables of P 2 have been alpha-renamed in a type-preserving manner. We then define the set of encrypted subterms of P by:

We say that a process P is type-compliant w.r.t. a structure preserving type system if for all unifiable terms t, t ∈ ESt(P ), we have δ(t) = δ(t ).

Acyclicity A process P is said acyclic when its dependency graph is acyclic, where this dependency graph G is defined in the rest of this section. Two definitions of G are given in [START_REF] Chrétien | Decidability of trace equivalence for protocols with nonces[END_REF]: a preliminary one sufficient to obtain decidability and a refined variant which allows more protocols to verify the acyclicity hypothesis. Here we only need the simple version, hence the lighter presentation compared to [START_REF] Chrétien | Decidability of trace equivalence for protocols with nonces[END_REF].

First of all we assume a structure preserving type system (T 0 , δ) and define two important syntactic classes of types. Intuitively public types (resp. private types 1 ) correspond to values that are always (resp. never) deducible by the adversary. Naturally a type may be neither public nor private. Formally we say a type τ is public if there exist no names n occuring in P such that δ(n) is a syntactic subterm of the type τ . private if it is atomic, τ = δ(a) for all variables and constants a appearing in P , and τ / ∈ pp(u) for any term u occurring in P . Regarding the last item, the set pp(u) of types in plaintext position in a term u is defined inductively as follows:

This covers all cases since, in the patterned fragment, no destructors appear explicitly in the process.

We then define a set io (τ ) that characterises the types of the terms that can be deduced by the adversary from a term of type τ . More precisely io (τ ) contains elements of the form τ #S τ type and S set of non-private types meaning that a term of type τ may be deducible provided prior deduction of terms of type in S. Formally io (τ ) = ∅ io (τ ) where Using this, we eventually define the dependency graph G. The node of this graph are the input and output instructions of the process P ; for the sake of reference we tag each of them with a label with the following syntax : c(u).P : c u .P and the nodes of G should rather be seen as the labels themselves. The edges of G are then defined as follows; there is an edge → in the graph whenever Appendix sequential edges: : α.Q is a subprocess of P and : β is the first input or output instruction appearing in Q (if any) pattern edges: : c u and : d(v) are actions occurring in P and there exists τ #S ∈ io (δ(u)), τ non-public type, and τ #S ∈ io (δ(v)) such that τ = τ or τ ∈ S . deduction edges:

: c u and : d v are actions occurring in P and there exists τ #S ∈ io (δ(u)), τ non-public type, and τ #S ∈ io (δ(v)) such that τ ∈ S . An edge → model that it may be necessary to execute the action labelled before the one labelled to be able to perform some attacker actions in a trace. Sequential edges model the dependencies between non-concurrent actions. Pattern edges model that it may be necessary to execute a given output u for the attacker to be able to produce a term complying to a given pattern v: for example u = senc(m, k) and v = senc(x, k) for some name k. Deduction edges model that an output u may be necessary to deduce a subterm of an output v: for example u = k and v = senc(m, k) for some name k.

Proof of coNEXP hardness

We now prove Theorem 7.8, by reduction from SuccinctSAT as annouced in the proof sketch in the body of the paper. We therefore let a circuit Γ : B m+2 → B n+1 encoding a formula ϕ whose variables are x 0 , . . . , x 2 n -1 , and the set of booleans B is modelled by two distinct constants 0, 1 for false and true, respectively. We then construct two patterned, simple, typecompliant, acyclic processes with atomic keys P 0 and P 1 that are trace equivalent iff ϕ is unsatisfiable.

Construction of the processes For simplicity we use a single channel c in the definition of P 0 and P 1 which can easily be converted to simple processes by using a different channel for each parallel subprocess. More precisely P i = P (b i ) where P (t) has the following form

Intuitively the processes operate as follows:

Similarly to the reduction presented in Appendix 1.1, the processes Extract and Eval are utilitaries that perform tree extractions and circuit evaluations, respectively, upon request from other parallel processes.

Init is a non-replicated process that receives a input x from the attacker that is expected to be a valuation of ϕ, modelled by a complete binary tree of height n whose leaves are booleans. As in Appendix 1.1, the nodes of this tree are modelled by pairs. After receiving x the process reveals its encryption under a dedicated secret key, forcing the attacker to commit once and for all on this valuation.

CheckSat is a replicated process whose instances can be used to verify, one clause at a time, that the valuation chosen by the attacker in Init satisfies ϕ. Each time a clause is successfully verified this way, say the i th clause of ϕ, the encryption of the binary representation of i is revealed to the adversary.

Appendix

Definition of Eval The definition of Eval follows the same intuition as in Appendix 1.1, but using nonces to mark messages as in the previous paragraph. As before the gates of a circuit are tuples (e 1 , e 2 , f, e 3 , e 4 ) where e 1 , e 2 are the input edges, e 3 , e 4 are the output edges, and f : B 2 → B is the gate boolean function Given G(C) is the set of gates of a circuit C and for each edge e we associate a fresh name k e . Such a circuit C is then translated as follows into a process: We then let Eval = Γ 1 | Γ 2 | Γ 3 | Γ v where Γ 1 , Γ 2 , Γ 3 are three copies of Γ with fresh edges and Γ v is a circuit computing the boolean function

For the sake of succinctness, when an other processes interacts with Eval to, say, compute the a circuit C whose input edges (resp. output edges) are e 1 , . . . , e p (resp. f 1 , . . . , f q ), we write x 1 , . . . , x q ← C(t 1 , . . . , t p ). P instead of: new r. c senc( t 1 , r , e 1 ) . . . c senc( t p , r , e p ) . c(senc( x 1 , r , f 1 )) . . . c(senc( x q , r , f q )). P Definition of Init This process simply forces the attacker to commit on a value x that will allow to violate equivalence iff it is a complete binary tree of height n with boolean leaves modelling a valuation satisfying ϕ. Formally Init = c(x).c senc(x, k) This is the only ciphertext encrypted by k produced by the process and the attacker thus cannot forge any others. All processes that use the commited value x will therefore first receive an input encrypted by k, which can thus only be this one.

Definition of CheckSat This replicates a process that first retrieves the value x committed in Init, then receives an integer i chosen by the attacker, computes the valuation of the i th Definition of Final The process Final (t) gathers integers sent by CheckSat and outputs t if when the whole set 0, 2 m -1 has been received, which is only possible if it has been verified that all clauses of ϕ were satisfied by the valuation committed in Init. For that Final (t) gathers pairs of integers that differ only by their least significant bits, and then reveals the encryption of these integers with this bit truncated. It then suffices to iterate this operation until the encryptions of 0 and 1 are eventually revealed. Formally

where F (t) = c(senc(nil, k 0 Final )).c t and for all i ∈ 1, m

Final i = ! ch c(senc( 0, x 2 , . . . , x i , nil , k i Final )). c(senc( 1, x 2 , . . . , x i , nil , k i Final )). c senc( x 2 , . . . , x i , nil , k i-1

Final )

Proof of type compliance and acyclicity Now we show that P (b), b ∈ B, indeed satisfies the hypotheses of the theorem. That is, we define a structure-preserving type system (T 0 , δ) and show that P (b) is type-compliant and acyclic w.r.t. it.

On the size of the type system In terms of complexity, the type system is part of the input of the problem: as it can be observed in the proof of Theorem 7.7, the complexity of the decision procedure depends on its size. In particular for our reduction it should be ensured that (T 0 , δ) is of polynomial size.

Unfortunately we need a type for boolean trees of height n, which is a type of size 2 n . However when inspecting the details of the decision procedure in [START_REF] Chrétien | Decidability of trace equivalence for protocols with nonces[END_REF] we observe that:

The coNEXP complexity is obtained by applying a coNP decidability result in the bounded fragment (Theorem 7.20) to an exponential number of sessions of the process. This exponential number N of sessions is to be computed from the type system and the process. More precisely there exist two polynomials A, B such that

where |P | is number of instructions of the process P and ||io P || is the maximal size (i.e. the maximal number of constructor symbols) of an input or an output in a trace where input variables x are only instanciated by terms t such that δ(x) = δ(t).

Appendix

In particular the complexity analysis is robust to ||io P || being exponential in the size of the parameters. Since ||io P || is polynomial in the size of the type system and P (in a classical tree representation of terms), this shows that the procedure would be coNEXP even if the types are represented in DAG form (i.e. the representation size of a type is only the number of its different subtypes, which is linear in n for the type of binary trees of height n).

To sum up, our coNEXP-completeness result holds for processes represented in any form (tree or DAG) but only with the type system represented in DAG form.

Construction of the type system The set of atomic types T 0 contains τ B , a type τ k for each name k used as an encryption key in the process, τ nil and τ new . The typing function δ is then defined as follows on the atomic data of the process: δ(a) = τ B if a is one of the constants 0, 1 or a variable that expects a boolean in the description of the process (e.g. b i , x i , y i , ω i in CheckSat). Note that τ B is public. δ(k) = τ k if k is a name used as an encryption key. Note that the types τ k are private. δ(nil) = τ nil δ(r) = τ new if r is declared in the process using a new binder. we write τ p BT the type of binary trees of height p, defined by

BT

Then δ(x) = τ n BT where x is the initial input variable of Init and CheckSat. We also have δ(x) = δ(y) = τ n-j BT where x and y are the input variables at the start of E j i . It is then straightforward to verify that P (0) and P (1) are type-compliant w.r.t. this type system. Regarding acyclicity a picture of the dependency graph of P (t) can be found in Figure E.1. Each circle is a node of the process, an arrow is an edge of the graph and dotted arrows materialise a chain of linked nodes of non-constant length. We omitted some nodes in the picture, e.g. the subgraphs of the circuits Γ i since they are isomorphic to the circuits themselves.

Correctness of the reduction We now prove that the reduction is correct. More precisely we prove that it is even correct for reachability by showing that the following three points are equivalent:

(i ) P (0) and P (1) are not trace equivalent (ii ) There exists a trace P (0) tr = ⇒ (P, Φ) such that senc(nil, k 0 Final ) is deducible from Φ (iii ) ϕ is satisfiable Proof of ¬(ii ) =⇒ ¬(i ) Under the assumption ¬(ii ), the process P (t) is trace equivalent to the process obtained by replacing the last output of F (t) by the null process in the definition of P (t). This process does not depends of t anymore, hence P (0) and P (1) are also trace equivalent.

Proof of (ii ) =⇒ (i ) Let t : P (0) tr = ⇒ (P, Φ) a trace such that there exists a recipe ξ such that msg(ξΦ) and ξΦ↓= senc(nil, k 0 Final ). Without loss of generality we assume this trace of minimal size; in particular no instruction of F (t) has been executed in this trace. Then it suffices to consider whose final frame is not statically equivalent to that of t .

Proof of (ii ) =⇒ (iii )

A quick induction on i shows that for any trace t of P (t) whose final frame is Φ (where t is an arbitrary term), if the term senc( x 1 , . . . , x i , k i Final is in CheckSat, all such messages need have been output by an instance of CheckSat during the trace. Therefore we deduce

x is a binary tree of height at least n (otherwise the process CheckSat could never be executed until the end). It contains all positions p 1 , . . . , p n such that the variable x i appears in a clause of ϕ, where p 1 , . . . , p n is the binary representation of i, and these positions are boolean leaves. Hence x encodes a valuation v. For all i ∈ 0, 2 m -1 , the i th clause of ϕ is valued to 1 by v. All in all v satisfies ϕ.

Proof of (iii ) =⇒ (ii ) Let v a valuation that satisfies ϕ and t the complete binary tree of height n whose i th leaf is the valuation v(x i ) of the i th variable of ϕ. Then we consider the trace consisting of the following actions:

Execute Init with input recipe ξ = t for x. The output senc(x, k) is referred through the axiom ax. Execute the 2 m instances of CheckSat each obtained for initial input recipes ξ 1 = ax and ξ 2 = p 1 , . . . , p m , nil for some booleans p 1 , . . . , p m . In particular, after interacting with Extract and Eval , the final result of Γ v is the valuation of the i th clause of ϕ w.r.t. v, where i is the integer whose binary representation is p 1 , . . . , p m . Since v satisfies all clause of ϕ by hypothesis, this enables the execution of the final output senc( p 1 , . . . , p m , nil , k m Final ) of this instance of CheckSat. We refer to this output as ax p 1 ,...,pm . For each i ∈ 1, m in decreasing order, execute all instances of Final i obtained by inputting ax 0,p m-i+2 ,...,pm , ax 1,p m-i+2 ,...,pm , and outputting back an output referred through the axiom ax p m-i+2 ,...,pm . Eventually the axiom ax ε points to the term senc(nil, k 0 Final ). In particular this gives the expected conclusion.